# Flog Txt Version 1 # Analyzer Version: 2.3.0 # Analyzer Build Date: Mar 28 2018 12:41:31 # Log Creation Date: 03.04.2018 14:29:37.168 Process: id = "1" image_name = "gabkrj.jpg.exe" filename = "c:\\users\\ciihmnxmn6ps\\desktop\\gabkrj.jpg.exe" page_root = "0x16a8d000" os_pid = "0x66c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe\" " cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001714b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x1e0000 end_va = 0x2d1fff entry_point = 0x1e0000 region_type = mapped_file name = "gabkrj.jpg.exe" filename = "\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gabkrj.jpg.exe") Region: id = 2 start_va = 0x2e0000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 3 start_va = 0x300000 end_va = 0x300fff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 4 start_va = 0x310000 end_va = 0x323fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000310000" filename = "" Region: id = 5 start_va = 0x330000 end_va = 0x36ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 6 start_va = 0x370000 end_va = 0x46ffff entry_point = 0x0 region_type = private name = "private_0x0000000000370000" filename = "" Region: id = 7 start_va = 0x470000 end_va = 0x473fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000470000" filename = "" Region: id = 8 start_va = 0x480000 end_va = 0x480fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 9 start_va = 0x490000 end_va = 0x491fff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 10 start_va = 0x77c40000 end_va = 0x77db8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 11 start_va = 0x7ef50000 end_va = 0x7ef72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ef50000" filename = "" Region: id = 12 start_va = 0x7ef74000 end_va = 0x7ef74fff entry_point = 0x0 region_type = private name = "private_0x000000007ef74000" filename = "" Region: id = 13 start_va = 0x7ef76000 end_va = 0x7ef76fff entry_point = 0x0 region_type = private name = "private_0x000000007ef76000" filename = "" Region: id = 14 start_va = 0x7ef7d000 end_va = 0x7ef7ffff entry_point = 0x0 region_type = private name = "private_0x000000007ef7d000" filename = "" Region: id = 15 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 16 start_va = 0x7fff0000 end_va = 0x7ffc03e6ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 17 start_va = 0x7ffc03e70000 end_va = 0x7ffc04031fff entry_point = 0x7ffc03e70000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 18 start_va = 0x7ffc04032000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc04032000" filename = "" Region: id = 165 start_va = 0x4e0000 end_va = 0x4effff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 166 start_va = 0x59300000 end_va = 0x5934efff entry_point = 0x59300000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 167 start_va = 0x59360000 end_va = 0x593d2fff entry_point = 0x59360000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 168 start_va = 0x59350000 end_va = 0x59357fff entry_point = 0x59350000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 169 start_va = 0x670000 end_va = 0x76ffff entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 170 start_va = 0x74b40000 end_va = 0x74b98fff entry_point = 0x74b40000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 171 start_va = 0x76970000 end_va = 0x76ae5fff entry_point = 0x76970000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 172 start_va = 0x77670000 end_va = 0x7775ffff entry_point = 0x77670000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 173 start_va = 0x2e0000 end_va = 0x2effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002e0000" filename = "" Region: id = 174 start_va = 0x4f0000 end_va = 0x5adfff entry_point = 0x4f0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 175 start_va = 0x640000 end_va = 0x64ffff entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 176 start_va = 0x74c40000 end_va = 0x74cd0fff entry_point = 0x74c40000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 177 start_va = 0x7ee50000 end_va = 0x7ef4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ee50000" filename = "" Region: id = 178 start_va = 0x2f0000 end_va = 0x2f3fff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 179 start_va = 0x4a0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 180 start_va = 0x770000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 181 start_va = 0x74ce0000 end_va = 0x74d38fff entry_point = 0x74ce0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 182 start_va = 0x74d40000 end_va = 0x74d49fff entry_point = 0x74d40000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 183 start_va = 0x74d50000 end_va = 0x74d6dfff entry_point = 0x74d50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 184 start_va = 0x77250000 end_va = 0x77292fff entry_point = 0x77250000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 185 start_va = 0x77990000 end_va = 0x77a0afff entry_point = 0x77990000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 186 start_va = 0x77a10000 end_va = 0x77acdfff entry_point = 0x77a10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 187 start_va = 0x77af0000 end_va = 0x77b9bfff entry_point = 0x77af0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 188 start_va = 0x7ef7a000 end_va = 0x7ef7cfff entry_point = 0x0 region_type = private name = "private_0x000000007ef7a000" filename = "" Region: id = 189 start_va = 0x980000 end_va = 0x98ffff entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 190 start_va = 0x74ac0000 end_va = 0x74b37fff entry_point = 0x74ac0000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 191 start_va = 0x74d70000 end_va = 0x74eaffff entry_point = 0x74d70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 192 start_va = 0x75080000 end_va = 0x750c3fff entry_point = 0x75080000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 193 start_va = 0x76ca0000 end_va = 0x76decfff entry_point = 0x76ca0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 194 start_va = 0x77090000 end_va = 0x77249fff entry_point = 0x77090000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 195 start_va = 0x990000 end_va = 0xb17fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 196 start_va = 0x76f70000 end_va = 0x7708ffff entry_point = 0x76f70000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 197 start_va = 0x775e0000 end_va = 0x7760afff entry_point = 0x775e0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 198 start_va = 0x300000 end_va = 0x300fff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 199 start_va = 0x5b0000 end_va = 0x5b0fff entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 200 start_va = 0xb20000 end_va = 0xca0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 201 start_va = 0xcb0000 end_va = 0x20affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cb0000" filename = "" Region: id = 202 start_va = 0x76f60000 end_va = 0x76f6bfff entry_point = 0x76f60000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 203 start_va = 0x74ab0000 end_va = 0x74ab7fff entry_point = 0x74ab0000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 204 start_va = 0x5c0000 end_va = 0x5c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 205 start_va = 0x5d0000 end_va = 0x60ffff entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 206 start_va = 0x870000 end_va = 0x96ffff entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 207 start_va = 0x2270000 end_va = 0x227ffff entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 208 start_va = 0x74460000 end_va = 0x744fafff entry_point = 0x74460000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\msvcr80.dll") Region: id = 209 start_va = 0x74500000 end_va = 0x74aaffff entry_point = 0x74500000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll") Region: id = 210 start_va = 0x7ef77000 end_va = 0x7ef79fff entry_point = 0x0 region_type = private name = "private_0x000000007ef77000" filename = "" Region: id = 211 start_va = 0x610000 end_va = 0x610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 212 start_va = 0x620000 end_va = 0x620fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 213 start_va = 0x630000 end_va = 0x63ffff entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 214 start_va = 0x650000 end_va = 0x65ffff entry_point = 0x0 region_type = private name = "private_0x0000000000650000" filename = "" Region: id = 215 start_va = 0x660000 end_va = 0x66ffff entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 216 start_va = 0x970000 end_va = 0x97ffff entry_point = 0x0 region_type = private name = "private_0x0000000000970000" filename = "" Region: id = 217 start_va = 0x20b0000 end_va = 0x20bffff entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 218 start_va = 0x20c0000 end_va = 0x20cffff entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 219 start_va = 0x20e0000 end_va = 0x20effff entry_point = 0x0 region_type = private name = "private_0x00000000020e0000" filename = "" Region: id = 220 start_va = 0x20f0000 end_va = 0x212ffff entry_point = 0x0 region_type = private name = "private_0x00000000020f0000" filename = "" Region: id = 221 start_va = 0x2130000 end_va = 0x222ffff entry_point = 0x0 region_type = private name = "private_0x0000000002130000" filename = "" Region: id = 222 start_va = 0x75070000 end_va = 0x7507efff entry_point = 0x75070000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 223 start_va = 0x750d0000 end_va = 0x755acfff entry_point = 0x750d0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 224 start_va = 0x755b0000 end_va = 0x7696efff entry_point = 0x755b0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 225 start_va = 0x777f0000 end_va = 0x77833fff entry_point = 0x777f0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 226 start_va = 0x778a0000 end_va = 0x7792cfff entry_point = 0x778a0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 227 start_va = 0x7ee4d000 end_va = 0x7ee4ffff entry_point = 0x0 region_type = private name = "private_0x000000007ee4d000" filename = "" Region: id = 228 start_va = 0x20d0000 end_va = 0x20d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000020d0000" filename = "" Region: id = 229 start_va = 0x2230000 end_va = 0x226ffff entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 230 start_va = 0x2280000 end_va = 0x25b6fff entry_point = 0x2280000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 231 start_va = 0x25c0000 end_va = 0x45bffff entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 232 start_va = 0x45c0000 end_va = 0x465ffff entry_point = 0x0 region_type = private name = "private_0x00000000045c0000" filename = "" Region: id = 233 start_va = 0x4660000 end_va = 0x475ffff entry_point = 0x0 region_type = private name = "private_0x0000000004660000" filename = "" Region: id = 234 start_va = 0x73960000 end_va = 0x74459fff entry_point = 0x73960000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll") Region: id = 235 start_va = 0x7ee4a000 end_va = 0x7ee4cfff entry_point = 0x0 region_type = private name = "private_0x000000007ee4a000" filename = "" Region: id = 236 start_va = 0x77430000 end_va = 0x77519fff entry_point = 0x77430000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 237 start_va = 0x4760000 end_va = 0x4762fff entry_point = 0x4760000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\SysWOW64\\l_intl.nls" (normalized: "c:\\windows\\syswow64\\l_intl.nls") Region: id = 238 start_va = 0x4770000 end_va = 0x4770fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004770000" filename = "" Region: id = 239 start_va = 0x73900000 end_va = 0x7395afff entry_point = 0x73900000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll") Region: id = 240 start_va = 0x4780000 end_va = 0x478ffff entry_point = 0x0 region_type = private name = "private_0x0000000004780000" filename = "" Region: id = 241 start_va = 0x4790000 end_va = 0x479ffff entry_point = 0x0 region_type = private name = "private_0x0000000004790000" filename = "" Region: id = 242 start_va = 0x47a0000 end_va = 0x47affff entry_point = 0x0 region_type = private name = "private_0x00000000047a0000" filename = "" Region: id = 243 start_va = 0x723e0000 end_va = 0x72fbffff entry_point = 0x723e0000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\e3f653c6d321c4c528daa164908e0ff8\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\e3f653c6d321c4c528daa164908e0ff8\\system.windows.forms.ni.dll") Region: id = 244 start_va = 0x72fc0000 end_va = 0x73148fff entry_point = 0x72fc0000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\cebfffe6cee14413d504056227f496b2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\cebfffe6cee14413d504056227f496b2\\system.drawing.ni.dll") Region: id = 245 start_va = 0x73150000 end_va = 0x738f2fff entry_point = 0x73150000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\b0de8183f9e33cd0fbe10c8db1402653\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\b0de8183f9e33cd0fbe10c8db1402653\\system.ni.dll") Region: id = 246 start_va = 0x47b0000 end_va = 0x57affff entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 247 start_va = 0x57b0000 end_va = 0x58dffff entry_point = 0x0 region_type = private name = "private_0x00000000057b0000" filename = "" Region: id = 248 start_va = 0x74bc0000 end_va = 0x74c34fff entry_point = 0x74bc0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 249 start_va = 0x45c0000 end_va = 0x45cffff entry_point = 0x0 region_type = private name = "private_0x00000000045c0000" filename = "" Region: id = 250 start_va = 0x45d0000 end_va = 0x45d1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000045d0000" filename = "" Region: id = 251 start_va = 0x74ba0000 end_va = 0x74bbcfff entry_point = 0x74ba0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 252 start_va = 0x72270000 end_va = 0x723dafff entry_point = 0x72270000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll") Region: id = 253 start_va = 0x45e0000 end_va = 0x462ffff entry_point = 0x0 region_type = private name = "private_0x00000000045e0000" filename = "" Region: id = 254 start_va = 0x45e0000 end_va = 0x461ffff entry_point = 0x0 region_type = private name = "private_0x00000000045e0000" filename = "" Region: id = 255 start_va = 0x4620000 end_va = 0x462ffff entry_point = 0x0 region_type = private name = "private_0x0000000004620000" filename = "" Region: id = 256 start_va = 0x58e0000 end_va = 0x59dffff entry_point = 0x0 region_type = private name = "private_0x00000000058e0000" filename = "" Region: id = 257 start_va = 0x72080000 end_va = 0x7226ffff entry_point = 0x72080000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll") Region: id = 258 start_va = 0x7ee47000 end_va = 0x7ee49fff entry_point = 0x0 region_type = private name = "private_0x000000007ee47000" filename = "" Region: id = 259 start_va = 0x59e0000 end_va = 0x5a55fff entry_point = 0x59e0000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 260 start_va = 0x4630000 end_va = 0x4633fff entry_point = 0x0 region_type = private name = "private_0x0000000004630000" filename = "" Region: id = 261 start_va = 0x5a60000 end_va = 0x5b5ffff entry_point = 0x0 region_type = private name = "private_0x0000000005a60000" filename = "" Region: id = 262 start_va = 0x5b60000 end_va = 0x6b5ffff entry_point = 0x5b60000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 263 start_va = 0x4640000 end_va = 0x4643fff entry_point = 0x0 region_type = private name = "private_0x0000000004640000" filename = "" Region: id = 264 start_va = 0x6b60000 end_va = 0x6c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000006b60000" filename = "" Region: id = 265 start_va = 0x6c60000 end_va = 0x7151fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006c60000" filename = "" Region: id = 266 start_va = 0x4650000 end_va = 0x4650fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 267 start_va = 0x7160000 end_va = 0x7217fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007160000" filename = "" Region: id = 268 start_va = 0x4650000 end_va = 0x4653fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004650000" filename = "" Region: id = 269 start_va = 0x7220000 end_va = 0x722ffff entry_point = 0x0 region_type = private name = "private_0x0000000007220000" filename = "" Region: id = 270 start_va = 0x7230000 end_va = 0x726ffff entry_point = 0x0 region_type = private name = "private_0x0000000007230000" filename = "" Region: id = 271 start_va = 0x7270000 end_va = 0x736ffff entry_point = 0x0 region_type = private name = "private_0x0000000007270000" filename = "" Region: id = 272 start_va = 0x7ee44000 end_va = 0x7ee46fff entry_point = 0x0 region_type = private name = "private_0x000000007ee44000" filename = "" Region: id = 273 start_va = 0x7370000 end_va = 0x7374fff entry_point = 0x7370000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 274 start_va = 0x7380000 end_va = 0x7383fff entry_point = 0x0 region_type = private name = "private_0x0000000007380000" filename = "" Region: id = 275 start_va = 0x7390000 end_va = 0x739ffff entry_point = 0x0 region_type = private name = "private_0x0000000007390000" filename = "" Region: id = 276 start_va = 0x7390000 end_va = 0x739ffff entry_point = 0x0 region_type = private name = "private_0x0000000007390000" filename = "" Region: id = 277 start_va = 0x7390000 end_va = 0x739dfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007390000" filename = "" Region: id = 278 start_va = 0x47b0000 end_va = 0x47bffff entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 279 start_va = 0x71e40000 end_va = 0x72075fff entry_point = 0x71e40000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\40661cdfbf2201f3d6c5cf6378755082\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\40661cdfbf2201f3d6c5cf6378755082\\system.core.ni.dll") Region: id = 280 start_va = 0x71e20000 end_va = 0x71e32fff entry_point = 0x71e20000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 281 start_va = 0x71e00000 end_va = 0x71e1afff entry_point = 0x71e00000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 282 start_va = 0x71dd0000 end_va = 0x71dfefff entry_point = 0x71dd0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 283 start_va = 0x47b0000 end_va = 0x47bffff entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 284 start_va = 0x47c0000 end_va = 0x47cffff entry_point = 0x0 region_type = private name = "private_0x00000000047c0000" filename = "" Region: id = 285 start_va = 0x47d0000 end_va = 0x47dffff entry_point = 0x0 region_type = private name = "private_0x00000000047d0000" filename = "" Region: id = 286 start_va = 0x47e0000 end_va = 0x47effff entry_point = 0x0 region_type = private name = "private_0x00000000047e0000" filename = "" Region: id = 287 start_va = 0x773d0000 end_va = 0x773d5fff entry_point = 0x773d0000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 288 start_va = 0x47d0000 end_va = 0x493ffff entry_point = 0x0 region_type = private name = "private_0x00000000047d0000" filename = "" Region: id = 289 start_va = 0x47b0000 end_va = 0x47b3fff entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 290 start_va = 0x47d0000 end_va = 0x47d4fff entry_point = 0x47d0000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 291 start_va = 0x4930000 end_va = 0x493ffff entry_point = 0x0 region_type = private name = "private_0x0000000004930000" filename = "" Region: id = 292 start_va = 0x47e0000 end_va = 0x4820fff entry_point = 0x47e0000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 293 start_va = 0x71dc0000 end_va = 0x71dc7fff entry_point = 0x71dc0000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\culture.dll") Region: id = 294 start_va = 0x4830000 end_va = 0x4830fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004830000" filename = "" Region: id = 295 start_va = 0x4830000 end_va = 0x4883fff entry_point = 0x4830000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorrc.dll") Region: id = 296 start_va = 0x4890000 end_va = 0x489ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 297 start_va = 0x48a0000 end_va = 0x48affff entry_point = 0x0 region_type = private name = "private_0x00000000048a0000" filename = "" Region: id = 298 start_va = 0x4890000 end_va = 0x489ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 299 start_va = 0x4890000 end_va = 0x489ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 300 start_va = 0x4890000 end_va = 0x489ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 301 start_va = 0x4890000 end_va = 0x489ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 302 start_va = 0x4890000 end_va = 0x489ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 303 start_va = 0x4890000 end_va = 0x489ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 304 start_va = 0x4890000 end_va = 0x489ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 305 start_va = 0x4890000 end_va = 0x489ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 306 start_va = 0x4890000 end_va = 0x489ffff entry_point = 0x0 region_type = private name = "private_0x0000000004890000" filename = "" Region: id = 307 start_va = 0x4890000 end_va = 0x4916fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004890000" filename = "" Region: id = 308 start_va = 0x4920000 end_va = 0x492ffff entry_point = 0x0 region_type = private name = "private_0x0000000004920000" filename = "" Region: id = 309 start_va = 0x4920000 end_va = 0x492ffff entry_point = 0x0 region_type = private name = "private_0x0000000004920000" filename = "" Region: id = 310 start_va = 0x4940000 end_va = 0x49bffff entry_point = 0x0 region_type = private name = "private_0x0000000004940000" filename = "" Region: id = 311 start_va = 0x71c50000 end_va = 0x71dc0fff entry_point = 0x71c50000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 312 start_va = 0x49c0000 end_va = 0x49effff entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 313 start_va = 0x49c0000 end_va = 0x49cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000049c0000" filename = "" Region: id = 314 start_va = 0x49d0000 end_va = 0x49dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000049d0000" filename = "" Region: id = 315 start_va = 0x49e0000 end_va = 0x49effff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000049e0000" filename = "" Region: id = 316 start_va = 0x77ba0000 end_va = 0x77c31fff entry_point = 0x77ba0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 317 start_va = 0x49f0000 end_va = 0x4a72fff entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 318 start_va = 0x49f0000 end_va = 0x4a7bfff entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 319 start_va = 0x49f0000 end_va = 0x4a7cfff entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 320 start_va = 0x49f0000 end_va = 0x4a72fff entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 321 start_va = 0x49f0000 end_va = 0x4a72fff entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 322 start_va = 0x49f0000 end_va = 0x4a79fff entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 323 start_va = 0x49f0000 end_va = 0x4a80fff entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 324 start_va = 0x49f0000 end_va = 0x4a77fff entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 325 start_va = 0x49f0000 end_va = 0x4a79fff entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 326 start_va = 0x49f0000 end_va = 0x4beffff entry_point = 0x0 region_type = private name = "private_0x00000000049f0000" filename = "" Region: id = 327 start_va = 0x4bf0000 end_va = 0x4c73fff entry_point = 0x0 region_type = private name = "private_0x0000000004bf0000" filename = "" Region: id = 328 start_va = 0x4bf0000 end_va = 0x4c79fff entry_point = 0x0 region_type = private name = "private_0x0000000004bf0000" filename = "" Region: id = 329 start_va = 0x4bf0000 end_va = 0x4ceffff entry_point = 0x0 region_type = private name = "private_0x0000000004bf0000" filename = "" Region: id = 330 start_va = 0x4cf0000 end_va = 0x4d7cfff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 331 start_va = 0x4cf0000 end_va = 0x4d71fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 332 start_va = 0x4cf0000 end_va = 0x4d71fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 333 start_va = 0x4cf0000 end_va = 0x4d79fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 334 start_va = 0x4cf0000 end_va = 0x4d7afff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 335 start_va = 0x4cf0000 end_va = 0x4d78fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 336 start_va = 0x4cf0000 end_va = 0x4d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 337 start_va = 0x4cf0000 end_va = 0x4d78fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 338 start_va = 0x4cf0000 end_va = 0x4d7afff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 339 start_va = 0x4cf0000 end_va = 0x4d71fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 340 start_va = 0x4cf0000 end_va = 0x4d75fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 341 start_va = 0x4cf0000 end_va = 0x4d77fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 342 start_va = 0x4cf0000 end_va = 0x4d79fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 343 start_va = 0x4cf0000 end_va = 0x4d74fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 344 start_va = 0x4cf0000 end_va = 0x4d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 345 start_va = 0x4cf0000 end_va = 0x4d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 346 start_va = 0x4cf0000 end_va = 0x4d72fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 347 start_va = 0x4cf0000 end_va = 0x4d79fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 348 start_va = 0x4cf0000 end_va = 0x4d7bfff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 349 start_va = 0x4cf0000 end_va = 0x4d7afff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 350 start_va = 0x4cf0000 end_va = 0x4d73fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 351 start_va = 0x4cf0000 end_va = 0x4d80fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 352 start_va = 0x4cf0000 end_va = 0x4d76fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 353 start_va = 0x4cf0000 end_va = 0x4d72fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 354 start_va = 0x4cf0000 end_va = 0x4d72fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 355 start_va = 0x4cf0000 end_va = 0x4d7dfff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 356 start_va = 0x4cf0000 end_va = 0x4d7cfff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 357 start_va = 0x4cf0000 end_va = 0x4d78fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 358 start_va = 0x4cf0000 end_va = 0x4d74fff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 361 start_va = 0x4cf0000 end_va = 0x4cfffff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 362 start_va = 0x4d00000 end_va = 0x4d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 363 start_va = 0x71c40000 end_va = 0x71c45fff entry_point = 0x71c40000 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\SysWOW64\\shfolder.dll" (normalized: "c:\\windows\\syswow64\\shfolder.dll") Region: id = 364 start_va = 0x71c10000 end_va = 0x71c37fff entry_point = 0x71c10000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 365 start_va = 0x4cf0000 end_va = 0x4d2ffff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 366 start_va = 0x4d30000 end_va = 0x4e2ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d30000" filename = "" Region: id = 367 start_va = 0x71ac0000 end_va = 0x71c01fff entry_point = 0x71ac0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 368 start_va = 0x7ee41000 end_va = 0x7ee43fff entry_point = 0x0 region_type = private name = "private_0x000000007ee41000" filename = "" Region: id = 369 start_va = 0x4e30000 end_va = 0x4e6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e30000" filename = "" Region: id = 370 start_va = 0x4e70000 end_va = 0x4f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 371 start_va = 0x4f70000 end_va = 0x4faffff entry_point = 0x0 region_type = private name = "private_0x0000000004f70000" filename = "" Region: id = 372 start_va = 0x4fb0000 end_va = 0x50affff entry_point = 0x0 region_type = private name = "private_0x0000000004fb0000" filename = "" Region: id = 373 start_va = 0x50b0000 end_va = 0x50effff entry_point = 0x0 region_type = private name = "private_0x00000000050b0000" filename = "" Region: id = 374 start_va = 0x50f0000 end_va = 0x51effff entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 375 start_va = 0x51f0000 end_va = 0x51f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000051f0000" filename = "" Region: id = 376 start_va = 0x7ee38000 end_va = 0x7ee3afff entry_point = 0x0 region_type = private name = "private_0x000000007ee38000" filename = "" Region: id = 377 start_va = 0x7ee3b000 end_va = 0x7ee3dfff entry_point = 0x0 region_type = private name = "private_0x000000007ee3b000" filename = "" Region: id = 378 start_va = 0x7ee3e000 end_va = 0x7ee40fff entry_point = 0x0 region_type = private name = "private_0x000000007ee3e000" filename = "" Region: id = 379 start_va = 0x77760000 end_va = 0x777e1fff entry_point = 0x77760000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 380 start_va = 0x718b0000 end_va = 0x71ab6fff entry_point = 0x718b0000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 381 start_va = 0x5200000 end_va = 0x5200fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005200000" filename = "" Region: id = 382 start_va = 0x5210000 end_va = 0x524ffff entry_point = 0x0 region_type = private name = "private_0x0000000005210000" filename = "" Region: id = 383 start_va = 0x5250000 end_va = 0x534ffff entry_point = 0x0 region_type = private name = "private_0x0000000005250000" filename = "" Region: id = 384 start_va = 0x75030000 end_va = 0x75065fff entry_point = 0x75030000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 385 start_va = 0x7ee35000 end_va = 0x7ee37fff entry_point = 0x0 region_type = private name = "private_0x000000007ee35000" filename = "" Region: id = 386 start_va = 0x5350000 end_va = 0x5353fff entry_point = 0x5350000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 387 start_va = 0x5360000 end_va = 0x53a2fff entry_point = 0x5360000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000b.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000b.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000b.db") Region: id = 388 start_va = 0x53b0000 end_va = 0x53b3fff entry_point = 0x53b0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 389 start_va = 0x53c0000 end_va = 0x544afff entry_point = 0x53c0000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 390 start_va = 0x5450000 end_va = 0x5460fff entry_point = 0x5450000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\propsys.dll.mui") Region: id = 391 start_va = 0x5470000 end_va = 0x54affff entry_point = 0x0 region_type = private name = "private_0x0000000005470000" filename = "" Region: id = 392 start_va = 0x54b0000 end_va = 0x55affff entry_point = 0x0 region_type = private name = "private_0x00000000054b0000" filename = "" Region: id = 393 start_va = 0x55b0000 end_va = 0x55b3fff entry_point = 0x55b0000 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 394 start_va = 0x7ee32000 end_va = 0x7ee34fff entry_point = 0x0 region_type = private name = "private_0x000000007ee32000" filename = "" Region: id = 395 start_va = 0x55c0000 end_va = 0x55d2fff entry_point = 0x55c0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001a.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001a.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001a.db") Region: id = 396 start_va = 0x55e0000 end_va = 0x55e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000055e0000" filename = "" Region: id = 397 start_va = 0x71750000 end_va = 0x718affff entry_point = 0x71750000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 398 start_va = 0x71480000 end_va = 0x71740fff entry_point = 0x71480000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 399 start_va = 0x55b0000 end_va = 0x55b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000055b0000" filename = "" Thread: id = 1 os_tid = 0xad4 [0035.479] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0035.579] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe", nBufferLength=0x105, lpBuffer=0x46ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe", lpFilePart=0x0) returned 0x2c [0035.579] GetLastError () returned 0x2 [0035.583] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe", nBufferLength=0x105, lpBuffer=0x46e9dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe", lpFilePart=0x0) returned 0x2c [0035.583] GetLastError () returned 0x2 [0035.604] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", nBufferLength=0x105, lpBuffer=0x46e9a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpFilePart=0x0) returned 0x1e [0035.604] GetLastError () returned 0x2 [0035.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", nBufferLength=0x105, lpBuffer=0x46ea40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpFilePart=0x0) returned 0x1e [0035.607] GetLastError () returned 0x2 [0035.607] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", nBufferLength=0x105, lpBuffer=0x46e9dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\", lpFilePart=0x0) returned 0x1e [0035.607] GetLastError () returned 0x2 [0035.682] GetVersionExW (in: lpVersionInformation=0x6b24d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6b24d0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0035.682] GetLastError () returned 0x2 [0035.683] GetVersionExW (in: lpVersionInformation=0x6b24d0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6b24d0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0035.683] GetLastError () returned 0x2 [0038.448] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe", nBufferLength=0x105, lpBuffer=0x46e74c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe", lpFilePart=0x0) returned 0x2c [0038.448] GetLastError () returned 0x8013141b [0038.448] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe", nBufferLength=0x105, lpBuffer=0x46e6d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe", lpFilePart=0x0) returned 0x2c [0038.448] GetLastError () returned 0x8013141b [0038.464] VirtualProtect (in: lpAddress=0x1e2000, dwSize=0x8a688, flNewProtect=0x40, lpflOldProtect=0x46edec | out: lpflOldProtect=0x46edec*=0x2) returned 1 [0039.813] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x46eb6c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x64 [0039.813] GetLastError () returned 0x1e7 [0039.905] IsAppThemed () returned 0x0 [0039.906] CoTaskMemAlloc (cb=0xca) returned 0x688b50 [0039.906] CreateActCtxA (pActCtx=0x6b2ab8) returned 0x6bf9f4 [0040.047] CoTaskMemFree (pv=0x688b50) [0040.061] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc16b [0040.061] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc16c [0040.092] GetSystemMetrics (nIndex=75) returned 1 [0040.177] AdjustWindowRectEx (in: lpRect=0x46f064, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x46f064) returned 1 [0040.179] GetCurrentProcess () returned 0xffffffff [0040.179] GetCurrentThread () returned 0xfffffffe [0040.179] GetCurrentProcess () returned 0xffffffff [0040.180] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x46ef94, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x46ef94*=0x268) returned 1 [0040.180] GetLastError () returned 0x0 [0040.182] GetCurrentThreadId () returned 0xad4 [0040.190] GetCurrentActCtx (in: lphActCtx=0x46eef4 | out: lphActCtx=0x46eef4*=0x0) returned 1 [0040.191] ActivateActCtx (in: hActCtx=0x6bf9f4, lpCookie=0x46ef08 | out: hActCtx=0x6bf9f4, lpCookie=0x46ef08) returned 1 [0040.192] lstrlenW (lpString="䅁") returned 1 [0040.193] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74d70000 [0040.194] GetProcAddress (hModule=0x74d70000, lpProcName="DefWindowProcW") returned 0x77cbcaa0 [0040.195] GetStockObject (i=5) returned 0x1900015 [0040.195] GetLastError () returned 0x0 [0040.217] GetModuleHandleW (lpModuleName=0x0) returned 0x1e0000 [0040.262] CoTaskMemAlloc (cb=0x4c) returned 0x69bb20 [0040.262] RegisterClassW (lpWndClass=0x6b2ad0) returned 0xc166 [0040.263] GetLastError () returned 0x2 [0040.263] CoTaskMemFree (pv=0x69bb20) [0040.263] GetModuleHandleW (lpModuleName=0x0) returned 0x1e0000 [0040.264] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x1e0000, lpParam=0x0) returned 0x60164 [0040.266] SetWindowLongW (hWnd=0x60164, nIndex=-4, dwNewLong=2009844384) returned 36112242 [0040.268] GetWindowLongW (hWnd=0x60164, nIndex=-4) returned 2009844384 [0040.271] lstrlenW (lpString="䅁") returned 1 [0040.273] GetVersionExW (in: lpVersionInformation=0x6b2af0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6b2af0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0040.273] GetLastError () returned 0x2 [0040.276] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x46e5d8 | out: phkResult=0x46e5d8*=0x270) returned 0x0 [0040.277] RegQueryValueExW (in: hKey=0x270, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x46e620, lpData=0x0, lpcbData=0x46e61c*=0x0 | out: lpType=0x46e620*=0x0, lpData=0x0, lpcbData=0x46e61c*=0x0) returned 0x2 [0040.277] RegQueryValueExW (in: hKey=0x270, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x46e620, lpData=0x0, lpcbData=0x46e61c*=0x0 | out: lpType=0x46e620*=0x0, lpData=0x0, lpcbData=0x46e61c*=0x0) returned 0x2 [0040.277] RegCloseKey (hKey=0x270) returned 0x0 [0040.279] SetWindowLongW (hWnd=0x60164, nIndex=-4, dwNewLong=36112562) returned 2009844384 [0040.279] GetWindowLongW (hWnd=0x60164, nIndex=-4) returned 36112562 [0040.279] GetWindowLongW (hWnd=0x60164, nIndex=-16) returned 113311744 [0040.281] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc167 [0040.282] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x60164, Msg=0x24, wParam=0x0, lParam=0x46e8f4) returned 0x0 [0040.282] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc0e6 [0040.282] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x60164, Msg=0x81, wParam=0x0, lParam=0x46e8e8) returned 0x1 [0040.283] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x60164, Msg=0x83, wParam=0x0, lParam=0x46e8d4) returned 0x0 [0040.457] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x60164, Msg=0x1, wParam=0x0, lParam=0x46e8e8) returned 0x0 [0040.458] GetClientRect (in: hWnd=0x60164, lpRect=0x46e628 | out: lpRect=0x46e628) returned 1 [0040.458] GetWindowRect (in: hWnd=0x60164, lpRect=0x46e628 | out: lpRect=0x46e628) returned 1 [0040.459] GetLastError () returned 0x6 [0040.461] GetParent (hWnd=0x60164) returned 0x0 [0040.462] DeactivateActCtx (dwFlags=0x0, ulCookie=0x1f2b0001) returned 1 [0041.534] AdjustWindowRectEx (in: lpRect=0x46f008, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x46f008) returned 1 [0041.534] GetSystemMetrics (nIndex=59) returned 1456 [0041.534] GetSystemMetrics (nIndex=60) returned 916 [0041.534] GetSystemMetrics (nIndex=34) returned 136 [0041.534] GetSystemMetrics (nIndex=35) returned 39 [0041.535] AdjustWindowRectEx (in: lpRect=0x46ef0c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x46ef0c) returned 1 [0041.574] CreateCompatibleDC (hdc=0x0) returned 0x6010751 [0041.578] GetLastError () returned 0x6 [0041.580] GetSystemDefaultLCID () returned 0x409 [0041.580] GetLastError () returned 0x6 [0041.580] GetStockObject (i=17) returned 0x10a0047 [0041.580] GetLastError () returned 0x6 [0041.582] GetObjectW (in: h=0x10a0047, c=92, pv=0x6b2ad0 | out: pv=0x6b2ad0) returned 92 [0041.582] GetLastError () returned 0x6 [0041.583] GetDC (hWnd=0x0) returned 0xa0100d0 [0041.583] GetLastError () returned 0x6 [0041.651] GetCurrentProcessId () returned 0x66c [0041.651] GetLastError () returned 0x6 [0041.654] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0041.654] GetLastError () returned 0x2 [0041.654] AddAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0041.654] GetLastError () returned 0x2 [0041.702] GdiplusStartup (in: token=0x664168, input=0x6b2ab8, output=0x46e664 | out: token=0x664168, output=0x46e664) returned 0x0 [0041.705] GetLastError () returned 0x0 [0041.723] GdipCreateFontFromLogfontW (hdc=0xa0100d0, logfont=0x6b2ad0, font=0x46ee74) returned 0x0 [0042.024] GetLastError () returned 0x7a [0042.027] GdipGetFontUnit (font=0x4621f08, unit=0x46ee38) returned 0x0 [0042.027] GetLastError () returned 0x7f [0042.027] GdipGetFontSize (font=0x4621f08, size=0x46ee3c) returned 0x0 [0042.027] GetLastError () returned 0x7f [0042.027] GdipGetFontStyle (font=0x4621f08, style=0x46ee34) returned 0x0 [0042.027] GetLastError () returned 0x7f [0042.027] GdipGetFamily (font=0x4621f08, family=0x46ee30) returned 0x0 [0042.027] GetLastError () returned 0x7f [0042.028] GdipGetFontSize (font=0x4621f08, size=0x25eb444) returned 0x0 [0042.028] GetLastError () returned 0x7f [0042.028] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1 [0042.029] GetLastError () returned 0x7f [0042.029] GetDC (hWnd=0x0) returned 0x300106cd [0042.029] GetLastError () returned 0x7f [0042.029] GdipCreateFromHDC (hdc=0x300106cd, graphics=0x46ee6c) returned 0x0 [0042.032] GetLastError () returned 0x7f [0042.033] GdipGetDpiY (graphics=0x6b6f260, dpi=0x25eb54c) returned 0x0 [0042.033] GetLastError () returned 0x7f [0042.033] GdipGetFontHeight (font=0x4621f08, graphics=0x6b6f260, height=0x46ee64) returned 0x0 [0042.033] GetLastError () returned 0x7f [0042.034] GdipGetEmHeight (family=0x6b65cb8, style=0, EmHeight=0x46ee6c) returned 0x0 [0042.034] GetLastError () returned 0x7f [0042.034] GdipGetLineSpacing (family=0x6b65cb8, style=0, LineSpacing=0x46ee6c) returned 0x0 [0042.034] GetLastError () returned 0x7f [0042.034] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0042.034] GetLastError () returned 0x7f [0042.035] GdipDeleteGraphics (graphics=0x6b6f260) returned 0x0 [0042.035] GetLastError () returned 0x7f [0042.035] ReleaseDC (hWnd=0x0, hDC=0x300106cd) returned 1 [0042.036] GetLastError () returned 0x7f [0042.036] GdipCreateFont (fontFamily=0x6b65cb8, emSize=0x41040000, style=0, unit=0x3, font=0x25eb50c) returned 0x0 [0042.036] GetLastError () returned 0x7f [0042.036] GdipGetFontSize (font=0x462ef48, size=0x25eb510) returned 0x0 [0042.036] GetLastError () returned 0x7f [0042.036] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0042.036] GetLastError () returned 0x7f [0042.036] GdipDeleteFont (font=0x4621f08) returned 0x0 [0042.036] GetLastError () returned 0x7f [0042.037] GetDC (hWnd=0x0) returned 0x300106cd [0042.037] GetLastError () returned 0x7f [0042.037] GdipCreateFromHDC (hdc=0x300106cd, graphics=0x46ee9c) returned 0x0 [0042.037] GetLastError () returned 0x7f [0042.042] GdipGetLogFontW (font=0x462ef48, graphics=0x6b6f260, logfontW=0x6b2ad0) returned 0x0 [0042.049] GetLastError () returned 0x7f [0042.050] GdipDeleteGraphics (graphics=0x6b6f260) returned 0x0 [0042.050] GetLastError () returned 0x7f [0042.050] ReleaseDC (hWnd=0x0, hDC=0x300106cd) returned 1 [0042.050] GetLastError () returned 0x7f [0042.051] CreateFontIndirectW (lplf=0x6b2ad0) returned 0x2a0a0658 [0042.051] GetLastError () returned 0x7f [0042.051] SelectObject (hdc=0x6010751, h=0x2a0a0658) returned 0x18a0048 [0042.051] GetLastError () returned 0x7f [0042.069] GetTextMetricsW (in: hdc=0x6010751, lptm=0x46ef88 | out: lptm=0x46ef88) returned 1 [0042.071] GetLastError () returned 0x7f [0042.073] GetTextExtentPoint32W (in: hdc=0x6010751, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x25eb774 | out: psizl=0x25eb774) returned 1 [0042.104] GetLastError () returned 0x0 [0042.104] SelectObject (hdc=0x6010751, h=0x18a0048) returned 0x2a0a0658 [0042.105] GetLastError () returned 0x0 [0042.105] DeleteDC (hdc=0x6010751) returned 1 [0042.106] GetLastError () returned 0x0 [0042.110] AdjustWindowRectEx (in: lpRect=0x46eda8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x46eda8) returned 1 [0042.110] AdjustWindowRectEx (in: lpRect=0x46ef1c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x46ef1c) returned 1 [0042.110] AdjustWindowRectEx (in: lpRect=0x46ed14, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x46ed14) returned 1 [0042.110] AdjustWindowRectEx (in: lpRect=0x46ede8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x46ede8) returned 1 [0042.113] GetSystemMetrics (nIndex=34) returned 136 [0042.113] GetSystemMetrics (nIndex=35) returned 39 [0042.113] GetCurrentActCtx (in: lphActCtx=0x46f084 | out: lphActCtx=0x46f084*=0x0) returned 1 [0042.114] ActivateActCtx (in: hActCtx=0x6bf9f4, lpCookie=0x46f098 | out: hActCtx=0x6bf9f4, lpCookie=0x46f098) returned 1 [0042.114] GetCurrentActCtx (in: lphActCtx=0x46eec4 | out: lphActCtx=0x46eec4*=0x6bf9f4) returned 1 [0042.114] AdjustWindowRectEx (in: lpRect=0x46ee38, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x46ee38) returned 1 [0042.114] GetModuleHandleW (lpModuleName=0x0) returned 0x1e0000 [0042.114] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName="PPppp", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=309, nHeight=169, hWndParent=0x0, hMenu=0x0, hInstance=0x1e0000, lpParam=0x0) returned 0x601f8 [0042.115] SetWindowLongW (hWnd=0x601f8, nIndex=-4, dwNewLong=2009844384) returned 36112242 [0042.115] GetWindowLongW (hWnd=0x601f8, nIndex=-4) returned 2009844384 [0042.116] SetWindowLongW (hWnd=0x601f8, nIndex=-4, dwNewLong=36112610) returned 2009844384 [0042.116] GetWindowLongW (hWnd=0x601f8, nIndex=-4) returned 36112610 [0042.116] GetWindowLongW (hWnd=0x601f8, nIndex=-16) returned 114229248 [0042.116] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x81, wParam=0x0, lParam=0x46e8b8) returned 0x1 [0042.120] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x83, wParam=0x0, lParam=0x46e8a4) returned 0x0 [0042.131] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x1, wParam=0x0, lParam=0x46e8b8) returned 0x0 [0042.131] GetClientRect (in: hWnd=0x601f8, lpRect=0x46e5c0 | out: lpRect=0x46e5c0) returned 1 [0042.131] GetWindowRect (in: hWnd=0x601f8, lpRect=0x46e5c0 | out: lpRect=0x46e5c0) returned 1 [0042.133] SetWindowTextW (hWnd=0x601f8, lpString="PPppp") returned 1 [0042.133] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0xc, wParam=0x0, lParam=0x25eab40) returned 0x1 [0042.167] GetProcessWindowStation () returned 0xf4 [0042.169] GetUserObjectInformationA (in: hObj=0xf4, nIndex=1, pvInfo=0x25ebd78, nLength=0xc, lpnLengthNeeded=0x46e4c0 | out: pvInfo=0x25ebd78, lpnLengthNeeded=0x46e4c0) returned 1 [0042.169] GetLastError () returned 0x0 [0042.287] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x2a8 [0042.287] GetLastError () returned 0x0 [0042.409] GetStartupInfoW (in: lpStartupInfo=0x25ec774 | out: lpStartupInfo=0x25ec774*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0042.434] GetLastError () returned 0x0 [0042.434] GetParent (hWnd=0x601f8) returned 0x0 [0042.434] SetWindowLongW (hWnd=0x601f8, nIndex=-8, dwNewLong=0) returned 0 [0042.575] GetSystemMetrics (nIndex=11) returned 32 [0042.575] GetLastError () returned 0x578 [0042.575] GetSystemMetrics (nIndex=12) returned 32 [0042.575] GetLastError () returned 0x578 [0042.575] GetDC (hWnd=0x0) returned 0x300106cd [0042.575] GetLastError () returned 0x578 [0042.576] GetDeviceCaps (hdc=0x300106cd, index=12) returned 32 [0042.576] GetLastError () returned 0x578 [0042.576] GetDeviceCaps (hdc=0x300106cd, index=14) returned 1 [0042.576] GetLastError () returned 0x578 [0042.576] ReleaseDC (hWnd=0x0, hDC=0x300106cd) returned 1 [0042.576] GetLastError () returned 0x578 [0042.577] CreateIconFromResourceEx (presbits=0x25ef3b8, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x90207 [0042.578] GetLastError () returned 0x578 [0042.578] GetSystemMetrics (nIndex=49) returned 16 [0042.578] GetSystemMetrics (nIndex=50) returned 16 [0042.578] CreateIconFromResourceEx (presbits=0x25f0494, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x8501a1 [0042.579] GetLastError () returned 0x578 [0042.579] SendMessageW (hWnd=0x601f8, Msg=0x80, wParam=0x0, lParam=0x8501a1) returned 0x0 [0042.579] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x80, wParam=0x0, lParam=0x8501a1) returned 0x0 [0042.581] SendMessageW (hWnd=0x601f8, Msg=0x80, wParam=0x1, lParam=0x90207) returned 0x0 [0042.581] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x80, wParam=0x1, lParam=0x90207) returned 0x0 [0042.582] GetSystemMenu (hWnd=0x601f8, bRevert=0) returned 0xe019b [0042.591] GetWindowPlacement (in: hWnd=0x601f8, lpwndpl=0x46eed4 | out: lpwndpl=0x46eed4) returned 1 [0042.591] EnableMenuItem (hMenu=0xe019b, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0042.592] EnableMenuItem (hMenu=0xe019b, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0042.592] EnableMenuItem (hMenu=0xe019b, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0042.592] EnableMenuItem (hMenu=0xe019b, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0042.592] EnableMenuItem (hMenu=0xe019b, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0042.592] GetClientRect (in: hWnd=0x601f8, lpRect=0x46ef14 | out: lpRect=0x46ef14) returned 1 [0042.592] GetClientRect (in: hWnd=0x601f8, lpRect=0x46eec8 | out: lpRect=0x46eec8) returned 1 [0042.592] GetWindowRect (in: hWnd=0x601f8, lpRect=0x46eec8 | out: lpRect=0x46eec8) returned 1 [0042.592] GetWindowLongW (hWnd=0x601f8, nIndex=-16) returned 114229248 [0042.592] GetWindowTextLengthW (hWnd=0x601f8) returned 5 [0042.592] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0042.592] GetSystemMetrics (nIndex=42) returned 0 [0042.593] GetWindowTextW (in: hWnd=0x601f8, lpString=0x6b2ab8, nMaxCount=6 | out: lpString="PPppp") returned 5 [0042.593] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0xd, wParam=0x6, lParam=0x6b2ab8) returned 0x5 [0042.593] GetWindowTextLengthW (hWnd=0x601f8) returned 5 [0042.594] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0042.594] GetSystemMetrics (nIndex=42) returned 0 [0042.594] GetWindowTextW (in: hWnd=0x601f8, lpString=0x6b2ab8, nMaxCount=6 | out: lpString="PPppp") returned 5 [0042.594] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0xd, wParam=0x6, lParam=0x6b2ab8) returned 0x5 [0042.594] GetWindowLongW (hWnd=0x601f8, nIndex=-16) returned 114229248 [0042.594] GetWindowLongW (hWnd=0x601f8, nIndex=-20) returned 327936 [0042.594] SetWindowLongW (hWnd=0x601f8, nIndex=-16, dwNewLong=47120384) returned 114229248 [0042.594] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x7c, wParam=0xfffffff0, lParam=0x46ee54) returned 0x0 [0042.594] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x7d, wParam=0xfffffff0, lParam=0x46ee54) returned 0x0 [0042.599] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x8501a1 [0042.599] SetWindowLongW (hWnd=0x601f8, nIndex=-20, dwNewLong=327680) returned 327936 [0042.599] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x7c, wParam=0xffffffec, lParam=0x46ee54) returned 0x0 [0042.600] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x7d, wParam=0xffffffec, lParam=0x46ee54) returned 0x0 [0042.600] SetWindowPos (hWnd=0x601f8, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0042.601] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x46, wParam=0x0, lParam=0x46ee84) returned 0x0 [0042.601] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x83, wParam=0x1, lParam=0x46ee5c) returned 0x0 [0042.602] GetWindowPlacement (in: hWnd=0x601f8, lpwndpl=0x46ec04 | out: lpwndpl=0x46ec04) returned 1 [0042.602] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x47, wParam=0x0, lParam=0x46ee84) returned 0x0 [0042.602] GetClientRect (in: hWnd=0x601f8, lpRect=0x46eba0 | out: lpRect=0x46eba0) returned 1 [0042.602] GetWindowRect (in: hWnd=0x601f8, lpRect=0x46eba0 | out: lpRect=0x46eba0) returned 1 [0042.603] RedrawWindow (hWnd=0x601f8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0042.603] GetSystemMenu (hWnd=0x601f8, bRevert=0) returned 0xe019b [0042.604] GetWindowPlacement (in: hWnd=0x601f8, lpwndpl=0x46eeb8 | out: lpwndpl=0x46eeb8) returned 1 [0042.604] EnableMenuItem (hMenu=0xe019b, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0042.604] EnableMenuItem (hMenu=0xe019b, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0042.604] EnableMenuItem (hMenu=0xe019b, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0042.604] EnableMenuItem (hMenu=0xe019b, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0042.604] EnableMenuItem (hMenu=0xe019b, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0042.605] ShowWindow (hWnd=0x601f8, nCmdShow=5) [0042.605] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0042.605] GetWindowTextLengthW (hWnd=0x601f8) returned 5 [0042.605] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0042.605] GetSystemMetrics (nIndex=42) returned 0 [0042.605] GetWindowTextW (in: hWnd=0x601f8, lpString=0x6b2ab8, nMaxCount=6 | out: lpString="PPppp") returned 5 [0042.605] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601f8, Msg=0xd, wParam=0x6, lParam=0x6b2ab8) returned 0x5 [0042.670] SendMessageW (hWnd=0x601f8, Msg=0x10, wParam=0x0, lParam=0x0) [0043.719] GetVersionExW (in: lpVersionInformation=0x6b2ad0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6b2ad0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0043.719] GetLastError () returned 0x1e7 [0044.315] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x46da5c | out: pfEnabled=0x46da5c) returned 0x0 [0044.772] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe:Zone.Identifier" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gabkrj.jpg.exe:zone.identifier")) returned 0 [0044.773] GetLastError () returned 0x2 [0045.685] GetCurrentProcessId () returned 0x66c [0046.036] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x46d9e0 | out: lpLuid=0x46d9e0*(LowPart=0x14, HighPart=0)) returned 1 [0046.039] GetLastError () returned 0x0 [0046.053] GetCurrentProcess () returned 0xffffffff [0046.053] GetLastError () returned 0x0 [0046.054] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x46d9dc | out: TokenHandle=0x46d9dc*=0x328) returned 1 [0046.054] GetLastError () returned 0x0 [0046.063] AdjustTokenPrivileges (in: TokenHandle=0x328, DisableAllPrivileges=0, NewState=0x261fc98*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0046.063] GetLastError () returned 0x0 [0046.064] CloseHandle (hObject=0x328) returned 1 [0046.064] GetLastError () returned 0x0 [0046.067] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x66c) returned 0x328 [0046.067] GetLastError () returned 0x0 [0046.113] EnumProcessModules (in: hProcess=0x328, lphModule=0x261fcdc, cb=0x100, lpcbNeeded=0x46e1d0 | out: lphModule=0x261fcdc, lpcbNeeded=0x46e1d0) returned 1 [0046.114] GetLastError () returned 0x0 [0046.128] GetModuleInformation (in: hProcess=0x328, hModule=0x1e0000, lpmodinfo=0x261fe1c, cb=0xc | out: lpmodinfo=0x261fe1c*(lpBaseOfDll=0x1e0000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0046.129] GetLastError () returned 0x0 [0046.130] GetModuleBaseNameW (in: hProcess=0x328, hModule=0x1e0000, lpBaseName=0x6db9f8, nSize=0x800 | out: lpBaseName="gabkrj.jpg.exe") returned 0xe [0046.130] GetLastError () returned 0x0 [0046.131] GetModuleFileNameExW (in: hProcess=0x328, hModule=0x1e0000, lpFilename=0x6db9f8, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gabkrj.jpg.exe")) returned 0x2c [0046.131] GetLastError () returned 0x0 [0046.132] CloseHandle (hObject=0x328) returned 1 [0046.132] GetLastError () returned 0x0 [0046.624] GetCurrentProcessId () returned 0x66c [0046.624] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x66c) returned 0x338 [0046.624] GetLastError () returned 0x0 [0046.624] EnumProcessModules (in: hProcess=0x338, lphModule=0x2624538, cb=0x100, lpcbNeeded=0x46e194 | out: lphModule=0x2624538, lpcbNeeded=0x46e194) returned 1 [0046.625] GetLastError () returned 0x0 [0046.625] GetModuleInformation (in: hProcess=0x338, hModule=0x1e0000, lpmodinfo=0x2624678, cb=0xc | out: lpmodinfo=0x2624678*(lpBaseOfDll=0x1e0000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0046.625] GetLastError () returned 0x0 [0046.625] GetModuleBaseNameW (in: hProcess=0x338, hModule=0x1e0000, lpBaseName=0x6db9f8, nSize=0x800 | out: lpBaseName="gabkrj.jpg.exe") returned 0xe [0046.625] GetLastError () returned 0x0 [0046.625] GetModuleFileNameExW (in: hProcess=0x338, hModule=0x1e0000, lpFilename=0x6db9f8, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gabkrj.jpg.exe")) returned 0x2c [0046.625] GetLastError () returned 0x0 [0046.625] CloseHandle (hObject=0x338) returned 1 [0046.625] GetLastError () returned 0x0 [0046.704] GetCurrentProcessId () returned 0x66c [0046.704] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x66c) returned 0x338 [0046.704] GetLastError () returned 0x0 [0046.704] EnumProcessModules (in: hProcess=0x338, lphModule=0x268070c, cb=0x100, lpcbNeeded=0x46e194 | out: lphModule=0x268070c, lpcbNeeded=0x46e194) returned 1 [0046.704] GetLastError () returned 0x0 [0046.704] GetModuleInformation (in: hProcess=0x338, hModule=0x1e0000, lpmodinfo=0x268084c, cb=0xc | out: lpmodinfo=0x268084c*(lpBaseOfDll=0x1e0000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0046.705] GetLastError () returned 0x0 [0046.705] GetModuleBaseNameW (in: hProcess=0x338, hModule=0x1e0000, lpBaseName=0x6db9f8, nSize=0x800 | out: lpBaseName="gabkrj.jpg.exe") returned 0xe [0046.705] GetLastError () returned 0x0 [0046.705] GetModuleFileNameExW (in: hProcess=0x338, hModule=0x1e0000, lpFilename=0x6db9f8, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gabkrj.jpg.exe")) returned 0x2c [0046.705] GetLastError () returned 0x0 [0046.705] CloseHandle (hObject=0x338) returned 1 [0046.708] GetLastError () returned 0x0 [0046.708] GetCurrentProcessId () returned 0x66c [0046.708] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x66c) returned 0x338 [0046.708] GetLastError () returned 0x0 [0046.708] EnumProcessModules (in: hProcess=0x338, lphModule=0x2681e38, cb=0x100, lpcbNeeded=0x46e194 | out: lphModule=0x2681e38, lpcbNeeded=0x46e194) returned 1 [0046.709] GetLastError () returned 0x0 [0046.709] GetModuleInformation (in: hProcess=0x338, hModule=0x1e0000, lpmodinfo=0x2681f78, cb=0xc | out: lpmodinfo=0x2681f78*(lpBaseOfDll=0x1e0000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0046.709] GetLastError () returned 0x0 [0046.709] GetModuleBaseNameW (in: hProcess=0x338, hModule=0x1e0000, lpBaseName=0x6db9f8, nSize=0x800 | out: lpBaseName="gabkrj.jpg.exe") returned 0xe [0046.709] GetLastError () returned 0x0 [0046.709] GetModuleFileNameExW (in: hProcess=0x338, hModule=0x1e0000, lpFilename=0x6db9f8, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gabkrj.jpg.exe")) returned 0x2c [0046.710] GetLastError () returned 0x0 [0046.710] CloseHandle (hObject=0x338) returned 1 [0046.710] GetLastError () returned 0x0 [0046.710] GetCurrentProcessId () returned 0x66c [0046.710] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x66c) returned 0x338 [0046.710] GetLastError () returned 0x0 [0046.710] EnumProcessModules (in: hProcess=0x338, lphModule=0x2683514, cb=0x100, lpcbNeeded=0x46e194 | out: lphModule=0x2683514, lpcbNeeded=0x46e194) returned 1 [0046.711] GetLastError () returned 0x0 [0046.711] GetModuleInformation (in: hProcess=0x338, hModule=0x1e0000, lpmodinfo=0x2683654, cb=0xc | out: lpmodinfo=0x2683654*(lpBaseOfDll=0x1e0000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0046.711] GetLastError () returned 0x0 [0046.711] GetModuleBaseNameW (in: hProcess=0x338, hModule=0x1e0000, lpBaseName=0x6db9f8, nSize=0x800 | out: lpBaseName="gabkrj.jpg.exe") returned 0xe [0046.711] GetLastError () returned 0x0 [0046.711] GetModuleFileNameExW (in: hProcess=0x338, hModule=0x1e0000, lpFilename=0x6db9f8, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gabkrj.jpg.exe")) returned 0x2c [0046.711] GetLastError () returned 0x0 [0046.711] CloseHandle (hObject=0x338) returned 1 [0046.711] GetLastError () returned 0x0 [0046.946] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.config", nBufferLength=0x105, lpBuffer=0x46dc48, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.config", lpFilePart=0x0) returned 0x2f [0046.946] GetLastError () returned 0x0 [0046.947] SetErrorMode (uMode=0x1) returned 0x0 [0046.947] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.config" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gabkrj.jpg.config"), fInfoLevelId=0x0, lpFileInformation=0x46e0f0 | out: lpFileInformation=0x46e0f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0046.947] GetLastError () returned 0x2 [0046.947] SetErrorMode (uMode=0x0) returned 0x1 [0047.914] SetErrorMode (uMode=0x1) returned 0x0 [0047.914] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\enterprisesec.config"), fInfoLevelId=0x0, lpFileInformation=0x46cbb0 | out: lpFileInformation=0x46cbb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0047.914] GetLastError () returned 0x2 [0047.914] SetErrorMode (uMode=0x0) returned 0x1 [0047.915] SetErrorMode (uMode=0x1) returned 0x0 [0047.915] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.default" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\enterprisesec.config.default"), fInfoLevelId=0x0, lpFileInformation=0x46cb80 | out: lpFileInformation=0x46cb80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0047.915] GetLastError () returned 0x2 [0047.915] SetErrorMode (uMode=0x0) returned 0x1 [0047.981] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x46cb3c | out: phkResult=0x46cb3c*=0x348) returned 0x0 [0047.981] RegOpenKeyExW (in: hKey=0x348, lpSubKey="Security\\Policy\\Extensions\\NamedPermissionSets", ulOptions=0x0, samDesired=0x20019, phkResult=0x46cb3c | out: phkResult=0x46cb3c*=0x350) returned 0x0 [0047.982] RegOpenKeyExW (in: hKey=0x350, lpSubKey="Internet", ulOptions=0x0, samDesired=0x20019, phkResult=0x46cb3c | out: phkResult=0x46cb3c*=0x34c) returned 0x0 [0047.982] RegQueryInfoKeyW (in: hKey=0x34c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x46cb80, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x46cb7c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x46cb80*=0x2, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x46cb7c*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0047.983] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x0, lpName=0x6db9f8, lpcchName=0x46cb9c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MediaPermission", lpcchName=0x46cb9c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0047.983] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x1, lpName=0x6db9f8, lpcchName=0x46cb9c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WebBrowserPermission", lpcchName=0x46cb9c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0047.983] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="MediaPermission", ulOptions=0x0, samDesired=0x20019, phkResult=0x46cb3c | out: phkResult=0x46cb3c*=0x354) returned 0x0 [0047.983] RegQueryValueExW (in: hKey=0x354, lpValueName="Xml", lpReserved=0x0, lpType=0x46cb80, lpData=0x0, lpcbData=0x46cb7c*=0x0 | out: lpType=0x46cb80*=0x1, lpData=0x0, lpcbData=0x46cb7c*=0x1aa) returned 0x0 [0047.983] RegQueryValueExW (in: hKey=0x354, lpValueName="Xml", lpReserved=0x0, lpType=0x46cb80, lpData=0x6db9f8, lpcbData=0x46cb7c*=0x1aa | out: lpType=0x46cb80*=0x1, lpData="", lpcbData=0x46cb7c*=0x1aa) returned 0x0 [0047.984] RegCloseKey (hKey=0x354) returned 0x0 [0047.984] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="WebBrowserPermission", ulOptions=0x0, samDesired=0x20019, phkResult=0x46cb3c | out: phkResult=0x46cb3c*=0x354) returned 0x0 [0047.984] RegQueryValueExW (in: hKey=0x354, lpValueName="Xml", lpReserved=0x0, lpType=0x46cb80, lpData=0x0, lpcbData=0x46cb7c*=0x0 | out: lpType=0x46cb80*=0x1, lpData=0x0, lpcbData=0x46cb7c*=0x162) returned 0x0 [0047.984] RegQueryValueExW (in: hKey=0x354, lpValueName="Xml", lpReserved=0x0, lpType=0x46cb80, lpData=0x6b2ab8, lpcbData=0x46cb7c*=0x162 | out: lpType=0x46cb80*=0x1, lpData="", lpcbData=0x46cb7c*=0x162) returned 0x0 [0047.984] RegCloseKey (hKey=0x354) returned 0x0 [0047.984] RegCloseKey (hKey=0x34c) returned 0x0 [0047.984] RegOpenKeyExW (in: hKey=0x350, lpSubKey="LocalIntranet", ulOptions=0x0, samDesired=0x20019, phkResult=0x46cb3c | out: phkResult=0x46cb3c*=0x34c) returned 0x0 [0047.984] RegQueryInfoKeyW (in: hKey=0x34c, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x46cb80, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x46cb7c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x46cb80*=0x2, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x46cb7c*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0047.984] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x0, lpName=0x6db9f8, lpcchName=0x46cb9c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MediaPermission", lpcchName=0x46cb9c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0047.984] RegEnumKeyExW (in: hKey=0x34c, dwIndex=0x1, lpName=0x6db9f8, lpcchName=0x46cb9c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WebBrowserPermission", lpcchName=0x46cb9c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0047.984] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="MediaPermission", ulOptions=0x0, samDesired=0x20019, phkResult=0x46cb3c | out: phkResult=0x46cb3c*=0x354) returned 0x0 [0047.985] RegQueryValueExW (in: hKey=0x354, lpValueName="Xml", lpReserved=0x0, lpType=0x46cb80, lpData=0x0, lpcbData=0x46cb7c*=0x0 | out: lpType=0x46cb80*=0x1, lpData=0x0, lpcbData=0x46cb7c*=0x1aa) returned 0x0 [0047.985] RegQueryValueExW (in: hKey=0x354, lpValueName="Xml", lpReserved=0x0, lpType=0x46cb80, lpData=0x6db9f8, lpcbData=0x46cb7c*=0x1aa | out: lpType=0x46cb80*=0x1, lpData="", lpcbData=0x46cb7c*=0x1aa) returned 0x0 [0047.985] RegCloseKey (hKey=0x354) returned 0x0 [0047.985] RegOpenKeyExW (in: hKey=0x34c, lpSubKey="WebBrowserPermission", ulOptions=0x0, samDesired=0x20019, phkResult=0x46cb3c | out: phkResult=0x46cb3c*=0x354) returned 0x0 [0047.985] RegQueryValueExW (in: hKey=0x354, lpValueName="Xml", lpReserved=0x0, lpType=0x46cb80, lpData=0x0, lpcbData=0x46cb7c*=0x0 | out: lpType=0x46cb80*=0x1, lpData=0x0, lpcbData=0x46cb7c*=0x162) returned 0x0 [0047.985] RegQueryValueExW (in: hKey=0x354, lpValueName="Xml", lpReserved=0x0, lpType=0x46cb80, lpData=0x6b2ab8, lpcbData=0x46cb7c*=0x162 | out: lpType=0x46cb80*=0x1, lpData="", lpcbData=0x46cb7c*=0x162) returned 0x0 [0047.985] RegCloseKey (hKey=0x354) returned 0x0 [0047.985] RegCloseKey (hKey=0x34c) returned 0x0 [0047.985] RegCloseKey (hKey=0x350) returned 0x0 [0047.985] RegCloseKey (hKey=0x348) returned 0x0 [0047.988] SetErrorMode (uMode=0x1) returned 0x0 [0047.989] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\security.config"), fInfoLevelId=0x0, lpFileInformation=0x46cbb0 | out: lpFileInformation=0x46cbb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0047.989] GetLastError () returned 0x2 [0047.989] SetErrorMode (uMode=0x0) returned 0x1 [0047.989] SetErrorMode (uMode=0x1) returned 0x0 [0047.989] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.default" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\security.config.default"), fInfoLevelId=0x0, lpFileInformation=0x46cb80 | out: lpFileInformation=0x46cb80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0047.989] GetLastError () returned 0x2 [0047.989] SetErrorMode (uMode=0x0) returned 0x1 [0048.172] SetErrorMode (uMode=0x1) returned 0x0 [0048.172] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\clr security config\\v2.0.50727.312\\security.config"), fInfoLevelId=0x0, lpFileInformation=0x46cbb0 | out: lpFileInformation=0x46cbb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0048.172] GetLastError () returned 0x3 [0048.172] SetErrorMode (uMode=0x0) returned 0x1 [0048.172] SetErrorMode (uMode=0x1) returned 0x0 [0048.172] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.default" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\clr security config\\v2.0.50727.312\\security.config.default"), fInfoLevelId=0x0, lpFileInformation=0x46cb80 | out: lpFileInformation=0x46cb80*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0048.172] GetLastError () returned 0x3 [0048.173] SetErrorMode (uMode=0x0) returned 0x1 [0048.278] GdipLoadImageFromStream (stream=0x4920030, image=0x46db3c) returned 0x0 [0048.523] GetLastError () returned 0x0 [0048.523] GdipImageForceValidation (image=0x6b6f260) returned 0x0 [0048.527] GetLastError () returned 0x0 [0048.527] GdipGetImageType (image=0x6b6f260, type=0x46db38) returned 0x0 [0048.527] GetLastError () returned 0x0 [0048.528] GdipGetImageRawFormat (image=0x6b6f260, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.528] GetLastError () returned 0x0 [0048.536] GdipLoadImageFromStream (stream=0x4920010, image=0x46db3c) returned 0x0 [0048.537] GetLastError () returned 0x0 [0048.537] GdipImageForceValidation (image=0x6b72cb0) returned 0x0 [0048.537] GetLastError () returned 0x0 [0048.537] GdipGetImageType (image=0x6b72cb0, type=0x46db38) returned 0x0 [0048.537] GetLastError () returned 0x0 [0048.538] GdipGetImageRawFormat (image=0x6b72cb0, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.538] GetLastError () returned 0x0 [0048.539] GdipLoadImageFromStream (stream=0x492fff0, image=0x46db3c) returned 0x0 [0048.539] GetLastError () returned 0x0 [0048.540] GdipImageForceValidation (image=0x6b762b8) returned 0x0 [0048.540] GetLastError () returned 0x0 [0048.540] GdipGetImageType (image=0x6b762b8, type=0x46db38) returned 0x0 [0048.540] GetLastError () returned 0x0 [0048.540] GdipGetImageRawFormat (image=0x6b762b8, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.540] GetLastError () returned 0x0 [0048.542] GdipLoadImageFromStream (stream=0x492ffd0, image=0x46db3c) returned 0x0 [0048.542] GetLastError () returned 0x0 [0048.542] GdipImageForceValidation (image=0x6b798c0) returned 0x0 [0048.543] GetLastError () returned 0x0 [0048.543] GdipGetImageType (image=0x6b798c0, type=0x46db38) returned 0x0 [0048.543] GetLastError () returned 0x0 [0048.543] GdipGetImageRawFormat (image=0x6b798c0, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.543] GetLastError () returned 0x0 [0048.544] GdipLoadImageFromStream (stream=0x492ffb0, image=0x46db3c) returned 0x0 [0048.545] GetLastError () returned 0x0 [0048.545] GdipImageForceValidation (image=0x6b7cec8) returned 0x0 [0048.546] GetLastError () returned 0x0 [0048.546] GdipGetImageType (image=0x6b7cec8, type=0x46db38) returned 0x0 [0048.546] GetLastError () returned 0x0 [0048.546] GdipGetImageRawFormat (image=0x6b7cec8, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.546] GetLastError () returned 0x0 [0048.547] GdipLoadImageFromStream (stream=0x492ff90, image=0x46db3c) returned 0x0 [0048.548] GetLastError () returned 0x0 [0048.548] GdipImageForceValidation (image=0x6b804d0) returned 0x0 [0048.549] GetLastError () returned 0x0 [0048.549] GdipGetImageType (image=0x6b804d0, type=0x46db38) returned 0x0 [0048.549] GetLastError () returned 0x0 [0048.549] GdipGetImageRawFormat (image=0x6b804d0, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.549] GetLastError () returned 0x0 [0048.550] GdipLoadImageFromStream (stream=0x492ff70, image=0x46db3c) returned 0x0 [0048.551] GetLastError () returned 0x0 [0048.551] GdipImageForceValidation (image=0x6b83ad8) returned 0x0 [0048.551] GetLastError () returned 0x0 [0048.551] GdipGetImageType (image=0x6b83ad8, type=0x46db38) returned 0x0 [0048.552] GetLastError () returned 0x0 [0048.552] GdipGetImageRawFormat (image=0x6b83ad8, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.552] GetLastError () returned 0x0 [0048.553] GdipLoadImageFromStream (stream=0x492ff50, image=0x46db3c) returned 0x0 [0048.553] GetLastError () returned 0x0 [0048.553] GdipImageForceValidation (image=0x6b870e0) returned 0x0 [0048.554] GetLastError () returned 0x0 [0048.554] GdipGetImageType (image=0x6b870e0, type=0x46db38) returned 0x0 [0048.554] GetLastError () returned 0x0 [0048.554] GdipGetImageRawFormat (image=0x6b870e0, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.554] GetLastError () returned 0x0 [0048.555] GdipLoadImageFromStream (stream=0x492ff30, image=0x46db3c) returned 0x0 [0048.556] GetLastError () returned 0x0 [0048.556] GdipImageForceValidation (image=0x6b8a6e8) returned 0x0 [0048.556] GetLastError () returned 0x0 [0048.556] GdipGetImageType (image=0x6b8a6e8, type=0x46db38) returned 0x0 [0048.556] GetLastError () returned 0x0 [0048.556] GdipGetImageRawFormat (image=0x6b8a6e8, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.557] GetLastError () returned 0x0 [0048.557] GdipLoadImageFromStream (stream=0x492ff10, image=0x46db3c) returned 0x0 [0048.558] GetLastError () returned 0x0 [0048.558] GdipImageForceValidation (image=0x6b8dcf0) returned 0x0 [0048.559] GetLastError () returned 0x0 [0048.559] GdipGetImageType (image=0x6b8dcf0, type=0x46db38) returned 0x0 [0048.559] GetLastError () returned 0x0 [0048.559] GdipGetImageRawFormat (image=0x6b8dcf0, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.559] GetLastError () returned 0x0 [0048.559] GdipLoadImageFromStream (stream=0x492fef0, image=0x46db3c) returned 0x0 [0048.560] GetLastError () returned 0x0 [0048.560] GdipImageForceValidation (image=0x6b912f8) returned 0x0 [0048.561] GetLastError () returned 0x0 [0048.561] GdipGetImageType (image=0x6b912f8, type=0x46db38) returned 0x0 [0048.561] GetLastError () returned 0x0 [0048.561] GdipGetImageRawFormat (image=0x6b912f8, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.561] GetLastError () returned 0x0 [0048.562] GdipLoadImageFromStream (stream=0x492fed0, image=0x46db3c) returned 0x0 [0048.563] GetLastError () returned 0x0 [0048.563] GdipImageForceValidation (image=0x6b94900) returned 0x0 [0048.564] GetLastError () returned 0x0 [0048.564] GdipGetImageType (image=0x6b94900, type=0x46db38) returned 0x0 [0048.564] GetLastError () returned 0x0 [0048.564] GdipGetImageRawFormat (image=0x6b94900, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.564] GetLastError () returned 0x0 [0048.564] GdipLoadImageFromStream (stream=0x492feb0, image=0x46db3c) returned 0x0 [0048.565] GetLastError () returned 0x0 [0048.565] GdipImageForceValidation (image=0x6b97f08) returned 0x0 [0048.566] GetLastError () returned 0x0 [0048.566] GdipGetImageType (image=0x6b97f08, type=0x46db38) returned 0x0 [0048.566] GetLastError () returned 0x0 [0048.566] GdipGetImageRawFormat (image=0x6b97f08, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.566] GetLastError () returned 0x0 [0048.567] GdipLoadImageFromStream (stream=0x492fe90, image=0x46db3c) returned 0x0 [0048.567] GetLastError () returned 0x0 [0048.567] GdipImageForceValidation (image=0x6b9b510) returned 0x0 [0048.568] GetLastError () returned 0x0 [0048.568] GdipGetImageType (image=0x6b9b510, type=0x46db38) returned 0x0 [0048.568] GetLastError () returned 0x0 [0048.568] GdipGetImageRawFormat (image=0x6b9b510, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.568] GetLastError () returned 0x0 [0048.568] GdipLoadImageFromStream (stream=0x492fe70, image=0x46db3c) returned 0x0 [0048.569] GetLastError () returned 0x0 [0048.569] GdipImageForceValidation (image=0x6b9eb18) returned 0x0 [0048.570] GetLastError () returned 0x0 [0048.570] GdipGetImageType (image=0x6b9eb18, type=0x46db38) returned 0x0 [0048.571] GetLastError () returned 0x0 [0048.571] GdipGetImageRawFormat (image=0x6b9eb18, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.571] GetLastError () returned 0x0 [0048.571] GdipLoadImageFromStream (stream=0x492fe50, image=0x46db3c) returned 0x0 [0048.572] GetLastError () returned 0x0 [0048.572] GdipImageForceValidation (image=0x6ba2120) returned 0x0 [0048.573] GetLastError () returned 0x0 [0048.573] GdipGetImageType (image=0x6ba2120, type=0x46db38) returned 0x0 [0048.573] GetLastError () returned 0x0 [0048.573] GdipGetImageRawFormat (image=0x6ba2120, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.573] GetLastError () returned 0x0 [0048.573] GdipLoadImageFromStream (stream=0x492fe30, image=0x46db3c) returned 0x0 [0048.574] GetLastError () returned 0x0 [0048.574] GdipImageForceValidation (image=0x6ba5728) returned 0x0 [0048.575] GetLastError () returned 0x0 [0048.575] GdipGetImageType (image=0x6ba5728, type=0x46db38) returned 0x0 [0048.575] GetLastError () returned 0x0 [0048.575] GdipGetImageRawFormat (image=0x6ba5728, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.575] GetLastError () returned 0x0 [0048.576] GdipLoadImageFromStream (stream=0x492fe10, image=0x46db3c) returned 0x0 [0048.578] GetLastError () returned 0x0 [0048.578] GdipImageForceValidation (image=0x6ba9730) returned 0x0 [0048.579] GetLastError () returned 0x0 [0048.579] GdipGetImageType (image=0x6ba9730, type=0x46db38) returned 0x0 [0048.579] GetLastError () returned 0x0 [0048.579] GdipGetImageRawFormat (image=0x6ba9730, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.579] GetLastError () returned 0x0 [0048.580] GdipLoadImageFromStream (stream=0x492fdf0, image=0x46db3c) returned 0x0 [0048.581] GetLastError () returned 0x0 [0048.581] GdipImageForceValidation (image=0x6ba9a78) returned 0x0 [0048.581] GetLastError () returned 0x0 [0048.581] GdipGetImageType (image=0x6ba9a78, type=0x46db38) returned 0x0 [0048.581] GetLastError () returned 0x0 [0048.581] GdipGetImageRawFormat (image=0x6ba9a78, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.582] GetLastError () returned 0x0 [0048.582] GdipLoadImageFromStream (stream=0x492fdd0, image=0x46db3c) returned 0x0 [0048.583] GetLastError () returned 0x0 [0048.583] GdipImageForceValidation (image=0x6ba90a0) returned 0x0 [0048.583] GetLastError () returned 0x0 [0048.583] GdipGetImageType (image=0x6ba90a0, type=0x46db38) returned 0x0 [0048.583] GetLastError () returned 0x0 [0048.583] GdipGetImageRawFormat (image=0x6ba90a0, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.584] GetLastError () returned 0x0 [0048.584] GdipLoadImageFromStream (stream=0x492fdb0, image=0x46db3c) returned 0x0 [0048.585] GetLastError () returned 0x0 [0048.585] GdipImageForceValidation (image=0x6baa798) returned 0x0 [0048.585] GetLastError () returned 0x0 [0048.585] GdipGetImageType (image=0x6baa798, type=0x46db38) returned 0x0 [0048.585] GetLastError () returned 0x0 [0048.586] GdipGetImageRawFormat (image=0x6baa798, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.586] GetLastError () returned 0x0 [0048.586] GdipLoadImageFromStream (stream=0x492fd90, image=0x46db3c) returned 0x0 [0048.587] GetLastError () returned 0x0 [0048.587] GdipImageForceValidation (image=0x6ba8d58) returned 0x0 [0048.587] GetLastError () returned 0x0 [0048.587] GdipGetImageType (image=0x6ba8d58, type=0x46db38) returned 0x0 [0048.587] GetLastError () returned 0x0 [0048.587] GdipGetImageRawFormat (image=0x6ba8d58, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.588] GetLastError () returned 0x0 [0048.588] GdipLoadImageFromStream (stream=0x492fd70, image=0x46db3c) returned 0x0 [0048.589] GetLastError () returned 0x0 [0048.589] GdipImageForceValidation (image=0x6ba9dc0) returned 0x0 [0048.589] GetLastError () returned 0x0 [0048.589] GdipGetImageType (image=0x6ba9dc0, type=0x46db38) returned 0x0 [0048.589] GetLastError () returned 0x0 [0048.589] GdipGetImageRawFormat (image=0x6ba9dc0, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.590] GetLastError () returned 0x0 [0048.590] GdipLoadImageFromStream (stream=0x492fd50, image=0x46db3c) returned 0x0 [0048.591] GetLastError () returned 0x0 [0048.591] GdipImageForceValidation (image=0x6baa108) returned 0x0 [0048.591] GetLastError () returned 0x0 [0048.591] GdipGetImageType (image=0x6baa108, type=0x46db38) returned 0x0 [0048.591] GetLastError () returned 0x0 [0048.591] GdipGetImageRawFormat (image=0x6baa108, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.592] GetLastError () returned 0x0 [0048.592] GdipLoadImageFromStream (stream=0x492fd30, image=0x46db3c) returned 0x0 [0048.593] GetLastError () returned 0x0 [0048.593] GdipImageForceValidation (image=0x6ba93e8) returned 0x0 [0048.594] GetLastError () returned 0x0 [0048.594] GdipGetImageType (image=0x6ba93e8, type=0x46db38) returned 0x0 [0048.594] GetLastError () returned 0x0 [0048.594] GdipGetImageRawFormat (image=0x6ba93e8, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.594] GetLastError () returned 0x0 [0048.594] GdipLoadImageFromStream (stream=0x492fd10, image=0x46db3c) returned 0x0 [0048.595] GetLastError () returned 0x0 [0048.595] GdipImageForceValidation (image=0x6baa450) returned 0x0 [0048.596] GetLastError () returned 0x0 [0048.596] GdipGetImageType (image=0x6baa450, type=0x46db38) returned 0x0 [0048.596] GetLastError () returned 0x0 [0048.596] GdipGetImageRawFormat (image=0x6baa450, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.596] GetLastError () returned 0x0 [0048.596] GdipLoadImageFromStream (stream=0x492fcf0, image=0x46db3c) returned 0x0 [0048.597] GetLastError () returned 0x0 [0048.597] GdipImageForceValidation (image=0x6bce188) returned 0x0 [0048.598] GetLastError () returned 0x0 [0048.598] GdipGetImageType (image=0x6bce188, type=0x46db38) returned 0x0 [0048.598] GetLastError () returned 0x0 [0048.598] GdipGetImageRawFormat (image=0x6bce188, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.598] GetLastError () returned 0x0 [0048.599] GdipLoadImageFromStream (stream=0x492fcd0, image=0x46db3c) returned 0x0 [0048.600] GetLastError () returned 0x0 [0048.600] GdipImageForceValidation (image=0x6bcf538) returned 0x0 [0048.601] GetLastError () returned 0x0 [0048.602] GdipGetImageType (image=0x6bcf538, type=0x46db38) returned 0x0 [0048.602] GetLastError () returned 0x0 [0048.602] GdipGetImageRawFormat (image=0x6bcf538, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.602] GetLastError () returned 0x0 [0048.602] GdipLoadImageFromStream (stream=0x492fcb0, image=0x46db3c) returned 0x0 [0048.603] GetLastError () returned 0x0 [0048.603] GdipImageForceValidation (image=0x6bceb60) returned 0x0 [0048.604] GetLastError () returned 0x0 [0048.604] GdipGetImageType (image=0x6bceb60, type=0x46db38) returned 0x0 [0048.604] GetLastError () returned 0x0 [0048.604] GdipGetImageRawFormat (image=0x6bceb60, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.604] GetLastError () returned 0x0 [0048.605] GdipLoadImageFromStream (stream=0x492fc90, image=0x46db3c) returned 0x0 [0048.605] GetLastError () returned 0x0 [0048.605] GdipImageForceValidation (image=0x6bceea8) returned 0x0 [0048.606] GetLastError () returned 0x0 [0048.606] GdipGetImageType (image=0x6bceea8, type=0x46db38) returned 0x0 [0048.606] GetLastError () returned 0x0 [0048.606] GdipGetImageRawFormat (image=0x6bceea8, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.606] GetLastError () returned 0x0 [0048.606] GdipLoadImageFromStream (stream=0x492fc70, image=0x46db3c) returned 0x0 [0048.607] GetLastError () returned 0x0 [0048.607] GdipImageForceValidation (image=0x6bcf880) returned 0x0 [0048.608] GetLastError () returned 0x0 [0048.608] GdipGetImageType (image=0x6bcf880, type=0x46db38) returned 0x0 [0048.608] GetLastError () returned 0x0 [0048.608] GdipGetImageRawFormat (image=0x6bcf880, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.609] GetLastError () returned 0x0 [0048.609] GdipLoadImageFromStream (stream=0x492fc50, image=0x46db3c) returned 0x0 [0048.610] GetLastError () returned 0x0 [0048.610] GdipImageForceValidation (image=0x6bd08e8) returned 0x0 [0048.611] GetLastError () returned 0x0 [0048.611] GdipGetImageType (image=0x6bd08e8, type=0x46db38) returned 0x0 [0048.611] GetLastError () returned 0x0 [0048.611] GdipGetImageRawFormat (image=0x6bd08e8, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.611] GetLastError () returned 0x0 [0048.613] GdipLoadImageFromStream (stream=0x492fc30, image=0x46db3c) returned 0x0 [0048.613] GetLastError () returned 0x0 [0048.613] GdipImageForceValidation (image=0x6bd0258) returned 0x0 [0048.614] GetLastError () returned 0x0 [0048.614] GdipGetImageType (image=0x6bd0258, type=0x46db38) returned 0x0 [0048.614] GetLastError () returned 0x0 [0048.614] GdipGetImageRawFormat (image=0x6bd0258, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.614] GetLastError () returned 0x0 [0048.620] GdipLoadImageFromStream (stream=0x492fc10, image=0x46db3c) returned 0x0 [0048.620] GetLastError () returned 0x0 [0048.620] GdipImageForceValidation (image=0x6bcf1f0) returned 0x0 [0048.621] GetLastError () returned 0x0 [0048.621] GdipGetImageType (image=0x6bcf1f0, type=0x46db38) returned 0x0 [0048.621] GetLastError () returned 0x0 [0048.621] GdipGetImageRawFormat (image=0x6bcf1f0, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.621] GetLastError () returned 0x0 [0048.623] GdipLoadImageFromStream (stream=0x492fbf0, image=0x46db3c) returned 0x0 [0048.623] GetLastError () returned 0x0 [0048.624] GdipImageForceValidation (image=0x6bcfbc8) returned 0x0 [0048.624] GetLastError () returned 0x0 [0048.625] GdipGetImageType (image=0x6bcfbc8, type=0x46db38) returned 0x0 [0048.625] GetLastError () returned 0x0 [0048.625] GdipGetImageRawFormat (image=0x6bcfbc8, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.625] GetLastError () returned 0x0 [0048.626] GdipLoadImageFromStream (stream=0x492fbd0, image=0x46db3c) returned 0x0 [0048.627] GetLastError () returned 0x0 [0048.627] GdipImageForceValidation (image=0x6bcff10) returned 0x0 [0048.632] GetLastError () returned 0x0 [0048.632] GdipGetImageType (image=0x6bcff10, type=0x46db38) returned 0x0 [0048.632] GetLastError () returned 0x0 [0048.632] GdipGetImageRawFormat (image=0x6bcff10, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.632] GetLastError () returned 0x0 [0048.634] GdipLoadImageFromStream (stream=0x492fbb0, image=0x46db3c) returned 0x0 [0048.635] GetLastError () returned 0x0 [0048.635] GdipImageForceValidation (image=0x6bd05a0) returned 0x0 [0048.635] GetLastError () returned 0x0 [0048.635] GdipGetImageType (image=0x6bd05a0, type=0x46db38) returned 0x0 [0048.635] GetLastError () returned 0x0 [0048.635] GdipGetImageRawFormat (image=0x6bd05a0, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.635] GetLastError () returned 0x0 [0048.637] GdipLoadImageFromStream (stream=0x492fb90, image=0x46db3c) returned 0x0 [0048.637] GetLastError () returned 0x0 [0048.638] GdipImageForceValidation (image=0x6bce4d0) returned 0x0 [0048.638] GetLastError () returned 0x0 [0048.638] GdipGetImageType (image=0x6bce4d0, type=0x46db38) returned 0x0 [0048.638] GetLastError () returned 0x0 [0048.638] GdipGetImageRawFormat (image=0x6bce4d0, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.638] GetLastError () returned 0x0 [0048.640] GdipLoadImageFromStream (stream=0x492fb70, image=0x46db3c) returned 0x0 [0048.641] GetLastError () returned 0x0 [0048.641] GdipImageForceValidation (image=0x6bd0c30) returned 0x0 [0048.642] GetLastError () returned 0x0 [0048.642] GdipGetImageType (image=0x6bd0c30, type=0x46db38) returned 0x0 [0048.642] GetLastError () returned 0x0 [0048.642] GdipGetImageRawFormat (image=0x6bd0c30, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.642] GetLastError () returned 0x0 [0048.643] GdipLoadImageFromStream (stream=0x492fb50, image=0x46db3c) returned 0x0 [0048.644] GetLastError () returned 0x0 [0048.644] GdipImageForceValidation (image=0x6bd1c98) returned 0x0 [0048.644] GetLastError () returned 0x0 [0048.644] GdipGetImageType (image=0x6bd1c98, type=0x46db38) returned 0x0 [0048.645] GetLastError () returned 0x0 [0048.645] GdipGetImageRawFormat (image=0x6bd1c98, format=0x46daa4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.645] GetLastError () returned 0x0 [0048.701] GdipGetImageWidth (image=0x6b6f260, width=0x46e1e8) returned 0x0 [0048.701] GetLastError () returned 0x0 [0048.701] GdipGetImageHeight (image=0x6b6f260, height=0x46e1e8) returned 0x0 [0048.701] GetLastError () returned 0x0 [0048.705] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0048.705] GetLastError () returned 0x0 [0048.705] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x701200 [0048.706] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x701200 | out: encoders=0x701200) returned 0x0 [0048.706] GetLastError () returned 0x0 [0048.710] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0048.711] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x70137c, Length=0x26 | out: Destination=0x6b2ab8) [0048.715] lstrlenW (lpString="BMP") returned 3 [0048.715] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7013a2, Length=0x8 | out: Destination=0x6b2ab8) [0048.715] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0048.715] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7013aa, Length=0x24 | out: Destination=0x6b2ab8) [0048.715] lstrlenW (lpString="image/bmp") returned 9 [0048.716] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7013ce, Length=0x14 | out: Destination=0x6b2ab8) [0048.716] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0048.716] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7013e6, Length=0x28 | out: Destination=0x6b2ab8) [0048.716] lstrlenW (lpString="JPEG") returned 4 [0048.716] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x70140e, Length=0xa | out: Destination=0x6b2ab8) [0048.716] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0048.716] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701418, Length=0x34 | out: Destination=0x6b2ab8) [0048.716] lstrlenW (lpString="image/jpeg") returned 10 [0048.716] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x70144c, Length=0x16 | out: Destination=0x6b2ab8) [0048.716] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0048.716] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701466, Length=0x26 | out: Destination=0x6b2ab8) [0048.716] lstrlenW (lpString="GIF") returned 3 [0048.716] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x70148c, Length=0x8 | out: Destination=0x6b2ab8) [0048.717] lstrlenW (lpString="*.GIF") returned 5 [0048.717] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701494, Length=0xc | out: Destination=0x6b2ab8) [0048.717] lstrlenW (lpString="image/gif") returned 9 [0048.717] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7014a0, Length=0x14 | out: Destination=0x6b2ab8) [0048.717] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0048.717] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7014cc, Length=0x28 | out: Destination=0x6b2ab8) [0048.717] lstrlenW (lpString="TIFF") returned 4 [0048.717] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7014f4, Length=0xa | out: Destination=0x6b2ab8) [0048.717] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0048.717] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7014fe, Length=0x1a | out: Destination=0x6b2ab8) [0048.717] lstrlenW (lpString="image/tiff") returned 10 [0048.717] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701518, Length=0x16 | out: Destination=0x6b2ab8) [0048.717] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0048.718] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701536, Length=0x26 | out: Destination=0x6b2ab8) [0048.718] lstrlenW (lpString="PNG") returned 3 [0048.718] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x70155c, Length=0x8 | out: Destination=0x6b2ab8) [0048.718] lstrlenW (lpString="*.PNG") returned 5 [0048.718] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701564, Length=0xc | out: Destination=0x6b2ab8) [0048.718] lstrlenW (lpString="image/png") returned 9 [0048.718] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701570, Length=0x14 | out: Destination=0x6b2ab8) [0048.718] LocalFree (hMem=0x701200) returned 0x0 [0048.718] GetLastError () returned 0x7f [0048.726] GdipSaveImageToStream (image=0x6b6f260, stream=0x492fb30, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0048.934] GetLastError () returned 0x0 [0048.935] GdipCreateBitmapFromStream (stream=0x492fb10, bitmap=0x46e1f0) returned 0x0 [0048.936] GetLastError () returned 0x0 [0048.936] GdipImageForceValidation (image=0x6bd0f78) returned 0x0 [0048.937] GetLastError () returned 0x0 [0048.937] GdipGetImageRawFormat (image=0x6bd0f78, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.937] GetLastError () returned 0x0 [0048.938] GdipBitmapLockBits (bitmap=0x6bd0f78, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x267a828) returned 0x0 [0048.938] GetLastError () returned 0x0 [0048.938] GdipBitmapUnlockBits (bitmap=0x6bd0f78, lockedBitmapData=0x267a828) returned 0x0 [0048.938] GetLastError () returned 0x0 [0048.938] GdipGetImageWidth (image=0x6b72cb0, width=0x46e1e8) returned 0x0 [0048.938] GetLastError () returned 0x0 [0048.939] GdipGetImageHeight (image=0x6b72cb0, height=0x46e1e8) returned 0x0 [0048.939] GetLastError () returned 0x0 [0048.939] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0048.939] GetLastError () returned 0x0 [0048.939] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x701200 [0048.939] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x701200 | out: encoders=0x701200) returned 0x0 [0048.939] GetLastError () returned 0x0 [0048.939] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0048.939] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x70137c, Length=0x26 | out: Destination=0x6b2ab8) [0048.939] lstrlenW (lpString="BMP") returned 3 [0048.939] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7013a2, Length=0x8 | out: Destination=0x6b2ab8) [0048.939] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0048.939] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7013aa, Length=0x24 | out: Destination=0x6b2ab8) [0048.939] lstrlenW (lpString="image/bmp") returned 9 [0048.939] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7013ce, Length=0x14 | out: Destination=0x6b2ab8) [0048.940] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0048.940] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7013e6, Length=0x28 | out: Destination=0x6b2ab8) [0048.940] lstrlenW (lpString="JPEG") returned 4 [0048.940] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x70140e, Length=0xa | out: Destination=0x6b2ab8) [0048.940] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0048.940] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701418, Length=0x34 | out: Destination=0x6b2ab8) [0048.940] lstrlenW (lpString="image/jpeg") returned 10 [0048.940] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x70144c, Length=0x16 | out: Destination=0x6b2ab8) [0048.940] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0048.940] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701466, Length=0x26 | out: Destination=0x6b2ab8) [0048.940] lstrlenW (lpString="GIF") returned 3 [0048.940] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x70148c, Length=0x8 | out: Destination=0x6b2ab8) [0048.940] lstrlenW (lpString="*.GIF") returned 5 [0048.940] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701494, Length=0xc | out: Destination=0x6b2ab8) [0048.940] lstrlenW (lpString="image/gif") returned 9 [0048.941] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7014a0, Length=0x14 | out: Destination=0x6b2ab8) [0048.941] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0048.941] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7014cc, Length=0x28 | out: Destination=0x6b2ab8) [0048.941] lstrlenW (lpString="TIFF") returned 4 [0048.941] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7014f4, Length=0xa | out: Destination=0x6b2ab8) [0048.941] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0048.941] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7014fe, Length=0x1a | out: Destination=0x6b2ab8) [0048.941] lstrlenW (lpString="image/tiff") returned 10 [0048.941] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701518, Length=0x16 | out: Destination=0x6b2ab8) [0048.941] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0048.941] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701536, Length=0x26 | out: Destination=0x6b2ab8) [0048.941] lstrlenW (lpString="PNG") returned 3 [0048.941] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x70155c, Length=0x8 | out: Destination=0x6b2ab8) [0048.941] lstrlenW (lpString="*.PNG") returned 5 [0048.941] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701564, Length=0xc | out: Destination=0x6b2ab8) [0048.942] lstrlenW (lpString="image/png") returned 9 [0048.942] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x701570, Length=0x14 | out: Destination=0x6b2ab8) [0048.942] LocalFree (hMem=0x701200) returned 0x0 [0048.942] GetLastError () returned 0x0 [0048.942] GdipSaveImageToStream (image=0x6b72cb0, stream=0x492faf0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0048.949] GetLastError () returned 0x0 [0048.950] GdipCreateBitmapFromStream (stream=0x492fad0, bitmap=0x46e1f0) returned 0x0 [0048.950] GetLastError () returned 0x0 [0048.950] GdipImageForceValidation (image=0x6bd12c0) returned 0x0 [0048.951] GetLastError () returned 0x0 [0048.951] GdipGetImageRawFormat (image=0x6bd12c0, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.951] GetLastError () returned 0x0 [0048.951] GdipBitmapLockBits (bitmap=0x6bd12c0, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26856f0) returned 0x0 [0048.951] GetLastError () returned 0x0 [0048.951] GdipBitmapUnlockBits (bitmap=0x6bd12c0, lockedBitmapData=0x26856f0) returned 0x0 [0048.951] GetLastError () returned 0x0 [0048.951] GdipGetImageWidth (image=0x6b762b8, width=0x46e1e8) returned 0x0 [0048.951] GetLastError () returned 0x0 [0048.951] GdipGetImageHeight (image=0x6b762b8, height=0x46e1e8) returned 0x0 [0048.951] GetLastError () returned 0x0 [0048.951] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0048.951] GetLastError () returned 0x0 [0048.951] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x7582b8 [0048.952] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x7582b8 | out: encoders=0x7582b8) returned 0x0 [0048.952] GetLastError () returned 0x0 [0048.952] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0048.952] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758434, Length=0x26 | out: Destination=0x6b2ab8) [0048.952] lstrlenW (lpString="BMP") returned 3 [0048.952] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75845a, Length=0x8 | out: Destination=0x6b2ab8) [0048.952] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0048.952] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758462, Length=0x24 | out: Destination=0x6b2ab8) [0048.952] lstrlenW (lpString="image/bmp") returned 9 [0048.953] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758486, Length=0x14 | out: Destination=0x6b2ab8) [0048.953] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0048.953] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75849e, Length=0x28 | out: Destination=0x6b2ab8) [0048.953] lstrlenW (lpString="JPEG") returned 4 [0048.953] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584c6, Length=0xa | out: Destination=0x6b2ab8) [0048.953] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0048.953] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584d0, Length=0x34 | out: Destination=0x6b2ab8) [0048.953] lstrlenW (lpString="image/jpeg") returned 10 [0048.953] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758504, Length=0x16 | out: Destination=0x6b2ab8) [0048.953] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0048.953] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75851e, Length=0x26 | out: Destination=0x6b2ab8) [0048.953] lstrlenW (lpString="GIF") returned 3 [0048.953] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758544, Length=0x8 | out: Destination=0x6b2ab8) [0048.953] lstrlenW (lpString="*.GIF") returned 5 [0048.953] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75854c, Length=0xc | out: Destination=0x6b2ab8) [0048.954] lstrlenW (lpString="image/gif") returned 9 [0048.954] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758558, Length=0x14 | out: Destination=0x6b2ab8) [0048.954] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0048.954] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758584, Length=0x28 | out: Destination=0x6b2ab8) [0048.954] lstrlenW (lpString="TIFF") returned 4 [0048.954] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ac, Length=0xa | out: Destination=0x6b2ab8) [0048.954] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0048.954] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585b6, Length=0x1a | out: Destination=0x6b2ab8) [0048.954] lstrlenW (lpString="image/tiff") returned 10 [0048.954] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585d0, Length=0x16 | out: Destination=0x6b2ab8) [0048.954] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0048.954] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ee, Length=0x26 | out: Destination=0x6b2ab8) [0048.954] lstrlenW (lpString="PNG") returned 3 [0048.955] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758614, Length=0x8 | out: Destination=0x6b2ab8) [0048.955] lstrlenW (lpString="*.PNG") returned 5 [0048.955] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75861c, Length=0xc | out: Destination=0x6b2ab8) [0048.955] lstrlenW (lpString="image/png") returned 9 [0048.955] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758628, Length=0x14 | out: Destination=0x6b2ab8) [0048.955] LocalFree (hMem=0x7582b8) returned 0x0 [0048.955] GetLastError () returned 0x0 [0048.955] GdipSaveImageToStream (image=0x6b762b8, stream=0x492fab0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0048.963] GetLastError () returned 0x0 [0048.963] GdipCreateBitmapFromStream (stream=0x492fa90, bitmap=0x46e1f0) returned 0x0 [0048.964] GetLastError () returned 0x0 [0048.964] GdipImageForceValidation (image=0x6bd1608) returned 0x0 [0048.964] GetLastError () returned 0x0 [0048.964] GdipGetImageRawFormat (image=0x6bd1608, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.964] GetLastError () returned 0x0 [0048.964] GdipBitmapLockBits (bitmap=0x6bd1608, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26925a8) returned 0x0 [0048.964] GetLastError () returned 0x0 [0048.965] GdipBitmapUnlockBits (bitmap=0x6bd1608, lockedBitmapData=0x26925a8) returned 0x0 [0048.965] GetLastError () returned 0x0 [0048.965] GdipGetImageWidth (image=0x6b798c0, width=0x46e1e8) returned 0x0 [0048.965] GetLastError () returned 0x0 [0048.965] GdipGetImageHeight (image=0x6b798c0, height=0x46e1e8) returned 0x0 [0048.965] GetLastError () returned 0x0 [0048.965] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0048.965] GetLastError () returned 0x0 [0048.965] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x7575e0 [0048.965] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x7575e0 | out: encoders=0x7575e0) returned 0x0 [0048.965] GetLastError () returned 0x0 [0048.965] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0048.965] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75775c, Length=0x26 | out: Destination=0x6b2ab8) [0048.965] lstrlenW (lpString="BMP") returned 3 [0048.965] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757782, Length=0x8 | out: Destination=0x6b2ab8) [0048.965] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0048.965] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75778a, Length=0x24 | out: Destination=0x6b2ab8) [0048.966] lstrlenW (lpString="image/bmp") returned 9 [0048.966] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7577ae, Length=0x14 | out: Destination=0x6b2ab8) [0048.966] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0048.966] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7577c6, Length=0x28 | out: Destination=0x6b2ab8) [0048.966] lstrlenW (lpString="JPEG") returned 4 [0048.966] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7577ee, Length=0xa | out: Destination=0x6b2ab8) [0048.966] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0048.966] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7577f8, Length=0x34 | out: Destination=0x6b2ab8) [0048.966] lstrlenW (lpString="image/jpeg") returned 10 [0048.966] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75782c, Length=0x16 | out: Destination=0x6b2ab8) [0048.966] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0048.966] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757846, Length=0x26 | out: Destination=0x6b2ab8) [0048.966] lstrlenW (lpString="GIF") returned 3 [0048.966] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75786c, Length=0x8 | out: Destination=0x6b2ab8) [0048.966] lstrlenW (lpString="*.GIF") returned 5 [0048.967] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757874, Length=0xc | out: Destination=0x6b2ab8) [0048.967] lstrlenW (lpString="image/gif") returned 9 [0048.967] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757880, Length=0x14 | out: Destination=0x6b2ab8) [0048.967] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0048.967] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7578ac, Length=0x28 | out: Destination=0x6b2ab8) [0048.967] lstrlenW (lpString="TIFF") returned 4 [0048.967] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7578d4, Length=0xa | out: Destination=0x6b2ab8) [0048.967] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0048.967] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7578de, Length=0x1a | out: Destination=0x6b2ab8) [0048.967] lstrlenW (lpString="image/tiff") returned 10 [0048.967] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7578f8, Length=0x16 | out: Destination=0x6b2ab8) [0048.967] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0048.967] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757916, Length=0x26 | out: Destination=0x6b2ab8) [0048.968] lstrlenW (lpString="PNG") returned 3 [0048.968] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75793c, Length=0x8 | out: Destination=0x6b2ab8) [0048.968] lstrlenW (lpString="*.PNG") returned 5 [0048.968] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757944, Length=0xc | out: Destination=0x6b2ab8) [0048.968] lstrlenW (lpString="image/png") returned 9 [0048.968] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757950, Length=0x14 | out: Destination=0x6b2ab8) [0048.968] LocalFree (hMem=0x7575e0) returned 0x0 [0048.968] GetLastError () returned 0x0 [0048.968] GdipSaveImageToStream (image=0x6b798c0, stream=0x492fa70, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0048.977] GetLastError () returned 0x0 [0048.977] GdipCreateBitmapFromStream (stream=0x492fa50, bitmap=0x46e1f0) returned 0x0 [0048.978] GetLastError () returned 0x0 [0048.978] GdipImageForceValidation (image=0x6bce818) returned 0x0 [0048.978] GetLastError () returned 0x0 [0048.978] GdipGetImageRawFormat (image=0x6bce818, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.978] GetLastError () returned 0x0 [0048.979] GdipBitmapLockBits (bitmap=0x6bce818, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26a3464) returned 0x0 [0048.979] GetLastError () returned 0x0 [0048.979] GdipBitmapUnlockBits (bitmap=0x6bce818, lockedBitmapData=0x26a3464) returned 0x0 [0048.979] GetLastError () returned 0x0 [0048.979] GdipGetImageWidth (image=0x6b7cec8, width=0x46e1e8) returned 0x0 [0048.979] GetLastError () returned 0x0 [0048.979] GdipGetImageHeight (image=0x6b7cec8, height=0x46e1e8) returned 0x0 [0048.979] GetLastError () returned 0x0 [0048.979] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0048.979] GetLastError () returned 0x0 [0048.979] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x758b48 [0048.979] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x758b48 | out: encoders=0x758b48) returned 0x0 [0048.979] GetLastError () returned 0x0 [0048.979] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0048.979] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cc4, Length=0x26 | out: Destination=0x6b2ab8) [0048.979] lstrlenW (lpString="BMP") returned 3 [0048.979] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cea, Length=0x8 | out: Destination=0x6b2ab8) [0048.979] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0048.980] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cf2, Length=0x24 | out: Destination=0x6b2ab8) [0048.980] lstrlenW (lpString="image/bmp") returned 9 [0048.980] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d16, Length=0x14 | out: Destination=0x6b2ab8) [0048.980] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0048.980] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d2e, Length=0x28 | out: Destination=0x6b2ab8) [0048.980] lstrlenW (lpString="JPEG") returned 4 [0048.980] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d56, Length=0xa | out: Destination=0x6b2ab8) [0048.980] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0048.980] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d60, Length=0x34 | out: Destination=0x6b2ab8) [0048.980] lstrlenW (lpString="image/jpeg") returned 10 [0048.980] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d94, Length=0x16 | out: Destination=0x6b2ab8) [0048.980] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0048.980] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758dae, Length=0x26 | out: Destination=0x6b2ab8) [0048.980] lstrlenW (lpString="GIF") returned 3 [0048.981] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758dd4, Length=0x8 | out: Destination=0x6b2ab8) [0048.981] lstrlenW (lpString="*.GIF") returned 5 [0048.981] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758ddc, Length=0xc | out: Destination=0x6b2ab8) [0048.981] lstrlenW (lpString="image/gif") returned 9 [0048.981] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758de8, Length=0x14 | out: Destination=0x6b2ab8) [0048.981] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0048.981] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e14, Length=0x28 | out: Destination=0x6b2ab8) [0048.981] lstrlenW (lpString="TIFF") returned 4 [0048.981] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e3c, Length=0xa | out: Destination=0x6b2ab8) [0048.981] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0048.981] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e46, Length=0x1a | out: Destination=0x6b2ab8) [0048.981] lstrlenW (lpString="image/tiff") returned 10 [0048.981] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e60, Length=0x16 | out: Destination=0x6b2ab8) [0048.981] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0048.982] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e7e, Length=0x26 | out: Destination=0x6b2ab8) [0048.982] lstrlenW (lpString="PNG") returned 3 [0048.982] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758ea4, Length=0x8 | out: Destination=0x6b2ab8) [0048.982] lstrlenW (lpString="*.PNG") returned 5 [0048.982] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758eac, Length=0xc | out: Destination=0x6b2ab8) [0048.982] lstrlenW (lpString="image/png") returned 9 [0048.982] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758eb8, Length=0x14 | out: Destination=0x6b2ab8) [0048.982] LocalFree (hMem=0x758b48) returned 0x0 [0048.982] GetLastError () returned 0x0 [0048.982] GdipSaveImageToStream (image=0x6b7cec8, stream=0x492fa30, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0048.990] GetLastError () returned 0x0 [0048.991] GdipCreateBitmapFromStream (stream=0x492fa10, bitmap=0x46e1f0) returned 0x0 [0048.991] GetLastError () returned 0x0 [0048.991] GdipImageForceValidation (image=0x6bd1950) returned 0x0 [0048.992] GetLastError () returned 0x0 [0048.992] GdipGetImageRawFormat (image=0x6bd1950, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0048.992] GetLastError () returned 0x0 [0048.992] GdipBitmapLockBits (bitmap=0x6bd1950, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26ac324) returned 0x0 [0048.992] GetLastError () returned 0x0 [0048.992] GdipBitmapUnlockBits (bitmap=0x6bd1950, lockedBitmapData=0x26ac324) returned 0x0 [0048.992] GetLastError () returned 0x0 [0048.992] GdipGetImageWidth (image=0x6b804d0, width=0x46e1e8) returned 0x0 [0048.992] GetLastError () returned 0x0 [0048.992] GdipGetImageHeight (image=0x6b804d0, height=0x46e1e8) returned 0x0 [0048.992] GetLastError () returned 0x0 [0048.992] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0048.992] GetLastError () returned 0x0 [0048.992] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x75ad88 [0048.992] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x75ad88 | out: encoders=0x75ad88) returned 0x0 [0048.992] GetLastError () returned 0x0 [0048.993] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0048.993] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af04, Length=0x26 | out: Destination=0x6b2ab8) [0048.993] lstrlenW (lpString="BMP") returned 3 [0048.993] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af2a, Length=0x8 | out: Destination=0x6b2ab8) [0048.993] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0048.993] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af32, Length=0x24 | out: Destination=0x6b2ab8) [0048.993] lstrlenW (lpString="image/bmp") returned 9 [0048.993] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af56, Length=0x14 | out: Destination=0x6b2ab8) [0048.993] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0048.993] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af6e, Length=0x28 | out: Destination=0x6b2ab8) [0048.993] lstrlenW (lpString="JPEG") returned 4 [0048.993] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af96, Length=0xa | out: Destination=0x6b2ab8) [0048.993] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0048.993] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75afa0, Length=0x34 | out: Destination=0x6b2ab8) [0048.993] lstrlenW (lpString="image/jpeg") returned 10 [0048.994] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75afd4, Length=0x16 | out: Destination=0x6b2ab8) [0048.994] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0048.994] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75afee, Length=0x26 | out: Destination=0x6b2ab8) [0048.994] lstrlenW (lpString="GIF") returned 3 [0048.994] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b014, Length=0x8 | out: Destination=0x6b2ab8) [0048.994] lstrlenW (lpString="*.GIF") returned 5 [0048.994] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b01c, Length=0xc | out: Destination=0x6b2ab8) [0048.994] lstrlenW (lpString="image/gif") returned 9 [0048.994] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b028, Length=0x14 | out: Destination=0x6b2ab8) [0048.994] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0048.994] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b054, Length=0x28 | out: Destination=0x6b2ab8) [0048.994] lstrlenW (lpString="TIFF") returned 4 [0048.994] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b07c, Length=0xa | out: Destination=0x6b2ab8) [0048.994] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0048.995] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b086, Length=0x1a | out: Destination=0x6b2ab8) [0048.995] lstrlenW (lpString="image/tiff") returned 10 [0048.995] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0a0, Length=0x16 | out: Destination=0x6b2ab8) [0048.995] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0048.995] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0be, Length=0x26 | out: Destination=0x6b2ab8) [0048.995] lstrlenW (lpString="PNG") returned 3 [0048.995] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0e4, Length=0x8 | out: Destination=0x6b2ab8) [0048.995] lstrlenW (lpString="*.PNG") returned 5 [0048.995] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0ec, Length=0xc | out: Destination=0x6b2ab8) [0048.995] lstrlenW (lpString="image/png") returned 9 [0048.995] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0f8, Length=0x14 | out: Destination=0x6b2ab8) [0048.995] LocalFree (hMem=0x75ad88) returned 0x0 [0048.995] GetLastError () returned 0x0 [0048.996] GdipSaveImageToStream (image=0x6b804d0, stream=0x492f9f0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.003] GetLastError () returned 0x0 [0049.004] GdipCreateBitmapFromStream (stream=0x492f9d0, bitmap=0x46e1f0) returned 0x0 [0049.005] GetLastError () returned 0x0 [0049.005] GdipImageForceValidation (image=0x6c1afb8) returned 0x0 [0049.005] GetLastError () returned 0x0 [0049.005] GdipGetImageRawFormat (image=0x6c1afb8, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.005] GetLastError () returned 0x0 [0049.005] GdipBitmapLockBits (bitmap=0x6c1afb8, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26c51c4) returned 0x0 [0049.005] GetLastError () returned 0x0 [0049.005] GdipBitmapUnlockBits (bitmap=0x6c1afb8, lockedBitmapData=0x26c51c4) returned 0x0 [0049.005] GetLastError () returned 0x0 [0049.006] GdipGetImageWidth (image=0x6b83ad8, width=0x46e1e8) returned 0x0 [0049.006] GetLastError () returned 0x0 [0049.006] GdipGetImageHeight (image=0x6b83ad8, height=0x46e1e8) returned 0x0 [0049.006] GetLastError () returned 0x0 [0049.006] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.006] GetLastError () returned 0x0 [0049.006] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x757e70 [0049.006] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x757e70 | out: encoders=0x757e70) returned 0x0 [0049.006] GetLastError () returned 0x0 [0049.006] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.006] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757fec, Length=0x26 | out: Destination=0x6b2ab8) [0049.006] lstrlenW (lpString="BMP") returned 3 [0049.006] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758012, Length=0x8 | out: Destination=0x6b2ab8) [0049.006] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.006] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75801a, Length=0x24 | out: Destination=0x6b2ab8) [0049.006] lstrlenW (lpString="image/bmp") returned 9 [0049.006] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75803e, Length=0x14 | out: Destination=0x6b2ab8) [0049.007] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.007] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758056, Length=0x28 | out: Destination=0x6b2ab8) [0049.007] lstrlenW (lpString="JPEG") returned 4 [0049.007] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75807e, Length=0xa | out: Destination=0x6b2ab8) [0049.007] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.007] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758088, Length=0x34 | out: Destination=0x6b2ab8) [0049.007] lstrlenW (lpString="image/jpeg") returned 10 [0049.007] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7580bc, Length=0x16 | out: Destination=0x6b2ab8) [0049.007] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.007] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7580d6, Length=0x26 | out: Destination=0x6b2ab8) [0049.007] lstrlenW (lpString="GIF") returned 3 [0049.007] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7580fc, Length=0x8 | out: Destination=0x6b2ab8) [0049.007] lstrlenW (lpString="*.GIF") returned 5 [0049.007] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758104, Length=0xc | out: Destination=0x6b2ab8) [0049.007] lstrlenW (lpString="image/gif") returned 9 [0049.008] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758110, Length=0x14 | out: Destination=0x6b2ab8) [0049.008] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.008] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75813c, Length=0x28 | out: Destination=0x6b2ab8) [0049.008] lstrlenW (lpString="TIFF") returned 4 [0049.008] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758164, Length=0xa | out: Destination=0x6b2ab8) [0049.008] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.008] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75816e, Length=0x1a | out: Destination=0x6b2ab8) [0049.008] lstrlenW (lpString="image/tiff") returned 10 [0049.008] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758188, Length=0x16 | out: Destination=0x6b2ab8) [0049.008] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.008] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7581a6, Length=0x26 | out: Destination=0x6b2ab8) [0049.008] lstrlenW (lpString="PNG") returned 3 [0049.008] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7581cc, Length=0x8 | out: Destination=0x6b2ab8) [0049.008] lstrlenW (lpString="*.PNG") returned 5 [0049.009] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7581d4, Length=0xc | out: Destination=0x6b2ab8) [0049.009] lstrlenW (lpString="image/png") returned 9 [0049.009] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7581e0, Length=0x14 | out: Destination=0x6b2ab8) [0049.009] LocalFree (hMem=0x757e70) returned 0x0 [0049.009] GetLastError () returned 0x0 [0049.009] GdipSaveImageToStream (image=0x6b83ad8, stream=0x492f9b0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.017] GetLastError () returned 0x0 [0049.017] GdipCreateBitmapFromStream (stream=0x492f990, bitmap=0x46e1f0) returned 0x0 [0049.018] GetLastError () returned 0x0 [0049.018] GdipImageForceValidation (image=0x6c19c08) returned 0x0 [0049.018] GetLastError () returned 0x0 [0049.018] GdipGetImageRawFormat (image=0x6c19c08, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.018] GetLastError () returned 0x0 [0049.018] GdipBitmapLockBits (bitmap=0x6c19c08, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26ce078) returned 0x0 [0049.018] GetLastError () returned 0x0 [0049.018] GdipBitmapUnlockBits (bitmap=0x6c19c08, lockedBitmapData=0x26ce078) returned 0x0 [0049.018] GetLastError () returned 0x0 [0049.018] GdipGetImageWidth (image=0x6b870e0, width=0x46e1e8) returned 0x0 [0049.018] GetLastError () returned 0x0 [0049.018] GdipGetImageHeight (image=0x6b870e0, height=0x46e1e8) returned 0x0 [0049.018] GetLastError () returned 0x0 [0049.018] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.018] GetLastError () returned 0x0 [0049.018] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x7582b8 [0049.019] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x7582b8 | out: encoders=0x7582b8) returned 0x0 [0049.019] GetLastError () returned 0x0 [0049.019] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.019] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758434, Length=0x26 | out: Destination=0x6b2ab8) [0049.019] lstrlenW (lpString="BMP") returned 3 [0049.019] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75845a, Length=0x8 | out: Destination=0x6b2ab8) [0049.019] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.019] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758462, Length=0x24 | out: Destination=0x6b2ab8) [0049.019] lstrlenW (lpString="image/bmp") returned 9 [0049.019] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758486, Length=0x14 | out: Destination=0x6b2ab8) [0049.019] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.019] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75849e, Length=0x28 | out: Destination=0x6b2ab8) [0049.019] lstrlenW (lpString="JPEG") returned 4 [0049.019] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584c6, Length=0xa | out: Destination=0x6b2ab8) [0049.020] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.020] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584d0, Length=0x34 | out: Destination=0x6b2ab8) [0049.020] lstrlenW (lpString="image/jpeg") returned 10 [0049.020] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758504, Length=0x16 | out: Destination=0x6b2ab8) [0049.020] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.020] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75851e, Length=0x26 | out: Destination=0x6b2ab8) [0049.021] lstrlenW (lpString="GIF") returned 3 [0049.021] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758544, Length=0x8 | out: Destination=0x6b2ab8) [0049.021] lstrlenW (lpString="*.GIF") returned 5 [0049.021] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75854c, Length=0xc | out: Destination=0x6b2ab8) [0049.021] lstrlenW (lpString="image/gif") returned 9 [0049.021] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758558, Length=0x14 | out: Destination=0x6b2ab8) [0049.021] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.021] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758584, Length=0x28 | out: Destination=0x6b2ab8) [0049.021] lstrlenW (lpString="TIFF") returned 4 [0049.021] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ac, Length=0xa | out: Destination=0x6b2ab8) [0049.021] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.021] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585b6, Length=0x1a | out: Destination=0x6b2ab8) [0049.021] lstrlenW (lpString="image/tiff") returned 10 [0049.021] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585d0, Length=0x16 | out: Destination=0x6b2ab8) [0049.022] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.022] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ee, Length=0x26 | out: Destination=0x6b2ab8) [0049.022] lstrlenW (lpString="PNG") returned 3 [0049.022] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758614, Length=0x8 | out: Destination=0x6b2ab8) [0049.022] lstrlenW (lpString="*.PNG") returned 5 [0049.022] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75861c, Length=0xc | out: Destination=0x6b2ab8) [0049.022] lstrlenW (lpString="image/png") returned 9 [0049.022] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758628, Length=0x14 | out: Destination=0x6b2ab8) [0049.022] LocalFree (hMem=0x7582b8) returned 0x0 [0049.022] GetLastError () returned 0x0 [0049.023] GdipSaveImageToStream (image=0x6b870e0, stream=0x492f970, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.030] GetLastError () returned 0x0 [0049.031] GdipCreateBitmapFromStream (stream=0x492f950, bitmap=0x46e1f0) returned 0x0 [0049.031] GetLastError () returned 0x0 [0049.031] GdipImageForceValidation (image=0x6c1b990) returned 0x0 [0049.032] GetLastError () returned 0x0 [0049.032] GdipGetImageRawFormat (image=0x6c1b990, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.032] GetLastError () returned 0x0 [0049.032] GdipBitmapLockBits (bitmap=0x6c1b990, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26d6f2c) returned 0x0 [0049.032] GetLastError () returned 0x0 [0049.032] GdipBitmapUnlockBits (bitmap=0x6c1b990, lockedBitmapData=0x26d6f2c) returned 0x0 [0049.032] GetLastError () returned 0x0 [0049.032] GdipGetImageWidth (image=0x6b8a6e8, width=0x46e1e8) returned 0x0 [0049.032] GetLastError () returned 0x0 [0049.032] GdipGetImageHeight (image=0x6b8a6e8, height=0x46e1e8) returned 0x0 [0049.032] GetLastError () returned 0x0 [0049.032] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.032] GetLastError () returned 0x0 [0049.032] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x7582b8 [0049.033] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x7582b8 | out: encoders=0x7582b8) returned 0x0 [0049.033] GetLastError () returned 0x0 [0049.033] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.033] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758434, Length=0x26 | out: Destination=0x6b2ab8) [0049.033] lstrlenW (lpString="BMP") returned 3 [0049.033] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75845a, Length=0x8 | out: Destination=0x6b2ab8) [0049.033] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.033] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758462, Length=0x24 | out: Destination=0x6b2ab8) [0049.033] lstrlenW (lpString="image/bmp") returned 9 [0049.033] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758486, Length=0x14 | out: Destination=0x6b2ab8) [0049.033] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.033] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75849e, Length=0x28 | out: Destination=0x6b2ab8) [0049.033] lstrlenW (lpString="JPEG") returned 4 [0049.033] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584c6, Length=0xa | out: Destination=0x6b2ab8) [0049.034] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.034] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584d0, Length=0x34 | out: Destination=0x6b2ab8) [0049.034] lstrlenW (lpString="image/jpeg") returned 10 [0049.034] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758504, Length=0x16 | out: Destination=0x6b2ab8) [0049.034] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.034] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75851e, Length=0x26 | out: Destination=0x6b2ab8) [0049.034] lstrlenW (lpString="GIF") returned 3 [0049.034] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758544, Length=0x8 | out: Destination=0x6b2ab8) [0049.034] lstrlenW (lpString="*.GIF") returned 5 [0049.034] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75854c, Length=0xc | out: Destination=0x6b2ab8) [0049.034] lstrlenW (lpString="image/gif") returned 9 [0049.034] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758558, Length=0x14 | out: Destination=0x6b2ab8) [0049.034] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.034] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758584, Length=0x28 | out: Destination=0x6b2ab8) [0049.035] lstrlenW (lpString="TIFF") returned 4 [0049.035] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ac, Length=0xa | out: Destination=0x6b2ab8) [0049.035] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.035] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585b6, Length=0x1a | out: Destination=0x6b2ab8) [0049.035] lstrlenW (lpString="image/tiff") returned 10 [0049.035] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585d0, Length=0x16 | out: Destination=0x6b2ab8) [0049.035] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.035] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ee, Length=0x26 | out: Destination=0x6b2ab8) [0049.035] lstrlenW (lpString="PNG") returned 3 [0049.035] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758614, Length=0x8 | out: Destination=0x6b2ab8) [0049.035] lstrlenW (lpString="*.PNG") returned 5 [0049.035] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75861c, Length=0xc | out: Destination=0x6b2ab8) [0049.035] lstrlenW (lpString="image/png") returned 9 [0049.035] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758628, Length=0x14 | out: Destination=0x6b2ab8) [0049.035] LocalFree (hMem=0x7582b8) returned 0x0 [0049.036] GetLastError () returned 0x0 [0049.036] GdipSaveImageToStream (image=0x6b8a6e8, stream=0x492f930, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.045] GetLastError () returned 0x0 [0049.045] GdipCreateBitmapFromStream (stream=0x492f910, bitmap=0x46e1f0) returned 0x0 [0049.046] GetLastError () returned 0x0 [0049.046] GdipImageForceValidation (image=0x6c1a5e0) returned 0x0 [0049.048] GetLastError () returned 0x0 [0049.048] GdipGetImageRawFormat (image=0x6c1a5e0, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.048] GetLastError () returned 0x0 [0049.048] GdipBitmapLockBits (bitmap=0x6c1a5e0, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26dfde0) returned 0x0 [0049.048] GetLastError () returned 0x0 [0049.048] GdipBitmapUnlockBits (bitmap=0x6c1a5e0, lockedBitmapData=0x26dfde0) returned 0x0 [0049.048] GetLastError () returned 0x0 [0049.048] GdipGetImageWidth (image=0x6b8dcf0, width=0x46e1e8) returned 0x0 [0049.048] GetLastError () returned 0x0 [0049.048] GdipGetImageHeight (image=0x6b8dcf0, height=0x46e1e8) returned 0x0 [0049.048] GetLastError () returned 0x0 [0049.049] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.049] GetLastError () returned 0x0 [0049.049] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x75a4f8 [0049.049] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x75a4f8 | out: encoders=0x75a4f8) returned 0x0 [0049.049] GetLastError () returned 0x0 [0049.049] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.049] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a674, Length=0x26 | out: Destination=0x6b2ab8) [0049.049] lstrlenW (lpString="BMP") returned 3 [0049.049] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a69a, Length=0x8 | out: Destination=0x6b2ab8) [0049.049] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.049] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a6a2, Length=0x24 | out: Destination=0x6b2ab8) [0049.049] lstrlenW (lpString="image/bmp") returned 9 [0049.049] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a6c6, Length=0x14 | out: Destination=0x6b2ab8) [0049.049] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.049] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a6de, Length=0x28 | out: Destination=0x6b2ab8) [0049.050] lstrlenW (lpString="JPEG") returned 4 [0049.050] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a706, Length=0xa | out: Destination=0x6b2ab8) [0049.050] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.050] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a710, Length=0x34 | out: Destination=0x6b2ab8) [0049.050] lstrlenW (lpString="image/jpeg") returned 10 [0049.050] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a744, Length=0x16 | out: Destination=0x6b2ab8) [0049.050] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.050] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a75e, Length=0x26 | out: Destination=0x6b2ab8) [0049.050] lstrlenW (lpString="GIF") returned 3 [0049.050] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a784, Length=0x8 | out: Destination=0x6b2ab8) [0049.050] lstrlenW (lpString="*.GIF") returned 5 [0049.050] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a78c, Length=0xc | out: Destination=0x6b2ab8) [0049.050] lstrlenW (lpString="image/gif") returned 9 [0049.050] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a798, Length=0x14 | out: Destination=0x6b2ab8) [0049.051] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.051] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a7c4, Length=0x28 | out: Destination=0x6b2ab8) [0049.051] lstrlenW (lpString="TIFF") returned 4 [0049.051] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a7ec, Length=0xa | out: Destination=0x6b2ab8) [0049.051] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.051] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a7f6, Length=0x1a | out: Destination=0x6b2ab8) [0049.051] lstrlenW (lpString="image/tiff") returned 10 [0049.051] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a810, Length=0x16 | out: Destination=0x6b2ab8) [0049.051] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.051] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a82e, Length=0x26 | out: Destination=0x6b2ab8) [0049.052] lstrlenW (lpString="PNG") returned 3 [0049.052] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a854, Length=0x8 | out: Destination=0x6b2ab8) [0049.052] lstrlenW (lpString="*.PNG") returned 5 [0049.052] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a85c, Length=0xc | out: Destination=0x6b2ab8) [0049.052] lstrlenW (lpString="image/png") returned 9 [0049.052] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a868, Length=0x14 | out: Destination=0x6b2ab8) [0049.052] LocalFree (hMem=0x75a4f8) returned 0x0 [0049.052] GetLastError () returned 0x0 [0049.052] GdipSaveImageToStream (image=0x6b8dcf0, stream=0x492f8f0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.061] GetLastError () returned 0x0 [0049.061] GdipCreateBitmapFromStream (stream=0x492f8d0, bitmap=0x46e1f0) returned 0x0 [0049.062] GetLastError () returned 0x0 [0049.062] GdipImageForceValidation (image=0x6c1b300) returned 0x0 [0049.062] GetLastError () returned 0x0 [0049.062] GdipGetImageRawFormat (image=0x6c1b300, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.062] GetLastError () returned 0x0 [0049.062] GdipBitmapLockBits (bitmap=0x6c1b300, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26e8ca0) returned 0x0 [0049.062] GetLastError () returned 0x0 [0049.062] GdipBitmapUnlockBits (bitmap=0x6c1b300, lockedBitmapData=0x26e8ca0) returned 0x0 [0049.062] GetLastError () returned 0x0 [0049.062] GdipGetImageWidth (image=0x6b912f8, width=0x46e1e8) returned 0x0 [0049.063] GetLastError () returned 0x0 [0049.063] GdipGetImageHeight (image=0x6b912f8, height=0x46e1e8) returned 0x0 [0049.063] GetLastError () returned 0x0 [0049.063] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.063] GetLastError () returned 0x0 [0049.063] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x758f90 [0049.063] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x758f90 | out: encoders=0x758f90) returned 0x0 [0049.063] GetLastError () returned 0x0 [0049.063] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.063] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75910c, Length=0x26 | out: Destination=0x6b2ab8) [0049.063] lstrlenW (lpString="BMP") returned 3 [0049.063] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759132, Length=0x8 | out: Destination=0x6b2ab8) [0049.063] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.063] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75913a, Length=0x24 | out: Destination=0x6b2ab8) [0049.063] lstrlenW (lpString="image/bmp") returned 9 [0049.063] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75915e, Length=0x14 | out: Destination=0x6b2ab8) [0049.064] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.064] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759176, Length=0x28 | out: Destination=0x6b2ab8) [0049.064] lstrlenW (lpString="JPEG") returned 4 [0049.064] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75919e, Length=0xa | out: Destination=0x6b2ab8) [0049.064] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.064] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7591a8, Length=0x34 | out: Destination=0x6b2ab8) [0049.064] lstrlenW (lpString="image/jpeg") returned 10 [0049.064] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7591dc, Length=0x16 | out: Destination=0x6b2ab8) [0049.064] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.064] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7591f6, Length=0x26 | out: Destination=0x6b2ab8) [0049.064] lstrlenW (lpString="GIF") returned 3 [0049.064] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75921c, Length=0x8 | out: Destination=0x6b2ab8) [0049.064] lstrlenW (lpString="*.GIF") returned 5 [0049.064] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759224, Length=0xc | out: Destination=0x6b2ab8) [0049.065] lstrlenW (lpString="image/gif") returned 9 [0049.065] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759230, Length=0x14 | out: Destination=0x6b2ab8) [0049.065] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.065] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75925c, Length=0x28 | out: Destination=0x6b2ab8) [0049.065] lstrlenW (lpString="TIFF") returned 4 [0049.065] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759284, Length=0xa | out: Destination=0x6b2ab8) [0049.065] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.065] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75928e, Length=0x1a | out: Destination=0x6b2ab8) [0049.065] lstrlenW (lpString="image/tiff") returned 10 [0049.065] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7592a8, Length=0x16 | out: Destination=0x6b2ab8) [0049.065] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.065] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7592c6, Length=0x26 | out: Destination=0x6b2ab8) [0049.065] lstrlenW (lpString="PNG") returned 3 [0049.065] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7592ec, Length=0x8 | out: Destination=0x6b2ab8) [0049.066] lstrlenW (lpString="*.PNG") returned 5 [0049.066] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7592f4, Length=0xc | out: Destination=0x6b2ab8) [0049.066] lstrlenW (lpString="image/png") returned 9 [0049.066] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759300, Length=0x14 | out: Destination=0x6b2ab8) [0049.066] LocalFree (hMem=0x758f90) returned 0x0 [0049.066] GetLastError () returned 0x0 [0049.066] GdipSaveImageToStream (image=0x6b912f8, stream=0x492f8b0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.074] GetLastError () returned 0x0 [0049.074] GdipCreateBitmapFromStream (stream=0x492f890, bitmap=0x46e1f0) returned 0x0 [0049.075] GetLastError () returned 0x0 [0049.075] GdipImageForceValidation (image=0x6c1c368) returned 0x0 [0049.076] GetLastError () returned 0x0 [0049.076] GdipGetImageRawFormat (image=0x6c1c368, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.076] GetLastError () returned 0x0 [0049.076] GdipBitmapLockBits (bitmap=0x6c1c368, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26f1b54) returned 0x0 [0049.076] GetLastError () returned 0x0 [0049.076] GdipBitmapUnlockBits (bitmap=0x6c1c368, lockedBitmapData=0x26f1b54) returned 0x0 [0049.076] GetLastError () returned 0x0 [0049.076] GdipGetImageWidth (image=0x6b94900, width=0x46e1e8) returned 0x0 [0049.077] GetLastError () returned 0x0 [0049.077] GdipGetImageHeight (image=0x6b94900, height=0x46e1e8) returned 0x0 [0049.077] GetLastError () returned 0x0 [0049.077] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.077] GetLastError () returned 0x0 [0049.077] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x758b48 [0049.077] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x758b48 | out: encoders=0x758b48) returned 0x0 [0049.077] GetLastError () returned 0x0 [0049.077] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.077] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cc4, Length=0x26 | out: Destination=0x6b2ab8) [0049.077] lstrlenW (lpString="BMP") returned 3 [0049.077] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cea, Length=0x8 | out: Destination=0x6b2ab8) [0049.077] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.077] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cf2, Length=0x24 | out: Destination=0x6b2ab8) [0049.077] lstrlenW (lpString="image/bmp") returned 9 [0049.077] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d16, Length=0x14 | out: Destination=0x6b2ab8) [0049.078] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.078] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d2e, Length=0x28 | out: Destination=0x6b2ab8) [0049.078] lstrlenW (lpString="JPEG") returned 4 [0049.078] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d56, Length=0xa | out: Destination=0x6b2ab8) [0049.078] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.078] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d60, Length=0x34 | out: Destination=0x6b2ab8) [0049.078] lstrlenW (lpString="image/jpeg") returned 10 [0049.078] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d94, Length=0x16 | out: Destination=0x6b2ab8) [0049.078] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.078] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758dae, Length=0x26 | out: Destination=0x6b2ab8) [0049.078] lstrlenW (lpString="GIF") returned 3 [0049.078] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758dd4, Length=0x8 | out: Destination=0x6b2ab8) [0049.078] lstrlenW (lpString="*.GIF") returned 5 [0049.078] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758ddc, Length=0xc | out: Destination=0x6b2ab8) [0049.079] lstrlenW (lpString="image/gif") returned 9 [0049.079] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758de8, Length=0x14 | out: Destination=0x6b2ab8) [0049.079] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.079] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e14, Length=0x28 | out: Destination=0x6b2ab8) [0049.079] lstrlenW (lpString="TIFF") returned 4 [0049.079] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e3c, Length=0xa | out: Destination=0x6b2ab8) [0049.079] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.079] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e46, Length=0x1a | out: Destination=0x6b2ab8) [0049.079] lstrlenW (lpString="image/tiff") returned 10 [0049.079] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e60, Length=0x16 | out: Destination=0x6b2ab8) [0049.079] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.079] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e7e, Length=0x26 | out: Destination=0x6b2ab8) [0049.079] lstrlenW (lpString="PNG") returned 3 [0049.080] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758ea4, Length=0x8 | out: Destination=0x6b2ab8) [0049.080] lstrlenW (lpString="*.PNG") returned 5 [0049.080] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758eac, Length=0xc | out: Destination=0x6b2ab8) [0049.080] lstrlenW (lpString="image/png") returned 9 [0049.080] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758eb8, Length=0x14 | out: Destination=0x6b2ab8) [0049.080] LocalFree (hMem=0x758b48) returned 0x0 [0049.080] GetLastError () returned 0x0 [0049.080] GdipSaveImageToStream (image=0x6b94900, stream=0x492f870, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.090] GetLastError () returned 0x0 [0049.090] GdipCreateBitmapFromStream (stream=0x492f850, bitmap=0x46e1f0) returned 0x0 [0049.091] GetLastError () returned 0x0 [0049.091] GdipImageForceValidation (image=0x6c19f50) returned 0x0 [0049.092] GetLastError () returned 0x0 [0049.092] GdipGetImageRawFormat (image=0x6c19f50, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.092] GetLastError () returned 0x0 [0049.092] GdipBitmapLockBits (bitmap=0x6c19f50, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26faa14) returned 0x0 [0049.092] GetLastError () returned 0x0 [0049.092] GdipBitmapUnlockBits (bitmap=0x6c19f50, lockedBitmapData=0x26faa14) returned 0x0 [0049.092] GetLastError () returned 0x0 [0049.092] GdipGetImageWidth (image=0x6b97f08, width=0x46e1e8) returned 0x0 [0049.092] GetLastError () returned 0x0 [0049.092] GdipGetImageHeight (image=0x6b97f08, height=0x46e1e8) returned 0x0 [0049.092] GetLastError () returned 0x0 [0049.092] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.092] GetLastError () returned 0x0 [0049.092] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x758700 [0049.092] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x758700 | out: encoders=0x758700) returned 0x0 [0049.092] GetLastError () returned 0x0 [0049.093] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.093] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75887c, Length=0x26 | out: Destination=0x6b2ab8) [0049.093] lstrlenW (lpString="BMP") returned 3 [0049.093] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7588a2, Length=0x8 | out: Destination=0x6b2ab8) [0049.093] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.093] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7588aa, Length=0x24 | out: Destination=0x6b2ab8) [0049.093] lstrlenW (lpString="image/bmp") returned 9 [0049.093] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7588ce, Length=0x14 | out: Destination=0x6b2ab8) [0049.093] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.093] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7588e6, Length=0x28 | out: Destination=0x6b2ab8) [0049.093] lstrlenW (lpString="JPEG") returned 4 [0049.093] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75890e, Length=0xa | out: Destination=0x6b2ab8) [0049.093] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758918, Length=0x34 | out: Destination=0x6b2ab8) [0049.093] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75894c, Length=0x16 | out: Destination=0x6b2ab8) [0049.094] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.094] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758966, Length=0x26 | out: Destination=0x6b2ab8) [0049.094] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75898c, Length=0x8 | out: Destination=0x6b2ab8) [0049.094] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758994, Length=0xc | out: Destination=0x6b2ab8) [0049.094] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7589a0, Length=0x14 | out: Destination=0x6b2ab8) [0049.094] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.094] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7589cc, Length=0x28 | out: Destination=0x6b2ab8) [0049.094] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7589f4, Length=0xa | out: Destination=0x6b2ab8) [0049.094] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7589fe, Length=0x1a | out: Destination=0x6b2ab8) [0049.094] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758a18, Length=0x16 | out: Destination=0x6b2ab8) [0049.094] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.094] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758a36, Length=0x26 | out: Destination=0x6b2ab8) [0049.094] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758a5c, Length=0x8 | out: Destination=0x6b2ab8) [0049.095] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758a64, Length=0xc | out: Destination=0x6b2ab8) [0049.095] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758a70, Length=0x14 | out: Destination=0x6b2ab8) [0049.095] LocalFree (hMem=0x758700) returned 0x0 [0049.095] GetLastError () returned 0x0 [0049.095] GdipSaveImageToStream (image=0x6b97f08, stream=0x492f830, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.106] GetLastError () returned 0x0 [0049.107] GdipCreateBitmapFromStream (stream=0x492f810, bitmap=0x46e1f0) returned 0x0 [0049.108] GetLastError () returned 0x0 [0049.108] GdipImageForceValidation (image=0x6c1a298) returned 0x0 [0049.108] GetLastError () returned 0x0 [0049.108] GdipGetImageRawFormat (image=0x6c1a298, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.109] GetLastError () returned 0x0 [0049.109] GdipBitmapLockBits (bitmap=0x6c1a298, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x27038d4) returned 0x0 [0049.109] GetLastError () returned 0x0 [0049.109] GdipBitmapUnlockBits (bitmap=0x6c1a298, lockedBitmapData=0x27038d4) returned 0x0 [0049.109] GetLastError () returned 0x0 [0049.109] GdipGetImageWidth (image=0x6b9b510, width=0x46e1e8) returned 0x0 [0049.109] GetLastError () returned 0x0 [0049.109] GdipGetImageHeight (image=0x6b9b510, height=0x46e1e8) returned 0x0 [0049.109] GetLastError () returned 0x0 [0049.109] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.109] GetLastError () returned 0x0 [0049.109] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x758b48 [0049.109] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x758b48 | out: encoders=0x758b48) returned 0x0 [0049.110] GetLastError () returned 0x0 [0049.110] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.110] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cc4, Length=0x26 | out: Destination=0x6b2ab8) [0049.110] lstrlenW (lpString="BMP") returned 3 [0049.110] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cea, Length=0x8 | out: Destination=0x6b2ab8) [0049.110] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.110] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cf2, Length=0x24 | out: Destination=0x6b2ab8) [0049.110] lstrlenW (lpString="image/bmp") returned 9 [0049.110] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d16, Length=0x14 | out: Destination=0x6b2ab8) [0049.110] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.110] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d2e, Length=0x28 | out: Destination=0x6b2ab8) [0049.110] lstrlenW (lpString="JPEG") returned 4 [0049.110] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d56, Length=0xa | out: Destination=0x6b2ab8) [0049.110] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.111] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d60, Length=0x34 | out: Destination=0x6b2ab8) [0049.111] lstrlenW (lpString="image/jpeg") returned 10 [0049.111] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d94, Length=0x16 | out: Destination=0x6b2ab8) [0049.111] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.111] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758dae, Length=0x26 | out: Destination=0x6b2ab8) [0049.111] lstrlenW (lpString="GIF") returned 3 [0049.111] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758dd4, Length=0x8 | out: Destination=0x6b2ab8) [0049.111] lstrlenW (lpString="*.GIF") returned 5 [0049.111] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758ddc, Length=0xc | out: Destination=0x6b2ab8) [0049.111] lstrlenW (lpString="image/gif") returned 9 [0049.111] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758de8, Length=0x14 | out: Destination=0x6b2ab8) [0049.111] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.111] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e14, Length=0x28 | out: Destination=0x6b2ab8) [0049.111] lstrlenW (lpString="TIFF") returned 4 [0049.112] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e3c, Length=0xa | out: Destination=0x6b2ab8) [0049.112] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.112] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e46, Length=0x1a | out: Destination=0x6b2ab8) [0049.112] lstrlenW (lpString="image/tiff") returned 10 [0049.112] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e60, Length=0x16 | out: Destination=0x6b2ab8) [0049.112] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.112] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e7e, Length=0x26 | out: Destination=0x6b2ab8) [0049.112] lstrlenW (lpString="PNG") returned 3 [0049.112] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758ea4, Length=0x8 | out: Destination=0x6b2ab8) [0049.112] lstrlenW (lpString="*.PNG") returned 5 [0049.112] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758eac, Length=0xc | out: Destination=0x6b2ab8) [0049.112] lstrlenW (lpString="image/png") returned 9 [0049.112] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758eb8, Length=0x14 | out: Destination=0x6b2ab8) [0049.112] LocalFree (hMem=0x758b48) returned 0x0 [0049.112] GetLastError () returned 0x0 [0049.113] GdipSaveImageToStream (image=0x6b9b510, stream=0x492f7f0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.121] GetLastError () returned 0x0 [0049.122] GdipCreateBitmapFromStream (stream=0x492f7d0, bitmap=0x46e1f0) returned 0x0 [0049.123] GetLastError () returned 0x0 [0049.123] GdipImageForceValidation (image=0x6c1ac70) returned 0x0 [0049.123] GetLastError () returned 0x0 [0049.123] GdipGetImageRawFormat (image=0x6c1ac70, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.123] GetLastError () returned 0x0 [0049.123] GdipBitmapLockBits (bitmap=0x6c1ac70, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x270c788) returned 0x0 [0049.123] GetLastError () returned 0x0 [0049.123] GdipBitmapUnlockBits (bitmap=0x6c1ac70, lockedBitmapData=0x270c788) returned 0x0 [0049.123] GetLastError () returned 0x0 [0049.123] GdipGetImageWidth (image=0x6b9eb18, width=0x46e1e8) returned 0x0 [0049.123] GetLastError () returned 0x0 [0049.123] GdipGetImageHeight (image=0x6b9eb18, height=0x46e1e8) returned 0x0 [0049.124] GetLastError () returned 0x0 [0049.124] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.124] GetLastError () returned 0x0 [0049.124] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x7575e0 [0049.124] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x7575e0 | out: encoders=0x7575e0) returned 0x0 [0049.124] GetLastError () returned 0x0 [0049.124] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.124] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75775c, Length=0x26 | out: Destination=0x6b2ab8) [0049.124] lstrlenW (lpString="BMP") returned 3 [0049.124] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757782, Length=0x8 | out: Destination=0x6b2ab8) [0049.124] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.124] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75778a, Length=0x24 | out: Destination=0x6b2ab8) [0049.124] lstrlenW (lpString="image/bmp") returned 9 [0049.125] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7577ae, Length=0x14 | out: Destination=0x6b2ab8) [0049.125] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.125] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7577c6, Length=0x28 | out: Destination=0x6b2ab8) [0049.125] lstrlenW (lpString="JPEG") returned 4 [0049.125] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7577ee, Length=0xa | out: Destination=0x6b2ab8) [0049.125] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.125] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7577f8, Length=0x34 | out: Destination=0x6b2ab8) [0049.125] lstrlenW (lpString="image/jpeg") returned 10 [0049.125] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75782c, Length=0x16 | out: Destination=0x6b2ab8) [0049.125] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.125] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757846, Length=0x26 | out: Destination=0x6b2ab8) [0049.125] lstrlenW (lpString="GIF") returned 3 [0049.125] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75786c, Length=0x8 | out: Destination=0x6b2ab8) [0049.125] lstrlenW (lpString="*.GIF") returned 5 [0049.126] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757874, Length=0xc | out: Destination=0x6b2ab8) [0049.126] lstrlenW (lpString="image/gif") returned 9 [0049.126] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757880, Length=0x14 | out: Destination=0x6b2ab8) [0049.126] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.126] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7578ac, Length=0x28 | out: Destination=0x6b2ab8) [0049.126] lstrlenW (lpString="TIFF") returned 4 [0049.126] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7578d4, Length=0xa | out: Destination=0x6b2ab8) [0049.126] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.126] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7578de, Length=0x1a | out: Destination=0x6b2ab8) [0049.126] lstrlenW (lpString="image/tiff") returned 10 [0049.126] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7578f8, Length=0x16 | out: Destination=0x6b2ab8) [0049.126] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.126] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757916, Length=0x26 | out: Destination=0x6b2ab8) [0049.126] lstrlenW (lpString="PNG") returned 3 [0049.127] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75793c, Length=0x8 | out: Destination=0x6b2ab8) [0049.127] lstrlenW (lpString="*.PNG") returned 5 [0049.127] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757944, Length=0xc | out: Destination=0x6b2ab8) [0049.127] lstrlenW (lpString="image/png") returned 9 [0049.127] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757950, Length=0x14 | out: Destination=0x6b2ab8) [0049.127] LocalFree (hMem=0x7575e0) returned 0x0 [0049.127] GetLastError () returned 0x0 [0049.127] GdipSaveImageToStream (image=0x6b9eb18, stream=0x492f7b0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.136] GetLastError () returned 0x0 [0049.137] GdipCreateBitmapFromStream (stream=0x492f790, bitmap=0x46e1f0) returned 0x0 [0049.137] GetLastError () returned 0x0 [0049.137] GdipImageForceValidation (image=0x6c1b648) returned 0x0 [0049.138] GetLastError () returned 0x0 [0049.138] GdipGetImageRawFormat (image=0x6c1b648, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.138] GetLastError () returned 0x0 [0049.138] GdipBitmapLockBits (bitmap=0x6c1b648, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x2715648) returned 0x0 [0049.138] GetLastError () returned 0x0 [0049.138] GdipBitmapUnlockBits (bitmap=0x6c1b648, lockedBitmapData=0x2715648) returned 0x0 [0049.138] GetLastError () returned 0x0 [0049.138] GdipGetImageWidth (image=0x6ba2120, width=0x46e1e8) returned 0x0 [0049.138] GetLastError () returned 0x0 [0049.138] GdipGetImageHeight (image=0x6ba2120, height=0x46e1e8) returned 0x0 [0049.138] GetLastError () returned 0x0 [0049.138] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.138] GetLastError () returned 0x0 [0049.138] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x7582b8 [0049.138] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x7582b8 | out: encoders=0x7582b8) returned 0x0 [0049.138] GetLastError () returned 0x0 [0049.139] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.139] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758434, Length=0x26 | out: Destination=0x6b2ab8) [0049.139] lstrlenW (lpString="BMP") returned 3 [0049.139] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75845a, Length=0x8 | out: Destination=0x6b2ab8) [0049.139] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.139] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758462, Length=0x24 | out: Destination=0x6b2ab8) [0049.139] lstrlenW (lpString="image/bmp") returned 9 [0049.139] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758486, Length=0x14 | out: Destination=0x6b2ab8) [0049.139] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.139] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75849e, Length=0x28 | out: Destination=0x6b2ab8) [0049.139] lstrlenW (lpString="JPEG") returned 4 [0049.139] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584c6, Length=0xa | out: Destination=0x6b2ab8) [0049.139] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.139] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584d0, Length=0x34 | out: Destination=0x6b2ab8) [0049.139] lstrlenW (lpString="image/jpeg") returned 10 [0049.140] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758504, Length=0x16 | out: Destination=0x6b2ab8) [0049.140] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.140] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75851e, Length=0x26 | out: Destination=0x6b2ab8) [0049.140] lstrlenW (lpString="GIF") returned 3 [0049.140] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758544, Length=0x8 | out: Destination=0x6b2ab8) [0049.140] lstrlenW (lpString="*.GIF") returned 5 [0049.140] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75854c, Length=0xc | out: Destination=0x6b2ab8) [0049.140] lstrlenW (lpString="image/gif") returned 9 [0049.140] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758558, Length=0x14 | out: Destination=0x6b2ab8) [0049.140] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.140] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758584, Length=0x28 | out: Destination=0x6b2ab8) [0049.140] lstrlenW (lpString="TIFF") returned 4 [0049.140] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ac, Length=0xa | out: Destination=0x6b2ab8) [0049.140] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.141] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585b6, Length=0x1a | out: Destination=0x6b2ab8) [0049.141] lstrlenW (lpString="image/tiff") returned 10 [0049.141] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585d0, Length=0x16 | out: Destination=0x6b2ab8) [0049.141] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.141] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ee, Length=0x26 | out: Destination=0x6b2ab8) [0049.141] lstrlenW (lpString="PNG") returned 3 [0049.141] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758614, Length=0x8 | out: Destination=0x6b2ab8) [0049.141] lstrlenW (lpString="*.PNG") returned 5 [0049.141] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75861c, Length=0xc | out: Destination=0x6b2ab8) [0049.141] lstrlenW (lpString="image/png") returned 9 [0049.141] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758628, Length=0x14 | out: Destination=0x6b2ab8) [0049.141] LocalFree (hMem=0x7582b8) returned 0x0 [0049.141] GetLastError () returned 0x0 [0049.142] GdipSaveImageToStream (image=0x6ba2120, stream=0x492f770, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.150] GetLastError () returned 0x0 [0049.151] GdipCreateBitmapFromStream (stream=0x492f750, bitmap=0x46e1f0) returned 0x0 [0049.151] GetLastError () returned 0x0 [0049.151] GdipImageForceValidation (image=0x6c1bcd8) returned 0x0 [0049.152] GetLastError () returned 0x0 [0049.152] GdipGetImageRawFormat (image=0x6c1bcd8, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.152] GetLastError () returned 0x0 [0049.152] GdipBitmapLockBits (bitmap=0x6c1bcd8, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x271e4fc) returned 0x0 [0049.152] GetLastError () returned 0x0 [0049.152] GdipBitmapUnlockBits (bitmap=0x6c1bcd8, lockedBitmapData=0x271e4fc) returned 0x0 [0049.152] GetLastError () returned 0x0 [0049.152] GdipGetImageWidth (image=0x6ba5728, width=0x46e1e8) returned 0x0 [0049.152] GetLastError () returned 0x0 [0049.152] GdipGetImageHeight (image=0x6ba5728, height=0x46e1e8) returned 0x0 [0049.152] GetLastError () returned 0x0 [0049.152] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.152] GetLastError () returned 0x0 [0049.152] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x757e70 [0049.152] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x757e70 | out: encoders=0x757e70) returned 0x0 [0049.153] GetLastError () returned 0x0 [0049.153] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.153] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757fec, Length=0x26 | out: Destination=0x6b2ab8) [0049.153] lstrlenW (lpString="BMP") returned 3 [0049.153] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758012, Length=0x8 | out: Destination=0x6b2ab8) [0049.153] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.153] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75801a, Length=0x24 | out: Destination=0x6b2ab8) [0049.153] lstrlenW (lpString="image/bmp") returned 9 [0049.153] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75803e, Length=0x14 | out: Destination=0x6b2ab8) [0049.153] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.153] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758056, Length=0x28 | out: Destination=0x6b2ab8) [0049.153] lstrlenW (lpString="JPEG") returned 4 [0049.153] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75807e, Length=0xa | out: Destination=0x6b2ab8) [0049.153] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.153] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758088, Length=0x34 | out: Destination=0x6b2ab8) [0049.153] lstrlenW (lpString="image/jpeg") returned 10 [0049.154] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7580bc, Length=0x16 | out: Destination=0x6b2ab8) [0049.154] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.154] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7580d6, Length=0x26 | out: Destination=0x6b2ab8) [0049.154] lstrlenW (lpString="GIF") returned 3 [0049.154] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7580fc, Length=0x8 | out: Destination=0x6b2ab8) [0049.154] lstrlenW (lpString="*.GIF") returned 5 [0049.154] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758104, Length=0xc | out: Destination=0x6b2ab8) [0049.154] lstrlenW (lpString="image/gif") returned 9 [0049.154] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758110, Length=0x14 | out: Destination=0x6b2ab8) [0049.154] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.154] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75813c, Length=0x28 | out: Destination=0x6b2ab8) [0049.154] lstrlenW (lpString="TIFF") returned 4 [0049.154] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758164, Length=0xa | out: Destination=0x6b2ab8) [0049.154] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.155] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75816e, Length=0x1a | out: Destination=0x6b2ab8) [0049.155] lstrlenW (lpString="image/tiff") returned 10 [0049.155] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758188, Length=0x16 | out: Destination=0x6b2ab8) [0049.155] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.155] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7581a6, Length=0x26 | out: Destination=0x6b2ab8) [0049.155] lstrlenW (lpString="PNG") returned 3 [0049.155] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7581cc, Length=0x8 | out: Destination=0x6b2ab8) [0049.155] lstrlenW (lpString="*.PNG") returned 5 [0049.155] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7581d4, Length=0xc | out: Destination=0x6b2ab8) [0049.155] lstrlenW (lpString="image/png") returned 9 [0049.155] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7581e0, Length=0x14 | out: Destination=0x6b2ab8) [0049.155] LocalFree (hMem=0x757e70) returned 0x0 [0049.155] GetLastError () returned 0x0 [0049.156] GdipSaveImageToStream (image=0x6ba5728, stream=0x492f730, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.164] GetLastError () returned 0x0 [0049.165] GdipCreateBitmapFromStream (stream=0x492f710, bitmap=0x46e1f0) returned 0x0 [0049.165] GetLastError () returned 0x0 [0049.165] GdipImageForceValidation (image=0x6c1c020) returned 0x0 [0049.166] GetLastError () returned 0x0 [0049.166] GdipGetImageRawFormat (image=0x6c1c020, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.166] GetLastError () returned 0x0 [0049.166] GdipBitmapLockBits (bitmap=0x6c1c020, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x27273bc) returned 0x0 [0049.166] GetLastError () returned 0x0 [0049.166] GdipBitmapUnlockBits (bitmap=0x6c1c020, lockedBitmapData=0x27273bc) returned 0x0 [0049.166] GetLastError () returned 0x0 [0049.170] GdipGetImageWidth (image=0x6ba9730, width=0x46e1e8) returned 0x0 [0049.170] GetLastError () returned 0x1e7 [0049.170] GdipGetImageHeight (image=0x6ba9730, height=0x46e1e8) returned 0x0 [0049.170] GetLastError () returned 0x1e7 [0049.170] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.170] GetLastError () returned 0x1e7 [0049.171] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x75a4f8 [0049.171] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x75a4f8 | out: encoders=0x75a4f8) returned 0x0 [0049.171] GetLastError () returned 0x1e7 [0049.171] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.171] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a674, Length=0x26 | out: Destination=0x6b2ab8) [0049.171] lstrlenW (lpString="BMP") returned 3 [0049.171] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a69a, Length=0x8 | out: Destination=0x6b2ab8) [0049.171] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.171] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a6a2, Length=0x24 | out: Destination=0x6b2ab8) [0049.171] lstrlenW (lpString="image/bmp") returned 9 [0049.171] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a6c6, Length=0x14 | out: Destination=0x6b2ab8) [0049.171] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.172] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a6de, Length=0x28 | out: Destination=0x6b2ab8) [0049.172] lstrlenW (lpString="JPEG") returned 4 [0049.172] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a706, Length=0xa | out: Destination=0x6b2ab8) [0049.172] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.172] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a710, Length=0x34 | out: Destination=0x6b2ab8) [0049.172] lstrlenW (lpString="image/jpeg") returned 10 [0049.172] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a744, Length=0x16 | out: Destination=0x6b2ab8) [0049.172] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.172] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a75e, Length=0x26 | out: Destination=0x6b2ab8) [0049.172] lstrlenW (lpString="GIF") returned 3 [0049.172] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a784, Length=0x8 | out: Destination=0x6b2ab8) [0049.172] lstrlenW (lpString="*.GIF") returned 5 [0049.172] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a78c, Length=0xc | out: Destination=0x6b2ab8) [0049.172] lstrlenW (lpString="image/gif") returned 9 [0049.172] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a798, Length=0x14 | out: Destination=0x6b2ab8) [0049.173] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.173] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a7c4, Length=0x28 | out: Destination=0x6b2ab8) [0049.173] lstrlenW (lpString="TIFF") returned 4 [0049.173] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a7ec, Length=0xa | out: Destination=0x6b2ab8) [0049.173] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.173] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a7f6, Length=0x1a | out: Destination=0x6b2ab8) [0049.173] lstrlenW (lpString="image/tiff") returned 10 [0049.173] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a810, Length=0x16 | out: Destination=0x6b2ab8) [0049.173] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.173] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a82e, Length=0x26 | out: Destination=0x6b2ab8) [0049.173] lstrlenW (lpString="PNG") returned 3 [0049.173] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a854, Length=0x8 | out: Destination=0x6b2ab8) [0049.173] lstrlenW (lpString="*.PNG") returned 5 [0049.173] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a85c, Length=0xc | out: Destination=0x6b2ab8) [0049.173] lstrlenW (lpString="image/png") returned 9 [0049.174] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a868, Length=0x14 | out: Destination=0x6b2ab8) [0049.174] LocalFree (hMem=0x75a4f8) returned 0x0 [0049.174] GetLastError () returned 0x1e7 [0049.174] GdipSaveImageToStream (image=0x6ba9730, stream=0x492f6f0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.196] GetLastError () returned 0x0 [0049.197] GdipCreateBitmapFromStream (stream=0x492fb30, bitmap=0x46e1f0) returned 0x0 [0049.198] GetLastError () returned 0x0 [0049.198] GdipImageForceValidation (image=0x6bd1950) returned 0x0 [0049.198] GetLastError () returned 0x0 [0049.198] GdipGetImageRawFormat (image=0x6bd1950, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.198] GetLastError () returned 0x0 [0049.199] GdipBitmapLockBits (bitmap=0x6bd1950, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x2686d5c) returned 0x0 [0049.199] GetLastError () returned 0x0 [0049.199] GdipBitmapUnlockBits (bitmap=0x6bd1950, lockedBitmapData=0x2686d5c) returned 0x0 [0049.199] GetLastError () returned 0x0 [0049.199] GdipGetImageWidth (image=0x6ba9a78, width=0x46e1e8) returned 0x0 [0049.199] GetLastError () returned 0x0 [0049.199] GdipGetImageHeight (image=0x6ba9a78, height=0x46e1e8) returned 0x0 [0049.199] GetLastError () returned 0x0 [0049.199] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.199] GetLastError () returned 0x0 [0049.199] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x757a28 [0049.199] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x757a28 | out: encoders=0x757a28) returned 0x0 [0049.199] GetLastError () returned 0x0 [0049.199] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.199] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757ba4, Length=0x26 | out: Destination=0x6b2ab8) [0049.199] lstrlenW (lpString="BMP") returned 3 [0049.199] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757bca, Length=0x8 | out: Destination=0x6b2ab8) [0049.199] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.199] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757bd2, Length=0x24 | out: Destination=0x6b2ab8) [0049.200] lstrlenW (lpString="image/bmp") returned 9 [0049.200] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757bf6, Length=0x14 | out: Destination=0x6b2ab8) [0049.200] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.200] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c0e, Length=0x28 | out: Destination=0x6b2ab8) [0049.200] lstrlenW (lpString="JPEG") returned 4 [0049.200] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c36, Length=0xa | out: Destination=0x6b2ab8) [0049.200] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.200] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c40, Length=0x34 | out: Destination=0x6b2ab8) [0049.200] lstrlenW (lpString="image/jpeg") returned 10 [0049.200] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c74, Length=0x16 | out: Destination=0x6b2ab8) [0049.200] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.200] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c8e, Length=0x26 | out: Destination=0x6b2ab8) [0049.200] lstrlenW (lpString="GIF") returned 3 [0049.200] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757cb4, Length=0x8 | out: Destination=0x6b2ab8) [0049.201] lstrlenW (lpString="*.GIF") returned 5 [0049.201] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757cbc, Length=0xc | out: Destination=0x6b2ab8) [0049.201] lstrlenW (lpString="image/gif") returned 9 [0049.201] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757cc8, Length=0x14 | out: Destination=0x6b2ab8) [0049.201] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.201] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757cf4, Length=0x28 | out: Destination=0x6b2ab8) [0049.201] lstrlenW (lpString="TIFF") returned 4 [0049.201] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d1c, Length=0xa | out: Destination=0x6b2ab8) [0049.201] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.201] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d26, Length=0x1a | out: Destination=0x6b2ab8) [0049.201] lstrlenW (lpString="image/tiff") returned 10 [0049.201] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d40, Length=0x16 | out: Destination=0x6b2ab8) [0049.201] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.201] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d5e, Length=0x26 | out: Destination=0x6b2ab8) [0049.202] lstrlenW (lpString="PNG") returned 3 [0049.202] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d84, Length=0x8 | out: Destination=0x6b2ab8) [0049.202] lstrlenW (lpString="*.PNG") returned 5 [0049.202] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d8c, Length=0xc | out: Destination=0x6b2ab8) [0049.202] lstrlenW (lpString="image/png") returned 9 [0049.202] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d98, Length=0x14 | out: Destination=0x6b2ab8) [0049.202] LocalFree (hMem=0x757a28) returned 0x0 [0049.202] GetLastError () returned 0x0 [0049.202] GdipSaveImageToStream (image=0x6ba9a78, stream=0x492faf0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.210] GetLastError () returned 0x0 [0049.211] GdipCreateBitmapFromStream (stream=0x492fab0, bitmap=0x46e1f0) returned 0x0 [0049.211] GetLastError () returned 0x0 [0049.212] GdipImageForceValidation (image=0x6bd0f78) returned 0x0 [0049.212] GetLastError () returned 0x0 [0049.212] GdipGetImageRawFormat (image=0x6bd0f78, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.212] GetLastError () returned 0x0 [0049.212] GdipBitmapLockBits (bitmap=0x6bd0f78, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x268fc10) returned 0x0 [0049.212] GetLastError () returned 0x0 [0049.212] GdipBitmapUnlockBits (bitmap=0x6bd0f78, lockedBitmapData=0x268fc10) returned 0x0 [0049.212] GetLastError () returned 0x0 [0049.212] GdipGetImageWidth (image=0x6ba90a0, width=0x46e1e8) returned 0x0 [0049.212] GetLastError () returned 0x0 [0049.212] GdipGetImageHeight (image=0x6ba90a0, height=0x46e1e8) returned 0x0 [0049.212] GetLastError () returned 0x0 [0049.212] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.212] GetLastError () returned 0x0 [0049.212] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x758f90 [0049.212] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x758f90 | out: encoders=0x758f90) returned 0x0 [0049.212] GetLastError () returned 0x0 [0049.213] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.213] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75910c, Length=0x26 | out: Destination=0x6b2ab8) [0049.213] lstrlenW (lpString="BMP") returned 3 [0049.213] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759132, Length=0x8 | out: Destination=0x6b2ab8) [0049.213] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.213] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75913a, Length=0x24 | out: Destination=0x6b2ab8) [0049.213] lstrlenW (lpString="image/bmp") returned 9 [0049.213] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75915e, Length=0x14 | out: Destination=0x6b2ab8) [0049.213] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.213] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759176, Length=0x28 | out: Destination=0x6b2ab8) [0049.213] lstrlenW (lpString="JPEG") returned 4 [0049.213] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75919e, Length=0xa | out: Destination=0x6b2ab8) [0049.213] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.213] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7591a8, Length=0x34 | out: Destination=0x6b2ab8) [0049.213] lstrlenW (lpString="image/jpeg") returned 10 [0049.214] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7591dc, Length=0x16 | out: Destination=0x6b2ab8) [0049.214] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.214] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7591f6, Length=0x26 | out: Destination=0x6b2ab8) [0049.214] lstrlenW (lpString="GIF") returned 3 [0049.214] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75921c, Length=0x8 | out: Destination=0x6b2ab8) [0049.214] lstrlenW (lpString="*.GIF") returned 5 [0049.214] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759224, Length=0xc | out: Destination=0x6b2ab8) [0049.214] lstrlenW (lpString="image/gif") returned 9 [0049.214] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759230, Length=0x14 | out: Destination=0x6b2ab8) [0049.214] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.214] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75925c, Length=0x28 | out: Destination=0x6b2ab8) [0049.214] lstrlenW (lpString="TIFF") returned 4 [0049.214] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759284, Length=0xa | out: Destination=0x6b2ab8) [0049.214] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.215] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75928e, Length=0x1a | out: Destination=0x6b2ab8) [0049.215] lstrlenW (lpString="image/tiff") returned 10 [0049.215] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7592a8, Length=0x16 | out: Destination=0x6b2ab8) [0049.215] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.215] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7592c6, Length=0x26 | out: Destination=0x6b2ab8) [0049.215] lstrlenW (lpString="PNG") returned 3 [0049.215] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7592ec, Length=0x8 | out: Destination=0x6b2ab8) [0049.215] lstrlenW (lpString="*.PNG") returned 5 [0049.215] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7592f4, Length=0xc | out: Destination=0x6b2ab8) [0049.215] lstrlenW (lpString="image/png") returned 9 [0049.215] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759300, Length=0x14 | out: Destination=0x6b2ab8) [0049.215] LocalFree (hMem=0x758f90) returned 0x0 [0049.215] GetLastError () returned 0x0 [0049.216] GdipSaveImageToStream (image=0x6ba90a0, stream=0x492fa70, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.224] GetLastError () returned 0x0 [0049.225] GdipCreateBitmapFromStream (stream=0x492fa30, bitmap=0x46e1f0) returned 0x0 [0049.226] GetLastError () returned 0x0 [0049.226] GdipImageForceValidation (image=0x6bd12c0) returned 0x0 [0049.226] GetLastError () returned 0x0 [0049.226] GdipGetImageRawFormat (image=0x6bd12c0, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.226] GetLastError () returned 0x0 [0049.226] GdipBitmapLockBits (bitmap=0x6bd12c0, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x2698ad0) returned 0x0 [0049.226] GetLastError () returned 0x0 [0049.226] GdipBitmapUnlockBits (bitmap=0x6bd12c0, lockedBitmapData=0x2698ad0) returned 0x0 [0049.226] GetLastError () returned 0x0 [0049.226] GdipGetImageWidth (image=0x6baa798, width=0x46e1e8) returned 0x0 [0049.226] GetLastError () returned 0x0 [0049.226] GdipGetImageHeight (image=0x6baa798, height=0x46e1e8) returned 0x0 [0049.226] GetLastError () returned 0x0 [0049.226] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.226] GetLastError () returned 0x0 [0049.226] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x75ad88 [0049.226] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x75ad88 | out: encoders=0x75ad88) returned 0x0 [0049.227] GetLastError () returned 0x0 [0049.227] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.227] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af04, Length=0x26 | out: Destination=0x6b2ab8) [0049.227] lstrlenW (lpString="BMP") returned 3 [0049.227] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af2a, Length=0x8 | out: Destination=0x6b2ab8) [0049.227] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.227] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af32, Length=0x24 | out: Destination=0x6b2ab8) [0049.227] lstrlenW (lpString="image/bmp") returned 9 [0049.227] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af56, Length=0x14 | out: Destination=0x6b2ab8) [0049.227] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.227] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af6e, Length=0x28 | out: Destination=0x6b2ab8) [0049.227] lstrlenW (lpString="JPEG") returned 4 [0049.227] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af96, Length=0xa | out: Destination=0x6b2ab8) [0049.227] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.227] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75afa0, Length=0x34 | out: Destination=0x6b2ab8) [0049.228] lstrlenW (lpString="image/jpeg") returned 10 [0049.228] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75afd4, Length=0x16 | out: Destination=0x6b2ab8) [0049.228] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.228] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75afee, Length=0x26 | out: Destination=0x6b2ab8) [0049.228] lstrlenW (lpString="GIF") returned 3 [0049.228] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b014, Length=0x8 | out: Destination=0x6b2ab8) [0049.228] lstrlenW (lpString="*.GIF") returned 5 [0049.228] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b01c, Length=0xc | out: Destination=0x6b2ab8) [0049.228] lstrlenW (lpString="image/gif") returned 9 [0049.228] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b028, Length=0x14 | out: Destination=0x6b2ab8) [0049.228] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.228] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b054, Length=0x28 | out: Destination=0x6b2ab8) [0049.228] lstrlenW (lpString="TIFF") returned 4 [0049.228] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b07c, Length=0xa | out: Destination=0x6b2ab8) [0049.229] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.229] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b086, Length=0x1a | out: Destination=0x6b2ab8) [0049.229] lstrlenW (lpString="image/tiff") returned 10 [0049.229] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0a0, Length=0x16 | out: Destination=0x6b2ab8) [0049.229] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.229] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0be, Length=0x26 | out: Destination=0x6b2ab8) [0049.229] lstrlenW (lpString="PNG") returned 3 [0049.229] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0e4, Length=0x8 | out: Destination=0x6b2ab8) [0049.229] lstrlenW (lpString="*.PNG") returned 5 [0049.229] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0ec, Length=0xc | out: Destination=0x6b2ab8) [0049.229] lstrlenW (lpString="image/png") returned 9 [0049.229] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0f8, Length=0x14 | out: Destination=0x6b2ab8) [0049.229] LocalFree (hMem=0x75ad88) returned 0x0 [0049.229] GetLastError () returned 0x0 [0049.230] GdipSaveImageToStream (image=0x6baa798, stream=0x492f9f0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.237] GetLastError () returned 0x0 [0049.238] GdipCreateBitmapFromStream (stream=0x492f9b0, bitmap=0x46e1f0) returned 0x0 [0049.238] GetLastError () returned 0x0 [0049.238] GdipImageForceValidation (image=0x6bd1608) returned 0x0 [0049.238] GetLastError () returned 0x0 [0049.238] GdipGetImageRawFormat (image=0x6bd1608, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.239] GetLastError () returned 0x0 [0049.239] GdipBitmapLockBits (bitmap=0x6bd1608, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26a1984) returned 0x0 [0049.239] GetLastError () returned 0x0 [0049.239] GdipBitmapUnlockBits (bitmap=0x6bd1608, lockedBitmapData=0x26a1984) returned 0x0 [0049.239] GetLastError () returned 0x0 [0049.239] GdipGetImageWidth (image=0x6ba8d58, width=0x46e1e8) returned 0x0 [0049.239] GetLastError () returned 0x0 [0049.239] GdipGetImageHeight (image=0x6ba8d58, height=0x46e1e8) returned 0x0 [0049.239] GetLastError () returned 0x0 [0049.239] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.239] GetLastError () returned 0x0 [0049.239] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x7582b8 [0049.240] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x7582b8 | out: encoders=0x7582b8) returned 0x0 [0049.240] GetLastError () returned 0x0 [0049.240] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.240] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758434, Length=0x26 | out: Destination=0x6b2ab8) [0049.240] lstrlenW (lpString="BMP") returned 3 [0049.240] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75845a, Length=0x8 | out: Destination=0x6b2ab8) [0049.240] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.240] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758462, Length=0x24 | out: Destination=0x6b2ab8) [0049.240] lstrlenW (lpString="image/bmp") returned 9 [0049.240] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758486, Length=0x14 | out: Destination=0x6b2ab8) [0049.240] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.240] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75849e, Length=0x28 | out: Destination=0x6b2ab8) [0049.240] lstrlenW (lpString="JPEG") returned 4 [0049.241] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584c6, Length=0xa | out: Destination=0x6b2ab8) [0049.241] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.241] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584d0, Length=0x34 | out: Destination=0x6b2ab8) [0049.241] lstrlenW (lpString="image/jpeg") returned 10 [0049.241] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758504, Length=0x16 | out: Destination=0x6b2ab8) [0049.241] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.241] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75851e, Length=0x26 | out: Destination=0x6b2ab8) [0049.241] lstrlenW (lpString="GIF") returned 3 [0049.241] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758544, Length=0x8 | out: Destination=0x6b2ab8) [0049.241] lstrlenW (lpString="*.GIF") returned 5 [0049.241] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75854c, Length=0xc | out: Destination=0x6b2ab8) [0049.241] lstrlenW (lpString="image/gif") returned 9 [0049.241] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758558, Length=0x14 | out: Destination=0x6b2ab8) [0049.241] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.241] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758584, Length=0x28 | out: Destination=0x6b2ab8) [0049.242] lstrlenW (lpString="TIFF") returned 4 [0049.242] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ac, Length=0xa | out: Destination=0x6b2ab8) [0049.242] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.242] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585b6, Length=0x1a | out: Destination=0x6b2ab8) [0049.242] lstrlenW (lpString="image/tiff") returned 10 [0049.242] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585d0, Length=0x16 | out: Destination=0x6b2ab8) [0049.242] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.242] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ee, Length=0x26 | out: Destination=0x6b2ab8) [0049.242] lstrlenW (lpString="PNG") returned 3 [0049.242] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758614, Length=0x8 | out: Destination=0x6b2ab8) [0049.242] lstrlenW (lpString="*.PNG") returned 5 [0049.242] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75861c, Length=0xc | out: Destination=0x6b2ab8) [0049.242] lstrlenW (lpString="image/png") returned 9 [0049.242] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758628, Length=0x14 | out: Destination=0x6b2ab8) [0049.242] LocalFree (hMem=0x7582b8) returned 0x0 [0049.242] GetLastError () returned 0x0 [0049.243] GdipSaveImageToStream (image=0x6ba8d58, stream=0x492f970, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.250] GetLastError () returned 0x0 [0049.251] GdipCreateBitmapFromStream (stream=0x492f930, bitmap=0x46e1f0) returned 0x0 [0049.251] GetLastError () returned 0x0 [0049.251] GdipImageForceValidation (image=0x6bce818) returned 0x0 [0049.252] GetLastError () returned 0x0 [0049.252] GdipGetImageRawFormat (image=0x6bce818, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.252] GetLastError () returned 0x0 [0049.252] GdipBitmapLockBits (bitmap=0x6bce818, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26aa844) returned 0x0 [0049.252] GetLastError () returned 0x0 [0049.252] GdipBitmapUnlockBits (bitmap=0x6bce818, lockedBitmapData=0x26aa844) returned 0x0 [0049.252] GetLastError () returned 0x0 [0049.252] GdipGetImageWidth (image=0x6ba9dc0, width=0x46e1e8) returned 0x0 [0049.252] GetLastError () returned 0x0 [0049.252] GdipGetImageHeight (image=0x6ba9dc0, height=0x46e1e8) returned 0x0 [0049.252] GetLastError () returned 0x0 [0049.252] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.252] GetLastError () returned 0x0 [0049.252] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x75ad88 [0049.252] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x75ad88 | out: encoders=0x75ad88) returned 0x0 [0049.252] GetLastError () returned 0x0 [0049.252] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.252] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af04, Length=0x26 | out: Destination=0x6b2ab8) [0049.253] lstrlenW (lpString="BMP") returned 3 [0049.253] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af2a, Length=0x8 | out: Destination=0x6b2ab8) [0049.253] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.253] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af32, Length=0x24 | out: Destination=0x6b2ab8) [0049.253] lstrlenW (lpString="image/bmp") returned 9 [0049.253] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af56, Length=0x14 | out: Destination=0x6b2ab8) [0049.253] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.253] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af6e, Length=0x28 | out: Destination=0x6b2ab8) [0049.253] lstrlenW (lpString="JPEG") returned 4 [0049.253] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75af96, Length=0xa | out: Destination=0x6b2ab8) [0049.253] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.253] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75afa0, Length=0x34 | out: Destination=0x6b2ab8) [0049.253] lstrlenW (lpString="image/jpeg") returned 10 [0049.253] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75afd4, Length=0x16 | out: Destination=0x6b2ab8) [0049.253] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.254] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75afee, Length=0x26 | out: Destination=0x6b2ab8) [0049.254] lstrlenW (lpString="GIF") returned 3 [0049.254] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b014, Length=0x8 | out: Destination=0x6b2ab8) [0049.254] lstrlenW (lpString="*.GIF") returned 5 [0049.254] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b01c, Length=0xc | out: Destination=0x6b2ab8) [0049.254] lstrlenW (lpString="image/gif") returned 9 [0049.254] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b028, Length=0x14 | out: Destination=0x6b2ab8) [0049.254] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.254] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b054, Length=0x28 | out: Destination=0x6b2ab8) [0049.254] lstrlenW (lpString="TIFF") returned 4 [0049.254] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b07c, Length=0xa | out: Destination=0x6b2ab8) [0049.254] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.255] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b086, Length=0x1a | out: Destination=0x6b2ab8) [0049.255] lstrlenW (lpString="image/tiff") returned 10 [0049.255] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0a0, Length=0x16 | out: Destination=0x6b2ab8) [0049.255] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.255] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0be, Length=0x26 | out: Destination=0x6b2ab8) [0049.255] lstrlenW (lpString="PNG") returned 3 [0049.255] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0e4, Length=0x8 | out: Destination=0x6b2ab8) [0049.255] lstrlenW (lpString="*.PNG") returned 5 [0049.255] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0ec, Length=0xc | out: Destination=0x6b2ab8) [0049.255] lstrlenW (lpString="image/png") returned 9 [0049.255] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75b0f8, Length=0x14 | out: Destination=0x6b2ab8) [0049.256] LocalFree (hMem=0x75ad88) returned 0x0 [0049.256] GetLastError () returned 0x0 [0049.256] GdipSaveImageToStream (image=0x6ba9dc0, stream=0x492f8f0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.263] GetLastError () returned 0x0 [0049.264] GdipCreateBitmapFromStream (stream=0x492f8b0, bitmap=0x46e1f0) returned 0x0 [0049.264] GetLastError () returned 0x0 [0049.265] GdipImageForceValidation (image=0x6c1c9f8) returned 0x0 [0049.265] GetLastError () returned 0x0 [0049.265] GdipGetImageRawFormat (image=0x6c1c9f8, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.265] GetLastError () returned 0x0 [0049.265] GdipBitmapLockBits (bitmap=0x6c1c9f8, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26b36ec) returned 0x0 [0049.265] GetLastError () returned 0x0 [0049.265] GdipBitmapUnlockBits (bitmap=0x6c1c9f8, lockedBitmapData=0x26b36ec) returned 0x0 [0049.265] GetLastError () returned 0x0 [0049.265] GdipGetImageWidth (image=0x6baa108, width=0x46e1e8) returned 0x0 [0049.265] GetLastError () returned 0x0 [0049.265] GdipGetImageHeight (image=0x6baa108, height=0x46e1e8) returned 0x0 [0049.265] GetLastError () returned 0x0 [0049.265] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.265] GetLastError () returned 0x0 [0049.265] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x75a940 [0049.265] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x75a940 | out: encoders=0x75a940) returned 0x0 [0049.265] GetLastError () returned 0x0 [0049.266] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.266] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75aabc, Length=0x26 | out: Destination=0x6b2ab8) [0049.266] lstrlenW (lpString="BMP") returned 3 [0049.266] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75aae2, Length=0x8 | out: Destination=0x6b2ab8) [0049.266] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.266] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75aaea, Length=0x24 | out: Destination=0x6b2ab8) [0049.266] lstrlenW (lpString="image/bmp") returned 9 [0049.266] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ab0e, Length=0x14 | out: Destination=0x6b2ab8) [0049.266] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.266] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ab26, Length=0x28 | out: Destination=0x6b2ab8) [0049.266] lstrlenW (lpString="JPEG") returned 4 [0049.266] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ab4e, Length=0xa | out: Destination=0x6b2ab8) [0049.266] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.266] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ab58, Length=0x34 | out: Destination=0x6b2ab8) [0049.266] lstrlenW (lpString="image/jpeg") returned 10 [0049.267] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ab8c, Length=0x16 | out: Destination=0x6b2ab8) [0049.267] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.267] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75aba6, Length=0x26 | out: Destination=0x6b2ab8) [0049.267] lstrlenW (lpString="GIF") returned 3 [0049.267] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75abcc, Length=0x8 | out: Destination=0x6b2ab8) [0049.267] lstrlenW (lpString="*.GIF") returned 5 [0049.267] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75abd4, Length=0xc | out: Destination=0x6b2ab8) [0049.267] lstrlenW (lpString="image/gif") returned 9 [0049.267] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75abe0, Length=0x14 | out: Destination=0x6b2ab8) [0049.267] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.267] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ac0c, Length=0x28 | out: Destination=0x6b2ab8) [0049.267] lstrlenW (lpString="TIFF") returned 4 [0049.267] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ac34, Length=0xa | out: Destination=0x6b2ab8) [0049.267] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.268] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ac3e, Length=0x1a | out: Destination=0x6b2ab8) [0049.268] lstrlenW (lpString="image/tiff") returned 10 [0049.268] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ac58, Length=0x16 | out: Destination=0x6b2ab8) [0049.268] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.268] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ac76, Length=0x26 | out: Destination=0x6b2ab8) [0049.268] lstrlenW (lpString="PNG") returned 3 [0049.268] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ac9c, Length=0x8 | out: Destination=0x6b2ab8) [0049.268] lstrlenW (lpString="*.PNG") returned 5 [0049.268] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75aca4, Length=0xc | out: Destination=0x6b2ab8) [0049.268] lstrlenW (lpString="image/png") returned 9 [0049.268] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75acb0, Length=0x14 | out: Destination=0x6b2ab8) [0049.268] LocalFree (hMem=0x75a940) returned 0x0 [0049.268] GetLastError () returned 0x0 [0049.269] GdipSaveImageToStream (image=0x6baa108, stream=0x492f870, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.305] GetLastError () returned 0x0 [0049.306] GdipCreateBitmapFromStream (stream=0x492f830, bitmap=0x46e1f0) returned 0x0 [0049.306] GetLastError () returned 0x0 [0049.306] GdipImageForceValidation (image=0x6c19230) returned 0x0 [0049.307] GetLastError () returned 0x0 [0049.307] GdipGetImageRawFormat (image=0x6c19230, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.307] GetLastError () returned 0x0 [0049.307] GdipBitmapLockBits (bitmap=0x6c19230, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26bc5ac) returned 0x0 [0049.307] GetLastError () returned 0x0 [0049.307] GdipBitmapUnlockBits (bitmap=0x6c19230, lockedBitmapData=0x26bc5ac) returned 0x0 [0049.307] GetLastError () returned 0x0 [0049.307] GdipGetImageWidth (image=0x6ba93e8, width=0x46e1e8) returned 0x0 [0049.307] GetLastError () returned 0x0 [0049.307] GdipGetImageHeight (image=0x6ba93e8, height=0x46e1e8) returned 0x0 [0049.307] GetLastError () returned 0x0 [0049.307] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.307] GetLastError () returned 0x0 [0049.307] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x7582b8 [0049.307] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x7582b8 | out: encoders=0x7582b8) returned 0x0 [0049.307] GetLastError () returned 0x0 [0049.307] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.307] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758434, Length=0x26 | out: Destination=0x6b2ab8) [0049.308] lstrlenW (lpString="BMP") returned 3 [0049.308] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75845a, Length=0x8 | out: Destination=0x6b2ab8) [0049.308] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.308] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758462, Length=0x24 | out: Destination=0x6b2ab8) [0049.308] lstrlenW (lpString="image/bmp") returned 9 [0049.308] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758486, Length=0x14 | out: Destination=0x6b2ab8) [0049.308] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.308] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75849e, Length=0x28 | out: Destination=0x6b2ab8) [0049.308] lstrlenW (lpString="JPEG") returned 4 [0049.308] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584c6, Length=0xa | out: Destination=0x6b2ab8) [0049.308] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.308] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584d0, Length=0x34 | out: Destination=0x6b2ab8) [0049.308] lstrlenW (lpString="image/jpeg") returned 10 [0049.308] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758504, Length=0x16 | out: Destination=0x6b2ab8) [0049.309] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.309] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75851e, Length=0x26 | out: Destination=0x6b2ab8) [0049.309] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758544, Length=0x8 | out: Destination=0x6b2ab8) [0049.309] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75854c, Length=0xc | out: Destination=0x6b2ab8) [0049.309] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758558, Length=0x14 | out: Destination=0x6b2ab8) [0049.309] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.309] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758584, Length=0x28 | out: Destination=0x6b2ab8) [0049.309] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ac, Length=0xa | out: Destination=0x6b2ab8) [0049.309] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585b6, Length=0x1a | out: Destination=0x6b2ab8) [0049.309] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585d0, Length=0x16 | out: Destination=0x6b2ab8) [0049.309] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.309] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ee, Length=0x26 | out: Destination=0x6b2ab8) [0049.309] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758614, Length=0x8 | out: Destination=0x6b2ab8) [0049.309] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75861c, Length=0xc | out: Destination=0x6b2ab8) [0049.310] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758628, Length=0x14 | out: Destination=0x6b2ab8) [0049.310] LocalFree (hMem=0x7582b8) returned 0x0 [0049.310] GetLastError () returned 0x0 [0049.310] GdipSaveImageToStream (image=0x6ba93e8, stream=0x492f7f0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.318] GetLastError () returned 0x0 [0049.318] GdipCreateBitmapFromStream (stream=0x492f7b0, bitmap=0x46e1f0) returned 0x0 [0049.319] GetLastError () returned 0x0 [0049.319] GdipImageForceValidation (image=0x6c1c368) returned 0x0 [0049.319] GetLastError () returned 0x0 [0049.319] GdipGetImageRawFormat (image=0x6c1c368, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.319] GetLastError () returned 0x0 [0049.319] GdipBitmapLockBits (bitmap=0x6c1c368, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26c5454) returned 0x0 [0049.319] GetLastError () returned 0x0 [0049.319] GdipBitmapUnlockBits (bitmap=0x6c1c368, lockedBitmapData=0x26c5454) returned 0x0 [0049.319] GetLastError () returned 0x0 [0049.319] GdipGetImageWidth (image=0x6baa450, width=0x46e1e8) returned 0x0 [0049.319] GetLastError () returned 0x0 [0049.319] GdipGetImageHeight (image=0x6baa450, height=0x46e1e8) returned 0x0 [0049.319] GetLastError () returned 0x0 [0049.320] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.320] GetLastError () returned 0x0 [0049.320] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x7593d8 [0049.320] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x7593d8 | out: encoders=0x7593d8) returned 0x0 [0049.320] GetLastError () returned 0x0 [0049.320] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.320] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759554, Length=0x26 | out: Destination=0x6b2ab8) [0049.320] lstrlenW (lpString="BMP") returned 3 [0049.320] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75957a, Length=0x8 | out: Destination=0x6b2ab8) [0049.320] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.320] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759582, Length=0x24 | out: Destination=0x6b2ab8) [0049.320] lstrlenW (lpString="image/bmp") returned 9 [0049.320] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7595a6, Length=0x14 | out: Destination=0x6b2ab8) [0049.321] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.321] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7595be, Length=0x28 | out: Destination=0x6b2ab8) [0049.321] lstrlenW (lpString="JPEG") returned 4 [0049.321] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7595e6, Length=0xa | out: Destination=0x6b2ab8) [0049.321] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.321] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7595f0, Length=0x34 | out: Destination=0x6b2ab8) [0049.321] lstrlenW (lpString="image/jpeg") returned 10 [0049.321] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759624, Length=0x16 | out: Destination=0x6b2ab8) [0049.321] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.321] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75963e, Length=0x26 | out: Destination=0x6b2ab8) [0049.321] lstrlenW (lpString="GIF") returned 3 [0049.321] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759664, Length=0x8 | out: Destination=0x6b2ab8) [0049.321] lstrlenW (lpString="*.GIF") returned 5 [0049.321] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75966c, Length=0xc | out: Destination=0x6b2ab8) [0049.322] lstrlenW (lpString="image/gif") returned 9 [0049.322] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759678, Length=0x14 | out: Destination=0x6b2ab8) [0049.322] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.322] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7596a4, Length=0x28 | out: Destination=0x6b2ab8) [0049.322] lstrlenW (lpString="TIFF") returned 4 [0049.322] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7596cc, Length=0xa | out: Destination=0x6b2ab8) [0049.322] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.322] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7596d6, Length=0x1a | out: Destination=0x6b2ab8) [0049.322] lstrlenW (lpString="image/tiff") returned 10 [0049.322] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7596f0, Length=0x16 | out: Destination=0x6b2ab8) [0049.322] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.322] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75970e, Length=0x26 | out: Destination=0x6b2ab8) [0049.322] lstrlenW (lpString="PNG") returned 3 [0049.322] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759734, Length=0x8 | out: Destination=0x6b2ab8) [0049.322] lstrlenW (lpString="*.PNG") returned 5 [0049.323] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75973c, Length=0xc | out: Destination=0x6b2ab8) [0049.323] lstrlenW (lpString="image/png") returned 9 [0049.323] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759748, Length=0x14 | out: Destination=0x6b2ab8) [0049.323] LocalFree (hMem=0x7593d8) returned 0x0 [0049.323] GetLastError () returned 0x0 [0049.323] GdipSaveImageToStream (image=0x6baa450, stream=0x492f770, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.330] GetLastError () returned 0x0 [0049.331] GdipCreateBitmapFromStream (stream=0x492f730, bitmap=0x46e1f0) returned 0x0 [0049.331] GetLastError () returned 0x0 [0049.332] GdipImageForceValidation (image=0x6c1b300) returned 0x0 [0049.332] GetLastError () returned 0x0 [0049.332] GdipGetImageRawFormat (image=0x6c1b300, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.332] GetLastError () returned 0x0 [0049.332] GdipBitmapLockBits (bitmap=0x6c1b300, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26ce308) returned 0x0 [0049.332] GetLastError () returned 0x0 [0049.332] GdipBitmapUnlockBits (bitmap=0x6c1b300, lockedBitmapData=0x26ce308) returned 0x0 [0049.332] GetLastError () returned 0x0 [0049.332] GdipGetImageWidth (image=0x6bce188, width=0x46e1e8) returned 0x0 [0049.332] GetLastError () returned 0x0 [0049.332] GdipGetImageHeight (image=0x6bce188, height=0x46e1e8) returned 0x0 [0049.332] GetLastError () returned 0x0 [0049.332] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.332] GetLastError () returned 0x0 [0049.332] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x758b48 [0049.332] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x758b48 | out: encoders=0x758b48) returned 0x0 [0049.333] GetLastError () returned 0x0 [0049.333] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.333] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cc4, Length=0x26 | out: Destination=0x6b2ab8) [0049.333] lstrlenW (lpString="BMP") returned 3 [0049.333] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cea, Length=0x8 | out: Destination=0x6b2ab8) [0049.333] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.333] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cf2, Length=0x24 | out: Destination=0x6b2ab8) [0049.333] lstrlenW (lpString="image/bmp") returned 9 [0049.333] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d16, Length=0x14 | out: Destination=0x6b2ab8) [0049.334] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.334] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d2e, Length=0x28 | out: Destination=0x6b2ab8) [0049.334] lstrlenW (lpString="JPEG") returned 4 [0049.334] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d56, Length=0xa | out: Destination=0x6b2ab8) [0049.334] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.334] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d60, Length=0x34 | out: Destination=0x6b2ab8) [0049.334] lstrlenW (lpString="image/jpeg") returned 10 [0049.334] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d94, Length=0x16 | out: Destination=0x6b2ab8) [0049.334] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.334] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758dae, Length=0x26 | out: Destination=0x6b2ab8) [0049.334] lstrlenW (lpString="GIF") returned 3 [0049.334] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758dd4, Length=0x8 | out: Destination=0x6b2ab8) [0049.334] lstrlenW (lpString="*.GIF") returned 5 [0049.334] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758ddc, Length=0xc | out: Destination=0x6b2ab8) [0049.334] lstrlenW (lpString="image/gif") returned 9 [0049.335] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758de8, Length=0x14 | out: Destination=0x6b2ab8) [0049.335] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.335] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e14, Length=0x28 | out: Destination=0x6b2ab8) [0049.335] lstrlenW (lpString="TIFF") returned 4 [0049.335] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e3c, Length=0xa | out: Destination=0x6b2ab8) [0049.335] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.335] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e46, Length=0x1a | out: Destination=0x6b2ab8) [0049.335] lstrlenW (lpString="image/tiff") returned 10 [0049.335] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e60, Length=0x16 | out: Destination=0x6b2ab8) [0049.335] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.335] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e7e, Length=0x26 | out: Destination=0x6b2ab8) [0049.335] lstrlenW (lpString="PNG") returned 3 [0049.335] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758ea4, Length=0x8 | out: Destination=0x6b2ab8) [0049.335] lstrlenW (lpString="*.PNG") returned 5 [0049.336] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758eac, Length=0xc | out: Destination=0x6b2ab8) [0049.336] lstrlenW (lpString="image/png") returned 9 [0049.336] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758eb8, Length=0x14 | out: Destination=0x6b2ab8) [0049.336] LocalFree (hMem=0x758b48) returned 0x0 [0049.336] GetLastError () returned 0x0 [0049.336] GdipSaveImageToStream (image=0x6bce188, stream=0x492f6d0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.344] GetLastError () returned 0x0 [0049.345] GdipCreateBitmapFromStream (stream=0x492f6b0, bitmap=0x46e1f0) returned 0x0 [0049.345] GetLastError () returned 0x0 [0049.345] GdipImageForceValidation (image=0x6c1b648) returned 0x0 [0049.345] GetLastError () returned 0x0 [0049.345] GdipGetImageRawFormat (image=0x6c1b648, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.346] GetLastError () returned 0x0 [0049.346] GdipBitmapLockBits (bitmap=0x6c1b648, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26d71bc) returned 0x0 [0049.346] GetLastError () returned 0x0 [0049.346] GdipBitmapUnlockBits (bitmap=0x6c1b648, lockedBitmapData=0x26d71bc) returned 0x0 [0049.346] GetLastError () returned 0x0 [0049.346] GdipGetImageWidth (image=0x6bcf538, width=0x46e1e8) returned 0x0 [0049.346] GetLastError () returned 0x0 [0049.346] GdipGetImageHeight (image=0x6bcf538, height=0x46e1e8) returned 0x0 [0049.346] GetLastError () returned 0x0 [0049.346] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.346] GetLastError () returned 0x0 [0049.346] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x758f90 [0049.346] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x758f90 | out: encoders=0x758f90) returned 0x0 [0049.346] GetLastError () returned 0x0 [0049.346] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.346] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75910c, Length=0x26 | out: Destination=0x6b2ab8) [0049.346] lstrlenW (lpString="BMP") returned 3 [0049.346] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759132, Length=0x8 | out: Destination=0x6b2ab8) [0049.346] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.347] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75913a, Length=0x24 | out: Destination=0x6b2ab8) [0049.347] lstrlenW (lpString="image/bmp") returned 9 [0049.347] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75915e, Length=0x14 | out: Destination=0x6b2ab8) [0049.347] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.347] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759176, Length=0x28 | out: Destination=0x6b2ab8) [0049.347] lstrlenW (lpString="JPEG") returned 4 [0049.347] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75919e, Length=0xa | out: Destination=0x6b2ab8) [0049.347] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.347] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7591a8, Length=0x34 | out: Destination=0x6b2ab8) [0049.347] lstrlenW (lpString="image/jpeg") returned 10 [0049.347] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7591dc, Length=0x16 | out: Destination=0x6b2ab8) [0049.347] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.347] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7591f6, Length=0x26 | out: Destination=0x6b2ab8) [0049.347] lstrlenW (lpString="GIF") returned 3 [0049.347] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75921c, Length=0x8 | out: Destination=0x6b2ab8) [0049.348] lstrlenW (lpString="*.GIF") returned 5 [0049.348] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759224, Length=0xc | out: Destination=0x6b2ab8) [0049.348] lstrlenW (lpString="image/gif") returned 9 [0049.348] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759230, Length=0x14 | out: Destination=0x6b2ab8) [0049.348] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.348] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75925c, Length=0x28 | out: Destination=0x6b2ab8) [0049.348] lstrlenW (lpString="TIFF") returned 4 [0049.348] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759284, Length=0xa | out: Destination=0x6b2ab8) [0049.348] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.348] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75928e, Length=0x1a | out: Destination=0x6b2ab8) [0049.348] lstrlenW (lpString="image/tiff") returned 10 [0049.348] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7592a8, Length=0x16 | out: Destination=0x6b2ab8) [0049.349] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.349] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7592c6, Length=0x26 | out: Destination=0x6b2ab8) [0049.349] lstrlenW (lpString="PNG") returned 3 [0049.349] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7592ec, Length=0x8 | out: Destination=0x6b2ab8) [0049.349] lstrlenW (lpString="*.PNG") returned 5 [0049.349] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7592f4, Length=0xc | out: Destination=0x6b2ab8) [0049.349] lstrlenW (lpString="image/png") returned 9 [0049.349] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759300, Length=0x14 | out: Destination=0x6b2ab8) [0049.349] LocalFree (hMem=0x758f90) returned 0x0 [0049.349] GetLastError () returned 0x0 [0049.350] GdipSaveImageToStream (image=0x6bcf538, stream=0x492f690, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.357] GetLastError () returned 0x0 [0049.357] GdipCreateBitmapFromStream (stream=0x492f670, bitmap=0x46e1f0) returned 0x0 [0049.358] GetLastError () returned 0x0 [0049.358] GdipImageForceValidation (image=0x6c198c0) returned 0x0 [0049.358] GetLastError () returned 0x0 [0049.358] GdipGetImageRawFormat (image=0x6c198c0, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.358] GetLastError () returned 0x0 [0049.358] GdipBitmapLockBits (bitmap=0x6c198c0, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26e0070) returned 0x0 [0049.358] GetLastError () returned 0x0 [0049.358] GdipBitmapUnlockBits (bitmap=0x6c198c0, lockedBitmapData=0x26e0070) returned 0x0 [0049.358] GetLastError () returned 0x0 [0049.358] GdipGetImageWidth (image=0x6bceb60, width=0x46e1e8) returned 0x0 [0049.358] GetLastError () returned 0x0 [0049.359] GdipGetImageHeight (image=0x6bceb60, height=0x46e1e8) returned 0x0 [0049.359] GetLastError () returned 0x0 [0049.359] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.359] GetLastError () returned 0x0 [0049.359] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x75a0b0 [0049.359] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x75a0b0 | out: encoders=0x75a0b0) returned 0x0 [0049.359] GetLastError () returned 0x0 [0049.359] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.359] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a22c, Length=0x26 | out: Destination=0x6b2ab8) [0049.359] lstrlenW (lpString="BMP") returned 3 [0049.359] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a252, Length=0x8 | out: Destination=0x6b2ab8) [0049.359] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.359] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a25a, Length=0x24 | out: Destination=0x6b2ab8) [0049.359] lstrlenW (lpString="image/bmp") returned 9 [0049.359] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a27e, Length=0x14 | out: Destination=0x6b2ab8) [0049.360] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.360] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a296, Length=0x28 | out: Destination=0x6b2ab8) [0049.360] lstrlenW (lpString="JPEG") returned 4 [0049.360] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a2be, Length=0xa | out: Destination=0x6b2ab8) [0049.360] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.360] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a2c8, Length=0x34 | out: Destination=0x6b2ab8) [0049.360] lstrlenW (lpString="image/jpeg") returned 10 [0049.360] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a2fc, Length=0x16 | out: Destination=0x6b2ab8) [0049.360] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.360] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a316, Length=0x26 | out: Destination=0x6b2ab8) [0049.360] lstrlenW (lpString="GIF") returned 3 [0049.360] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a33c, Length=0x8 | out: Destination=0x6b2ab8) [0049.360] lstrlenW (lpString="*.GIF") returned 5 [0049.360] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a344, Length=0xc | out: Destination=0x6b2ab8) [0049.360] lstrlenW (lpString="image/gif") returned 9 [0049.360] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a350, Length=0x14 | out: Destination=0x6b2ab8) [0049.361] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.361] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a37c, Length=0x28 | out: Destination=0x6b2ab8) [0049.361] lstrlenW (lpString="TIFF") returned 4 [0049.361] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a3a4, Length=0xa | out: Destination=0x6b2ab8) [0049.361] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.361] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a3ae, Length=0x1a | out: Destination=0x6b2ab8) [0049.361] lstrlenW (lpString="image/tiff") returned 10 [0049.361] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a3c8, Length=0x16 | out: Destination=0x6b2ab8) [0049.361] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.361] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a3e6, Length=0x26 | out: Destination=0x6b2ab8) [0049.361] lstrlenW (lpString="PNG") returned 3 [0049.361] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a40c, Length=0x8 | out: Destination=0x6b2ab8) [0049.361] lstrlenW (lpString="*.PNG") returned 5 [0049.361] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a414, Length=0xc | out: Destination=0x6b2ab8) [0049.362] lstrlenW (lpString="image/png") returned 9 [0049.362] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a420, Length=0x14 | out: Destination=0x6b2ab8) [0049.362] LocalFree (hMem=0x75a0b0) returned 0x0 [0049.362] GetLastError () returned 0x0 [0049.362] GdipSaveImageToStream (image=0x6bceb60, stream=0x492f650, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.370] GetLastError () returned 0x0 [0049.370] GdipCreateBitmapFromStream (stream=0x492f630, bitmap=0x46e1f0) returned 0x0 [0049.371] GetLastError () returned 0x0 [0049.371] GdipImageForceValidation (image=0x6c1b990) returned 0x0 [0049.371] GetLastError () returned 0x0 [0049.371] GdipGetImageRawFormat (image=0x6c1b990, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.371] GetLastError () returned 0x0 [0049.371] GdipBitmapLockBits (bitmap=0x6c1b990, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26e8f18) returned 0x0 [0049.371] GetLastError () returned 0x0 [0049.371] GdipBitmapUnlockBits (bitmap=0x6c1b990, lockedBitmapData=0x26e8f18) returned 0x0 [0049.371] GetLastError () returned 0x0 [0049.371] GdipGetImageWidth (image=0x6bceea8, width=0x46e1e8) returned 0x0 [0049.371] GetLastError () returned 0x0 [0049.371] GdipGetImageHeight (image=0x6bceea8, height=0x46e1e8) returned 0x0 [0049.371] GetLastError () returned 0x0 [0049.371] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.372] GetLastError () returned 0x0 [0049.372] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x75a4f8 [0049.372] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x75a4f8 | out: encoders=0x75a4f8) returned 0x0 [0049.372] GetLastError () returned 0x0 [0049.372] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.372] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a674, Length=0x26 | out: Destination=0x6b2ab8) [0049.372] lstrlenW (lpString="BMP") returned 3 [0049.372] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a69a, Length=0x8 | out: Destination=0x6b2ab8) [0049.372] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.372] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a6a2, Length=0x24 | out: Destination=0x6b2ab8) [0049.372] lstrlenW (lpString="image/bmp") returned 9 [0049.372] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a6c6, Length=0x14 | out: Destination=0x6b2ab8) [0049.372] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.372] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a6de, Length=0x28 | out: Destination=0x6b2ab8) [0049.373] lstrlenW (lpString="JPEG") returned 4 [0049.373] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a706, Length=0xa | out: Destination=0x6b2ab8) [0049.373] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.373] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a710, Length=0x34 | out: Destination=0x6b2ab8) [0049.373] lstrlenW (lpString="image/jpeg") returned 10 [0049.373] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a744, Length=0x16 | out: Destination=0x6b2ab8) [0049.373] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.373] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a75e, Length=0x26 | out: Destination=0x6b2ab8) [0049.373] lstrlenW (lpString="GIF") returned 3 [0049.373] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a784, Length=0x8 | out: Destination=0x6b2ab8) [0049.373] lstrlenW (lpString="*.GIF") returned 5 [0049.373] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a78c, Length=0xc | out: Destination=0x6b2ab8) [0049.373] lstrlenW (lpString="image/gif") returned 9 [0049.373] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a798, Length=0x14 | out: Destination=0x6b2ab8) [0049.374] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.374] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a7c4, Length=0x28 | out: Destination=0x6b2ab8) [0049.374] lstrlenW (lpString="TIFF") returned 4 [0049.374] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a7ec, Length=0xa | out: Destination=0x6b2ab8) [0049.374] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.374] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a7f6, Length=0x1a | out: Destination=0x6b2ab8) [0049.374] lstrlenW (lpString="image/tiff") returned 10 [0049.374] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a810, Length=0x16 | out: Destination=0x6b2ab8) [0049.374] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.374] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a82e, Length=0x26 | out: Destination=0x6b2ab8) [0049.374] lstrlenW (lpString="PNG") returned 3 [0049.374] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a854, Length=0x8 | out: Destination=0x6b2ab8) [0049.374] lstrlenW (lpString="*.PNG") returned 5 [0049.374] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a85c, Length=0xc | out: Destination=0x6b2ab8) [0049.374] lstrlenW (lpString="image/png") returned 9 [0049.374] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75a868, Length=0x14 | out: Destination=0x6b2ab8) [0049.375] LocalFree (hMem=0x75a4f8) returned 0x0 [0049.375] GetLastError () returned 0x0 [0049.375] GdipSaveImageToStream (image=0x6bceea8, stream=0x492f610, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.383] GetLastError () returned 0x0 [0049.384] GdipCreateBitmapFromStream (stream=0x492f5f0, bitmap=0x46e1f0) returned 0x0 [0049.384] GetLastError () returned 0x0 [0049.384] GdipImageForceValidation (image=0x6c1c6b0) returned 0x0 [0049.385] GetLastError () returned 0x0 [0049.385] GdipGetImageRawFormat (image=0x6c1c6b0, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.385] GetLastError () returned 0x0 [0049.385] GdipBitmapLockBits (bitmap=0x6c1c6b0, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26f1dcc) returned 0x0 [0049.385] GetLastError () returned 0x0 [0049.385] GdipBitmapUnlockBits (bitmap=0x6c1c6b0, lockedBitmapData=0x26f1dcc) returned 0x0 [0049.385] GetLastError () returned 0x0 [0049.385] GdipGetImageWidth (image=0x6bcf880, width=0x46e1e8) returned 0x0 [0049.385] GetLastError () returned 0x0 [0049.385] GdipGetImageHeight (image=0x6bcf880, height=0x46e1e8) returned 0x0 [0049.385] GetLastError () returned 0x0 [0049.385] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.385] GetLastError () returned 0x0 [0049.385] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x757a28 [0049.386] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x757a28 | out: encoders=0x757a28) returned 0x0 [0049.386] GetLastError () returned 0x0 [0049.386] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.386] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757ba4, Length=0x26 | out: Destination=0x6b2ab8) [0049.386] lstrlenW (lpString="BMP") returned 3 [0049.386] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757bca, Length=0x8 | out: Destination=0x6b2ab8) [0049.386] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.386] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757bd2, Length=0x24 | out: Destination=0x6b2ab8) [0049.386] lstrlenW (lpString="image/bmp") returned 9 [0049.386] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757bf6, Length=0x14 | out: Destination=0x6b2ab8) [0049.386] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.386] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c0e, Length=0x28 | out: Destination=0x6b2ab8) [0049.386] lstrlenW (lpString="JPEG") returned 4 [0049.386] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c36, Length=0xa | out: Destination=0x6b2ab8) [0049.386] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.387] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c40, Length=0x34 | out: Destination=0x6b2ab8) [0049.387] lstrlenW (lpString="image/jpeg") returned 10 [0049.387] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c74, Length=0x16 | out: Destination=0x6b2ab8) [0049.387] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.387] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c8e, Length=0x26 | out: Destination=0x6b2ab8) [0049.387] lstrlenW (lpString="GIF") returned 3 [0049.387] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757cb4, Length=0x8 | out: Destination=0x6b2ab8) [0049.387] lstrlenW (lpString="*.GIF") returned 5 [0049.387] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757cbc, Length=0xc | out: Destination=0x6b2ab8) [0049.387] lstrlenW (lpString="image/gif") returned 9 [0049.387] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757cc8, Length=0x14 | out: Destination=0x6b2ab8) [0049.387] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.387] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757cf4, Length=0x28 | out: Destination=0x6b2ab8) [0049.387] lstrlenW (lpString="TIFF") returned 4 [0049.388] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d1c, Length=0xa | out: Destination=0x6b2ab8) [0049.388] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.388] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d26, Length=0x1a | out: Destination=0x6b2ab8) [0049.388] lstrlenW (lpString="image/tiff") returned 10 [0049.388] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d40, Length=0x16 | out: Destination=0x6b2ab8) [0049.388] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.388] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d5e, Length=0x26 | out: Destination=0x6b2ab8) [0049.388] lstrlenW (lpString="PNG") returned 3 [0049.388] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d84, Length=0x8 | out: Destination=0x6b2ab8) [0049.388] lstrlenW (lpString="*.PNG") returned 5 [0049.388] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d8c, Length=0xc | out: Destination=0x6b2ab8) [0049.388] lstrlenW (lpString="image/png") returned 9 [0049.388] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d98, Length=0x14 | out: Destination=0x6b2ab8) [0049.388] LocalFree (hMem=0x757a28) returned 0x0 [0049.388] GetLastError () returned 0x0 [0049.389] GdipSaveImageToStream (image=0x6bcf880, stream=0x492f5d0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.397] GetLastError () returned 0x0 [0049.397] GdipCreateBitmapFromStream (stream=0x492f5b0, bitmap=0x46e1f0) returned 0x0 [0049.398] GetLastError () returned 0x0 [0049.398] GdipImageForceValidation (image=0x6c1cd40) returned 0x0 [0049.399] GetLastError () returned 0x0 [0049.399] GdipGetImageRawFormat (image=0x6c1cd40, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.399] GetLastError () returned 0x0 [0049.399] GdipBitmapLockBits (bitmap=0x6c1cd40, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x26fac80) returned 0x0 [0049.399] GetLastError () returned 0x0 [0049.399] GdipBitmapUnlockBits (bitmap=0x6c1cd40, lockedBitmapData=0x26fac80) returned 0x0 [0049.399] GetLastError () returned 0x0 [0049.399] GdipGetImageWidth (image=0x6bd08e8, width=0x46e1e8) returned 0x0 [0049.399] GetLastError () returned 0x0 [0049.399] GdipGetImageHeight (image=0x6bd08e8, height=0x46e1e8) returned 0x0 [0049.399] GetLastError () returned 0x0 [0049.399] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.399] GetLastError () returned 0x0 [0049.399] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x7593d8 [0049.399] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x7593d8 | out: encoders=0x7593d8) returned 0x0 [0049.399] GetLastError () returned 0x0 [0049.399] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.399] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759554, Length=0x26 | out: Destination=0x6b2ab8) [0049.400] lstrlenW (lpString="BMP") returned 3 [0049.400] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75957a, Length=0x8 | out: Destination=0x6b2ab8) [0049.400] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.400] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759582, Length=0x24 | out: Destination=0x6b2ab8) [0049.400] lstrlenW (lpString="image/bmp") returned 9 [0049.400] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7595a6, Length=0x14 | out: Destination=0x6b2ab8) [0049.400] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.400] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7595be, Length=0x28 | out: Destination=0x6b2ab8) [0049.400] lstrlenW (lpString="JPEG") returned 4 [0049.400] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7595e6, Length=0xa | out: Destination=0x6b2ab8) [0049.400] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.400] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7595f0, Length=0x34 | out: Destination=0x6b2ab8) [0049.400] lstrlenW (lpString="image/jpeg") returned 10 [0049.400] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759624, Length=0x16 | out: Destination=0x6b2ab8) [0049.401] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.401] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75963e, Length=0x26 | out: Destination=0x6b2ab8) [0049.401] lstrlenW (lpString="GIF") returned 3 [0049.401] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759664, Length=0x8 | out: Destination=0x6b2ab8) [0049.401] lstrlenW (lpString="*.GIF") returned 5 [0049.401] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75966c, Length=0xc | out: Destination=0x6b2ab8) [0049.401] lstrlenW (lpString="image/gif") returned 9 [0049.401] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759678, Length=0x14 | out: Destination=0x6b2ab8) [0049.401] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.401] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7596a4, Length=0x28 | out: Destination=0x6b2ab8) [0049.401] lstrlenW (lpString="TIFF") returned 4 [0049.401] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7596cc, Length=0xa | out: Destination=0x6b2ab8) [0049.401] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.401] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7596d6, Length=0x1a | out: Destination=0x6b2ab8) [0049.401] lstrlenW (lpString="image/tiff") returned 10 [0049.402] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7596f0, Length=0x16 | out: Destination=0x6b2ab8) [0049.402] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.402] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75970e, Length=0x26 | out: Destination=0x6b2ab8) [0049.402] lstrlenW (lpString="PNG") returned 3 [0049.402] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759734, Length=0x8 | out: Destination=0x6b2ab8) [0049.402] lstrlenW (lpString="*.PNG") returned 5 [0049.402] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75973c, Length=0xc | out: Destination=0x6b2ab8) [0049.402] lstrlenW (lpString="image/png") returned 9 [0049.402] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759748, Length=0x14 | out: Destination=0x6b2ab8) [0049.402] LocalFree (hMem=0x7593d8) returned 0x0 [0049.402] GetLastError () returned 0x0 [0049.403] GdipSaveImageToStream (image=0x6bd08e8, stream=0x492f590, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.410] GetLastError () returned 0x0 [0049.420] GdipCreateBitmapFromStream (stream=0x492f570, bitmap=0x46e1f0) returned 0x0 [0049.420] GetLastError () returned 0x0 [0049.421] GdipImageForceValidation (image=0x6c19578) returned 0x0 [0049.421] GetLastError () returned 0x0 [0049.421] GdipGetImageRawFormat (image=0x6c19578, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.421] GetLastError () returned 0x0 [0049.421] GdipBitmapLockBits (bitmap=0x6c19578, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x2703b34) returned 0x0 [0049.421] GetLastError () returned 0x0 [0049.421] GdipBitmapUnlockBits (bitmap=0x6c19578, lockedBitmapData=0x2703b34) returned 0x0 [0049.421] GetLastError () returned 0x0 [0049.421] GdipGetImageWidth (image=0x6bd0258, width=0x46e1e8) returned 0x0 [0049.421] GetLastError () returned 0x0 [0049.422] GdipGetImageHeight (image=0x6bd0258, height=0x46e1e8) returned 0x0 [0049.422] GetLastError () returned 0x0 [0049.422] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.422] GetLastError () returned 0x0 [0049.422] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x758700 [0049.422] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x758700 | out: encoders=0x758700) returned 0x0 [0049.422] GetLastError () returned 0x0 [0049.422] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.422] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75887c, Length=0x26 | out: Destination=0x6b2ab8) [0049.422] lstrlenW (lpString="BMP") returned 3 [0049.422] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7588a2, Length=0x8 | out: Destination=0x6b2ab8) [0049.422] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.422] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7588aa, Length=0x24 | out: Destination=0x6b2ab8) [0049.422] lstrlenW (lpString="image/bmp") returned 9 [0049.422] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7588ce, Length=0x14 | out: Destination=0x6b2ab8) [0049.423] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.423] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7588e6, Length=0x28 | out: Destination=0x6b2ab8) [0049.423] lstrlenW (lpString="JPEG") returned 4 [0049.423] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75890e, Length=0xa | out: Destination=0x6b2ab8) [0049.423] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.423] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758918, Length=0x34 | out: Destination=0x6b2ab8) [0049.423] lstrlenW (lpString="image/jpeg") returned 10 [0049.423] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75894c, Length=0x16 | out: Destination=0x6b2ab8) [0049.423] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.423] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758966, Length=0x26 | out: Destination=0x6b2ab8) [0049.423] lstrlenW (lpString="GIF") returned 3 [0049.423] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75898c, Length=0x8 | out: Destination=0x6b2ab8) [0049.423] lstrlenW (lpString="*.GIF") returned 5 [0049.423] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758994, Length=0xc | out: Destination=0x6b2ab8) [0049.423] lstrlenW (lpString="image/gif") returned 9 [0049.423] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7589a0, Length=0x14 | out: Destination=0x6b2ab8) [0049.424] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.424] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7589cc, Length=0x28 | out: Destination=0x6b2ab8) [0049.424] lstrlenW (lpString="TIFF") returned 4 [0049.424] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7589f4, Length=0xa | out: Destination=0x6b2ab8) [0049.424] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.424] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7589fe, Length=0x1a | out: Destination=0x6b2ab8) [0049.424] lstrlenW (lpString="image/tiff") returned 10 [0049.424] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758a18, Length=0x16 | out: Destination=0x6b2ab8) [0049.424] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.424] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758a36, Length=0x26 | out: Destination=0x6b2ab8) [0049.424] lstrlenW (lpString="PNG") returned 3 [0049.424] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758a5c, Length=0x8 | out: Destination=0x6b2ab8) [0049.424] lstrlenW (lpString="*.PNG") returned 5 [0049.424] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758a64, Length=0xc | out: Destination=0x6b2ab8) [0049.425] lstrlenW (lpString="image/png") returned 9 [0049.425] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758a70, Length=0x14 | out: Destination=0x6b2ab8) [0049.425] LocalFree (hMem=0x758700) returned 0x0 [0049.425] GetLastError () returned 0x0 [0049.425] GdipSaveImageToStream (image=0x6bd0258, stream=0x492f550, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.433] GetLastError () returned 0x0 [0049.434] GdipCreateBitmapFromStream (stream=0x492f530, bitmap=0x46e1f0) returned 0x0 [0049.434] GetLastError () returned 0x0 [0049.434] GdipImageForceValidation (image=0x6c1afb8) returned 0x0 [0049.435] GetLastError () returned 0x0 [0049.435] GdipGetImageRawFormat (image=0x6c1afb8, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.435] GetLastError () returned 0x0 [0049.435] GdipBitmapLockBits (bitmap=0x6c1afb8, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x270c9f4) returned 0x0 [0049.435] GetLastError () returned 0x0 [0049.435] GdipBitmapUnlockBits (bitmap=0x6c1afb8, lockedBitmapData=0x270c9f4) returned 0x0 [0049.435] GetLastError () returned 0x0 [0049.435] GdipGetImageWidth (image=0x6bcf1f0, width=0x46e1e8) returned 0x0 [0049.435] GetLastError () returned 0x0 [0049.435] GdipGetImageHeight (image=0x6bcf1f0, height=0x46e1e8) returned 0x0 [0049.435] GetLastError () returned 0x0 [0049.435] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.435] GetLastError () returned 0x0 [0049.435] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x757a28 [0049.435] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x757a28 | out: encoders=0x757a28) returned 0x0 [0049.436] GetLastError () returned 0x0 [0049.436] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.436] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757ba4, Length=0x26 | out: Destination=0x6b2ab8) [0049.436] lstrlenW (lpString="BMP") returned 3 [0049.436] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757bca, Length=0x8 | out: Destination=0x6b2ab8) [0049.436] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.436] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757bd2, Length=0x24 | out: Destination=0x6b2ab8) [0049.436] lstrlenW (lpString="image/bmp") returned 9 [0049.436] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757bf6, Length=0x14 | out: Destination=0x6b2ab8) [0049.436] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.436] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c0e, Length=0x28 | out: Destination=0x6b2ab8) [0049.436] lstrlenW (lpString="JPEG") returned 4 [0049.436] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c36, Length=0xa | out: Destination=0x6b2ab8) [0049.436] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.436] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c40, Length=0x34 | out: Destination=0x6b2ab8) [0049.437] lstrlenW (lpString="image/jpeg") returned 10 [0049.437] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c74, Length=0x16 | out: Destination=0x6b2ab8) [0049.437] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.437] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757c8e, Length=0x26 | out: Destination=0x6b2ab8) [0049.437] lstrlenW (lpString="GIF") returned 3 [0049.437] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757cb4, Length=0x8 | out: Destination=0x6b2ab8) [0049.437] lstrlenW (lpString="*.GIF") returned 5 [0049.437] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757cbc, Length=0xc | out: Destination=0x6b2ab8) [0049.437] lstrlenW (lpString="image/gif") returned 9 [0049.437] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757cc8, Length=0x14 | out: Destination=0x6b2ab8) [0049.437] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.437] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757cf4, Length=0x28 | out: Destination=0x6b2ab8) [0049.437] lstrlenW (lpString="TIFF") returned 4 [0049.437] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d1c, Length=0xa | out: Destination=0x6b2ab8) [0049.438] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.438] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d26, Length=0x1a | out: Destination=0x6b2ab8) [0049.438] lstrlenW (lpString="image/tiff") returned 10 [0049.438] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d40, Length=0x16 | out: Destination=0x6b2ab8) [0049.438] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.438] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d5e, Length=0x26 | out: Destination=0x6b2ab8) [0049.438] lstrlenW (lpString="PNG") returned 3 [0049.438] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d84, Length=0x8 | out: Destination=0x6b2ab8) [0049.438] lstrlenW (lpString="*.PNG") returned 5 [0049.438] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d8c, Length=0xc | out: Destination=0x6b2ab8) [0049.438] lstrlenW (lpString="image/png") returned 9 [0049.438] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x757d98, Length=0x14 | out: Destination=0x6b2ab8) [0049.438] LocalFree (hMem=0x757a28) returned 0x0 [0049.438] GetLastError () returned 0x0 [0049.439] GdipSaveImageToStream (image=0x6bcf1f0, stream=0x492f510, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.447] GetLastError () returned 0x0 [0049.447] GdipCreateBitmapFromStream (stream=0x492f4f0, bitmap=0x46e1f0) returned 0x0 [0049.448] GetLastError () returned 0x0 [0049.448] GdipImageForceValidation (image=0x6c1bcd8) returned 0x0 [0049.449] GetLastError () returned 0x0 [0049.449] GdipGetImageRawFormat (image=0x6c1bcd8, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.449] GetLastError () returned 0x0 [0049.449] GdipBitmapLockBits (bitmap=0x6c1bcd8, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x27158a8) returned 0x0 [0049.449] GetLastError () returned 0x0 [0049.449] GdipBitmapUnlockBits (bitmap=0x6c1bcd8, lockedBitmapData=0x27158a8) returned 0x0 [0049.449] GetLastError () returned 0x0 [0049.449] GdipGetImageWidth (image=0x6bcfbc8, width=0x46e1e8) returned 0x0 [0049.449] GetLastError () returned 0x0 [0049.449] GdipGetImageHeight (image=0x6bcfbc8, height=0x46e1e8) returned 0x0 [0049.449] GetLastError () returned 0x0 [0049.449] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.449] GetLastError () returned 0x0 [0049.449] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x759820 [0049.449] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x759820 | out: encoders=0x759820) returned 0x0 [0049.449] GetLastError () returned 0x0 [0049.449] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.449] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75999c, Length=0x26 | out: Destination=0x6b2ab8) [0049.450] lstrlenW (lpString="BMP") returned 3 [0049.450] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7599c2, Length=0x8 | out: Destination=0x6b2ab8) [0049.450] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.450] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7599ca, Length=0x24 | out: Destination=0x6b2ab8) [0049.450] lstrlenW (lpString="image/bmp") returned 9 [0049.450] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7599ee, Length=0x14 | out: Destination=0x6b2ab8) [0049.450] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.450] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759a06, Length=0x28 | out: Destination=0x6b2ab8) [0049.450] lstrlenW (lpString="JPEG") returned 4 [0049.450] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759a2e, Length=0xa | out: Destination=0x6b2ab8) [0049.450] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.450] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759a38, Length=0x34 | out: Destination=0x6b2ab8) [0049.450] lstrlenW (lpString="image/jpeg") returned 10 [0049.450] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759a6c, Length=0x16 | out: Destination=0x6b2ab8) [0049.450] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.451] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759a86, Length=0x26 | out: Destination=0x6b2ab8) [0049.451] lstrlenW (lpString="GIF") returned 3 [0049.451] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759aac, Length=0x8 | out: Destination=0x6b2ab8) [0049.451] lstrlenW (lpString="*.GIF") returned 5 [0049.451] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759ab4, Length=0xc | out: Destination=0x6b2ab8) [0049.451] lstrlenW (lpString="image/gif") returned 9 [0049.451] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759ac0, Length=0x14 | out: Destination=0x6b2ab8) [0049.451] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.451] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759aec, Length=0x28 | out: Destination=0x6b2ab8) [0049.451] lstrlenW (lpString="TIFF") returned 4 [0049.451] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759b14, Length=0xa | out: Destination=0x6b2ab8) [0049.451] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.451] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759b1e, Length=0x1a | out: Destination=0x6b2ab8) [0049.451] lstrlenW (lpString="image/tiff") returned 10 [0049.451] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759b38, Length=0x16 | out: Destination=0x6b2ab8) [0049.452] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.452] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759b56, Length=0x26 | out: Destination=0x6b2ab8) [0049.452] lstrlenW (lpString="PNG") returned 3 [0049.452] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759b7c, Length=0x8 | out: Destination=0x6b2ab8) [0049.452] lstrlenW (lpString="*.PNG") returned 5 [0049.452] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759b84, Length=0xc | out: Destination=0x6b2ab8) [0049.452] lstrlenW (lpString="image/png") returned 9 [0049.452] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759b90, Length=0x14 | out: Destination=0x6b2ab8) [0049.452] LocalFree (hMem=0x759820) returned 0x0 [0049.452] GetLastError () returned 0x0 [0049.453] GdipSaveImageToStream (image=0x6bcfbc8, stream=0x492f4d0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.460] GetLastError () returned 0x0 [0049.461] GdipCreateBitmapFromStream (stream=0x492f4b0, bitmap=0x46e1f0) returned 0x0 [0049.461] GetLastError () returned 0x0 [0049.462] GdipImageForceValidation (image=0x6c1a928) returned 0x0 [0049.462] GetLastError () returned 0x0 [0049.462] GdipGetImageRawFormat (image=0x6c1a928, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.462] GetLastError () returned 0x0 [0049.462] GdipBitmapLockBits (bitmap=0x6c1a928, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x271e768) returned 0x0 [0049.462] GetLastError () returned 0x0 [0049.462] GdipBitmapUnlockBits (bitmap=0x6c1a928, lockedBitmapData=0x271e768) returned 0x0 [0049.462] GetLastError () returned 0x0 [0049.462] GdipGetImageWidth (image=0x6bcff10, width=0x46e1e8) returned 0x0 [0049.462] GetLastError () returned 0x0 [0049.462] GdipGetImageHeight (image=0x6bcff10, height=0x46e1e8) returned 0x0 [0049.462] GetLastError () returned 0x0 [0049.462] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.462] GetLastError () returned 0x0 [0049.463] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x7593d8 [0049.463] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x7593d8 | out: encoders=0x7593d8) returned 0x0 [0049.463] GetLastError () returned 0x0 [0049.463] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.463] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759554, Length=0x26 | out: Destination=0x6b2ab8) [0049.463] lstrlenW (lpString="BMP") returned 3 [0049.463] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75957a, Length=0x8 | out: Destination=0x6b2ab8) [0049.463] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.463] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759582, Length=0x24 | out: Destination=0x6b2ab8) [0049.463] lstrlenW (lpString="image/bmp") returned 9 [0049.463] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7595a6, Length=0x14 | out: Destination=0x6b2ab8) [0049.463] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.463] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7595be, Length=0x28 | out: Destination=0x6b2ab8) [0049.464] lstrlenW (lpString="JPEG") returned 4 [0049.464] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7595e6, Length=0xa | out: Destination=0x6b2ab8) [0049.464] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.464] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7595f0, Length=0x34 | out: Destination=0x6b2ab8) [0049.464] lstrlenW (lpString="image/jpeg") returned 10 [0049.464] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759624, Length=0x16 | out: Destination=0x6b2ab8) [0049.464] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.464] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75963e, Length=0x26 | out: Destination=0x6b2ab8) [0049.464] lstrlenW (lpString="GIF") returned 3 [0049.464] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759664, Length=0x8 | out: Destination=0x6b2ab8) [0049.464] lstrlenW (lpString="*.GIF") returned 5 [0049.464] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75966c, Length=0xc | out: Destination=0x6b2ab8) [0049.464] lstrlenW (lpString="image/gif") returned 9 [0049.464] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759678, Length=0x14 | out: Destination=0x6b2ab8) [0049.465] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.465] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7596a4, Length=0x28 | out: Destination=0x6b2ab8) [0049.465] lstrlenW (lpString="TIFF") returned 4 [0049.465] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7596cc, Length=0xa | out: Destination=0x6b2ab8) [0049.465] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.465] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7596d6, Length=0x1a | out: Destination=0x6b2ab8) [0049.465] lstrlenW (lpString="image/tiff") returned 10 [0049.465] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7596f0, Length=0x16 | out: Destination=0x6b2ab8) [0049.465] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.465] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75970e, Length=0x26 | out: Destination=0x6b2ab8) [0049.465] lstrlenW (lpString="PNG") returned 3 [0049.465] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759734, Length=0x8 | out: Destination=0x6b2ab8) [0049.465] lstrlenW (lpString="*.PNG") returned 5 [0049.465] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75973c, Length=0xc | out: Destination=0x6b2ab8) [0049.465] lstrlenW (lpString="image/png") returned 9 [0049.465] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759748, Length=0x14 | out: Destination=0x6b2ab8) [0049.466] LocalFree (hMem=0x7593d8) returned 0x0 [0049.466] GetLastError () returned 0x0 [0049.466] GdipSaveImageToStream (image=0x6bcff10, stream=0x492f490, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.474] GetLastError () returned 0x0 [0049.475] GdipCreateBitmapFromStream (stream=0x492f470, bitmap=0x46e1f0) returned 0x0 [0049.475] GetLastError () returned 0x0 [0049.476] GdipImageForceValidation (image=0x6c1a298) returned 0x0 [0049.476] GetLastError () returned 0x0 [0049.476] GdipGetImageRawFormat (image=0x6c1a298, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.476] GetLastError () returned 0x0 [0049.476] GdipBitmapLockBits (bitmap=0x6c1a298, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x2727628) returned 0x0 [0049.476] GetLastError () returned 0x0 [0049.476] GdipBitmapUnlockBits (bitmap=0x6c1a298, lockedBitmapData=0x2727628) returned 0x0 [0049.476] GetLastError () returned 0x0 [0049.476] GdipGetImageWidth (image=0x6bd05a0, width=0x46e1e8) returned 0x0 [0049.476] GetLastError () returned 0x0 [0049.476] GdipGetImageHeight (image=0x6bd05a0, height=0x46e1e8) returned 0x0 [0049.476] GetLastError () returned 0x0 [0049.476] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.476] GetLastError () returned 0x0 [0049.476] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x75a940 [0049.477] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x75a940 | out: encoders=0x75a940) returned 0x0 [0049.477] GetLastError () returned 0x0 [0049.477] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.477] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75aabc, Length=0x26 | out: Destination=0x6b2ab8) [0049.477] lstrlenW (lpString="BMP") returned 3 [0049.477] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75aae2, Length=0x8 | out: Destination=0x6b2ab8) [0049.477] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.477] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75aaea, Length=0x24 | out: Destination=0x6b2ab8) [0049.477] lstrlenW (lpString="image/bmp") returned 9 [0049.477] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ab0e, Length=0x14 | out: Destination=0x6b2ab8) [0049.477] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.477] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ab26, Length=0x28 | out: Destination=0x6b2ab8) [0049.477] lstrlenW (lpString="JPEG") returned 4 [0049.478] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ab4e, Length=0xa | out: Destination=0x6b2ab8) [0049.478] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.478] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ab58, Length=0x34 | out: Destination=0x6b2ab8) [0049.478] lstrlenW (lpString="image/jpeg") returned 10 [0049.478] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ab8c, Length=0x16 | out: Destination=0x6b2ab8) [0049.478] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.478] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75aba6, Length=0x26 | out: Destination=0x6b2ab8) [0049.478] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75abcc, Length=0x8 | out: Destination=0x6b2ab8) [0049.478] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75abd4, Length=0xc | out: Destination=0x6b2ab8) [0049.478] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75abe0, Length=0x14 | out: Destination=0x6b2ab8) [0049.478] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.478] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ac0c, Length=0x28 | out: Destination=0x6b2ab8) [0049.478] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ac34, Length=0xa | out: Destination=0x6b2ab8) [0049.478] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ac3e, Length=0x1a | out: Destination=0x6b2ab8) [0049.479] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ac58, Length=0x16 | out: Destination=0x6b2ab8) [0049.479] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.479] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ac76, Length=0x26 | out: Destination=0x6b2ab8) [0049.479] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75ac9c, Length=0x8 | out: Destination=0x6b2ab8) [0049.479] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75aca4, Length=0xc | out: Destination=0x6b2ab8) [0049.479] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75acb0, Length=0x14 | out: Destination=0x6b2ab8) [0049.479] LocalFree (hMem=0x75a940) returned 0x0 [0049.479] GetLastError () returned 0x0 [0049.479] GdipSaveImageToStream (image=0x6bd05a0, stream=0x492f450, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.487] GetLastError () returned 0x0 [0049.487] GdipCreateBitmapFromStream (stream=0x492f430, bitmap=0x46e1f0) returned 0x0 [0049.488] GetLastError () returned 0x0 [0049.488] GdipImageForceValidation (image=0x6c19c08) returned 0x0 [0049.489] GetLastError () returned 0x0 [0049.489] GdipGetImageRawFormat (image=0x6c19c08, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.489] GetLastError () returned 0x0 [0049.489] GdipBitmapLockBits (bitmap=0x6c19c08, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x27304f4) returned 0x0 [0049.489] GetLastError () returned 0x0 [0049.490] GdipBitmapUnlockBits (bitmap=0x6c19c08, lockedBitmapData=0x27304f4) returned 0x0 [0049.490] GetLastError () returned 0x0 [0049.490] GdipGetImageWidth (image=0x6bce4d0, width=0x46e1e8) returned 0x0 [0049.490] GetLastError () returned 0x0 [0049.490] GdipGetImageHeight (image=0x6bce4d0, height=0x46e1e8) returned 0x0 [0049.490] GetLastError () returned 0x0 [0049.490] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.490] GetLastError () returned 0x0 [0049.490] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x759c68 [0049.490] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x759c68 | out: encoders=0x759c68) returned 0x0 [0049.490] GetLastError () returned 0x0 [0049.490] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.490] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759de4, Length=0x26 | out: Destination=0x6b2ab8) [0049.490] lstrlenW (lpString="BMP") returned 3 [0049.490] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759e0a, Length=0x8 | out: Destination=0x6b2ab8) [0049.490] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.490] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759e12, Length=0x24 | out: Destination=0x6b2ab8) [0049.490] lstrlenW (lpString="image/bmp") returned 9 [0049.491] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759e36, Length=0x14 | out: Destination=0x6b2ab8) [0049.491] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.491] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759e4e, Length=0x28 | out: Destination=0x6b2ab8) [0049.491] lstrlenW (lpString="JPEG") returned 4 [0049.491] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759e76, Length=0xa | out: Destination=0x6b2ab8) [0049.491] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.491] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759e80, Length=0x34 | out: Destination=0x6b2ab8) [0049.491] lstrlenW (lpString="image/jpeg") returned 10 [0049.491] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759eb4, Length=0x16 | out: Destination=0x6b2ab8) [0049.491] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.491] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759ece, Length=0x26 | out: Destination=0x6b2ab8) [0049.491] lstrlenW (lpString="GIF") returned 3 [0049.491] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759ef4, Length=0x8 | out: Destination=0x6b2ab8) [0049.491] lstrlenW (lpString="*.GIF") returned 5 [0049.491] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759efc, Length=0xc | out: Destination=0x6b2ab8) [0049.492] lstrlenW (lpString="image/gif") returned 9 [0049.492] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759f08, Length=0x14 | out: Destination=0x6b2ab8) [0049.492] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.492] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759f34, Length=0x28 | out: Destination=0x6b2ab8) [0049.492] lstrlenW (lpString="TIFF") returned 4 [0049.492] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759f5c, Length=0xa | out: Destination=0x6b2ab8) [0049.492] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.492] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759f66, Length=0x1a | out: Destination=0x6b2ab8) [0049.492] lstrlenW (lpString="image/tiff") returned 10 [0049.492] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759f80, Length=0x16 | out: Destination=0x6b2ab8) [0049.492] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.492] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759f9e, Length=0x26 | out: Destination=0x6b2ab8) [0049.492] lstrlenW (lpString="PNG") returned 3 [0049.492] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759fc4, Length=0x8 | out: Destination=0x6b2ab8) [0049.493] lstrlenW (lpString="*.PNG") returned 5 [0049.493] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759fcc, Length=0xc | out: Destination=0x6b2ab8) [0049.493] lstrlenW (lpString="image/png") returned 9 [0049.493] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x759fd8, Length=0x14 | out: Destination=0x6b2ab8) [0049.493] LocalFree (hMem=0x759c68) returned 0x0 [0049.493] GetLastError () returned 0x0 [0049.493] GdipSaveImageToStream (image=0x6bce4d0, stream=0x492f410, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.501] GetLastError () returned 0x0 [0049.501] GdipCreateBitmapFromStream (stream=0x492f3f0, bitmap=0x46e1f0) returned 0x0 [0049.502] GetLastError () returned 0x0 [0049.502] GdipImageForceValidation (image=0x6c1c020) returned 0x0 [0049.503] GetLastError () returned 0x0 [0049.503] GdipGetImageRawFormat (image=0x6c1c020, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.503] GetLastError () returned 0x0 [0049.503] GdipBitmapLockBits (bitmap=0x6c1c020, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x27393a8) returned 0x0 [0049.503] GetLastError () returned 0x0 [0049.503] GdipBitmapUnlockBits (bitmap=0x6c1c020, lockedBitmapData=0x27393a8) returned 0x0 [0049.503] GetLastError () returned 0x0 [0049.503] GdipGetImageWidth (image=0x6bd0c30, width=0x46e1e8) returned 0x0 [0049.503] GetLastError () returned 0x0 [0049.503] GdipGetImageHeight (image=0x6bd0c30, height=0x46e1e8) returned 0x0 [0049.503] GetLastError () returned 0x0 [0049.503] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.503] GetLastError () returned 0x0 [0049.503] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x7582b8 [0049.503] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x7582b8 | out: encoders=0x7582b8) returned 0x0 [0049.503] GetLastError () returned 0x0 [0049.503] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.503] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758434, Length=0x26 | out: Destination=0x6b2ab8) [0049.503] lstrlenW (lpString="BMP") returned 3 [0049.503] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75845a, Length=0x8 | out: Destination=0x6b2ab8) [0049.504] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.504] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758462, Length=0x24 | out: Destination=0x6b2ab8) [0049.504] lstrlenW (lpString="image/bmp") returned 9 [0049.504] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758486, Length=0x14 | out: Destination=0x6b2ab8) [0049.504] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.504] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75849e, Length=0x28 | out: Destination=0x6b2ab8) [0049.504] lstrlenW (lpString="JPEG") returned 4 [0049.504] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584c6, Length=0xa | out: Destination=0x6b2ab8) [0049.504] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.504] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7584d0, Length=0x34 | out: Destination=0x6b2ab8) [0049.504] lstrlenW (lpString="image/jpeg") returned 10 [0049.504] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758504, Length=0x16 | out: Destination=0x6b2ab8) [0049.505] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.505] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75851e, Length=0x26 | out: Destination=0x6b2ab8) [0049.505] lstrlenW (lpString="GIF") returned 3 [0049.505] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758544, Length=0x8 | out: Destination=0x6b2ab8) [0049.505] lstrlenW (lpString="*.GIF") returned 5 [0049.505] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75854c, Length=0xc | out: Destination=0x6b2ab8) [0049.505] lstrlenW (lpString="image/gif") returned 9 [0049.505] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758558, Length=0x14 | out: Destination=0x6b2ab8) [0049.505] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.505] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758584, Length=0x28 | out: Destination=0x6b2ab8) [0049.505] lstrlenW (lpString="TIFF") returned 4 [0049.505] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ac, Length=0xa | out: Destination=0x6b2ab8) [0049.505] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.505] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585b6, Length=0x1a | out: Destination=0x6b2ab8) [0049.506] lstrlenW (lpString="image/tiff") returned 10 [0049.506] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585d0, Length=0x16 | out: Destination=0x6b2ab8) [0049.506] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.506] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x7585ee, Length=0x26 | out: Destination=0x6b2ab8) [0049.506] lstrlenW (lpString="PNG") returned 3 [0049.506] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758614, Length=0x8 | out: Destination=0x6b2ab8) [0049.506] lstrlenW (lpString="*.PNG") returned 5 [0049.506] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x75861c, Length=0xc | out: Destination=0x6b2ab8) [0049.506] lstrlenW (lpString="image/png") returned 9 [0049.506] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758628, Length=0x14 | out: Destination=0x6b2ab8) [0049.506] LocalFree (hMem=0x7582b8) returned 0x0 [0049.506] GetLastError () returned 0x0 [0049.507] GdipSaveImageToStream (image=0x6bd0c30, stream=0x492f3d0, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.514] GetLastError () returned 0x0 [0049.515] GdipCreateBitmapFromStream (stream=0x492f3b0, bitmap=0x46e1f0) returned 0x0 [0049.515] GetLastError () returned 0x0 [0049.515] GdipImageForceValidation (image=0x6c19f50) returned 0x0 [0049.516] GetLastError () returned 0x0 [0049.516] GdipGetImageRawFormat (image=0x6c19f50, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.516] GetLastError () returned 0x0 [0049.516] GdipBitmapLockBits (bitmap=0x6c19f50, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x2742268) returned 0x0 [0049.516] GetLastError () returned 0x0 [0049.516] GdipBitmapUnlockBits (bitmap=0x6c19f50, lockedBitmapData=0x2742268) returned 0x0 [0049.516] GetLastError () returned 0x0 [0049.516] GdipGetImageWidth (image=0x6bd1c98, width=0x46e1e8) returned 0x0 [0049.516] GetLastError () returned 0x0 [0049.516] GdipGetImageHeight (image=0x6bd1c98, height=0x46e1e8) returned 0x0 [0049.516] GetLastError () returned 0x0 [0049.516] GdipGetImageEncodersSize (numEncoders=0x46e198, size=0x46e194) returned 0x0 [0049.516] GetLastError () returned 0x0 [0049.516] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x758b48 [0049.517] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x758b48 | out: encoders=0x758b48) returned 0x0 [0049.517] GetLastError () returned 0x0 [0049.517] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0049.517] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cc4, Length=0x26 | out: Destination=0x6b2ab8) [0049.517] lstrlenW (lpString="BMP") returned 3 [0049.517] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cea, Length=0x8 | out: Destination=0x6b2ab8) [0049.517] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0049.517] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758cf2, Length=0x24 | out: Destination=0x6b2ab8) [0049.517] lstrlenW (lpString="image/bmp") returned 9 [0049.517] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d16, Length=0x14 | out: Destination=0x6b2ab8) [0049.517] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0049.517] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d2e, Length=0x28 | out: Destination=0x6b2ab8) [0049.517] lstrlenW (lpString="JPEG") returned 4 [0049.517] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d56, Length=0xa | out: Destination=0x6b2ab8) [0049.518] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0049.518] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d60, Length=0x34 | out: Destination=0x6b2ab8) [0049.518] lstrlenW (lpString="image/jpeg") returned 10 [0049.518] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758d94, Length=0x16 | out: Destination=0x6b2ab8) [0049.518] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0049.518] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758dae, Length=0x26 | out: Destination=0x6b2ab8) [0049.518] lstrlenW (lpString="GIF") returned 3 [0049.518] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758dd4, Length=0x8 | out: Destination=0x6b2ab8) [0049.518] lstrlenW (lpString="*.GIF") returned 5 [0049.518] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758ddc, Length=0xc | out: Destination=0x6b2ab8) [0049.518] lstrlenW (lpString="image/gif") returned 9 [0049.518] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758de8, Length=0x14 | out: Destination=0x6b2ab8) [0049.518] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0049.518] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e14, Length=0x28 | out: Destination=0x6b2ab8) [0049.519] lstrlenW (lpString="TIFF") returned 4 [0049.519] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e3c, Length=0xa | out: Destination=0x6b2ab8) [0049.519] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0049.519] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e46, Length=0x1a | out: Destination=0x6b2ab8) [0049.519] lstrlenW (lpString="image/tiff") returned 10 [0049.519] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e60, Length=0x16 | out: Destination=0x6b2ab8) [0049.519] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0049.519] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758e7e, Length=0x26 | out: Destination=0x6b2ab8) [0049.519] lstrlenW (lpString="PNG") returned 3 [0049.519] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758ea4, Length=0x8 | out: Destination=0x6b2ab8) [0049.519] lstrlenW (lpString="*.PNG") returned 5 [0049.519] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758eac, Length=0xc | out: Destination=0x6b2ab8) [0049.519] lstrlenW (lpString="image/png") returned 9 [0049.519] RtlMoveMemory (in: Destination=0x6b2ab8, Source=0x758eb8, Length=0x14 | out: Destination=0x6b2ab8) [0049.519] LocalFree (hMem=0x758b48) returned 0x0 [0049.520] GetLastError () returned 0x0 [0049.520] GdipSaveImageToStream (image=0x6bd1c98, stream=0x492f390, clsidEncoder=0x46e1ac*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0049.527] GetLastError () returned 0x0 [0049.528] GdipCreateBitmapFromStream (stream=0x492f370, bitmap=0x46e1f0) returned 0x0 [0049.528] GetLastError () returned 0x0 [0049.529] GdipImageForceValidation (image=0x6c1a5e0) returned 0x0 [0049.529] GetLastError () returned 0x0 [0049.529] GdipGetImageRawFormat (image=0x6c1a5e0, format=0x46e158*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0049.529] GetLastError () returned 0x0 [0049.529] GdipBitmapLockBits (bitmap=0x6c1a5e0, rect=0x46e1a4, flags=0x1, format=0x21808, lockedBitmapData=0x27484f4) returned 0x0 [0049.529] GetLastError () returned 0x0 [0049.529] GdipBitmapUnlockBits (bitmap=0x6c1a5e0, lockedBitmapData=0x27484f4) returned 0x0 [0049.529] GetLastError () returned 0x0 [0051.522] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x6db9f8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0051.522] GetLastError () returned 0x3f0 [0057.054] SHGetFolderPathW (in: hwnd=0x0, csidl=7, hToken=0x0, dwFlags=0x0, pszPath=0x6db9f8 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x0 [0057.055] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x46dd18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x53 [0057.055] GetLastError () returned 0x3f0 [0057.055] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x46dd80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0057.055] GetLastError () returned 0x3f0 [0057.055] SetErrorMode (uMode=0x1) returned 0x0 [0057.055] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe"), fInfoLevelId=0x0, lpFileInformation=0x46e200 | out: lpFileInformation=0x46e200*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0057.055] GetLastError () returned 0x2 [0057.055] SetErrorMode (uMode=0x0) returned 0x1 [0057.055] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x46dd8c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0057.055] GetLastError () returned 0x2 [0057.056] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0 [0057.056] GetLastError () returned 0x2 [0057.078] CopyFileExW (lpExistingFileName="C:\\Users\\CIiHmnxMn6Ps\\Desktop\\gabkrj.jpg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\desktop\\gabkrj.jpg.exe"), lpNewFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe"), lpProgressRoutine=0x227161a, lpData=0x0, pbCancel=0x668d38, dwCopyFlags=0x2) returned 1 [0057.292] GetLastError () returned 0x0 [0062.400] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x73cb50 [0062.401] RtlMoveMemory (in: Destination=0x73cb50, Source=0x2793e64, Length=0x1a | out: Destination=0x73cb50) [0062.401] LocalAlloc (uFlags=0x0, uBytes=0x7a) returned 0x6c0e08 [0062.401] RtlMoveMemory (in: Destination=0x6c0e08, Source=0x27eea1c, Length=0x7a | out: Destination=0x6c0e08) [0065.434] LocalFree (hMem=0x73cb50) returned 0x0 [0065.434] GetLastError () returned 0x0 [0065.434] LocalFree (hMem=0x6c0e08) returned 0x0 [0065.434] GetLastError () returned 0x0 [0065.434] CoGetContextToken (in: pToken=0x46e0b4 | out: pToken=0x46e0b4) returned 0x0 [0065.434] CObjectContext::QueryInterface () returned 0x0 [0065.435] CObjectContext::GetCurrentThreadType () returned 0x0 [0065.435] Release () returned 0x0 [0065.436] CoGetContextToken (in: pToken=0x46de8c | out: pToken=0x46de8c) returned 0x0 [0065.436] CObjectContext::QueryInterface () returned 0x0 [0065.436] CObjectContext::GetCurrentThreadType () returned 0x0 [0065.436] Release () returned 0x0 [0065.445] CoGetContextToken (in: pToken=0x46de8c | out: pToken=0x46de8c) returned 0x0 [0065.445] CObjectContext::QueryInterface () returned 0x0 [0065.445] CObjectContext::GetCurrentThreadType () returned 0x0 [0065.445] Release () returned 0x0 [0065.475] CoGetContextToken (in: pToken=0x46de8c | out: pToken=0x46de8c) returned 0x0 [0065.475] CObjectContext::QueryInterface () returned 0x0 [0065.475] CObjectContext::GetCurrentThreadType () returned 0x0 [0065.475] Release () returned 0x0 [0065.522] CoGetContextToken (in: pToken=0x46de6c | out: pToken=0x46de6c) returned 0x0 [0065.522] CObjectContext::QueryInterface () returned 0x0 [0065.522] CObjectContext::GetCurrentThreadType () returned 0x0 [0065.522] Release () returned 0x0 [0065.599] CoUninitialize () Thread: id = 2 os_tid = 0xc10 Thread: id = 3 os_tid = 0xc48 Thread: id = 4 os_tid = 0xc4c Thread: id = 5 os_tid = 0xc50 [0035.480] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0049.179] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.179] GetLastError () returned 0x0 [0049.180] GdipDisposeImage (image=0x6c1c020) returned 0x0 [0049.180] GetLastError () returned 0x0 [0049.181] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.181] GetLastError () returned 0x0 [0049.181] GdipDisposeImage (image=0x6c1bcd8) returned 0x0 [0049.181] GetLastError () returned 0x0 [0049.181] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.181] GetLastError () returned 0x0 [0049.181] GdipDisposeImage (image=0x6c1b648) returned 0x0 [0049.181] GetLastError () returned 0x0 [0049.181] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.181] GetLastError () returned 0x0 [0049.181] GdipDisposeImage (image=0x6c1ac70) returned 0x0 [0049.181] GetLastError () returned 0x0 [0049.181] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.181] GetLastError () returned 0x0 [0049.181] GdipDisposeImage (image=0x6c1a298) returned 0x0 [0049.181] GetLastError () returned 0x0 [0049.181] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.181] GetLastError () returned 0x0 [0049.181] GdipDisposeImage (image=0x6c19f50) returned 0x0 [0049.182] GetLastError () returned 0x0 [0049.182] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.182] GetLastError () returned 0x0 [0049.182] GdipDisposeImage (image=0x6c1c368) returned 0x0 [0049.182] GetLastError () returned 0x0 [0049.182] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.182] GetLastError () returned 0x0 [0049.182] GdipDisposeImage (image=0x6c1b300) returned 0x0 [0049.182] GetLastError () returned 0x0 [0049.182] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.182] GetLastError () returned 0x0 [0049.182] GdipDisposeImage (image=0x6c1a5e0) returned 0x0 [0049.185] GetLastError () returned 0x0 [0049.188] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.188] GetLastError () returned 0x0 [0049.188] GdipDisposeImage (image=0x6c1b990) returned 0x0 [0049.188] GetLastError () returned 0x0 [0049.188] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.188] GetLastError () returned 0x0 [0049.188] GdipDisposeImage (image=0x6c19c08) returned 0x0 [0049.188] GetLastError () returned 0x0 [0049.188] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.188] GetLastError () returned 0x0 [0049.189] GdipDisposeImage (image=0x6c1afb8) returned 0x0 [0049.189] GetLastError () returned 0x0 [0049.189] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.189] GetLastError () returned 0x0 [0049.189] GdipDisposeImage (image=0x6bd1950) returned 0x0 [0049.189] GetLastError () returned 0x0 [0049.189] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.189] GetLastError () returned 0x0 [0049.189] GdipDisposeImage (image=0x6bce818) returned 0x0 [0049.189] GetLastError () returned 0x0 [0049.189] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.189] GetLastError () returned 0x0 [0049.189] GdipDisposeImage (image=0x6bd1608) returned 0x0 [0049.189] GetLastError () returned 0x0 [0049.189] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.189] GetLastError () returned 0x0 [0049.189] GdipDisposeImage (image=0x6bd12c0) returned 0x0 [0049.189] GetLastError () returned 0x0 [0049.189] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0049.189] GetLastError () returned 0x0 [0049.189] GdipDisposeImage (image=0x6bd0f78) returned 0x0 [0049.190] GetLastError () returned 0x0 [0050.950] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.950] GetLastError () returned 0x0 [0050.951] GdipDisposeImage (image=0x6c1a5e0) returned 0x0 [0050.951] GetLastError () returned 0x0 [0050.951] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.951] GetLastError () returned 0x0 [0050.951] GdipDisposeImage (image=0x6c19f50) returned 0x0 [0050.951] GetLastError () returned 0x0 [0050.951] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.951] GetLastError () returned 0x0 [0050.951] GdipDisposeImage (image=0x6c1c020) returned 0x0 [0050.951] GetLastError () returned 0x0 [0050.951] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.951] GetLastError () returned 0x0 [0050.951] GdipDisposeImage (image=0x6c19c08) returned 0x0 [0050.951] GetLastError () returned 0x0 [0050.951] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.951] GetLastError () returned 0x0 [0050.951] GdipDisposeImage (image=0x6c1a298) returned 0x0 [0050.951] GetLastError () returned 0x0 [0050.951] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.952] GetLastError () returned 0x0 [0050.952] GdipDisposeImage (image=0x6c1a928) returned 0x0 [0050.952] GetLastError () returned 0x0 [0050.952] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.952] GetLastError () returned 0x0 [0050.952] GdipDisposeImage (image=0x6c1bcd8) returned 0x0 [0050.952] GetLastError () returned 0x0 [0050.952] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.952] GetLastError () returned 0x0 [0050.952] GdipDisposeImage (image=0x6c1afb8) returned 0x0 [0050.952] GetLastError () returned 0x0 [0050.952] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.952] GetLastError () returned 0x0 [0050.952] GdipDisposeImage (image=0x6c19578) returned 0x0 [0050.952] GetLastError () returned 0x0 [0050.952] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.952] GetLastError () returned 0x0 [0050.952] GdipDisposeImage (image=0x6c1cd40) returned 0x0 [0050.954] GetLastError () returned 0x0 [0050.954] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.954] GetLastError () returned 0x0 [0050.954] GdipDisposeImage (image=0x6c1c6b0) returned 0x0 [0050.954] GetLastError () returned 0x0 [0050.954] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.955] GetLastError () returned 0x0 [0050.955] GdipDisposeImage (image=0x6c1b990) returned 0x0 [0050.955] GetLastError () returned 0x0 [0050.955] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.955] GetLastError () returned 0x0 [0050.955] GdipDisposeImage (image=0x6c198c0) returned 0x0 [0050.955] GetLastError () returned 0x0 [0050.955] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.955] GetLastError () returned 0x0 [0050.955] GdipDisposeImage (image=0x6c1b648) returned 0x0 [0050.955] GetLastError () returned 0x0 [0050.955] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.955] GetLastError () returned 0x0 [0050.955] GdipDisposeImage (image=0x6c1b300) returned 0x0 [0050.955] GetLastError () returned 0x0 [0050.955] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.955] GetLastError () returned 0x0 [0050.955] GdipDisposeImage (image=0x6c1c368) returned 0x0 [0050.955] GetLastError () returned 0x0 [0050.955] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.956] GetLastError () returned 0x0 [0050.956] GdipDisposeImage (image=0x6c19230) returned 0x0 [0050.956] GetLastError () returned 0x0 [0050.956] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.956] GetLastError () returned 0x0 [0050.956] GdipDisposeImage (image=0x6c1c9f8) returned 0x0 [0050.956] GetLastError () returned 0x0 [0050.957] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.957] GetLastError () returned 0x0 [0050.957] GdipDisposeImage (image=0x6bce818) returned 0x0 [0050.957] GetLastError () returned 0x0 [0050.957] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.957] GetLastError () returned 0x0 [0050.957] GdipDisposeImage (image=0x6bd1608) returned 0x0 [0050.957] GetLastError () returned 0x0 [0050.957] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.957] GetLastError () returned 0x0 [0050.957] GdipDisposeImage (image=0x6bd12c0) returned 0x0 [0050.957] GetLastError () returned 0x0 [0050.957] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.957] GetLastError () returned 0x0 [0050.957] GdipDisposeImage (image=0x6bd0f78) returned 0x0 [0050.958] GetLastError () returned 0x0 [0050.958] FindAtomW (lpString="GDI+Atom_1644_1") returned 0xc000 [0050.958] GetLastError () returned 0x0 [0050.958] GdipDisposeImage (image=0x6bd1950) returned 0x0 [0050.958] GetLastError () returned 0x0 [0065.437] SetWindowLongW (hWnd=0x60164, nIndex=-4, dwNewLong=2009844384) returned 36112562 [0065.438] SetClassLongW (hWnd=0x60164, nIndex=-24, dwNewLong=2009844384) returned 0x2270772 [0065.439] PostMessageW (hWnd=0x60164, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0065.439] SetWindowLongW (hWnd=0x601f8, nIndex=-4, dwNewLong=2009844384) returned 36112610 [0065.439] SetClassLongW (hWnd=0x601f8, nIndex=-24, dwNewLong=2009844384) returned 0x77cbcaa0 [0065.439] PostMessageW (hWnd=0x601f8, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0065.439] GetModuleHandleW (lpModuleName=0x0) returned 0x1e0000 [0065.440] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.378734a", hInstance=0x1e0000) returned 0 [0065.440] GetLastError () returned 0x584 [0065.441] DeleteAtom (nAtom=0xc000) returned 0x0 [0065.441] GetLastError () returned 0x584 [0065.441] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.441] GetLastError () returned 0x2 [0065.442] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x39c [0065.442] GetLastError () returned 0x0 [0065.443] PostMessageW (hWnd=0x601f4, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0065.443] CoGetContextToken (in: pToken=0x475f2b4 | out: pToken=0x475f2b4) returned 0x0 [0065.443] CObjectContext::QueryInterface () returned 0x0 [0065.443] CObjectContext::GetCurrentThreadType () returned 0x0 [0065.443] Release () returned 0x0 [0065.457] CoGetContextToken (in: pToken=0x475f2ac | out: pToken=0x475f2ac) returned 0x0 [0065.457] CObjectContext::QueryInterface () returned 0x0 [0065.457] CObjectContext::GetCurrentThreadType () returned 0x0 [0065.457] Release () returned 0x0 [0065.466] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.466] GetLastError () returned 0x2 [0065.467] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.467] GetLastError () returned 0x2 [0065.467] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.467] GetLastError () returned 0x2 [0065.467] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.467] GetLastError () returned 0x2 [0065.467] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.467] GetLastError () returned 0x2 [0065.467] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.467] GetLastError () returned 0x2 [0065.467] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.467] GetLastError () returned 0x2 [0065.468] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.468] GetLastError () returned 0x2 [0065.468] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.468] GetLastError () returned 0x2 [0065.468] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.468] GetLastError () returned 0x2 [0065.468] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.468] GetLastError () returned 0x2 [0065.468] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.468] GetLastError () returned 0x2 [0065.468] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.468] GetLastError () returned 0x2 [0065.469] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.469] GetLastError () returned 0x2 [0065.469] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.469] GetLastError () returned 0x2 [0065.469] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.469] GetLastError () returned 0x2 [0065.469] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.469] GetLastError () returned 0x2 [0065.469] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.469] GetLastError () returned 0x2 [0065.469] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.469] GetLastError () returned 0x2 [0065.469] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.469] GetLastError () returned 0x2 [0065.470] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.470] GetLastError () returned 0x2 [0065.472] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.472] GetLastError () returned 0x2 [0065.472] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.472] GetLastError () returned 0x2 [0065.472] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.472] GetLastError () returned 0x2 [0065.472] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.473] GetLastError () returned 0x2 [0065.473] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.473] GetLastError () returned 0x2 [0065.473] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.473] GetLastError () returned 0x2 [0065.473] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.473] GetLastError () returned 0x2 [0065.473] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.473] GetLastError () returned 0x2 [0065.473] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.473] GetLastError () returned 0x2 [0065.473] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.473] GetLastError () returned 0x2 [0065.474] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.474] GetLastError () returned 0x2 [0065.474] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.474] GetLastError () returned 0x2 [0065.474] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.474] GetLastError () returned 0x2 [0065.474] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.474] GetLastError () returned 0x2 [0065.474] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.474] GetLastError () returned 0x2 [0065.474] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.474] GetLastError () returned 0x2 [0065.474] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.474] GetLastError () returned 0x2 [0065.475] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.475] GetLastError () returned 0x2 [0065.475] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.475] GetLastError () returned 0x2 [0065.493] DestroyCursor (hCursor=0x8501a1) returned 1 [0065.493] GetLastError () returned 0x2 [0065.493] DestroyCursor (hCursor=0x90207) returned 1 [0065.493] GetLastError () returned 0x2 [0065.493] FindAtomW (lpString="GDI+Atom_1644_1") returned 0x0 [0065.493] GetLastError () returned 0x2 [0065.494] DeleteObject (ho=0x2a0a0658) returned 1 [0065.494] GetLastError () returned 0x2 [0065.494] CloseHandle (hObject=0x268) returned 1 [0065.494] GetLastError () returned 0x2 [0065.519] CloseHandle (hObject=0x39c) returned 1 [0065.519] GetLastError () returned 0x2 [0065.519] CloseHandle (hObject=0x4cc) returned 1 [0065.519] GetLastError () returned 0x2 [0065.520] CloseHandle (hObject=0x2a8) returned 1 [0065.520] GetLastError () returned 0x2 [0065.520] RegCloseKey (hKey=0x80000004) returned 0x0 Thread: id = 6 os_tid = 0xc7c Thread: id = 7 os_tid = 0xc80 [0042.317] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0042.343] SetConsoleCtrlHandler (HandlerRoutine=0x2270a1a, Add=1) returned 1 [0042.344] GetModuleHandleW (lpModuleName=0x0) returned 0x1e0000 [0042.344] GetModuleHandleW (lpModuleName=0x0) returned 0x1e0000 [0042.370] GetClassInfoW (in: hInstance=0x1e0000, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", lpWndClass=0x25ebf04 | out: lpWndClass=0x25ebf04) returned 0 [0042.372] CoTaskMemAlloc (cb=0x58) returned 0x6bf778 [0042.372] RegisterClassW (lpWndClass=0x6cc770) returned 0xc162 [0042.373] GetLastError () returned 0x583 [0042.373] CoTaskMemFree (pv=0x6bf778) [0042.374] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", lpWindowName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x1e0000, lpParam=0x0) returned 0x601f4 [0042.376] NtdllDefWindowProc_W (hWnd=0x601f4, Msg=0x81, wParam=0x0, lParam=0x736ed90) returned 0x1 [0042.386] NtdllDefWindowProc_W (hWnd=0x601f4, Msg=0x83, wParam=0x0, lParam=0x736ed7c) returned 0x0 [0042.386] NtdllDefWindowProc_W (hWnd=0x601f4, Msg=0x1, wParam=0x0, lParam=0x736ed90) returned 0x0 [0042.386] NtdllDefWindowProc_W (hWnd=0x601f4, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0042.386] NtdllDefWindowProc_W (hWnd=0x601f4, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0042.386] GetLastError () returned 0x0 [0042.400] SetEvent (hEvent=0x2a8) returned 1 [0042.401] GetLastError () returned 0x0 [0042.706] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0042.880] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0043.065] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0043.188] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0043.299] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0043.425] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0043.552] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0043.674] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0044.017] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0044.209] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0044.332] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0044.487] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0044.658] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0044.784] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0044.909] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0045.034] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0045.159] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0045.284] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0045.409] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0045.535] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0045.658] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0045.784] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0045.909] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0046.034] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0046.174] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0046.299] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0046.424] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0046.549] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0046.716] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0046.831] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0047.004] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0047.168] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0047.295] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0047.420] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0047.560] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0047.685] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0047.853] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0047.989] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0048.107] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0048.241] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0048.498] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0048.647] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0048.911] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0049.101] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0049.301] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0049.489] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0049.630] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0049.755] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0049.880] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0050.005] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0050.130] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0050.288] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0050.652] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0050.770] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0051.005] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0051.193] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0051.573] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0051.870] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0052.013] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0052.138] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0052.262] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0052.388] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0052.514] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0052.638] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0052.794] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0052.919] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0053.060] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0053.184] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0053.366] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0053.496] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0053.608] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0053.732] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0053.856] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0053.981] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0054.107] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0054.241] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0054.356] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0054.482] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0054.679] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0054.794] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0054.919] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0055.044] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0055.169] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0055.294] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0055.497] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0055.622] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0055.747] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0055.872] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0056.012] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0056.138] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0056.262] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0056.387] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0056.544] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0056.669] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0056.794] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0056.919] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0057.075] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0057.295] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0057.420] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0057.545] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0057.717] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0057.842] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0057.976] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0058.066] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0058.188] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0058.360] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0058.486] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0058.860] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0058.985] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0059.111] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0059.285] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0059.407] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0059.532] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0060.291] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0060.407] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0060.532] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0061.782] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0061.912] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0062.032] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0062.157] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0062.282] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0062.807] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0063.228] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0063.421] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0064.342] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0064.468] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0065.361] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x0 [0065.444] PeekMessageW (in: lpMsg=0x736f36c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x736f36c) returned 1 [0065.445] IsWindow (hWnd=0x601f4) returned 1 [0065.451] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74d70000 [0065.452] GetProcAddress (hModule=0x74d70000, lpProcName="DefWindowProcW") returned 0x77cbcaa0 [0065.453] SetWindowLongW (hWnd=0x601f4, nIndex=-4, dwNewLong=2009844384) returned 36112970 [0065.453] SetClassLongW (hWnd=0x601f4, nIndex=-24, dwNewLong=2009844384) returned 0x2270a4a [0065.453] IsWindow (hWnd=0x601f4) returned 1 [0065.453] DestroyWindow (hWnd=0x601f4) returned 1 [0065.456] GetModuleHandleW (lpModuleName=0x0) returned 0x1e0000 [0065.457] UnregisterClassW (lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", hInstance=0x1e0000) returned 1 [0065.457] GetLastError () returned 0x0 [0065.457] SetConsoleCtrlHandler (HandlerRoutine=0x2270a1a, Add=0) returned 1 [0065.457] SetEvent (hEvent=0x39c) returned 1 [0065.457] GetLastError () returned 0x0 Thread: id = 8 os_tid = 0xe24 [0062.404] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0062.410] ShellExecuteExW (in: pExecInfo=0x27eeb84*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="explorer.exe", lpParameters="/c select, C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x27eeb84*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="explorer.exe", lpParameters="/c select, C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x4cc)) returned 1 [0065.397] GetLastError () returned 0x0 [0065.397] CoGetContextToken (in: pToken=0x4e2f608 | out: pToken=0x4e2f608) returned 0x0 [0065.398] CoUninitialize () Thread: id = 9 os_tid = 0xe2c Thread: id = 10 os_tid = 0xe30 Thread: id = 11 os_tid = 0xe34 Thread: id = 12 os_tid = 0xe3c Thread: id = 13 os_tid = 0xe40 Process: id = "2" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0x90f9000" os_pid = "0xe44" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x66c" cmd_line = "\"C:\\Windows\\System32\\explorer.exe\" /c select, C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" cur_dir = "C:\\Users\\CIiHmnxMn6Ps\\Desktop\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001714b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 400 start_va = 0x800000 end_va = 0x81ffff entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 401 start_va = 0x820000 end_va = 0x821fff entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 402 start_va = 0x830000 end_va = 0x843fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 403 start_va = 0x850000 end_va = 0x88ffff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 404 start_va = 0x890000 end_va = 0x8cffff entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 405 start_va = 0xea0000 end_va = 0x1276fff entry_point = 0xea0000 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\SysWOW64\\explorer.exe" (normalized: "c:\\windows\\syswow64\\explorer.exe") Region: id = 406 start_va = 0x1280000 end_va = 0x527ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001280000" filename = "" Region: id = 407 start_va = 0x77c40000 end_va = 0x77db8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 408 start_va = 0x7fad0000 end_va = 0x7faf2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fad0000" filename = "" Region: id = 409 start_va = 0x7faf8000 end_va = 0x7faf8fff entry_point = 0x0 region_type = private name = "private_0x000000007faf8000" filename = "" Region: id = 410 start_va = 0x7fafb000 end_va = 0x7fafdfff entry_point = 0x0 region_type = private name = "private_0x000000007fafb000" filename = "" Region: id = 411 start_va = 0x7fafe000 end_va = 0x7fafefff entry_point = 0x0 region_type = private name = "private_0x000000007fafe000" filename = "" Region: id = 412 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 413 start_va = 0x7fff0000 end_va = 0x7dfc03e6ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 414 start_va = 0x7dfc03e70000 end_va = 0x7ffc03e6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfc03e70000" filename = "" Region: id = 415 start_va = 0x7ffc03e70000 end_va = 0x7ffc04031fff entry_point = 0x7ffc03e70000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 416 start_va = 0x7ffc04032000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc04032000" filename = "" Region: id = 417 start_va = 0x8d0000 end_va = 0x8d3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 418 start_va = 0x8e0000 end_va = 0x8e2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008e0000" filename = "" Region: id = 419 start_va = 0x8f0000 end_va = 0x8f1fff entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 420 start_va = 0xa50000 end_va = 0xa5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 421 start_va = 0x59300000 end_va = 0x5934efff entry_point = 0x59300000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 422 start_va = 0x59360000 end_va = 0x593d2fff entry_point = 0x59360000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 423 start_va = 0xbd0000 end_va = 0xccffff entry_point = 0x0 region_type = private name = "private_0x0000000000bd0000" filename = "" Region: id = 424 start_va = 0x59350000 end_va = 0x59357fff entry_point = 0x59350000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 425 start_va = 0x800000 end_va = 0x80ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 426 start_va = 0x810000 end_va = 0x813fff entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 427 start_va = 0x900000 end_va = 0x9bdfff entry_point = 0x900000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 428 start_va = 0x9c0000 end_va = 0x9fffff entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 429 start_va = 0xa00000 end_va = 0xa3ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a00000" filename = "" Region: id = 430 start_va = 0xa60000 end_va = 0xa9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 431 start_va = 0xaa0000 end_va = 0xadffff entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 432 start_va = 0x71050000 end_va = 0x71070fff entry_point = 0x71050000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\SysWOW64\\slc.dll" (normalized: "c:\\windows\\syswow64\\slc.dll") Region: id = 433 start_va = 0x71080000 end_va = 0x710fdfff entry_point = 0x71080000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\SysWOW64\\dxgi.dll" (normalized: "c:\\windows\\syswow64\\dxgi.dll") Region: id = 434 start_va = 0x71100000 end_va = 0x71118fff entry_point = 0x71100000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\SysWOW64\\userenv.dll" (normalized: "c:\\windows\\syswow64\\userenv.dll") Region: id = 435 start_va = 0x71120000 end_va = 0x711bbfff entry_point = 0x71120000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\SysWOW64\\dcomp.dll" (normalized: "c:\\windows\\syswow64\\dcomp.dll") Region: id = 436 start_va = 0x711c0000 end_va = 0x713d2fff entry_point = 0x711c0000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\SysWOW64\\d3d11.dll" (normalized: "c:\\windows\\syswow64\\d3d11.dll") Region: id = 437 start_va = 0x713e0000 end_va = 0x71478fff entry_point = 0x713e0000 region_type = mapped_file name = "twinapi.dll" filename = "\\Windows\\SysWOW64\\twinapi.dll" (normalized: "c:\\windows\\syswow64\\twinapi.dll") Region: id = 438 start_va = 0x71ac0000 end_va = 0x71c01fff entry_point = 0x71ac0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 439 start_va = 0x74ba0000 end_va = 0x74bbcfff entry_point = 0x74ba0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 440 start_va = 0x74bc0000 end_va = 0x74c34fff entry_point = 0x74bc0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 441 start_va = 0x74ce0000 end_va = 0x74d38fff entry_point = 0x74ce0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 442 start_va = 0x74d40000 end_va = 0x74d49fff entry_point = 0x74d40000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 443 start_va = 0x74d50000 end_va = 0x74d6dfff entry_point = 0x74d50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 444 start_va = 0x74d70000 end_va = 0x74eaffff entry_point = 0x74d70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 445 start_va = 0x74eb0000 end_va = 0x75024fff entry_point = 0x74eb0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 446 start_va = 0x75070000 end_va = 0x7507efff entry_point = 0x75070000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 447 start_va = 0x75080000 end_va = 0x750c3fff entry_point = 0x75080000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 448 start_va = 0x750d0000 end_va = 0x755acfff entry_point = 0x750d0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 449 start_va = 0x755b0000 end_va = 0x7696efff entry_point = 0x755b0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 450 start_va = 0x76970000 end_va = 0x76ae5fff entry_point = 0x76970000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 451 start_va = 0x76ca0000 end_va = 0x76decfff entry_point = 0x76ca0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 452 start_va = 0x76f60000 end_va = 0x76f6bfff entry_point = 0x76f60000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 453 start_va = 0x77090000 end_va = 0x77249fff entry_point = 0x77090000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 454 start_va = 0x77250000 end_va = 0x77292fff entry_point = 0x77250000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 455 start_va = 0x77670000 end_va = 0x7775ffff entry_point = 0x77670000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 456 start_va = 0x777f0000 end_va = 0x77833fff entry_point = 0x777f0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 457 start_va = 0x778a0000 end_va = 0x7792cfff entry_point = 0x778a0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 458 start_va = 0x77990000 end_va = 0x77a0afff entry_point = 0x77990000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 459 start_va = 0x77a10000 end_va = 0x77acdfff entry_point = 0x77a10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 460 start_va = 0x77ae0000 end_va = 0x77aedfff entry_point = 0x77ae0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 461 start_va = 0x77af0000 end_va = 0x77b9bfff entry_point = 0x77af0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 462 start_va = 0x77ba0000 end_va = 0x77c31fff entry_point = 0x77ba0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 463 start_va = 0x7f9cd000 end_va = 0x7f9cffff entry_point = 0x0 region_type = private name = "private_0x000000007f9cd000" filename = "" Region: id = 464 start_va = 0x7f9d0000 end_va = 0x7facffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f9d0000" filename = "" Region: id = 465 start_va = 0x7faf5000 end_va = 0x7faf7fff entry_point = 0x0 region_type = private name = "private_0x000000007faf5000" filename = "" Region: id = 466 start_va = 0xae0000 end_va = 0xb1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 467 start_va = 0xb20000 end_va = 0xb5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 468 start_va = 0x7f9ca000 end_va = 0x7f9ccfff entry_point = 0x0 region_type = private name = "private_0x000000007f9ca000" filename = "" Region: id = 469 start_va = 0x820000 end_va = 0x827fff entry_point = 0x820000 region_type = mapped_file name = "explorer.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\explorer.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\explorer.exe.mui") Region: id = 470 start_va = 0xa40000 end_va = 0xa40fff entry_point = 0x0 region_type = private name = "private_0x0000000000a40000" filename = "" Region: id = 471 start_va = 0xb60000 end_va = 0xb60fff entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 472 start_va = 0xba0000 end_va = 0xbaffff entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 473 start_va = 0xcd0000 end_va = 0xe57fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cd0000" filename = "" Region: id = 474 start_va = 0x5280000 end_va = 0x5400fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005280000" filename = "" Region: id = 475 start_va = 0x5410000 end_va = 0x680ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005410000" filename = "" Region: id = 476 start_va = 0x68e0000 end_va = 0x68effff entry_point = 0x0 region_type = private name = "private_0x00000000068e0000" filename = "" Region: id = 477 start_va = 0x68f0000 end_va = 0x6c26fff entry_point = 0x68f0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 478 start_va = 0x74b80000 end_va = 0x74b9cfff entry_point = 0x74b80000 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\SysWOW64\\sppc.dll" (normalized: "c:\\windows\\syswow64\\sppc.dll") Region: id = 479 start_va = 0x76f70000 end_va = 0x7708ffff entry_point = 0x76f70000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 480 start_va = 0x775e0000 end_va = 0x7760afff entry_point = 0x775e0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 481 start_va = 0xb70000 end_va = 0xb73fff entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 482 start_va = 0xb80000 end_va = 0xb80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b80000" filename = "" Region: id = 483 start_va = 0x74b40000 end_va = 0x74b5afff entry_point = 0x74b40000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 484 start_va = 0x74b60000 end_va = 0x74b72fff entry_point = 0x74b60000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 485 start_va = 0x77430000 end_va = 0x77519fff entry_point = 0x77430000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 486 start_va = 0x74b10000 end_va = 0x74b3efff entry_point = 0x74b10000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 487 start_va = 0xb90000 end_va = 0xb90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b90000" filename = "" Region: id = 488 start_va = 0xe60000 end_va = 0xe9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e60000" filename = "" Region: id = 489 start_va = 0x6810000 end_va = 0x684ffff entry_point = 0x0 region_type = private name = "private_0x0000000006810000" filename = "" Region: id = 490 start_va = 0x6850000 end_va = 0x688ffff entry_point = 0x0 region_type = private name = "private_0x0000000006850000" filename = "" Region: id = 491 start_va = 0x6890000 end_va = 0x68cffff entry_point = 0x0 region_type = private name = "private_0x0000000006890000" filename = "" Region: id = 492 start_va = 0x6c30000 end_va = 0x6c6ffff entry_point = 0x0 region_type = private name = "private_0x0000000006c30000" filename = "" Region: id = 493 start_va = 0x6c70000 end_va = 0x6caffff entry_point = 0x0 region_type = private name = "private_0x0000000006c70000" filename = "" Region: id = 494 start_va = 0x74900000 end_va = 0x74b06fff entry_point = 0x74900000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 495 start_va = 0x77760000 end_va = 0x777e1fff entry_point = 0x77760000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 496 start_va = 0x7f9c1000 end_va = 0x7f9c3fff entry_point = 0x0 region_type = private name = "private_0x000000007f9c1000" filename = "" Region: id = 497 start_va = 0x7f9c4000 end_va = 0x7f9c6fff entry_point = 0x0 region_type = private name = "private_0x000000007f9c4000" filename = "" Region: id = 498 start_va = 0x7f9c7000 end_va = 0x7f9c9fff entry_point = 0x0 region_type = private name = "private_0x000000007f9c7000" filename = "" Region: id = 499 start_va = 0xbb0000 end_va = 0xbb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bb0000" filename = "" Region: id = 500 start_va = 0x68d0000 end_va = 0x68d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000068d0000" filename = "" Region: id = 501 start_va = 0x6cb0000 end_va = 0x6cc2fff entry_point = 0x6cb0000 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001a.db" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001a.db" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000001a.db") Region: id = 502 start_va = 0x74890000 end_va = 0x748fefff entry_point = 0x74890000 region_type = mapped_file name = "dlnashext.dll" filename = "\\Windows\\SysWOW64\\dlnashext.dll" (normalized: "c:\\windows\\syswow64\\dlnashext.dll") Region: id = 503 start_va = 0x74c40000 end_va = 0x74cd0fff entry_point = 0x74c40000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 504 start_va = 0x75030000 end_va = 0x75065fff entry_point = 0x75030000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 505 start_va = 0x74830000 end_va = 0x74884fff entry_point = 0x74830000 region_type = mapped_file name = "playtodevice.dll" filename = "\\Windows\\SysWOW64\\PlayToDevice.dll" (normalized: "c:\\windows\\syswow64\\playtodevice.dll") Region: id = 506 start_va = 0x6cd0000 end_va = 0x6d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000006cd0000" filename = "" Region: id = 507 start_va = 0x6d10000 end_va = 0x6d4ffff entry_point = 0x0 region_type = private name = "private_0x0000000006d10000" filename = "" Region: id = 508 start_va = 0x6d50000 end_va = 0x6d8ffff entry_point = 0x0 region_type = private name = "private_0x0000000006d50000" filename = "" Region: id = 509 start_va = 0x6d90000 end_va = 0x6dcffff entry_point = 0x0 region_type = private name = "private_0x0000000006d90000" filename = "" Region: id = 510 start_va = 0x6dd0000 end_va = 0x6e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000006dd0000" filename = "" Region: id = 511 start_va = 0x6e10000 end_va = 0x6e4ffff entry_point = 0x0 region_type = private name = "private_0x0000000006e10000" filename = "" Region: id = 512 start_va = 0x74810000 end_va = 0x74829fff entry_point = 0x74810000 region_type = mapped_file name = "devdispitemprovider.dll" filename = "\\Windows\\SysWOW64\\DevDispItemProvider.dll" (normalized: "c:\\windows\\syswow64\\devdispitemprovider.dll") Region: id = 513 start_va = 0x7f9b8000 end_va = 0x7f9bafff entry_point = 0x0 region_type = private name = "private_0x000000007f9b8000" filename = "" Region: id = 514 start_va = 0x7f9bb000 end_va = 0x7f9bdfff entry_point = 0x0 region_type = private name = "private_0x000000007f9bb000" filename = "" Region: id = 515 start_va = 0x7f9be000 end_va = 0x7f9c0fff entry_point = 0x0 region_type = private name = "private_0x000000007f9be000" filename = "" Region: id = 516 start_va = 0x74780000 end_va = 0x747a0fff entry_point = 0x74780000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 517 start_va = 0x747b0000 end_va = 0x74803fff entry_point = 0x747b0000 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\SysWOW64\\MMDevAPI.dll" (normalized: "c:\\windows\\syswow64\\mmdevapi.dll") Region: id = 518 start_va = 0xbc0000 end_va = 0xbc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 519 start_va = 0x74420000 end_va = 0x7458afff entry_point = 0x74420000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll") Region: id = 520 start_va = 0x74590000 end_va = 0x74777fff entry_point = 0x74590000 region_type = mapped_file name = "wpdshext.dll" filename = "\\Windows\\SysWOW64\\wpdshext.dll" (normalized: "c:\\windows\\syswow64\\wpdshext.dll") Region: id = 521 start_va = 0x73ff0000 end_va = 0x74419fff entry_point = 0x73ff0000 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\SysWOW64\\ExplorerFrame.dll" (normalized: "c:\\windows\\syswow64\\explorerframe.dll") Thread: id = 14 os_tid = 0xe48 Thread: id = 15 os_tid = 0xe4c Thread: id = 16 os_tid = 0xe50 Thread: id = 17 os_tid = 0xe54 Thread: id = 18 os_tid = 0xe58 Thread: id = 19 os_tid = 0xe5c Thread: id = 20 os_tid = 0xe60 Thread: id = 21 os_tid = 0xe64 Thread: id = 22 os_tid = 0xe68 Thread: id = 23 os_tid = 0xe6c Thread: id = 24 os_tid = 0xe70 Thread: id = 25 os_tid = 0xe74 Process: id = "3" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0xb893000" os_pid = "0xe78" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0xe44" cmd_line = "C:\\Windows\\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001714b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 522 start_va = 0xad0000 end_va = 0xadffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ad0000" filename = "" Region: id = 523 start_va = 0xae0000 end_va = 0xae6fff entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 524 start_va = 0xaf0000 end_va = 0xb03fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 525 start_va = 0xb10000 end_va = 0xb8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 526 start_va = 0xb90000 end_va = 0xb93fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b90000" filename = "" Region: id = 527 start_va = 0xba0000 end_va = 0xba2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ba0000" filename = "" Region: id = 528 start_va = 0xbb0000 end_va = 0xbb1fff entry_point = 0x0 region_type = private name = "private_0x0000000000bb0000" filename = "" Region: id = 529 start_va = 0xbc0000 end_va = 0xc7dfff entry_point = 0xbc0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 530 start_va = 0xc80000 end_va = 0xc86fff entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 531 start_va = 0xc90000 end_va = 0xd8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 532 start_va = 0xd90000 end_va = 0xe0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000d90000" filename = "" Region: id = 533 start_va = 0xe10000 end_va = 0xe17fff entry_point = 0xe10000 region_type = mapped_file name = "explorer.exe.mui" filename = "\\Windows\\en-US\\explorer.exe.mui" (normalized: "c:\\windows\\en-us\\explorer.exe.mui") Region: id = 534 start_va = 0xe20000 end_va = 0xe20fff entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 535 start_va = 0xe30000 end_va = 0xe30fff entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 536 start_va = 0xe40000 end_va = 0xe40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e40000" filename = "" Region: id = 537 start_va = 0xe50000 end_va = 0xe50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e50000" filename = "" Region: id = 538 start_va = 0xe60000 end_va = 0xe60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e60000" filename = "" Region: id = 539 start_va = 0xe80000 end_va = 0xe8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e80000" filename = "" Region: id = 540 start_va = 0xe90000 end_va = 0xf0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e90000" filename = "" Region: id = 541 start_va = 0xf10000 end_va = 0xf1ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f10000" filename = "" Region: id = 542 start_va = 0xf20000 end_va = 0x10a7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f20000" filename = "" Region: id = 543 start_va = 0x10b0000 end_va = 0x1230fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000010b0000" filename = "" Region: id = 544 start_va = 0x1240000 end_va = 0x263ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001240000" filename = "" Region: id = 545 start_va = 0x2640000 end_va = 0x2976fff entry_point = 0x2640000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 546 start_va = 0x2980000 end_va = 0x29fffff entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 547 start_va = 0x2a00000 end_va = 0x2a7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 548 start_va = 0x2a80000 end_va = 0x2afffff entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 549 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 550 start_va = 0x7df5ff650000 end_va = 0x7ff5ff64ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff650000" filename = "" Region: id = 551 start_va = 0x7ff6e70de000 end_va = 0x7ff6e70dffff entry_point = 0x0 region_type = private name = "private_0x00007ff6e70de000" filename = "" Region: id = 552 start_va = 0x7ff6e70e0000 end_va = 0x7ff6e71dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6e70e0000" filename = "" Region: id = 553 start_va = 0x7ff6e71e0000 end_va = 0x7ff6e7202fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff6e71e0000" filename = "" Region: id = 554 start_va = 0x7ff6e7204000 end_va = 0x7ff6e7205fff entry_point = 0x0 region_type = private name = "private_0x00007ff6e7204000" filename = "" Region: id = 555 start_va = 0x7ff6e7206000 end_va = 0x7ff6e7207fff entry_point = 0x0 region_type = private name = "private_0x00007ff6e7206000" filename = "" Region: id = 556 start_va = 0x7ff6e7208000 end_va = 0x7ff6e7209fff entry_point = 0x0 region_type = private name = "private_0x00007ff6e7208000" filename = "" Region: id = 557 start_va = 0x7ff6e720a000 end_va = 0x7ff6e720bfff entry_point = 0x0 region_type = private name = "private_0x00007ff6e720a000" filename = "" Region: id = 558 start_va = 0x7ff6e720c000 end_va = 0x7ff6e720dfff entry_point = 0x0 region_type = private name = "private_0x00007ff6e720c000" filename = "" Region: id = 559 start_va = 0x7ff6e720e000 end_va = 0x7ff6e720efff entry_point = 0x0 region_type = private name = "private_0x00007ff6e720e000" filename = "" Region: id = 560 start_va = 0x7ff6e73b0000 end_va = 0x7ff6e77fdfff entry_point = 0x7ff6e73b0000 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe") Region: id = 561 start_va = 0x7ffbf4520000 end_va = 0x7ffbf49affff entry_point = 0x7ffbf4520000 region_type = mapped_file name = "explorerframe.dll" filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll") Region: id = 562 start_va = 0x7ffbf4cf0000 end_va = 0x7ffbf4da9fff entry_point = 0x7ffbf4cf0000 region_type = mapped_file name = "twinapi.dll" filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll") Region: id = 563 start_va = 0x7ffbf5460000 end_va = 0x7ffbf58c9fff entry_point = 0x7ffbf5460000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 564 start_va = 0x7ffbfd5b0000 end_va = 0x7ffbfd732fff entry_point = 0x7ffbfd5b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 565 start_va = 0x7ffbfe650000 end_va = 0x7ffbfe6ebfff entry_point = 0x7ffbfe650000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 566 start_va = 0x7ffbfe6f0000 end_va = 0x7ffbfe992fff entry_point = 0x7ffbfe6f0000 region_type = mapped_file name = "d3d11.dll" filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll") Region: id = 567 start_va = 0x7ffbfe9a0000 end_va = 0x7ffbfe9c1fff entry_point = 0x7ffbfe9a0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 568 start_va = 0x7ffbfe9f0000 end_va = 0x7ffbfea14fff entry_point = 0x7ffbfe9f0000 region_type = mapped_file name = "sppc.dll" filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll") Region: id = 569 start_va = 0x7ffbfea20000 end_va = 0x7ffbfea45fff entry_point = 0x7ffbfea20000 region_type = mapped_file name = "slc.dll" filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll") Region: id = 570 start_va = 0x7ffbfed00000 end_va = 0x7ffbfedd0fff entry_point = 0x7ffbfed00000 region_type = mapped_file name = "dcomp.dll" filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll") Region: id = 571 start_va = 0x7ffbff0d0000 end_va = 0x7ffbff147fff entry_point = 0x7ffbff0d0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 572 start_va = 0x7ffbff170000 end_va = 0x7ffbff205fff entry_point = 0x7ffbff170000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 573 start_va = 0x7ffbffdc0000 end_va = 0x7ffbffdf2fff entry_point = 0x7ffbffdc0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 574 start_va = 0x7ffbffeb0000 end_va = 0x7ffbffecefff entry_point = 0x7ffbffeb0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 575 start_va = 0x7ffc00170000 end_va = 0x7ffc00186fff entry_point = 0x7ffc00170000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 576 start_va = 0x7ffc002e0000 end_va = 0x7ffc002eafff entry_point = 0x7ffc002e0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 577 start_va = 0x7ffc004c0000 end_va = 0x7ffc004ebfff entry_point = 0x7ffc004c0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 578 start_va = 0x7ffc006c0000 end_va = 0x7ffc006e7fff entry_point = 0x7ffc006c0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 579 start_va = 0x7ffc006f0000 end_va = 0x7ffc0075afff entry_point = 0x7ffc006f0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 580 start_va = 0x7ffc008a0000 end_va = 0x7ffc008e9fff entry_point = 0x7ffc008a0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 581 start_va = 0x7ffc008f0000 end_va = 0x7ffc00902fff entry_point = 0x7ffc008f0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 582 start_va = 0x7ffc00910000 end_va = 0x7ffc0091efff entry_point = 0x7ffc00910000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 583 start_va = 0x7ffc00920000 end_va = 0x7ffc00930fff entry_point = 0x7ffc00920000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 584 start_va = 0x7ffc00940000 end_va = 0x7ffc00f67fff entry_point = 0x7ffc00940000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 585 start_va = 0x7ffc00fc0000 end_va = 0x7ffc01072fff entry_point = 0x7ffc00fc0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 586 start_va = 0x7ffc01190000 end_va = 0x7ffc01350fff entry_point = 0x7ffc01190000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 587 start_va = 0x7ffc01360000 end_va = 0x7ffc0153cfff entry_point = 0x7ffc01360000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 588 start_va = 0x7ffc01540000 end_va = 0x7ffc015e4fff entry_point = 0x7ffc01540000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 589 start_va = 0x7ffc015f0000 end_va = 0x7ffc01625fff entry_point = 0x7ffc015f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 590 start_va = 0x7ffc01640000 end_va = 0x7ffc016e5fff entry_point = 0x7ffc01640000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 591 start_va = 0x7ffc018a0000 end_va = 0x7ffc01b1bfff entry_point = 0x7ffc018a0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 592 start_va = 0x7ffc01dd0000 end_va = 0x7ffc01ef5fff entry_point = 0x7ffc01dd0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 593 start_va = 0x7ffc01f00000 end_va = 0x7ffc0204dfff entry_point = 0x7ffc01f00000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 594 start_va = 0x7ffc02060000 end_va = 0x7ffc020fcfff entry_point = 0x7ffc02060000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 595 start_va = 0x7ffc02100000 end_va = 0x7ffc0215afff entry_point = 0x7ffc02100000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 596 start_va = 0x7ffc02160000 end_va = 0x7ffc022bbfff entry_point = 0x7ffc02160000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 597 start_va = 0x7ffc022c0000 end_va = 0x7ffc037e4fff entry_point = 0x7ffc022c0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 598 start_va = 0x7ffc037f0000 end_va = 0x7ffc03974fff entry_point = 0x7ffc037f0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 599 start_va = 0x7ffc03a50000 end_va = 0x7ffc03aa0fff entry_point = 0x7ffc03a50000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 600 start_va = 0x7ffc03bb0000 end_va = 0x7ffc03cf0fff entry_point = 0x7ffc03bb0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 601 start_va = 0x7ffc03d00000 end_va = 0x7ffc03dbdfff entry_point = 0x7ffc03d00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 602 start_va = 0x7ffc03dc0000 end_va = 0x7ffc03e6cfff entry_point = 0x7ffc03dc0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 603 start_va = 0x7ffc03e70000 end_va = 0x7ffc04031fff entry_point = 0x7ffc03e70000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 604 start_va = 0xe70000 end_va = 0xe72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e70000" filename = "" Region: id = 605 start_va = 0x7ffbfb2d0000 end_va = 0x7ffbfb543fff entry_point = 0x7ffbfb2d0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll") Region: id = 606 start_va = 0x2b00000 end_va = 0x2b03fff entry_point = 0x2b00000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 607 start_va = 0x2b10000 end_va = 0x2b11fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b10000" filename = "" Region: id = 608 start_va = 0x2b20000 end_va = 0x2b62fff entry_point = 0x2b20000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000b.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000b.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000b.db") Region: id = 609 start_va = 0x2b70000 end_va = 0x2b73fff entry_point = 0x2b70000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 610 start_va = 0x2b80000 end_va = 0x2c0afff entry_point = 0x2b80000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 611 start_va = 0x2c10000 end_va = 0x2c20fff entry_point = 0x2c10000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 612 start_va = 0x2c30000 end_va = 0x2caffff entry_point = 0x0 region_type = private name = "private_0x0000000002c30000" filename = "" Region: id = 613 start_va = 0x2cb0000 end_va = 0x2cb0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002cb0000" filename = "" Region: id = 614 start_va = 0x2cc0000 end_va = 0x2d20fff entry_point = 0x2cc0000 region_type = mapped_file name = "shell32.dll.mui" filename = "\\Windows\\System32\\en-US\\shell32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\shell32.dll.mui") Region: id = 615 start_va = 0x2d30000 end_va = 0x2d37fff entry_point = 0x2d30000 region_type = mapped_file name = "windows.storage.dll.mui" filename = "\\Windows\\System32\\en-US\\windows.storage.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\windows.storage.dll.mui") Region: id = 616 start_va = 0x7ff6e70dc000 end_va = 0x7ff6e70ddfff entry_point = 0x0 region_type = private name = "private_0x00007ff6e70dc000" filename = "" Region: id = 617 start_va = 0x7ffbf6fc0000 end_va = 0x7ffbf7156fff entry_point = 0x7ffbf6fc0000 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 618 start_va = 0x7ffbf9380000 end_va = 0x7ffbf96f5fff entry_point = 0x7ffbf9380000 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 619 start_va = 0x2d40000 end_va = 0x2d40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002d40000" filename = "" Region: id = 620 start_va = 0x7ffc00f70000 end_va = 0x7ffc00fb3fff entry_point = 0x7ffc00f70000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 621 start_va = 0x7ffbf4fc0000 end_va = 0x7ffbf4fcefff entry_point = 0x7ffbf4fc0000 region_type = mapped_file name = "pcacli.dll" filename = "\\Windows\\System32\\pcacli.dll" (normalized: "c:\\windows\\system32\\pcacli.dll") Region: id = 622 start_va = 0x7ffbffad0000 end_va = 0x7ffbffaebfff entry_point = 0x7ffbffad0000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Thread: id = 26 os_tid = 0xe90 Thread: id = 27 os_tid = 0xe8c Thread: id = 28 os_tid = 0xe88 Thread: id = 29 os_tid = 0xe84 Thread: id = 30 os_tid = 0xe80 Thread: id = 31 os_tid = 0xe7c Thread: id = 32 os_tid = 0xe94 Process: id = "4" image_name = "vfggggg.exe" filename = "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe" page_root = "0x56cc5000" os_pid = "0xe98" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xe78" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001714b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 623 start_va = 0x410000 end_va = 0x501fff entry_point = 0x410000 region_type = mapped_file name = "vfggggg.exe" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe") Region: id = 624 start_va = 0x510000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 625 start_va = 0x530000 end_va = 0x531fff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 626 start_va = 0x540000 end_va = 0x553fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 627 start_va = 0x560000 end_va = 0x59ffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 628 start_va = 0x5a0000 end_va = 0x69ffff entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 629 start_va = 0x6a0000 end_va = 0x6a3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 630 start_va = 0x6b0000 end_va = 0x6b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 631 start_va = 0x6c0000 end_va = 0x6c1fff entry_point = 0x0 region_type = private name = "private_0x00000000006c0000" filename = "" Region: id = 632 start_va = 0x77c40000 end_va = 0x77db8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 633 start_va = 0x7f330000 end_va = 0x7f352fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f330000" filename = "" Region: id = 634 start_va = 0x7f35b000 end_va = 0x7f35bfff entry_point = 0x0 region_type = private name = "private_0x000000007f35b000" filename = "" Region: id = 635 start_va = 0x7f35c000 end_va = 0x7f35cfff entry_point = 0x0 region_type = private name = "private_0x000000007f35c000" filename = "" Region: id = 636 start_va = 0x7f35d000 end_va = 0x7f35ffff entry_point = 0x0 region_type = private name = "private_0x000000007f35d000" filename = "" Region: id = 637 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 638 start_va = 0x7fff0000 end_va = 0x7ffc03e6ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 639 start_va = 0x7ffc03e70000 end_va = 0x7ffc04031fff entry_point = 0x7ffc03e70000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 640 start_va = 0x7ffc04032000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc04032000" filename = "" Region: id = 641 start_va = 0x7e0000 end_va = 0x7effff entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 642 start_va = 0x59300000 end_va = 0x5934efff entry_point = 0x59300000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 643 start_va = 0x59360000 end_va = 0x593d2fff entry_point = 0x59360000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 644 start_va = 0x8b0000 end_va = 0x9affff entry_point = 0x0 region_type = private name = "private_0x00000000008b0000" filename = "" Region: id = 645 start_va = 0x59350000 end_va = 0x59357fff entry_point = 0x59350000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 646 start_va = 0x510000 end_va = 0x51ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 647 start_va = 0x6d0000 end_va = 0x78dfff entry_point = 0x6d0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 648 start_va = 0x73f90000 end_va = 0x73fe8fff entry_point = 0x73f90000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 649 start_va = 0x76970000 end_va = 0x76ae5fff entry_point = 0x76970000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 650 start_va = 0x77670000 end_va = 0x7775ffff entry_point = 0x77670000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 651 start_va = 0x7f230000 end_va = 0x7f32ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007f230000" filename = "" Region: id = 652 start_va = 0xba0000 end_va = 0xbaffff entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 653 start_va = 0x74c40000 end_va = 0x74cd0fff entry_point = 0x74c40000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 654 start_va = 0x7eea0000 end_va = 0x7f22ffff entry_point = 0x7eea0000 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 655 start_va = 0x520000 end_va = 0x523fff entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 656 start_va = 0x790000 end_va = 0x7cffff entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 657 start_va = 0x9b0000 end_va = 0xaaffff entry_point = 0x0 region_type = private name = "private_0x00000000009b0000" filename = "" Region: id = 658 start_va = 0xb80000 end_va = 0xb8ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 659 start_va = 0x74ce0000 end_va = 0x74d38fff entry_point = 0x74ce0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 660 start_va = 0x74d40000 end_va = 0x74d49fff entry_point = 0x74d40000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 661 start_va = 0x74d50000 end_va = 0x74d6dfff entry_point = 0x74d50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 662 start_va = 0x77250000 end_va = 0x77292fff entry_point = 0x77250000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 663 start_va = 0x77990000 end_va = 0x77a0afff entry_point = 0x77990000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 664 start_va = 0x77a10000 end_va = 0x77acdfff entry_point = 0x77a10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 665 start_va = 0x77af0000 end_va = 0x77b9bfff entry_point = 0x77af0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 666 start_va = 0x7f358000 end_va = 0x7f35afff entry_point = 0x0 region_type = private name = "private_0x000000007f358000" filename = "" Region: id = 667 start_va = 0x73f10000 end_va = 0x73f87fff entry_point = 0x73f10000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 668 start_va = 0x530000 end_va = 0x530fff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 669 start_va = 0x7d0000 end_va = 0x7d0fff entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 670 start_va = 0xbb0000 end_va = 0xd37fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bb0000" filename = "" Region: id = 671 start_va = 0xd40000 end_va = 0xec0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d40000" filename = "" Region: id = 672 start_va = 0xed0000 end_va = 0x22cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ed0000" filename = "" Region: id = 673 start_va = 0x74d70000 end_va = 0x74eaffff entry_point = 0x74d70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 674 start_va = 0x75080000 end_va = 0x750c3fff entry_point = 0x75080000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 675 start_va = 0x76ca0000 end_va = 0x76decfff entry_point = 0x76ca0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 676 start_va = 0x76f70000 end_va = 0x7708ffff entry_point = 0x76f70000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 677 start_va = 0x77090000 end_va = 0x77249fff entry_point = 0x77090000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 678 start_va = 0x775e0000 end_va = 0x7760afff entry_point = 0x775e0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 679 start_va = 0x76f60000 end_va = 0x76f6bfff entry_point = 0x76f60000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 680 start_va = 0x73f00000 end_va = 0x73f07fff entry_point = 0x73f00000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 681 start_va = 0x7f0000 end_va = 0x7f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007f0000" filename = "" Region: id = 682 start_va = 0x850000 end_va = 0x85ffff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 683 start_va = 0x738b0000 end_va = 0x7394afff entry_point = 0x738b0000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\msvcr80.dll") Region: id = 684 start_va = 0x73950000 end_va = 0x73efffff entry_point = 0x73950000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll") Region: id = 685 start_va = 0x800000 end_va = 0x800fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 686 start_va = 0x810000 end_va = 0x810fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 687 start_va = 0x820000 end_va = 0x82ffff entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 688 start_va = 0x830000 end_va = 0x83ffff entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 689 start_va = 0x840000 end_va = 0x84ffff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 690 start_va = 0x860000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 691 start_va = 0x870000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 692 start_va = 0x880000 end_va = 0x88ffff entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 693 start_va = 0x890000 end_va = 0x89ffff entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 694 start_va = 0xab0000 end_va = 0xaeffff entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 695 start_va = 0x22d0000 end_va = 0x23cffff entry_point = 0x0 region_type = private name = "private_0x00000000022d0000" filename = "" Region: id = 696 start_va = 0x75070000 end_va = 0x7507efff entry_point = 0x75070000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 697 start_va = 0x750d0000 end_va = 0x755acfff entry_point = 0x750d0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 698 start_va = 0x755b0000 end_va = 0x7696efff entry_point = 0x755b0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 699 start_va = 0x777f0000 end_va = 0x77833fff entry_point = 0x777f0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 700 start_va = 0x778a0000 end_va = 0x7792cfff entry_point = 0x778a0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 701 start_va = 0x7f355000 end_va = 0x7f357fff entry_point = 0x0 region_type = private name = "private_0x000000007f355000" filename = "" Region: id = 702 start_va = 0x8a0000 end_va = 0x8a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 703 start_va = 0xaf0000 end_va = 0xb2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 704 start_va = 0x23d0000 end_va = 0x2706fff entry_point = 0x23d0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 705 start_va = 0x2710000 end_va = 0x470ffff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 706 start_va = 0x4710000 end_va = 0x47affff entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 707 start_va = 0x47b0000 end_va = 0x48affff entry_point = 0x0 region_type = private name = "private_0x00000000047b0000" filename = "" Region: id = 708 start_va = 0x72db0000 end_va = 0x738a9fff entry_point = 0x72db0000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll") Region: id = 709 start_va = 0x7f22d000 end_va = 0x7f22ffff entry_point = 0x0 region_type = private name = "private_0x000000007f22d000" filename = "" Region: id = 710 start_va = 0x77430000 end_va = 0x77519fff entry_point = 0x77430000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 711 start_va = 0xb30000 end_va = 0xb32fff entry_point = 0xb30000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\SysWOW64\\l_intl.nls" (normalized: "c:\\windows\\syswow64\\l_intl.nls") Region: id = 712 start_va = 0xb40000 end_va = 0xb40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b40000" filename = "" Region: id = 713 start_va = 0x74ab0000 end_va = 0x74b0afff entry_point = 0x74ab0000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll") Region: id = 714 start_va = 0xb50000 end_va = 0xb5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 715 start_va = 0xb60000 end_va = 0xb6ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 716 start_va = 0xb70000 end_va = 0xb7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 717 start_va = 0x721d0000 end_va = 0x72daffff entry_point = 0x721d0000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\e3f653c6d321c4c528daa164908e0ff8\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\e3f653c6d321c4c528daa164908e0ff8\\system.windows.forms.ni.dll") Region: id = 718 start_va = 0x74060000 end_va = 0x74802fff entry_point = 0x74060000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\b0de8183f9e33cd0fbe10c8db1402653\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\b0de8183f9e33cd0fbe10c8db1402653\\system.ni.dll") Region: id = 719 start_va = 0x74920000 end_va = 0x74aa8fff entry_point = 0x74920000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\cebfffe6cee14413d504056227f496b2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\cebfffe6cee14413d504056227f496b2\\system.drawing.ni.dll") Region: id = 720 start_va = 0x4720000 end_va = 0x472ffff entry_point = 0x0 region_type = private name = "private_0x0000000004720000" filename = "" Region: id = 721 start_va = 0x48b0000 end_va = 0x58affff entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 722 start_va = 0x58b0000 end_va = 0x59dffff entry_point = 0x0 region_type = private name = "private_0x00000000058b0000" filename = "" Region: id = 723 start_va = 0x74bc0000 end_va = 0x74c34fff entry_point = 0x74bc0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 724 start_va = 0xb90000 end_va = 0xb91fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b90000" filename = "" Region: id = 725 start_va = 0x74ba0000 end_va = 0x74bbcfff entry_point = 0x74ba0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 726 start_va = 0x72060000 end_va = 0x721cafff entry_point = 0x72060000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll") Region: id = 727 start_va = 0x4730000 end_va = 0x475ffff entry_point = 0x0 region_type = private name = "private_0x0000000004730000" filename = "" Region: id = 728 start_va = 0x4760000 end_va = 0x479ffff entry_point = 0x0 region_type = private name = "private_0x0000000004760000" filename = "" Region: id = 729 start_va = 0x59e0000 end_va = 0x5adffff entry_point = 0x0 region_type = private name = "private_0x00000000059e0000" filename = "" Region: id = 730 start_va = 0x71e70000 end_va = 0x7205ffff entry_point = 0x71e70000 region_type = mapped_file name = "dwrite.dll" filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll") Region: id = 731 start_va = 0x7f22a000 end_va = 0x7f22cfff entry_point = 0x0 region_type = private name = "private_0x000000007f22a000" filename = "" Region: id = 732 start_va = 0x5ae0000 end_va = 0x5b55fff entry_point = 0x5ae0000 region_type = mapped_file name = "~fontcache-system.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat") Region: id = 733 start_va = 0x4710000 end_va = 0x4713fff entry_point = 0x0 region_type = private name = "private_0x0000000004710000" filename = "" Region: id = 734 start_va = 0x5b60000 end_va = 0x5c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000005b60000" filename = "" Region: id = 735 start_va = 0x5c60000 end_va = 0x6c5ffff entry_point = 0x5c60000 region_type = mapped_file name = "~fontcache-fontface.dat" filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat") Region: id = 736 start_va = 0x4730000 end_va = 0x4733fff entry_point = 0x0 region_type = private name = "private_0x0000000004730000" filename = "" Region: id = 737 start_va = 0x4750000 end_va = 0x475ffff entry_point = 0x0 region_type = private name = "private_0x0000000004750000" filename = "" Region: id = 738 start_va = 0x6c60000 end_va = 0x6d5ffff entry_point = 0x0 region_type = private name = "private_0x0000000006c60000" filename = "" Region: id = 739 start_va = 0x6d60000 end_va = 0x7251fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006d60000" filename = "" Region: id = 740 start_va = 0x4740000 end_va = 0x4740fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004740000" filename = "" Region: id = 741 start_va = 0x7260000 end_va = 0x7317fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007260000" filename = "" Region: id = 742 start_va = 0x4740000 end_va = 0x4743fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004740000" filename = "" Region: id = 743 start_va = 0x47a0000 end_va = 0x47affff entry_point = 0x0 region_type = private name = "private_0x00000000047a0000" filename = "" Region: id = 744 start_va = 0x7320000 end_va = 0x735ffff entry_point = 0x0 region_type = private name = "private_0x0000000007320000" filename = "" Region: id = 745 start_va = 0x7360000 end_va = 0x745ffff entry_point = 0x0 region_type = private name = "private_0x0000000007360000" filename = "" Region: id = 746 start_va = 0x7f227000 end_va = 0x7f229fff entry_point = 0x0 region_type = private name = "private_0x000000007f227000" filename = "" Region: id = 747 start_va = 0x7460000 end_va = 0x7464fff entry_point = 0x7460000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 748 start_va = 0x7470000 end_va = 0x7473fff entry_point = 0x0 region_type = private name = "private_0x0000000007470000" filename = "" Region: id = 749 start_va = 0x7480000 end_va = 0x748ffff entry_point = 0x0 region_type = private name = "private_0x0000000007480000" filename = "" Region: id = 750 start_va = 0x7480000 end_va = 0x748ffff entry_point = 0x0 region_type = private name = "private_0x0000000007480000" filename = "" Region: id = 751 start_va = 0x7480000 end_va = 0x748dfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000007480000" filename = "" Region: id = 752 start_va = 0x48b0000 end_va = 0x48bffff entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 753 start_va = 0x71c30000 end_va = 0x71e65fff entry_point = 0x71c30000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\40661cdfbf2201f3d6c5cf6378755082\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\40661cdfbf2201f3d6c5cf6378755082\\system.core.ni.dll") Region: id = 754 start_va = 0x74b80000 end_va = 0x74b92fff entry_point = 0x74b80000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 755 start_va = 0x74b60000 end_va = 0x74b7afff entry_point = 0x74b60000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 756 start_va = 0x74b30000 end_va = 0x74b5efff entry_point = 0x74b30000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 757 start_va = 0x48b0000 end_va = 0x48bffff entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 758 start_va = 0x48c0000 end_va = 0x48cffff entry_point = 0x0 region_type = private name = "private_0x00000000048c0000" filename = "" Region: id = 759 start_va = 0x48d0000 end_va = 0x48dffff entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 760 start_va = 0x48e0000 end_va = 0x48effff entry_point = 0x0 region_type = private name = "private_0x00000000048e0000" filename = "" Region: id = 761 start_va = 0x773d0000 end_va = 0x773d5fff entry_point = 0x773d0000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 762 start_va = 0x48d0000 end_va = 0x49affff entry_point = 0x0 region_type = private name = "private_0x00000000048d0000" filename = "" Region: id = 763 start_va = 0x48b0000 end_va = 0x48b3fff entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 764 start_va = 0x48d0000 end_va = 0x48d4fff entry_point = 0x48d0000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 765 start_va = 0x49a0000 end_va = 0x49affff entry_point = 0x0 region_type = private name = "private_0x00000000049a0000" filename = "" Region: id = 766 start_va = 0x48e0000 end_va = 0x4920fff entry_point = 0x48e0000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 767 start_va = 0x74b20000 end_va = 0x74b27fff entry_point = 0x74b20000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\culture.dll") Region: id = 768 start_va = 0x4930000 end_va = 0x4930fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004930000" filename = "" Region: id = 769 start_va = 0x4930000 end_va = 0x4983fff entry_point = 0x4930000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorrc.dll") Region: id = 770 start_va = 0x4990000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 771 start_va = 0x49b0000 end_va = 0x49bffff entry_point = 0x0 region_type = private name = "private_0x00000000049b0000" filename = "" Region: id = 772 start_va = 0x4990000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 773 start_va = 0x4990000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 774 start_va = 0x4990000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 775 start_va = 0x4990000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 776 start_va = 0x4990000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 777 start_va = 0x4990000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 778 start_va = 0x4990000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 779 start_va = 0x4990000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 780 start_va = 0x4990000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 781 start_va = 0x49b0000 end_va = 0x4a36fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000049b0000" filename = "" Region: id = 782 start_va = 0x4990000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 783 start_va = 0x4990000 end_va = 0x499ffff entry_point = 0x0 region_type = private name = "private_0x0000000004990000" filename = "" Region: id = 784 start_va = 0x4a40000 end_va = 0x4abffff entry_point = 0x0 region_type = private name = "private_0x0000000004a40000" filename = "" Region: id = 785 start_va = 0x71ab0000 end_va = 0x71c20fff entry_point = 0x71ab0000 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 786 start_va = 0x4ac0000 end_va = 0x4aeffff entry_point = 0x0 region_type = private name = "private_0x0000000004ac0000" filename = "" Region: id = 787 start_va = 0x4ac0000 end_va = 0x4acffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ac0000" filename = "" Region: id = 788 start_va = 0x4ad0000 end_va = 0x4adffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ad0000" filename = "" Region: id = 789 start_va = 0x4ae0000 end_va = 0x4aeffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ae0000" filename = "" Region: id = 790 start_va = 0x77ba0000 end_va = 0x77c31fff entry_point = 0x77ba0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 791 start_va = 0x4af0000 end_va = 0x4b72fff entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 792 start_va = 0x4af0000 end_va = 0x4b72fff entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 793 start_va = 0x4af0000 end_va = 0x4b73fff entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 794 start_va = 0x4af0000 end_va = 0x4b78fff entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 795 start_va = 0x4af0000 end_va = 0x4b75fff entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 796 start_va = 0x4af0000 end_va = 0x4b78fff entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 797 start_va = 0x4af0000 end_va = 0x4b76fff entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 798 start_va = 0x4af0000 end_va = 0x4b74fff entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 799 start_va = 0x4af0000 end_va = 0x4b7efff entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 800 start_va = 0x4af0000 end_va = 0x4ceffff entry_point = 0x0 region_type = private name = "private_0x0000000004af0000" filename = "" Region: id = 801 start_va = 0x4cf0000 end_va = 0x4d7efff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 802 start_va = 0x4cf0000 end_va = 0x4deffff entry_point = 0x0 region_type = private name = "private_0x0000000004cf0000" filename = "" Region: id = 803 start_va = 0x4df0000 end_va = 0x4e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 804 start_va = 0x4df0000 end_va = 0x4e7efff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 805 start_va = 0x4df0000 end_va = 0x4e71fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 806 start_va = 0x4df0000 end_va = 0x4e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 807 start_va = 0x4df0000 end_va = 0x4e77fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 808 start_va = 0x4df0000 end_va = 0x4e7dfff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 809 start_va = 0x4df0000 end_va = 0x4e72fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 810 start_va = 0x4df0000 end_va = 0x4e77fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 811 start_va = 0x4df0000 end_va = 0x4e73fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 812 start_va = 0x4df0000 end_va = 0x4e78fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 813 start_va = 0x4df0000 end_va = 0x4e73fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 814 start_va = 0x4df0000 end_va = 0x4e77fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 815 start_va = 0x4df0000 end_va = 0x4e72fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 816 start_va = 0x4df0000 end_va = 0x4e80fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 817 start_va = 0x4df0000 end_va = 0x4e72fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 818 start_va = 0x4df0000 end_va = 0x4e79fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 819 start_va = 0x4df0000 end_va = 0x4e72fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 820 start_va = 0x4df0000 end_va = 0x4e7efff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 821 start_va = 0x4df0000 end_va = 0x4e78fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 822 start_va = 0x4df0000 end_va = 0x4e7afff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 823 start_va = 0x4df0000 end_va = 0x4e7dfff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 824 start_va = 0x4df0000 end_va = 0x4e7cfff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 825 start_va = 0x4df0000 end_va = 0x4e80fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 826 start_va = 0x4df0000 end_va = 0x4e77fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 827 start_va = 0x4df0000 end_va = 0x4e72fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 828 start_va = 0x4df0000 end_va = 0x4e7bfff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 829 start_va = 0x4df0000 end_va = 0x4e71fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 830 start_va = 0x4df0000 end_va = 0x4e76fff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 831 start_va = 0x4df0000 end_va = 0x4e7dfff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 832 start_va = 0x4df0000 end_va = 0x4e7dfff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 833 start_va = 0x4df0000 end_va = 0x4dfffff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 834 start_va = 0x4e00000 end_va = 0x4e0ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 835 start_va = 0x74b20000 end_va = 0x74b25fff entry_point = 0x74b20000 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\SysWOW64\\shfolder.dll" (normalized: "c:\\windows\\syswow64\\shfolder.dll") Region: id = 836 start_va = 0x4df0000 end_va = 0x4dfffff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 837 start_va = 0x4df0000 end_va = 0x4dfffff entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Thread: id = 33 os_tid = 0xe9c [0072.386] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0072.418] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x69eb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0072.418] GetLastError () returned 0x2 [0072.423] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x69ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0072.423] GetLastError () returned 0x2 [0072.425] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x69ea64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x26 [0072.425] GetLastError () returned 0x2 [0072.429] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x69eb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x26 [0072.429] GetLastError () returned 0x2 [0072.429] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x69ea9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x26 [0072.429] GetLastError () returned 0x2 [0072.434] GetVersionExW (in: lpVersionInformation=0x8f33d8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x8f33d8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0072.434] GetLastError () returned 0x2 [0072.435] GetVersionExW (in: lpVersionInformation=0x8f33d8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x8f33d8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0072.435] GetLastError () returned 0x2 [0073.346] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x69e80c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0073.346] GetLastError () returned 0x8013141b [0073.346] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x69e798, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0073.346] GetLastError () returned 0x8013141b [0073.360] VirtualProtect (in: lpAddress=0x412000, dwSize=0x8a688, flNewProtect=0x40, lpflOldProtect=0x69eeac | out: lpflOldProtect=0x69eeac*=0x2) returned 1 [0074.106] GetFullPathNameW (in: lpFileName="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x69ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\assembly\\GAC_MSIL\\System.Windows.Forms\\2.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x64 [0074.106] GetLastError () returned 0x1e7 [0074.115] IsAppThemed () returned 0x0 [0074.117] CoTaskMemAlloc (cb=0xca) returned 0x8c9358 [0074.117] CreateActCtxA (pActCtx=0x8f39c0) returned 0x90424c [0074.118] CoTaskMemFree (pv=0x8c9358) [0074.131] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc16b [0074.131] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc16c [0074.140] GetSystemMetrics (nIndex=75) returned 1 [0074.145] AdjustWindowRectEx (in: lpRect=0x69f124, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x69f124) returned 1 [0074.147] GetCurrentProcess () returned 0xffffffff [0074.147] GetCurrentThread () returned 0xfffffffe [0074.147] GetCurrentProcess () returned 0xffffffff [0074.148] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x69f054, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x69f054*=0x270) returned 1 [0074.148] GetLastError () returned 0x0 [0074.150] GetCurrentThreadId () returned 0xe9c [0074.155] GetCurrentActCtx (in: lphActCtx=0x69efb4 | out: lphActCtx=0x69efb4*=0x0) returned 1 [0074.156] ActivateActCtx (in: hActCtx=0x90424c, lpCookie=0x69efc8 | out: hActCtx=0x90424c, lpCookie=0x69efc8) returned 1 [0074.156] lstrlenW (lpString="䅁") returned 1 [0074.157] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74d70000 [0074.158] GetProcAddress (hModule=0x74d70000, lpProcName="DefWindowProcW") returned 0x77cbcaa0 [0074.159] GetStockObject (i=5) returned 0x1900015 [0074.159] GetLastError () returned 0x0 [0074.162] GetModuleHandleW (lpModuleName=0x0) returned 0x410000 [0074.166] CoTaskMemAlloc (cb=0x4c) returned 0x8dc408 [0074.166] RegisterClassW (lpWndClass=0x8f39d8) returned 0xc172 [0074.166] GetLastError () returned 0x2 [0074.166] CoTaskMemFree (pv=0x8dc408) [0074.167] GetModuleHandleW (lpModuleName=0x0) returned 0x410000 [0074.168] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x410000, lpParam=0x0) returned 0x80166 [0074.170] SetWindowLongW (hWnd=0x80166, nIndex=-4, dwNewLong=2009844384) returned 8718194 [0074.171] GetWindowLongW (hWnd=0x80166, nIndex=-4) returned 2009844384 [0074.173] lstrlenW (lpString="䅁") returned 1 [0074.175] GetVersionExW (in: lpVersionInformation=0x8f39f8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x8f39f8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0074.175] GetLastError () returned 0x2 [0074.177] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x69e698 | out: phkResult=0x69e698*=0x278) returned 0x0 [0074.178] RegQueryValueExW (in: hKey=0x278, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x69e6e0, lpData=0x0, lpcbData=0x69e6dc*=0x0 | out: lpType=0x69e6e0*=0x0, lpData=0x0, lpcbData=0x69e6dc*=0x0) returned 0x2 [0074.178] RegQueryValueExW (in: hKey=0x278, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x69e6e0, lpData=0x0, lpcbData=0x69e6dc*=0x0 | out: lpType=0x69e6e0*=0x0, lpData=0x0, lpcbData=0x69e6dc*=0x0) returned 0x2 [0074.178] RegCloseKey (hKey=0x278) returned 0x0 [0074.180] SetWindowLongW (hWnd=0x80166, nIndex=-4, dwNewLong=8718514) returned 2009844384 [0074.180] GetWindowLongW (hWnd=0x80166, nIndex=-4) returned 8718514 [0074.180] GetWindowLongW (hWnd=0x80166, nIndex=-16) returned 113311744 [0074.183] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc167 [0074.183] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x80166, Msg=0x24, wParam=0x0, lParam=0x69e9b4) returned 0x0 [0074.184] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc0e6 [0074.184] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x80166, Msg=0x81, wParam=0x0, lParam=0x69e9a8) returned 0x1 [0074.184] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x80166, Msg=0x83, wParam=0x0, lParam=0x69e994) returned 0x0 [0074.187] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x80166, Msg=0x1, wParam=0x0, lParam=0x69e9a8) returned 0x0 [0074.187] GetClientRect (in: hWnd=0x80166, lpRect=0x69e6e8 | out: lpRect=0x69e6e8) returned 1 [0074.187] GetWindowRect (in: hWnd=0x80166, lpRect=0x69e6e8 | out: lpRect=0x69e6e8) returned 1 [0074.188] GetLastError () returned 0x6 [0074.189] GetParent (hWnd=0x80166) returned 0x0 [0074.189] DeactivateActCtx (dwFlags=0x0, ulCookie=0x181b0001) returned 1 [0074.266] AdjustWindowRectEx (in: lpRect=0x69f0c8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x69f0c8) returned 1 [0074.266] GetSystemMetrics (nIndex=59) returned 1456 [0074.266] GetSystemMetrics (nIndex=60) returned 916 [0074.266] GetSystemMetrics (nIndex=34) returned 136 [0074.266] GetSystemMetrics (nIndex=35) returned 39 [0074.267] AdjustWindowRectEx (in: lpRect=0x69efcc, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x69efcc) returned 1 [0074.305] CreateCompatibleDC (hdc=0x0) returned 0x3701064e [0074.305] GetLastError () returned 0x6 [0074.307] GetSystemDefaultLCID () returned 0x409 [0074.307] GetLastError () returned 0x6 [0074.307] GetStockObject (i=17) returned 0x10a0047 [0074.307] GetLastError () returned 0x6 [0074.310] GetObjectW (in: h=0x10a0047, c=92, pv=0x8f39d8 | out: pv=0x8f39d8) returned 92 [0074.310] GetLastError () returned 0x6 [0074.311] GetDC (hWnd=0x0) returned 0x300106cd [0074.311] GetLastError () returned 0x6 [0074.314] GetCurrentProcessId () returned 0xe98 [0074.314] GetLastError () returned 0x6 [0074.316] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0074.316] GetLastError () returned 0x2 [0074.316] AddAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0074.316] GetLastError () returned 0x2 [0074.327] GdiplusStartup (in: token=0x864168, input=0x8f39c0, output=0x69e724 | out: token=0x864168, output=0x69e724) returned 0x0 [0074.329] GetLastError () returned 0x0 [0074.331] GdipCreateFontFromLogfontW (hdc=0x300106cd, logfont=0x8f39d8, font=0x69ef34) returned 0x0 [0074.370] GetLastError () returned 0x7a [0074.372] GdipGetFontUnit (font=0x4751f08, unit=0x69eef8) returned 0x0 [0074.372] GetLastError () returned 0x7f [0074.372] GdipGetFontSize (font=0x4751f08, size=0x69eefc) returned 0x0 [0074.372] GetLastError () returned 0x7f [0074.372] GdipGetFontStyle (font=0x4751f08, style=0x69eef4) returned 0x0 [0074.372] GetLastError () returned 0x7f [0074.373] GdipGetFamily (font=0x4751f08, family=0x69eef0) returned 0x0 [0074.373] GetLastError () returned 0x7f [0074.373] GdipGetFontSize (font=0x4751f08, size=0x273b528) returned 0x0 [0074.373] GetLastError () returned 0x7f [0074.373] ReleaseDC (hWnd=0x0, hDC=0x300106cd) returned 1 [0074.373] GetLastError () returned 0x7f [0074.373] GetDC (hWnd=0x0) returned 0xa0100d0 [0074.373] GetLastError () returned 0x7f [0074.374] GdipCreateFromHDC (hdc=0xa0100d0, graphics=0x69ef2c) returned 0x0 [0074.374] GetLastError () returned 0x7f [0074.375] GdipGetDpiY (graphics=0x6c6f260, dpi=0x273b630) returned 0x0 [0074.375] GetLastError () returned 0x7f [0074.375] GdipGetFontHeight (font=0x4751f08, graphics=0x6c6f260, height=0x69ef24) returned 0x0 [0074.375] GetLastError () returned 0x7f [0074.375] GdipGetEmHeight (family=0x6c64890, style=0, EmHeight=0x69ef2c) returned 0x0 [0074.375] GetLastError () returned 0x7f [0074.376] GdipGetLineSpacing (family=0x6c64890, style=0, LineSpacing=0x69ef2c) returned 0x0 [0074.376] GetLastError () returned 0x7f [0074.376] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0074.376] GetLastError () returned 0x7f [0074.376] GdipDeleteGraphics (graphics=0x6c6f260) returned 0x0 [0074.376] GetLastError () returned 0x7f [0074.376] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1 [0074.376] GetLastError () returned 0x7f [0074.377] GdipCreateFont (fontFamily=0x6c64890, emSize=0x41040000, style=0, unit=0x3, font=0x273b5f0) returned 0x0 [0074.377] GetLastError () returned 0x7f [0074.377] GdipGetFontSize (font=0x475ef48, size=0x273b5f4) returned 0x0 [0074.377] GetLastError () returned 0x7f [0074.377] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0074.377] GetLastError () returned 0x7f [0074.377] GdipDeleteFont (font=0x4751f08) returned 0x0 [0074.377] GetLastError () returned 0x7f [0074.377] GetDC (hWnd=0x0) returned 0xa0100d0 [0074.377] GetLastError () returned 0x7f [0074.377] GdipCreateFromHDC (hdc=0xa0100d0, graphics=0x69ef5c) returned 0x0 [0074.378] GetLastError () returned 0x7f [0074.378] GdipGetLogFontW (font=0x475ef48, graphics=0x6c6f260, logfontW=0x8f39d8) returned 0x0 [0074.379] GetLastError () returned 0x7f [0074.379] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0074.380] GetLastError () returned 0x7f [0074.380] GdipDeleteGraphics (graphics=0x6c6f260) returned 0x0 [0074.380] GetLastError () returned 0x7f [0074.380] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1 [0074.380] GetLastError () returned 0x7f [0074.380] CreateFontIndirectW (lplf=0x8f39d8) returned 0x300a0658 [0074.380] GetLastError () returned 0x7f [0074.380] SelectObject (hdc=0x3701064e, h=0x300a0658) returned 0x18a0048 [0074.380] GetLastError () returned 0x7f [0074.381] GetTextMetricsW (in: hdc=0x3701064e, lptm=0x69f048 | out: lptm=0x69f048) returned 1 [0074.381] GetLastError () returned 0x7f [0074.381] GetTextExtentPoint32W (in: hdc=0x3701064e, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x273b858 | out: psizl=0x273b858) returned 1 [0074.382] GetLastError () returned 0x0 [0074.382] SelectObject (hdc=0x3701064e, h=0x18a0048) returned 0x300a0658 [0074.382] GetLastError () returned 0x0 [0074.382] DeleteDC (hdc=0x3701064e) returned 1 [0074.382] GetLastError () returned 0x0 [0074.383] AdjustWindowRectEx (in: lpRect=0x69ee68, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x69ee68) returned 1 [0074.383] AdjustWindowRectEx (in: lpRect=0x69efdc, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x69efdc) returned 1 [0074.383] AdjustWindowRectEx (in: lpRect=0x69edd4, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x69edd4) returned 1 [0074.383] AdjustWindowRectEx (in: lpRect=0x69eea8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x69eea8) returned 1 [0074.384] GetSystemMetrics (nIndex=34) returned 136 [0074.384] GetSystemMetrics (nIndex=35) returned 39 [0074.384] GetCurrentActCtx (in: lphActCtx=0x69f144 | out: lphActCtx=0x69f144*=0x0) returned 1 [0074.384] ActivateActCtx (in: hActCtx=0x90424c, lpCookie=0x69f158 | out: hActCtx=0x90424c, lpCookie=0x69f158) returned 1 [0074.384] GetCurrentActCtx (in: lphActCtx=0x69ef84 | out: lphActCtx=0x69ef84*=0x90424c) returned 1 [0074.384] AdjustWindowRectEx (in: lpRect=0x69eef8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x69eef8) returned 1 [0074.384] GetModuleHandleW (lpModuleName=0x0) returned 0x410000 [0074.384] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.378734a", lpWindowName="PPppp", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=309, nHeight=169, hWndParent=0x0, hMenu=0x0, hInstance=0x410000, lpParam=0x0) returned 0x601ca [0074.386] SetWindowLongW (hWnd=0x601ca, nIndex=-4, dwNewLong=2009844384) returned 8718194 [0074.386] GetWindowLongW (hWnd=0x601ca, nIndex=-4) returned 2009844384 [0074.386] SetWindowLongW (hWnd=0x601ca, nIndex=-4, dwNewLong=8718562) returned 2009844384 [0074.386] GetWindowLongW (hWnd=0x601ca, nIndex=-4) returned 8718562 [0074.386] GetWindowLongW (hWnd=0x601ca, nIndex=-16) returned 114229248 [0074.386] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x81, wParam=0x0, lParam=0x69e978) returned 0x1 [0074.388] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x83, wParam=0x0, lParam=0x69e964) returned 0x0 [0074.392] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x1, wParam=0x0, lParam=0x69e978) returned 0x0 [0074.392] GetClientRect (in: hWnd=0x601ca, lpRect=0x69e680 | out: lpRect=0x69e680) returned 1 [0074.392] GetWindowRect (in: hWnd=0x601ca, lpRect=0x69e680 | out: lpRect=0x69e680) returned 1 [0074.393] SetWindowTextW (hWnd=0x601ca, lpString="PPppp") returned 1 [0074.393] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0xc, wParam=0x0, lParam=0x273ac24) returned 0x1 [0074.396] GetProcessWindowStation () returned 0xf4 [0074.397] GetUserObjectInformationA (in: hObj=0xf4, nIndex=1, pvInfo=0x273be5c, nLength=0xc, lpnLengthNeeded=0x69e580 | out: pvInfo=0x273be5c, lpnLengthNeeded=0x69e580) returned 1 [0074.397] GetLastError () returned 0x0 [0074.401] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x2b0 [0074.401] GetLastError () returned 0x0 [0074.428] GetStartupInfoW (in: lpStartupInfo=0x273c858 | out: lpStartupInfo=0x273c858*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0xa, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0074.429] GetLastError () returned 0x0 [0074.429] GetParent (hWnd=0x601ca) returned 0x0 [0074.429] SetWindowLongW (hWnd=0x601ca, nIndex=-8, dwNewLong=0) returned 0 [0074.434] GetSystemMetrics (nIndex=11) returned 32 [0074.434] GetLastError () returned 0x578 [0074.434] GetSystemMetrics (nIndex=12) returned 32 [0074.434] GetLastError () returned 0x578 [0074.434] GetDC (hWnd=0x0) returned 0xa0100d0 [0074.434] GetLastError () returned 0x578 [0074.435] GetDeviceCaps (hdc=0xa0100d0, index=12) returned 32 [0074.435] GetLastError () returned 0x578 [0074.435] GetDeviceCaps (hdc=0xa0100d0, index=14) returned 1 [0074.435] GetLastError () returned 0x578 [0074.435] ReleaseDC (hWnd=0x0, hDC=0xa0100d0) returned 1 [0074.435] GetLastError () returned 0x578 [0074.436] CreateIconFromResourceEx (presbits=0x273f49c, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x501a7 [0074.437] GetLastError () returned 0x578 [0074.437] GetSystemMetrics (nIndex=49) returned 16 [0074.437] GetSystemMetrics (nIndex=50) returned 16 [0074.437] CreateIconFromResourceEx (presbits=0x2740578, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x500f1 [0074.437] GetLastError () returned 0x578 [0074.438] SendMessageW (hWnd=0x601ca, Msg=0x80, wParam=0x0, lParam=0x500f1) returned 0x0 [0074.438] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x80, wParam=0x0, lParam=0x500f1) returned 0x0 [0074.438] SendMessageW (hWnd=0x601ca, Msg=0x80, wParam=0x1, lParam=0x501a7) returned 0x0 [0074.438] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x80, wParam=0x1, lParam=0x501a7) returned 0x0 [0074.439] GetSystemMenu (hWnd=0x601ca, bRevert=0) returned 0x40105 [0074.441] GetWindowPlacement (in: hWnd=0x601ca, lpwndpl=0x69ef94 | out: lpwndpl=0x69ef94) returned 1 [0074.441] EnableMenuItem (hMenu=0x40105, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0074.441] EnableMenuItem (hMenu=0x40105, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0074.441] EnableMenuItem (hMenu=0x40105, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0074.441] EnableMenuItem (hMenu=0x40105, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0074.441] EnableMenuItem (hMenu=0x40105, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0074.442] GetClientRect (in: hWnd=0x601ca, lpRect=0x69efd4 | out: lpRect=0x69efd4) returned 1 [0074.442] GetClientRect (in: hWnd=0x601ca, lpRect=0x69ef88 | out: lpRect=0x69ef88) returned 1 [0074.442] GetWindowRect (in: hWnd=0x601ca, lpRect=0x69ef88 | out: lpRect=0x69ef88) returned 1 [0074.442] GetWindowLongW (hWnd=0x601ca, nIndex=-16) returned 114229248 [0074.442] GetWindowTextLengthW (hWnd=0x601ca) returned 5 [0074.442] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0074.442] GetSystemMetrics (nIndex=42) returned 0 [0074.442] GetWindowTextW (in: hWnd=0x601ca, lpString=0x8f39c0, nMaxCount=6 | out: lpString="PPppp") returned 5 [0074.442] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0xd, wParam=0x6, lParam=0x8f39c0) returned 0x5 [0074.443] GetWindowTextLengthW (hWnd=0x601ca) returned 5 [0074.443] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0074.443] GetSystemMetrics (nIndex=42) returned 0 [0074.443] GetWindowTextW (in: hWnd=0x601ca, lpString=0x8f39c0, nMaxCount=6 | out: lpString="PPppp") returned 5 [0074.443] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0xd, wParam=0x6, lParam=0x8f39c0) returned 0x5 [0074.443] GetWindowLongW (hWnd=0x601ca, nIndex=-16) returned 114229248 [0074.443] GetWindowLongW (hWnd=0x601ca, nIndex=-20) returned 327936 [0074.443] SetWindowLongW (hWnd=0x601ca, nIndex=-16, dwNewLong=47120384) returned 114229248 [0074.443] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x7c, wParam=0xfffffff0, lParam=0x69ef14) returned 0x0 [0074.443] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x7d, wParam=0xfffffff0, lParam=0x69ef14) returned 0x0 [0074.447] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x500f1 [0074.447] SetWindowLongW (hWnd=0x601ca, nIndex=-20, dwNewLong=327680) returned 327936 [0074.447] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x7c, wParam=0xffffffec, lParam=0x69ef14) returned 0x0 [0074.448] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x7d, wParam=0xffffffec, lParam=0x69ef14) returned 0x0 [0074.448] SetWindowPos (hWnd=0x601ca, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0074.448] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x46, wParam=0x0, lParam=0x69ef44) returned 0x0 [0074.448] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x83, wParam=0x1, lParam=0x69ef1c) returned 0x0 [0074.449] GetWindowPlacement (in: hWnd=0x601ca, lpwndpl=0x69ecc4 | out: lpwndpl=0x69ecc4) returned 1 [0074.449] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x47, wParam=0x0, lParam=0x69ef44) returned 0x0 [0074.449] GetClientRect (in: hWnd=0x601ca, lpRect=0x69ec60 | out: lpRect=0x69ec60) returned 1 [0074.450] GetWindowRect (in: hWnd=0x601ca, lpRect=0x69ec60 | out: lpRect=0x69ec60) returned 1 [0074.450] RedrawWindow (hWnd=0x601ca, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0074.450] GetSystemMenu (hWnd=0x601ca, bRevert=0) returned 0x40105 [0074.450] GetWindowPlacement (in: hWnd=0x601ca, lpwndpl=0x69ef78 | out: lpwndpl=0x69ef78) returned 1 [0074.450] EnableMenuItem (hMenu=0x40105, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0074.451] EnableMenuItem (hMenu=0x40105, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0074.451] EnableMenuItem (hMenu=0x40105, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0074.451] EnableMenuItem (hMenu=0x40105, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0074.451] EnableMenuItem (hMenu=0x40105, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0074.451] ShowWindow (hWnd=0x601ca, nCmdShow=5) returned 0 [0074.451] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0074.451] GetWindowTextLengthW (hWnd=0x601ca) returned 5 [0074.451] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0074.452] GetSystemMetrics (nIndex=42) returned 0 [0074.452] GetWindowTextW (in: hWnd=0x601ca, lpString=0x8f39c0, nMaxCount=6 | out: lpString="PPppp") returned 5 [0074.452] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0xd, wParam=0x6, lParam=0x8f39c0) returned 0x5 [0074.474] SendMessageW (hWnd=0x601ca, Msg=0x10, wParam=0x0, lParam=0x0) returned 0x0 [0074.813] GetVersionExW (in: lpVersionInformation=0x8f39d8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x8f39d8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0074.813] GetLastError () returned 0x1e7 [0074.887] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x69db1c | out: pfEnabled=0x69db1c) returned 0x0 [0075.168] DeleteFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe:Zone.Identifier" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe:zone.identifier")) returned 0 [0075.168] GetLastError () returned 0x2 [0075.949] GetCurrentProcessId () returned 0xe98 [0075.953] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x69daa0 | out: lpLuid=0x69daa0*(LowPart=0x14, HighPart=0)) returned 1 [0075.955] GetLastError () returned 0x0 [0075.955] GetCurrentProcess () returned 0xffffffff [0075.955] GetLastError () returned 0x0 [0075.955] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x69da9c | out: TokenHandle=0x69da9c*=0x330) returned 1 [0075.956] GetLastError () returned 0x0 [0075.956] AdjustTokenPrivileges (in: TokenHandle=0x330, DisableAllPrivileges=0, NewState=0x2969a38*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0075.956] GetLastError () returned 0x514 [0075.957] CloseHandle (hObject=0x330) returned 1 [0075.957] GetLastError () returned 0x514 [0075.960] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x330 [0075.960] GetLastError () returned 0x514 [0075.968] EnumProcessModules (in: hProcess=0x330, lphModule=0x2969a7c, cb=0x100, lpcbNeeded=0x69e290 | out: lphModule=0x2969a7c, lpcbNeeded=0x69e290) returned 1 [0075.971] GetLastError () returned 0x514 [0075.973] GetModuleInformation (in: hProcess=0x330, hModule=0x410000, lpmodinfo=0x2969bbc, cb=0xc | out: lpmodinfo=0x2969bbc*(lpBaseOfDll=0x410000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0075.973] GetLastError () returned 0x514 [0075.975] GetModuleBaseNameW (in: hProcess=0x330, hModule=0x410000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="vfggggg.exe") returned 0xb [0075.975] GetLastError () returned 0x514 [0075.975] GetModuleFileNameExW (in: hProcess=0x330, hModule=0x410000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0x31 [0075.976] GetLastError () returned 0x514 [0075.976] CloseHandle (hObject=0x330) returned 1 [0075.976] GetLastError () returned 0x514 [0076.027] GetCurrentProcessId () returned 0xe98 [0076.027] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x340 [0076.028] GetLastError () returned 0x0 [0076.028] EnumProcessModules (in: hProcess=0x340, lphModule=0x296e2d8, cb=0x100, lpcbNeeded=0x69e254 | out: lphModule=0x296e2d8, lpcbNeeded=0x69e254) returned 1 [0076.028] GetLastError () returned 0x0 [0076.028] GetModuleInformation (in: hProcess=0x340, hModule=0x410000, lpmodinfo=0x296e418, cb=0xc | out: lpmodinfo=0x296e418*(lpBaseOfDll=0x410000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0076.028] GetLastError () returned 0x0 [0076.029] GetModuleBaseNameW (in: hProcess=0x340, hModule=0x410000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="vfggggg.exe") returned 0xb [0076.029] GetLastError () returned 0x0 [0076.029] GetModuleFileNameExW (in: hProcess=0x340, hModule=0x410000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0x31 [0076.029] GetLastError () returned 0x0 [0076.029] CloseHandle (hObject=0x340) returned 1 [0076.029] GetLastError () returned 0x0 [0076.090] GetCurrentProcessId () returned 0xe98 [0076.090] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x340 [0076.090] GetLastError () returned 0x0 [0076.090] EnumProcessModules (in: hProcess=0x340, lphModule=0x29ca4ac, cb=0x100, lpcbNeeded=0x69e254 | out: lphModule=0x29ca4ac, lpcbNeeded=0x69e254) returned 1 [0076.090] GetLastError () returned 0x0 [0076.090] GetModuleInformation (in: hProcess=0x340, hModule=0x410000, lpmodinfo=0x29ca5ec, cb=0xc | out: lpmodinfo=0x29ca5ec*(lpBaseOfDll=0x410000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0076.090] GetLastError () returned 0x0 [0076.090] GetModuleBaseNameW (in: hProcess=0x340, hModule=0x410000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="vfggggg.exe") returned 0xb [0076.090] GetLastError () returned 0x0 [0076.090] GetModuleFileNameExW (in: hProcess=0x340, hModule=0x410000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0x31 [0076.091] GetLastError () returned 0x0 [0076.091] CloseHandle (hObject=0x340) returned 1 [0076.091] GetLastError () returned 0x0 [0076.091] GetCurrentProcessId () returned 0xe98 [0076.091] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x340 [0076.091] GetLastError () returned 0x0 [0076.091] EnumProcessModules (in: hProcess=0x340, lphModule=0x29cbbd8, cb=0x100, lpcbNeeded=0x69e254 | out: lphModule=0x29cbbd8, lpcbNeeded=0x69e254) returned 1 [0076.091] GetLastError () returned 0x0 [0076.091] GetModuleInformation (in: hProcess=0x340, hModule=0x410000, lpmodinfo=0x29cbd18, cb=0xc | out: lpmodinfo=0x29cbd18*(lpBaseOfDll=0x410000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0076.091] GetLastError () returned 0x0 [0076.092] GetModuleBaseNameW (in: hProcess=0x340, hModule=0x410000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="vfggggg.exe") returned 0xb [0076.092] GetLastError () returned 0x0 [0076.092] GetModuleFileNameExW (in: hProcess=0x340, hModule=0x410000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0x31 [0076.092] GetLastError () returned 0x0 [0076.092] CloseHandle (hObject=0x340) returned 1 [0076.092] GetLastError () returned 0x0 [0076.092] GetCurrentProcessId () returned 0xe98 [0076.092] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x340 [0076.092] GetLastError () returned 0x0 [0076.092] EnumProcessModules (in: hProcess=0x340, lphModule=0x29cd2b4, cb=0x100, lpcbNeeded=0x69e254 | out: lphModule=0x29cd2b4, lpcbNeeded=0x69e254) returned 1 [0076.092] GetLastError () returned 0x0 [0076.093] GetModuleInformation (in: hProcess=0x340, hModule=0x410000, lpmodinfo=0x29cd3f4, cb=0xc | out: lpmodinfo=0x29cd3f4*(lpBaseOfDll=0x410000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0076.093] GetLastError () returned 0x0 [0076.093] GetModuleBaseNameW (in: hProcess=0x340, hModule=0x410000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="vfggggg.exe") returned 0xb [0076.093] GetLastError () returned 0x0 [0076.093] GetModuleFileNameExW (in: hProcess=0x340, hModule=0x410000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0x31 [0076.093] GetLastError () returned 0x0 [0076.093] CloseHandle (hObject=0x340) returned 1 [0076.093] GetLastError () returned 0x0 [0076.122] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config", nBufferLength=0x105, lpBuffer=0x69dd08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config", lpFilePart=0x0) returned 0x34 [0076.122] GetLastError () returned 0x0 [0076.122] SetErrorMode (uMode=0x1) returned 0x0 [0076.123] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.config"), fInfoLevelId=0x0, lpFileInformation=0x69e1b0 | out: lpFileInformation=0x69e1b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.123] GetLastError () returned 0x2 [0076.123] SetErrorMode (uMode=0x0) returned 0x1 [0076.398] SetErrorMode (uMode=0x1) returned 0x0 [0076.398] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\enterprisesec.config"), fInfoLevelId=0x0, lpFileInformation=0x69cc70 | out: lpFileInformation=0x69cc70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.398] GetLastError () returned 0x2 [0076.398] SetErrorMode (uMode=0x0) returned 0x1 [0076.399] SetErrorMode (uMode=0x1) returned 0x0 [0076.399] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.default" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\enterprisesec.config.default"), fInfoLevelId=0x0, lpFileInformation=0x69cc40 | out: lpFileInformation=0x69cc40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.399] GetLastError () returned 0x2 [0076.399] SetErrorMode (uMode=0x0) returned 0x1 [0076.431] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x69cbfc | out: phkResult=0x69cbfc*=0x350) returned 0x0 [0076.431] RegOpenKeyExW (in: hKey=0x350, lpSubKey="Security\\Policy\\Extensions\\NamedPermissionSets", ulOptions=0x0, samDesired=0x20019, phkResult=0x69cbfc | out: phkResult=0x69cbfc*=0x358) returned 0x0 [0076.431] RegOpenKeyExW (in: hKey=0x358, lpSubKey="Internet", ulOptions=0x0, samDesired=0x20019, phkResult=0x69cbfc | out: phkResult=0x69cbfc*=0x354) returned 0x0 [0076.451] RegQueryInfoKeyW (in: hKey=0x354, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x69cc40, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x69cc3c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x69cc40*=0x2, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x69cc3c*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.451] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x0, lpName=0x91f2b0, lpcchName=0x69cc5c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MediaPermission", lpcchName=0x69cc5c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.452] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x1, lpName=0x91f2b0, lpcchName=0x69cc5c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WebBrowserPermission", lpcchName=0x69cc5c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.452] RegOpenKeyExW (in: hKey=0x354, lpSubKey="MediaPermission", ulOptions=0x0, samDesired=0x20019, phkResult=0x69cbfc | out: phkResult=0x69cbfc*=0x35c) returned 0x0 [0076.452] RegQueryValueExW (in: hKey=0x35c, lpValueName="Xml", lpReserved=0x0, lpType=0x69cc40, lpData=0x0, lpcbData=0x69cc3c*=0x0 | out: lpType=0x69cc40*=0x1, lpData=0x0, lpcbData=0x69cc3c*=0x1aa) returned 0x0 [0076.452] RegQueryValueExW (in: hKey=0x35c, lpValueName="Xml", lpReserved=0x0, lpType=0x69cc40, lpData=0x91f2b0, lpcbData=0x69cc3c*=0x1aa | out: lpType=0x69cc40*=0x1, lpData="", lpcbData=0x69cc3c*=0x1aa) returned 0x0 [0076.452] RegCloseKey (hKey=0x35c) returned 0x0 [0076.452] RegOpenKeyExW (in: hKey=0x354, lpSubKey="WebBrowserPermission", ulOptions=0x0, samDesired=0x20019, phkResult=0x69cbfc | out: phkResult=0x69cbfc*=0x35c) returned 0x0 [0076.452] RegQueryValueExW (in: hKey=0x35c, lpValueName="Xml", lpReserved=0x0, lpType=0x69cc40, lpData=0x0, lpcbData=0x69cc3c*=0x0 | out: lpType=0x69cc40*=0x1, lpData=0x0, lpcbData=0x69cc3c*=0x162) returned 0x0 [0076.453] RegQueryValueExW (in: hKey=0x35c, lpValueName="Xml", lpReserved=0x0, lpType=0x69cc40, lpData=0x8f39c0, lpcbData=0x69cc3c*=0x162 | out: lpType=0x69cc40*=0x1, lpData="", lpcbData=0x69cc3c*=0x162) returned 0x0 [0076.453] RegCloseKey (hKey=0x35c) returned 0x0 [0076.453] RegCloseKey (hKey=0x354) returned 0x0 [0076.453] RegOpenKeyExW (in: hKey=0x358, lpSubKey="LocalIntranet", ulOptions=0x0, samDesired=0x20019, phkResult=0x69cbfc | out: phkResult=0x69cbfc*=0x354) returned 0x0 [0076.453] RegQueryInfoKeyW (in: hKey=0x354, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x69cc40, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x69cc3c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x69cc40*=0x2, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x69cc3c*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.453] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x0, lpName=0x91f2b0, lpcchName=0x69cc5c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MediaPermission", lpcchName=0x69cc5c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.453] RegEnumKeyExW (in: hKey=0x354, dwIndex=0x1, lpName=0x91f2b0, lpcchName=0x69cc5c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WebBrowserPermission", lpcchName=0x69cc5c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0076.453] RegOpenKeyExW (in: hKey=0x354, lpSubKey="MediaPermission", ulOptions=0x0, samDesired=0x20019, phkResult=0x69cbfc | out: phkResult=0x69cbfc*=0x35c) returned 0x0 [0076.453] RegQueryValueExW (in: hKey=0x35c, lpValueName="Xml", lpReserved=0x0, lpType=0x69cc40, lpData=0x0, lpcbData=0x69cc3c*=0x0 | out: lpType=0x69cc40*=0x1, lpData=0x0, lpcbData=0x69cc3c*=0x1aa) returned 0x0 [0076.453] RegQueryValueExW (in: hKey=0x35c, lpValueName="Xml", lpReserved=0x0, lpType=0x69cc40, lpData=0x91f2b0, lpcbData=0x69cc3c*=0x1aa | out: lpType=0x69cc40*=0x1, lpData="", lpcbData=0x69cc3c*=0x1aa) returned 0x0 [0076.454] RegCloseKey (hKey=0x35c) returned 0x0 [0076.454] RegOpenKeyExW (in: hKey=0x354, lpSubKey="WebBrowserPermission", ulOptions=0x0, samDesired=0x20019, phkResult=0x69cbfc | out: phkResult=0x69cbfc*=0x35c) returned 0x0 [0076.454] RegQueryValueExW (in: hKey=0x35c, lpValueName="Xml", lpReserved=0x0, lpType=0x69cc40, lpData=0x0, lpcbData=0x69cc3c*=0x0 | out: lpType=0x69cc40*=0x1, lpData=0x0, lpcbData=0x69cc3c*=0x162) returned 0x0 [0076.454] RegQueryValueExW (in: hKey=0x35c, lpValueName="Xml", lpReserved=0x0, lpType=0x69cc40, lpData=0x8f39c0, lpcbData=0x69cc3c*=0x162 | out: lpType=0x69cc40*=0x1, lpData="", lpcbData=0x69cc3c*=0x162) returned 0x0 [0076.454] RegCloseKey (hKey=0x35c) returned 0x0 [0076.454] RegCloseKey (hKey=0x354) returned 0x0 [0076.454] RegCloseKey (hKey=0x358) returned 0x0 [0076.454] RegCloseKey (hKey=0x350) returned 0x0 [0076.457] SetErrorMode (uMode=0x1) returned 0x0 [0076.457] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\security.config"), fInfoLevelId=0x0, lpFileInformation=0x69cc70 | out: lpFileInformation=0x69cc70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.457] GetLastError () returned 0x2 [0076.457] SetErrorMode (uMode=0x0) returned 0x1 [0076.457] SetErrorMode (uMode=0x1) returned 0x0 [0076.457] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.default" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\security.config.default"), fInfoLevelId=0x0, lpFileInformation=0x69cc40 | out: lpFileInformation=0x69cc40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.457] GetLastError () returned 0x2 [0076.457] SetErrorMode (uMode=0x0) returned 0x1 [0076.477] SetErrorMode (uMode=0x1) returned 0x0 [0076.477] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\clr security config\\v2.0.50727.312\\security.config"), fInfoLevelId=0x0, lpFileInformation=0x69cc70 | out: lpFileInformation=0x69cc70*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.477] GetLastError () returned 0x2 [0076.477] SetErrorMode (uMode=0x0) returned 0x1 [0076.477] SetErrorMode (uMode=0x1) returned 0x0 [0076.477] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.default" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\clr security config\\v2.0.50727.312\\security.config.default"), fInfoLevelId=0x0, lpFileInformation=0x69cc40 | out: lpFileInformation=0x69cc40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0076.477] GetLastError () returned 0x2 [0076.477] SetErrorMode (uMode=0x0) returned 0x1 [0076.699] GdipLoadImageFromStream (stream=0x4990030, image=0x69dbfc) returned 0x0 [0076.717] GetLastError () returned 0x0 [0076.717] GdipImageForceValidation (image=0x6c6f260) returned 0x0 [0076.720] GetLastError () returned 0x0 [0076.720] GdipGetImageType (image=0x6c6f260, type=0x69dbf8) returned 0x0 [0076.720] GetLastError () returned 0x0 [0076.721] GdipGetImageRawFormat (image=0x6c6f260, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.721] GetLastError () returned 0x0 [0076.727] GdipLoadImageFromStream (stream=0x4990010, image=0x69dbfc) returned 0x0 [0076.727] GetLastError () returned 0x0 [0076.727] GdipImageForceValidation (image=0x6c72cb0) returned 0x0 [0076.728] GetLastError () returned 0x0 [0076.729] GdipGetImageType (image=0x6c72cb0, type=0x69dbf8) returned 0x0 [0076.729] GetLastError () returned 0x0 [0076.729] GdipGetImageRawFormat (image=0x6c72cb0, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.729] GetLastError () returned 0x0 [0076.730] GdipLoadImageFromStream (stream=0x499fff0, image=0x69dbfc) returned 0x0 [0076.731] GetLastError () returned 0x0 [0076.731] GdipImageForceValidation (image=0x6c762b8) returned 0x0 [0076.732] GetLastError () returned 0x0 [0076.732] GdipGetImageType (image=0x6c762b8, type=0x69dbf8) returned 0x0 [0076.732] GetLastError () returned 0x0 [0076.732] GdipGetImageRawFormat (image=0x6c762b8, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.732] GetLastError () returned 0x0 [0076.733] GdipLoadImageFromStream (stream=0x499ffd0, image=0x69dbfc) returned 0x0 [0076.734] GetLastError () returned 0x0 [0076.734] GdipImageForceValidation (image=0x6c798c0) returned 0x0 [0076.734] GetLastError () returned 0x0 [0076.734] GdipGetImageType (image=0x6c798c0, type=0x69dbf8) returned 0x0 [0076.734] GetLastError () returned 0x0 [0076.734] GdipGetImageRawFormat (image=0x6c798c0, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.734] GetLastError () returned 0x0 [0076.736] GdipLoadImageFromStream (stream=0x499ffb0, image=0x69dbfc) returned 0x0 [0076.737] GetLastError () returned 0x0 [0076.737] GdipImageForceValidation (image=0x6c7cec8) returned 0x0 [0076.738] GetLastError () returned 0x0 [0076.738] GdipGetImageType (image=0x6c7cec8, type=0x69dbf8) returned 0x0 [0076.738] GetLastError () returned 0x0 [0076.738] GdipGetImageRawFormat (image=0x6c7cec8, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.738] GetLastError () returned 0x0 [0076.739] GdipLoadImageFromStream (stream=0x499ff90, image=0x69dbfc) returned 0x0 [0076.740] GetLastError () returned 0x0 [0076.740] GdipImageForceValidation (image=0x6c804d0) returned 0x0 [0076.741] GetLastError () returned 0x0 [0076.741] GdipGetImageType (image=0x6c804d0, type=0x69dbf8) returned 0x0 [0076.741] GetLastError () returned 0x0 [0076.741] GdipGetImageRawFormat (image=0x6c804d0, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.741] GetLastError () returned 0x0 [0076.742] GdipLoadImageFromStream (stream=0x499ff70, image=0x69dbfc) returned 0x0 [0076.743] GetLastError () returned 0x0 [0076.743] GdipImageForceValidation (image=0x6c83ad8) returned 0x0 [0076.743] GetLastError () returned 0x0 [0076.743] GdipGetImageType (image=0x6c83ad8, type=0x69dbf8) returned 0x0 [0076.744] GetLastError () returned 0x0 [0076.744] GdipGetImageRawFormat (image=0x6c83ad8, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.744] GetLastError () returned 0x0 [0076.746] GdipLoadImageFromStream (stream=0x499ff50, image=0x69dbfc) returned 0x0 [0076.746] GetLastError () returned 0x0 [0076.746] GdipImageForceValidation (image=0x6c870e0) returned 0x0 [0076.747] GetLastError () returned 0x0 [0076.747] GdipGetImageType (image=0x6c870e0, type=0x69dbf8) returned 0x0 [0076.747] GetLastError () returned 0x0 [0076.747] GdipGetImageRawFormat (image=0x6c870e0, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.747] GetLastError () returned 0x0 [0076.748] GdipLoadImageFromStream (stream=0x499ff30, image=0x69dbfc) returned 0x0 [0076.748] GetLastError () returned 0x0 [0076.748] GdipImageForceValidation (image=0x6c8a6e8) returned 0x0 [0076.749] GetLastError () returned 0x0 [0076.749] GdipGetImageType (image=0x6c8a6e8, type=0x69dbf8) returned 0x0 [0076.749] GetLastError () returned 0x0 [0076.749] GdipGetImageRawFormat (image=0x6c8a6e8, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.749] GetLastError () returned 0x0 [0076.750] GdipLoadImageFromStream (stream=0x499ff10, image=0x69dbfc) returned 0x0 [0076.751] GetLastError () returned 0x0 [0076.751] GdipImageForceValidation (image=0x6c8dcf0) returned 0x0 [0076.752] GetLastError () returned 0x0 [0076.752] GdipGetImageType (image=0x6c8dcf0, type=0x69dbf8) returned 0x0 [0076.752] GetLastError () returned 0x0 [0076.752] GdipGetImageRawFormat (image=0x6c8dcf0, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.752] GetLastError () returned 0x0 [0076.753] GdipLoadImageFromStream (stream=0x499fef0, image=0x69dbfc) returned 0x0 [0076.753] GetLastError () returned 0x0 [0076.753] GdipImageForceValidation (image=0x6c912f8) returned 0x0 [0076.754] GetLastError () returned 0x0 [0076.754] GdipGetImageType (image=0x6c912f8, type=0x69dbf8) returned 0x0 [0076.754] GetLastError () returned 0x0 [0076.754] GdipGetImageRawFormat (image=0x6c912f8, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.754] GetLastError () returned 0x0 [0076.755] GdipLoadImageFromStream (stream=0x499fed0, image=0x69dbfc) returned 0x0 [0076.755] GetLastError () returned 0x0 [0076.755] GdipImageForceValidation (image=0x6c94900) returned 0x0 [0076.756] GetLastError () returned 0x0 [0076.756] GdipGetImageType (image=0x6c94900, type=0x69dbf8) returned 0x0 [0076.756] GetLastError () returned 0x0 [0076.756] GdipGetImageRawFormat (image=0x6c94900, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.756] GetLastError () returned 0x0 [0076.757] GdipLoadImageFromStream (stream=0x499feb0, image=0x69dbfc) returned 0x0 [0076.757] GetLastError () returned 0x0 [0076.757] GdipImageForceValidation (image=0x6c97f08) returned 0x0 [0076.758] GetLastError () returned 0x0 [0076.758] GdipGetImageType (image=0x6c97f08, type=0x69dbf8) returned 0x0 [0076.758] GetLastError () returned 0x0 [0076.758] GdipGetImageRawFormat (image=0x6c97f08, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.758] GetLastError () returned 0x0 [0076.759] GdipLoadImageFromStream (stream=0x499fe90, image=0x69dbfc) returned 0x0 [0076.759] GetLastError () returned 0x0 [0076.759] GdipImageForceValidation (image=0x6c9b510) returned 0x0 [0076.769] GetLastError () returned 0x0 [0076.770] GdipGetImageType (image=0x6c9b510, type=0x69dbf8) returned 0x0 [0076.770] GetLastError () returned 0x0 [0076.770] GdipGetImageRawFormat (image=0x6c9b510, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.770] GetLastError () returned 0x0 [0076.770] GdipLoadImageFromStream (stream=0x499fe70, image=0x69dbfc) returned 0x0 [0076.771] GetLastError () returned 0x0 [0076.771] GdipImageForceValidation (image=0x6c9eb18) returned 0x0 [0076.772] GetLastError () returned 0x0 [0076.772] GdipGetImageType (image=0x6c9eb18, type=0x69dbf8) returned 0x0 [0076.772] GetLastError () returned 0x0 [0076.772] GdipGetImageRawFormat (image=0x6c9eb18, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.772] GetLastError () returned 0x0 [0076.773] GdipLoadImageFromStream (stream=0x499fe50, image=0x69dbfc) returned 0x0 [0076.773] GetLastError () returned 0x0 [0076.773] GdipImageForceValidation (image=0x6ca2120) returned 0x0 [0076.774] GetLastError () returned 0x0 [0076.774] GdipGetImageType (image=0x6ca2120, type=0x69dbf8) returned 0x0 [0076.774] GetLastError () returned 0x0 [0076.774] GdipGetImageRawFormat (image=0x6ca2120, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.774] GetLastError () returned 0x0 [0076.775] GdipLoadImageFromStream (stream=0x499fe30, image=0x69dbfc) returned 0x0 [0076.776] GetLastError () returned 0x0 [0076.776] GdipImageForceValidation (image=0x6ca5728) returned 0x0 [0076.777] GetLastError () returned 0x0 [0076.777] GdipGetImageType (image=0x6ca5728, type=0x69dbf8) returned 0x0 [0076.777] GetLastError () returned 0x0 [0076.777] GdipGetImageRawFormat (image=0x6ca5728, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.777] GetLastError () returned 0x0 [0076.778] GdipLoadImageFromStream (stream=0x499fe10, image=0x69dbfc) returned 0x0 [0076.779] GetLastError () returned 0x0 [0076.780] GdipImageForceValidation (image=0x6caa798) returned 0x0 [0076.781] GetLastError () returned 0x0 [0076.781] GdipGetImageType (image=0x6caa798, type=0x69dbf8) returned 0x0 [0076.781] GetLastError () returned 0x0 [0076.781] GdipGetImageRawFormat (image=0x6caa798, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.781] GetLastError () returned 0x0 [0076.781] GdipLoadImageFromStream (stream=0x499fdf0, image=0x69dbfc) returned 0x0 [0076.782] GetLastError () returned 0x0 [0076.782] GdipImageForceValidation (image=0x6ca9a78) returned 0x0 [0076.782] GetLastError () returned 0x0 [0076.782] GdipGetImageType (image=0x6ca9a78, type=0x69dbf8) returned 0x0 [0076.782] GetLastError () returned 0x0 [0076.782] GdipGetImageRawFormat (image=0x6ca9a78, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.782] GetLastError () returned 0x0 [0076.783] GdipLoadImageFromStream (stream=0x499fdd0, image=0x69dbfc) returned 0x0 [0076.783] GetLastError () returned 0x0 [0076.783] GdipImageForceValidation (image=0x6ca9730) returned 0x0 [0076.783] GetLastError () returned 0x0 [0076.783] GdipGetImageType (image=0x6ca9730, type=0x69dbf8) returned 0x0 [0076.783] GetLastError () returned 0x0 [0076.783] GdipGetImageRawFormat (image=0x6ca9730, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.783] GetLastError () returned 0x0 [0076.784] GdipLoadImageFromStream (stream=0x499fdb0, image=0x69dbfc) returned 0x0 [0076.784] GetLastError () returned 0x0 [0076.784] GdipImageForceValidation (image=0x6ca8d58) returned 0x0 [0076.784] GetLastError () returned 0x0 [0076.785] GdipGetImageType (image=0x6ca8d58, type=0x69dbf8) returned 0x0 [0076.785] GetLastError () returned 0x0 [0076.785] GdipGetImageRawFormat (image=0x6ca8d58, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.785] GetLastError () returned 0x0 [0076.785] GdipLoadImageFromStream (stream=0x499fd90, image=0x69dbfc) returned 0x0 [0076.786] GetLastError () returned 0x0 [0076.786] GdipImageForceValidation (image=0x6ca90a0) returned 0x0 [0076.786] GetLastError () returned 0x0 [0076.786] GdipGetImageType (image=0x6ca90a0, type=0x69dbf8) returned 0x0 [0076.786] GetLastError () returned 0x0 [0076.786] GdipGetImageRawFormat (image=0x6ca90a0, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.786] GetLastError () returned 0x0 [0076.787] GdipLoadImageFromStream (stream=0x499fd70, image=0x69dbfc) returned 0x0 [0076.788] GetLastError () returned 0x0 [0076.788] GdipImageForceValidation (image=0x6ca93e8) returned 0x0 [0076.789] GetLastError () returned 0x0 [0076.789] GdipGetImageType (image=0x6ca93e8, type=0x69dbf8) returned 0x0 [0076.789] GetLastError () returned 0x0 [0076.789] GdipGetImageRawFormat (image=0x6ca93e8, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.789] GetLastError () returned 0x0 [0076.789] GdipLoadImageFromStream (stream=0x499fd50, image=0x69dbfc) returned 0x0 [0076.790] GetLastError () returned 0x0 [0076.790] GdipImageForceValidation (image=0x6caa450) returned 0x0 [0076.790] GetLastError () returned 0x0 [0076.790] GdipGetImageType (image=0x6caa450, type=0x69dbf8) returned 0x0 [0076.790] GetLastError () returned 0x0 [0076.790] GdipGetImageRawFormat (image=0x6caa450, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.791] GetLastError () returned 0x0 [0076.792] GdipLoadImageFromStream (stream=0x499fd30, image=0x69dbfc) returned 0x0 [0076.792] GetLastError () returned 0x0 [0076.792] GdipImageForceValidation (image=0x6ca9dc0) returned 0x0 [0076.793] GetLastError () returned 0x0 [0076.793] GdipGetImageType (image=0x6ca9dc0, type=0x69dbf8) returned 0x0 [0076.793] GetLastError () returned 0x0 [0076.793] GdipGetImageRawFormat (image=0x6ca9dc0, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.793] GetLastError () returned 0x0 [0076.794] GdipLoadImageFromStream (stream=0x499fd10, image=0x69dbfc) returned 0x0 [0076.794] GetLastError () returned 0x0 [0076.795] GdipImageForceValidation (image=0x6caa108) returned 0x0 [0076.795] GetLastError () returned 0x0 [0076.795] GdipGetImageType (image=0x6caa108, type=0x69dbf8) returned 0x0 [0076.795] GetLastError () returned 0x0 [0076.795] GdipGetImageRawFormat (image=0x6caa108, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.795] GetLastError () returned 0x0 [0076.796] GdipLoadImageFromStream (stream=0x499fcf0, image=0x69dbfc) returned 0x0 [0076.797] GetLastError () returned 0x0 [0076.797] GdipImageForceValidation (image=0x6cce4d0) returned 0x0 [0076.797] GetLastError () returned 0x0 [0076.798] GdipGetImageType (image=0x6cce4d0, type=0x69dbf8) returned 0x0 [0076.798] GetLastError () returned 0x0 [0076.798] GdipGetImageRawFormat (image=0x6cce4d0, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.798] GetLastError () returned 0x0 [0076.798] GdipLoadImageFromStream (stream=0x499fcd0, image=0x69dbfc) returned 0x0 [0076.799] GetLastError () returned 0x0 [0076.799] GdipImageForceValidation (image=0x6cd0f78) returned 0x0 [0076.801] GetLastError () returned 0x0 [0076.801] GdipGetImageType (image=0x6cd0f78, type=0x69dbf8) returned 0x0 [0076.801] GetLastError () returned 0x0 [0076.801] GdipGetImageRawFormat (image=0x6cd0f78, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.801] GetLastError () returned 0x0 [0076.802] GdipLoadImageFromStream (stream=0x499fcb0, image=0x69dbfc) returned 0x0 [0076.803] GetLastError () returned 0x0 [0076.803] GdipImageForceValidation (image=0x6cd12c0) returned 0x0 [0076.803] GetLastError () returned 0x0 [0076.803] GdipGetImageType (image=0x6cd12c0, type=0x69dbf8) returned 0x0 [0076.803] GetLastError () returned 0x0 [0076.803] GdipGetImageRawFormat (image=0x6cd12c0, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.803] GetLastError () returned 0x0 [0076.804] GdipLoadImageFromStream (stream=0x499fc90, image=0x69dbfc) returned 0x0 [0076.805] GetLastError () returned 0x0 [0076.805] GdipImageForceValidation (image=0x6ccfbc8) returned 0x0 [0076.805] GetLastError () returned 0x0 [0076.805] GdipGetImageType (image=0x6ccfbc8, type=0x69dbf8) returned 0x0 [0076.805] GetLastError () returned 0x0 [0076.805] GdipGetImageRawFormat (image=0x6ccfbc8, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.805] GetLastError () returned 0x0 [0076.806] GdipLoadImageFromStream (stream=0x499fc70, image=0x69dbfc) returned 0x0 [0076.808] GetLastError () returned 0x0 [0076.808] GdipImageForceValidation (image=0x6ccf538) returned 0x0 [0076.808] GetLastError () returned 0x0 [0076.809] GdipGetImageType (image=0x6ccf538, type=0x69dbf8) returned 0x0 [0076.809] GetLastError () returned 0x0 [0076.809] GdipGetImageRawFormat (image=0x6ccf538, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.809] GetLastError () returned 0x0 [0076.809] GdipLoadImageFromStream (stream=0x499fc50, image=0x69dbfc) returned 0x0 [0076.810] GetLastError () returned 0x0 [0076.810] GdipImageForceValidation (image=0x6cd1950) returned 0x0 [0076.810] GetLastError () returned 0x0 [0076.811] GdipGetImageType (image=0x6cd1950, type=0x69dbf8) returned 0x0 [0076.811] GetLastError () returned 0x0 [0076.811] GdipGetImageRawFormat (image=0x6cd1950, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.811] GetLastError () returned 0x0 [0076.811] GdipLoadImageFromStream (stream=0x499fc30, image=0x69dbfc) returned 0x0 [0076.812] GetLastError () returned 0x0 [0076.812] GdipImageForceValidation (image=0x6cd1608) returned 0x0 [0076.812] GetLastError () returned 0x0 [0076.812] GdipGetImageType (image=0x6cd1608, type=0x69dbf8) returned 0x0 [0076.813] GetLastError () returned 0x0 [0076.813] GdipGetImageRawFormat (image=0x6cd1608, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.813] GetLastError () returned 0x0 [0076.813] GdipLoadImageFromStream (stream=0x499fc10, image=0x69dbfc) returned 0x0 [0076.814] GetLastError () returned 0x0 [0076.814] GdipImageForceValidation (image=0x6ccf1f0) returned 0x0 [0076.814] GetLastError () returned 0x0 [0076.814] GdipGetImageType (image=0x6ccf1f0, type=0x69dbf8) returned 0x0 [0076.814] GetLastError () returned 0x0 [0076.814] GdipGetImageRawFormat (image=0x6ccf1f0, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.815] GetLastError () returned 0x0 [0076.815] GdipLoadImageFromStream (stream=0x499fbf0, image=0x69dbfc) returned 0x0 [0076.816] GetLastError () returned 0x0 [0076.816] GdipImageForceValidation (image=0x6ccff10) returned 0x0 [0076.816] GetLastError () returned 0x0 [0076.816] GdipGetImageType (image=0x6ccff10, type=0x69dbf8) returned 0x0 [0076.816] GetLastError () returned 0x0 [0076.816] GdipGetImageRawFormat (image=0x6ccff10, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.816] GetLastError () returned 0x0 [0076.817] GdipLoadImageFromStream (stream=0x499fbd0, image=0x69dbfc) returned 0x0 [0076.817] GetLastError () returned 0x0 [0076.817] GdipImageForceValidation (image=0x6ccf880) returned 0x0 [0076.818] GetLastError () returned 0x0 [0076.818] GdipGetImageType (image=0x6ccf880, type=0x69dbf8) returned 0x0 [0076.818] GetLastError () returned 0x0 [0076.818] GdipGetImageRawFormat (image=0x6ccf880, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.818] GetLastError () returned 0x0 [0076.819] GdipLoadImageFromStream (stream=0x499fbb0, image=0x69dbfc) returned 0x0 [0076.819] GetLastError () returned 0x0 [0076.820] GdipImageForceValidation (image=0x6cd0258) returned 0x0 [0076.820] GetLastError () returned 0x0 [0076.820] GdipGetImageType (image=0x6cd0258, type=0x69dbf8) returned 0x0 [0076.820] GetLastError () returned 0x0 [0076.820] GdipGetImageRawFormat (image=0x6cd0258, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.820] GetLastError () returned 0x0 [0076.821] GdipLoadImageFromStream (stream=0x499fb90, image=0x69dbfc) returned 0x0 [0076.822] GetLastError () returned 0x0 [0076.822] GdipImageForceValidation (image=0x6cd05a0) returned 0x0 [0076.822] GetLastError () returned 0x0 [0076.822] GdipGetImageType (image=0x6cd05a0, type=0x69dbf8) returned 0x0 [0076.822] GetLastError () returned 0x0 [0076.822] GdipGetImageRawFormat (image=0x6cd05a0, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.822] GetLastError () returned 0x0 [0076.823] GdipLoadImageFromStream (stream=0x499fb70, image=0x69dbfc) returned 0x0 [0076.823] GetLastError () returned 0x0 [0076.823] GdipImageForceValidation (image=0x6cd1c98) returned 0x0 [0076.824] GetLastError () returned 0x0 [0076.824] GdipGetImageType (image=0x6cd1c98, type=0x69dbf8) returned 0x0 [0076.824] GetLastError () returned 0x0 [0076.824] GdipGetImageRawFormat (image=0x6cd1c98, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.824] GetLastError () returned 0x0 [0076.825] GdipLoadImageFromStream (stream=0x499fb50, image=0x69dbfc) returned 0x0 [0076.825] GetLastError () returned 0x0 [0076.826] GdipImageForceValidation (image=0x6cd08e8) returned 0x0 [0076.826] GetLastError () returned 0x0 [0076.826] GdipGetImageType (image=0x6cd08e8, type=0x69dbf8) returned 0x0 [0076.826] GetLastError () returned 0x0 [0076.826] GdipGetImageRawFormat (image=0x6cd08e8, format=0x69db64*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.826] GetLastError () returned 0x0 [0076.853] GdipGetImageWidth (image=0x6c6f260, width=0x69e2a8) returned 0x0 [0076.853] GetLastError () returned 0x0 [0076.853] GdipGetImageHeight (image=0x6c6f260, height=0x69e2a8) returned 0x0 [0076.854] GetLastError () returned 0x0 [0076.854] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0076.854] GetLastError () returned 0x0 [0076.855] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0076.855] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0076.856] GetLastError () returned 0x0 [0076.858] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0076.859] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0076.859] lstrlenW (lpString="BMP") returned 3 [0076.859] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0076.859] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0076.859] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0076.859] lstrlenW (lpString="image/bmp") returned 9 [0076.859] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0076.859] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0076.859] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0076.859] lstrlenW (lpString="JPEG") returned 4 [0076.859] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0076.859] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0076.859] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0076.859] lstrlenW (lpString="image/jpeg") returned 10 [0076.859] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0076.860] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0076.860] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0076.860] lstrlenW (lpString="GIF") returned 3 [0076.860] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0076.860] lstrlenW (lpString="*.GIF") returned 5 [0076.860] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0076.860] lstrlenW (lpString="image/gif") returned 9 [0076.860] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0076.860] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0076.860] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0076.860] lstrlenW (lpString="TIFF") returned 4 [0076.860] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0076.860] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0076.860] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0076.860] lstrlenW (lpString="image/tiff") returned 10 [0076.860] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0076.860] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0076.860] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0076.860] lstrlenW (lpString="PNG") returned 3 [0076.860] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0076.861] lstrlenW (lpString="*.PNG") returned 5 [0076.861] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0076.861] lstrlenW (lpString="image/png") returned 9 [0076.861] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0076.861] LocalFree (hMem=0x93c5f0) returned 0x0 [0076.861] GetLastError () returned 0x7f [0076.867] GdipSaveImageToStream (image=0x6c6f260, stream=0x499fb30, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0076.895] GetLastError () returned 0x0 [0076.895] GdipCreateBitmapFromStream (stream=0x499fb10, bitmap=0x69e2b0) returned 0x0 [0076.896] GetLastError () returned 0x0 [0076.896] GdipImageForceValidation (image=0x6cce188) returned 0x0 [0076.896] GetLastError () returned 0x0 [0076.896] GdipGetImageRawFormat (image=0x6cce188, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.896] GetLastError () returned 0x0 [0076.897] GdipBitmapLockBits (bitmap=0x6cce188, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x28c5d20) returned 0x0 [0076.897] GetLastError () returned 0x0 [0076.898] GdipBitmapUnlockBits (bitmap=0x6cce188, lockedBitmapData=0x28c5d20) returned 0x0 [0076.898] GetLastError () returned 0x0 [0076.898] GdipGetImageWidth (image=0x6c72cb0, width=0x69e2a8) returned 0x0 [0076.898] GetLastError () returned 0x0 [0076.898] GdipGetImageHeight (image=0x6c72cb0, height=0x69e2a8) returned 0x0 [0076.898] GetLastError () returned 0x0 [0076.898] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0076.898] GetLastError () returned 0x0 [0076.898] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0076.898] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0076.898] GetLastError () returned 0x0 [0076.898] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0076.898] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0076.898] lstrlenW (lpString="BMP") returned 3 [0076.898] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0076.898] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0076.898] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0076.898] lstrlenW (lpString="image/bmp") returned 9 [0076.898] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0076.899] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0076.899] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0076.899] lstrlenW (lpString="JPEG") returned 4 [0076.899] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0076.899] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0076.899] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0076.899] lstrlenW (lpString="image/jpeg") returned 10 [0076.899] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0076.899] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0076.899] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0076.899] lstrlenW (lpString="GIF") returned 3 [0076.899] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0076.899] lstrlenW (lpString="*.GIF") returned 5 [0076.899] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0076.899] lstrlenW (lpString="image/gif") returned 9 [0076.899] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0076.899] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0076.900] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0076.900] lstrlenW (lpString="TIFF") returned 4 [0076.900] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0076.900] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0076.900] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0076.900] lstrlenW (lpString="image/tiff") returned 10 [0076.900] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0076.901] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0076.901] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0076.901] lstrlenW (lpString="PNG") returned 3 [0076.901] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0076.901] lstrlenW (lpString="*.PNG") returned 5 [0076.901] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0076.901] lstrlenW (lpString="image/png") returned 9 [0076.901] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0076.901] LocalFree (hMem=0x93c5f0) returned 0x0 [0076.901] GetLastError () returned 0x0 [0076.902] GdipSaveImageToStream (image=0x6c72cb0, stream=0x499faf0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0076.909] GetLastError () returned 0x0 [0076.909] GdipCreateBitmapFromStream (stream=0x499fad0, bitmap=0x69e2b0) returned 0x0 [0076.910] GetLastError () returned 0x0 [0076.910] GdipImageForceValidation (image=0x6cce818) returned 0x0 [0076.910] GetLastError () returned 0x0 [0076.910] GdipGetImageRawFormat (image=0x6cce818, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.910] GetLastError () returned 0x0 [0076.910] GdipBitmapLockBits (bitmap=0x6cce818, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x28d0be8) returned 0x0 [0076.910] GetLastError () returned 0x0 [0076.910] GdipBitmapUnlockBits (bitmap=0x6cce818, lockedBitmapData=0x28d0be8) returned 0x0 [0076.910] GetLastError () returned 0x0 [0076.910] GdipGetImageWidth (image=0x6c762b8, width=0x69e2a8) returned 0x0 [0076.910] GetLastError () returned 0x0 [0076.910] GdipGetImageHeight (image=0x6c762b8, height=0x69e2a8) returned 0x0 [0076.910] GetLastError () returned 0x0 [0076.910] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0076.910] GetLastError () returned 0x0 [0076.910] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0076.911] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0076.911] GetLastError () returned 0x0 [0076.911] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0076.911] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0076.911] lstrlenW (lpString="BMP") returned 3 [0076.911] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0076.911] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0076.911] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0076.911] lstrlenW (lpString="image/bmp") returned 9 [0076.911] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0076.911] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0076.912] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0076.912] lstrlenW (lpString="JPEG") returned 4 [0076.912] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0076.912] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0076.912] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0076.912] lstrlenW (lpString="image/jpeg") returned 10 [0076.912] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0076.912] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0076.912] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0076.912] lstrlenW (lpString="GIF") returned 3 [0076.912] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0076.912] lstrlenW (lpString="*.GIF") returned 5 [0076.912] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0076.912] lstrlenW (lpString="image/gif") returned 9 [0076.912] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0076.912] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0076.912] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0076.912] lstrlenW (lpString="TIFF") returned 4 [0076.912] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0076.912] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0076.912] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0076.912] lstrlenW (lpString="image/tiff") returned 10 [0076.912] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0076.913] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0076.913] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0076.913] lstrlenW (lpString="PNG") returned 3 [0076.913] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0076.913] lstrlenW (lpString="*.PNG") returned 5 [0076.913] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0076.913] lstrlenW (lpString="image/png") returned 9 [0076.913] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0076.913] LocalFree (hMem=0x93c5f0) returned 0x0 [0076.913] GetLastError () returned 0x0 [0076.913] GdipSaveImageToStream (image=0x6c762b8, stream=0x499fab0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0076.919] GetLastError () returned 0x0 [0076.920] GdipCreateBitmapFromStream (stream=0x499fa90, bitmap=0x69e2b0) returned 0x0 [0076.921] GetLastError () returned 0x0 [0076.921] GdipImageForceValidation (image=0x6cceb60) returned 0x0 [0076.921] GetLastError () returned 0x0 [0076.921] GdipGetImageRawFormat (image=0x6cceb60, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.921] GetLastError () returned 0x0 [0076.921] GdipBitmapLockBits (bitmap=0x6cceb60, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x28ddaa0) returned 0x0 [0076.921] GetLastError () returned 0x0 [0076.921] GdipBitmapUnlockBits (bitmap=0x6cceb60, lockedBitmapData=0x28ddaa0) returned 0x0 [0076.921] GetLastError () returned 0x0 [0076.921] GdipGetImageWidth (image=0x6c798c0, width=0x69e2a8) returned 0x0 [0076.921] GetLastError () returned 0x0 [0076.921] GdipGetImageHeight (image=0x6c798c0, height=0x69e2a8) returned 0x0 [0076.921] GetLastError () returned 0x0 [0076.921] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0076.921] GetLastError () returned 0x0 [0076.921] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0076.922] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0076.922] GetLastError () returned 0x0 [0076.922] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0076.922] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0076.922] lstrlenW (lpString="BMP") returned 3 [0076.922] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0076.922] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0076.922] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0076.922] lstrlenW (lpString="image/bmp") returned 9 [0076.922] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0076.922] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0076.922] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0076.922] lstrlenW (lpString="JPEG") returned 4 [0076.922] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0076.922] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0076.922] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0076.922] lstrlenW (lpString="image/jpeg") returned 10 [0076.922] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0076.922] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0076.922] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0076.922] lstrlenW (lpString="GIF") returned 3 [0076.922] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0076.922] lstrlenW (lpString="*.GIF") returned 5 [0076.923] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0076.923] lstrlenW (lpString="image/gif") returned 9 [0076.923] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0076.923] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0076.923] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0076.923] lstrlenW (lpString="TIFF") returned 4 [0076.923] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0076.923] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0076.923] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0076.923] lstrlenW (lpString="image/tiff") returned 10 [0076.923] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0076.923] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0076.923] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0076.923] lstrlenW (lpString="PNG") returned 3 [0076.923] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0076.923] lstrlenW (lpString="*.PNG") returned 5 [0076.923] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0076.923] lstrlenW (lpString="image/png") returned 9 [0076.923] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0076.923] LocalFree (hMem=0x93c5f0) returned 0x0 [0076.923] GetLastError () returned 0x0 [0076.924] GdipSaveImageToStream (image=0x6c798c0, stream=0x499fa70, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0076.930] GetLastError () returned 0x0 [0076.930] GdipCreateBitmapFromStream (stream=0x499fa50, bitmap=0x69e2b0) returned 0x0 [0076.930] GetLastError () returned 0x0 [0076.931] GdipImageForceValidation (image=0x6cceea8) returned 0x0 [0076.931] GetLastError () returned 0x0 [0076.931] GdipGetImageRawFormat (image=0x6cceea8, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.931] GetLastError () returned 0x0 [0076.931] GdipBitmapLockBits (bitmap=0x6cceea8, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x28ee95c) returned 0x0 [0076.931] GetLastError () returned 0x0 [0076.932] GdipBitmapUnlockBits (bitmap=0x6cceea8, lockedBitmapData=0x28ee95c) returned 0x0 [0076.932] GetLastError () returned 0x0 [0076.932] GdipGetImageWidth (image=0x6c7cec8, width=0x69e2a8) returned 0x0 [0076.932] GetLastError () returned 0x0 [0076.932] GdipGetImageHeight (image=0x6c7cec8, height=0x69e2a8) returned 0x0 [0076.932] GetLastError () returned 0x0 [0076.932] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0076.932] GetLastError () returned 0x0 [0076.932] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0076.932] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0076.932] GetLastError () returned 0x0 [0076.932] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0076.932] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0076.932] lstrlenW (lpString="BMP") returned 3 [0076.932] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0076.932] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0076.932] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0076.933] lstrlenW (lpString="image/bmp") returned 9 [0076.933] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0076.933] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0076.933] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0076.933] lstrlenW (lpString="JPEG") returned 4 [0076.933] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0076.933] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0076.933] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0076.933] lstrlenW (lpString="image/jpeg") returned 10 [0076.933] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0076.933] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0076.933] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0076.933] lstrlenW (lpString="GIF") returned 3 [0076.933] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0076.933] lstrlenW (lpString="*.GIF") returned 5 [0076.933] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0076.933] lstrlenW (lpString="image/gif") returned 9 [0076.933] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0076.934] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0076.934] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0076.934] lstrlenW (lpString="TIFF") returned 4 [0076.934] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0076.934] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0076.934] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0076.934] lstrlenW (lpString="image/tiff") returned 10 [0076.934] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0076.934] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0076.934] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0076.934] lstrlenW (lpString="PNG") returned 3 [0076.934] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0076.934] lstrlenW (lpString="*.PNG") returned 5 [0076.934] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0076.934] lstrlenW (lpString="image/png") returned 9 [0076.934] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0076.934] LocalFree (hMem=0x93c5f0) returned 0x0 [0076.934] GetLastError () returned 0x0 [0076.935] GdipSaveImageToStream (image=0x6c7cec8, stream=0x499fa30, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0076.941] GetLastError () returned 0x0 [0076.941] GdipCreateBitmapFromStream (stream=0x499fa10, bitmap=0x69e2b0) returned 0x0 [0076.942] GetLastError () returned 0x0 [0076.942] GdipImageForceValidation (image=0x6cd0c30) returned 0x0 [0076.942] GetLastError () returned 0x0 [0076.942] GdipGetImageRawFormat (image=0x6cd0c30, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.942] GetLastError () returned 0x0 [0076.942] GdipBitmapLockBits (bitmap=0x6cd0c30, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x28f781c) returned 0x0 [0076.942] GetLastError () returned 0x0 [0076.942] GdipBitmapUnlockBits (bitmap=0x6cd0c30, lockedBitmapData=0x28f781c) returned 0x0 [0076.942] GetLastError () returned 0x0 [0076.942] GdipGetImageWidth (image=0x6c804d0, width=0x69e2a8) returned 0x0 [0076.942] GetLastError () returned 0x0 [0076.942] GdipGetImageHeight (image=0x6c804d0, height=0x69e2a8) returned 0x0 [0076.942] GetLastError () returned 0x0 [0076.942] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0076.942] GetLastError () returned 0x0 [0076.942] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0076.943] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0076.943] GetLastError () returned 0x0 [0076.943] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0076.943] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0076.943] lstrlenW (lpString="BMP") returned 3 [0076.943] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0076.943] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0076.943] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0076.943] lstrlenW (lpString="image/bmp") returned 9 [0076.943] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0076.943] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0076.943] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0076.943] lstrlenW (lpString="JPEG") returned 4 [0076.943] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0076.943] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0076.943] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0076.943] lstrlenW (lpString="image/jpeg") returned 10 [0076.943] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0076.943] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0076.943] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0076.943] lstrlenW (lpString="GIF") returned 3 [0076.943] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0076.944] lstrlenW (lpString="*.GIF") returned 5 [0076.944] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0076.944] lstrlenW (lpString="image/gif") returned 9 [0076.944] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0076.944] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0076.944] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0076.944] lstrlenW (lpString="TIFF") returned 4 [0076.944] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0076.944] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0076.944] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0076.944] lstrlenW (lpString="image/tiff") returned 10 [0076.944] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0076.944] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0076.944] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0076.944] lstrlenW (lpString="PNG") returned 3 [0076.944] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0076.944] lstrlenW (lpString="*.PNG") returned 5 [0076.944] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0076.944] lstrlenW (lpString="image/png") returned 9 [0076.944] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0076.944] LocalFree (hMem=0x93c5f0) returned 0x0 [0076.944] GetLastError () returned 0x0 [0076.945] GdipSaveImageToStream (image=0x6c804d0, stream=0x499f9f0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0076.955] GetLastError () returned 0x0 [0076.956] GdipCreateBitmapFromStream (stream=0x499f9d0, bitmap=0x69e2b0) returned 0x0 [0076.956] GetLastError () returned 0x0 [0076.956] GdipImageForceValidation (image=0x6d19230) returned 0x0 [0076.957] GetLastError () returned 0x0 [0076.957] GdipGetImageRawFormat (image=0x6d19230, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.957] GetLastError () returned 0x0 [0076.957] GdipBitmapLockBits (bitmap=0x6d19230, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x29106bc) returned 0x0 [0076.957] GetLastError () returned 0x0 [0076.957] GdipBitmapUnlockBits (bitmap=0x6d19230, lockedBitmapData=0x29106bc) returned 0x0 [0076.957] GetLastError () returned 0x0 [0076.957] GdipGetImageWidth (image=0x6c83ad8, width=0x69e2a8) returned 0x0 [0076.957] GetLastError () returned 0x0 [0076.957] GdipGetImageHeight (image=0x6c83ad8, height=0x69e2a8) returned 0x0 [0076.957] GetLastError () returned 0x0 [0076.957] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0076.957] GetLastError () returned 0x0 [0076.957] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0076.957] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0076.958] GetLastError () returned 0x0 [0076.958] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0076.958] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0076.958] lstrlenW (lpString="BMP") returned 3 [0076.958] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0076.958] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0076.958] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0076.958] lstrlenW (lpString="image/bmp") returned 9 [0076.958] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0076.958] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0076.958] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0076.958] lstrlenW (lpString="JPEG") returned 4 [0076.958] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0076.958] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0076.958] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0076.958] lstrlenW (lpString="image/jpeg") returned 10 [0076.958] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0076.958] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0076.958] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0076.958] lstrlenW (lpString="GIF") returned 3 [0076.958] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0076.958] lstrlenW (lpString="*.GIF") returned 5 [0076.958] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0076.959] lstrlenW (lpString="image/gif") returned 9 [0076.959] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0076.959] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0076.959] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0076.959] lstrlenW (lpString="TIFF") returned 4 [0076.959] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0076.959] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0076.959] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0076.959] lstrlenW (lpString="image/tiff") returned 10 [0076.959] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0076.959] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0076.959] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0076.959] lstrlenW (lpString="PNG") returned 3 [0076.959] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0076.959] lstrlenW (lpString="*.PNG") returned 5 [0076.959] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0076.959] lstrlenW (lpString="image/png") returned 9 [0076.959] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0076.959] LocalFree (hMem=0x93c5f0) returned 0x0 [0076.959] GetLastError () returned 0x0 [0076.960] GdipSaveImageToStream (image=0x6c83ad8, stream=0x499f9b0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0076.967] GetLastError () returned 0x0 [0076.967] GdipCreateBitmapFromStream (stream=0x499f990, bitmap=0x69e2b0) returned 0x0 [0076.968] GetLastError () returned 0x0 [0076.968] GdipImageForceValidation (image=0x6d19f50) returned 0x0 [0076.969] GetLastError () returned 0x0 [0076.969] GdipGetImageRawFormat (image=0x6d19f50, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.969] GetLastError () returned 0x0 [0076.969] GdipBitmapLockBits (bitmap=0x6d19f50, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2919570) returned 0x0 [0076.969] GetLastError () returned 0x0 [0076.969] GdipBitmapUnlockBits (bitmap=0x6d19f50, lockedBitmapData=0x2919570) returned 0x0 [0076.969] GetLastError () returned 0x0 [0076.969] GdipGetImageWidth (image=0x6c870e0, width=0x69e2a8) returned 0x0 [0076.969] GetLastError () returned 0x0 [0076.969] GdipGetImageHeight (image=0x6c870e0, height=0x69e2a8) returned 0x0 [0076.969] GetLastError () returned 0x0 [0076.969] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0076.969] GetLastError () returned 0x0 [0076.969] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0076.969] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0076.970] GetLastError () returned 0x0 [0076.970] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0076.970] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0076.970] lstrlenW (lpString="BMP") returned 3 [0076.970] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0076.970] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0076.970] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0076.970] lstrlenW (lpString="image/bmp") returned 9 [0076.970] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0076.970] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0076.970] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0076.970] lstrlenW (lpString="JPEG") returned 4 [0076.970] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0076.970] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0076.971] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0076.971] lstrlenW (lpString="image/jpeg") returned 10 [0076.971] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0076.971] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0076.971] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0076.971] lstrlenW (lpString="GIF") returned 3 [0076.971] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0076.971] lstrlenW (lpString="*.GIF") returned 5 [0076.971] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0076.971] lstrlenW (lpString="image/gif") returned 9 [0076.971] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0076.971] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0076.971] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0076.971] lstrlenW (lpString="TIFF") returned 4 [0076.972] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0076.972] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0076.972] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0076.972] lstrlenW (lpString="image/tiff") returned 10 [0076.972] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0076.972] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0076.972] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0076.972] lstrlenW (lpString="PNG") returned 3 [0076.972] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0076.972] lstrlenW (lpString="*.PNG") returned 5 [0076.972] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0076.972] lstrlenW (lpString="image/png") returned 9 [0076.972] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0076.973] LocalFree (hMem=0x93c5f0) returned 0x0 [0076.973] GetLastError () returned 0x0 [0076.973] GdipSaveImageToStream (image=0x6c870e0, stream=0x499f970, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0076.980] GetLastError () returned 0x0 [0076.981] GdipCreateBitmapFromStream (stream=0x499f950, bitmap=0x69e2b0) returned 0x0 [0076.981] GetLastError () returned 0x0 [0076.981] GdipImageForceValidation (image=0x6d19c08) returned 0x0 [0076.982] GetLastError () returned 0x0 [0076.982] GdipGetImageRawFormat (image=0x6d19c08, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.982] GetLastError () returned 0x0 [0076.982] GdipBitmapLockBits (bitmap=0x6d19c08, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2922424) returned 0x0 [0076.982] GetLastError () returned 0x0 [0076.982] GdipBitmapUnlockBits (bitmap=0x6d19c08, lockedBitmapData=0x2922424) returned 0x0 [0076.982] GetLastError () returned 0x0 [0076.982] GdipGetImageWidth (image=0x6c8a6e8, width=0x69e2a8) returned 0x0 [0076.982] GetLastError () returned 0x0 [0076.982] GdipGetImageHeight (image=0x6c8a6e8, height=0x69e2a8) returned 0x0 [0076.982] GetLastError () returned 0x0 [0076.983] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0076.983] GetLastError () returned 0x0 [0076.983] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0076.983] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0076.983] GetLastError () returned 0x0 [0076.983] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0076.983] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0076.983] lstrlenW (lpString="BMP") returned 3 [0076.983] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0076.983] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0076.983] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0076.983] lstrlenW (lpString="image/bmp") returned 9 [0076.983] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0076.983] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0076.983] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0076.983] lstrlenW (lpString="JPEG") returned 4 [0076.983] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0076.984] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0076.984] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0076.984] lstrlenW (lpString="image/jpeg") returned 10 [0076.984] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0076.984] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0076.984] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0076.984] lstrlenW (lpString="GIF") returned 3 [0076.984] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0076.984] lstrlenW (lpString="*.GIF") returned 5 [0076.984] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0076.984] lstrlenW (lpString="image/gif") returned 9 [0076.984] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0076.984] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0076.984] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0076.984] lstrlenW (lpString="TIFF") returned 4 [0076.984] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0076.984] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0076.984] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0076.984] lstrlenW (lpString="image/tiff") returned 10 [0076.984] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0076.985] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0076.985] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0076.985] lstrlenW (lpString="PNG") returned 3 [0076.985] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0076.985] lstrlenW (lpString="*.PNG") returned 5 [0076.985] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0076.985] lstrlenW (lpString="image/png") returned 9 [0076.985] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0076.985] LocalFree (hMem=0x93c5f0) returned 0x0 [0076.985] GetLastError () returned 0x0 [0076.985] GdipSaveImageToStream (image=0x6c8a6e8, stream=0x499f930, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0076.991] GetLastError () returned 0x0 [0076.992] GdipCreateBitmapFromStream (stream=0x499f910, bitmap=0x69e2b0) returned 0x0 [0076.992] GetLastError () returned 0x0 [0076.992] GdipImageForceValidation (image=0x6d1bcd8) returned 0x0 [0076.995] GetLastError () returned 0x0 [0076.995] GdipGetImageRawFormat (image=0x6d1bcd8, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0076.995] GetLastError () returned 0x0 [0076.995] GdipBitmapLockBits (bitmap=0x6d1bcd8, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x292b2d8) returned 0x0 [0076.995] GetLastError () returned 0x0 [0076.995] GdipBitmapUnlockBits (bitmap=0x6d1bcd8, lockedBitmapData=0x292b2d8) returned 0x0 [0076.995] GetLastError () returned 0x0 [0076.995] GdipGetImageWidth (image=0x6c8dcf0, width=0x69e2a8) returned 0x0 [0076.995] GetLastError () returned 0x0 [0076.995] GdipGetImageHeight (image=0x6c8dcf0, height=0x69e2a8) returned 0x0 [0076.995] GetLastError () returned 0x0 [0076.995] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0076.995] GetLastError () returned 0x0 [0076.995] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0076.995] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0076.995] GetLastError () returned 0x0 [0076.995] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0076.995] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0076.995] lstrlenW (lpString="BMP") returned 3 [0076.995] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0076.995] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0076.995] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0076.996] lstrlenW (lpString="image/bmp") returned 9 [0076.996] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0076.996] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0076.996] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0076.996] lstrlenW (lpString="JPEG") returned 4 [0076.996] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0076.996] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0076.996] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0076.996] lstrlenW (lpString="image/jpeg") returned 10 [0076.996] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0076.996] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0076.996] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0076.996] lstrlenW (lpString="GIF") returned 3 [0076.996] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0076.996] lstrlenW (lpString="*.GIF") returned 5 [0076.996] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0076.996] lstrlenW (lpString="image/gif") returned 9 [0076.996] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0076.996] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0076.996] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0076.997] lstrlenW (lpString="TIFF") returned 4 [0076.997] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0076.997] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0076.997] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0076.997] lstrlenW (lpString="image/tiff") returned 10 [0076.997] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0076.997] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0076.997] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0076.997] lstrlenW (lpString="PNG") returned 3 [0076.997] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0076.997] lstrlenW (lpString="*.PNG") returned 5 [0076.997] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0076.997] lstrlenW (lpString="image/png") returned 9 [0076.997] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0076.997] LocalFree (hMem=0x93c5f0) returned 0x0 [0076.997] GetLastError () returned 0x0 [0076.997] GdipSaveImageToStream (image=0x6c8dcf0, stream=0x499f8f0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.003] GetLastError () returned 0x0 [0077.004] GdipCreateBitmapFromStream (stream=0x499f8d0, bitmap=0x69e2b0) returned 0x0 [0077.004] GetLastError () returned 0x0 [0077.004] GdipImageForceValidation (image=0x6d1afb8) returned 0x0 [0077.005] GetLastError () returned 0x0 [0077.005] GdipGetImageRawFormat (image=0x6d1afb8, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.005] GetLastError () returned 0x0 [0077.005] GdipBitmapLockBits (bitmap=0x6d1afb8, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2934198) returned 0x0 [0077.005] GetLastError () returned 0x0 [0077.005] GdipBitmapUnlockBits (bitmap=0x6d1afb8, lockedBitmapData=0x2934198) returned 0x0 [0077.005] GetLastError () returned 0x0 [0077.005] GdipGetImageWidth (image=0x6c912f8, width=0x69e2a8) returned 0x0 [0077.005] GetLastError () returned 0x0 [0077.005] GdipGetImageHeight (image=0x6c912f8, height=0x69e2a8) returned 0x0 [0077.005] GetLastError () returned 0x0 [0077.005] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.005] GetLastError () returned 0x0 [0077.005] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.005] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.005] GetLastError () returned 0x0 [0077.005] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.005] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.005] lstrlenW (lpString="BMP") returned 3 [0077.005] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.005] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.005] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.005] lstrlenW (lpString="image/bmp") returned 9 [0077.005] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.005] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.006] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.006] lstrlenW (lpString="JPEG") returned 4 [0077.006] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.006] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.006] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.006] lstrlenW (lpString="image/jpeg") returned 10 [0077.006] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.006] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.006] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.006] lstrlenW (lpString="GIF") returned 3 [0077.006] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.006] lstrlenW (lpString="*.GIF") returned 5 [0077.006] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.006] lstrlenW (lpString="image/gif") returned 9 [0077.006] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.006] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.006] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.006] lstrlenW (lpString="TIFF") returned 4 [0077.006] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.006] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.006] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.006] lstrlenW (lpString="image/tiff") returned 10 [0077.007] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.007] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.007] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.007] lstrlenW (lpString="PNG") returned 3 [0077.007] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.007] lstrlenW (lpString="*.PNG") returned 5 [0077.007] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.007] lstrlenW (lpString="image/png") returned 9 [0077.007] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.007] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.007] GetLastError () returned 0x0 [0077.007] GdipSaveImageToStream (image=0x6c912f8, stream=0x499f8b0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.015] GetLastError () returned 0x0 [0077.016] GdipCreateBitmapFromStream (stream=0x499f890, bitmap=0x69e2b0) returned 0x0 [0077.016] GetLastError () returned 0x0 [0077.016] GdipImageForceValidation (image=0x6d198c0) returned 0x0 [0077.017] GetLastError () returned 0x0 [0077.017] GdipGetImageRawFormat (image=0x6d198c0, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.017] GetLastError () returned 0x0 [0077.017] GdipBitmapLockBits (bitmap=0x6d198c0, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x293d04c) returned 0x0 [0077.017] GetLastError () returned 0x0 [0077.017] GdipBitmapUnlockBits (bitmap=0x6d198c0, lockedBitmapData=0x293d04c) returned 0x0 [0077.017] GetLastError () returned 0x0 [0077.017] GdipGetImageWidth (image=0x6c94900, width=0x69e2a8) returned 0x0 [0077.017] GetLastError () returned 0x0 [0077.017] GdipGetImageHeight (image=0x6c94900, height=0x69e2a8) returned 0x0 [0077.017] GetLastError () returned 0x0 [0077.017] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.017] GetLastError () returned 0x0 [0077.017] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.017] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.017] GetLastError () returned 0x0 [0077.017] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.017] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.017] lstrlenW (lpString="BMP") returned 3 [0077.017] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.017] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.017] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.018] lstrlenW (lpString="image/bmp") returned 9 [0077.018] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.018] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.018] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.018] lstrlenW (lpString="JPEG") returned 4 [0077.018] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.018] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.018] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.018] lstrlenW (lpString="image/jpeg") returned 10 [0077.018] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.018] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.018] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.018] lstrlenW (lpString="GIF") returned 3 [0077.018] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.018] lstrlenW (lpString="*.GIF") returned 5 [0077.018] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.018] lstrlenW (lpString="image/gif") returned 9 [0077.018] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.018] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.018] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.018] lstrlenW (lpString="TIFF") returned 4 [0077.019] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.019] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.019] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.019] lstrlenW (lpString="image/tiff") returned 10 [0077.019] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.019] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.019] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.019] lstrlenW (lpString="PNG") returned 3 [0077.019] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.019] lstrlenW (lpString="*.PNG") returned 5 [0077.019] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.019] lstrlenW (lpString="image/png") returned 9 [0077.019] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.019] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.019] GetLastError () returned 0x0 [0077.020] GdipSaveImageToStream (image=0x6c94900, stream=0x499f870, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.026] GetLastError () returned 0x0 [0077.027] GdipCreateBitmapFromStream (stream=0x499f850, bitmap=0x69e2b0) returned 0x0 [0077.027] GetLastError () returned 0x0 [0077.027] GdipImageForceValidation (image=0x6d1b300) returned 0x0 [0077.028] GetLastError () returned 0x0 [0077.028] GdipGetImageRawFormat (image=0x6d1b300, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.028] GetLastError () returned 0x0 [0077.028] GdipBitmapLockBits (bitmap=0x6d1b300, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2945f0c) returned 0x0 [0077.028] GetLastError () returned 0x0 [0077.028] GdipBitmapUnlockBits (bitmap=0x6d1b300, lockedBitmapData=0x2945f0c) returned 0x0 [0077.028] GetLastError () returned 0x0 [0077.028] GdipGetImageWidth (image=0x6c97f08, width=0x69e2a8) returned 0x0 [0077.028] GetLastError () returned 0x0 [0077.028] GdipGetImageHeight (image=0x6c97f08, height=0x69e2a8) returned 0x0 [0077.028] GetLastError () returned 0x0 [0077.028] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.028] GetLastError () returned 0x0 [0077.028] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.028] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.028] GetLastError () returned 0x0 [0077.028] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.028] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.028] lstrlenW (lpString="BMP") returned 3 [0077.028] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.029] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.029] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.029] lstrlenW (lpString="image/bmp") returned 9 [0077.029] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.029] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.029] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.029] lstrlenW (lpString="JPEG") returned 4 [0077.029] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.029] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.029] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.029] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.029] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.029] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.029] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.029] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.029] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.029] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.030] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.030] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.030] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.030] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.030] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.030] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.030] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.030] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.030] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.030] GetLastError () returned 0x0 [0077.031] GdipSaveImageToStream (image=0x6c97f08, stream=0x499f830, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.037] GetLastError () returned 0x0 [0077.038] GdipCreateBitmapFromStream (stream=0x499f810, bitmap=0x69e2b0) returned 0x0 [0077.038] GetLastError () returned 0x0 [0077.038] GdipImageForceValidation (image=0x6d1a928) returned 0x0 [0077.039] GetLastError () returned 0x0 [0077.039] GdipGetImageRawFormat (image=0x6d1a928, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.039] GetLastError () returned 0x0 [0077.039] GdipBitmapLockBits (bitmap=0x6d1a928, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x294edcc) returned 0x0 [0077.039] GetLastError () returned 0x0 [0077.039] GdipBitmapUnlockBits (bitmap=0x6d1a928, lockedBitmapData=0x294edcc) returned 0x0 [0077.039] GetLastError () returned 0x0 [0077.039] GdipGetImageWidth (image=0x6c9b510, width=0x69e2a8) returned 0x0 [0077.039] GetLastError () returned 0x0 [0077.039] GdipGetImageHeight (image=0x6c9b510, height=0x69e2a8) returned 0x0 [0077.039] GetLastError () returned 0x0 [0077.039] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.039] GetLastError () returned 0x0 [0077.039] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.039] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.039] GetLastError () returned 0x0 [0077.039] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.039] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.039] lstrlenW (lpString="BMP") returned 3 [0077.039] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.039] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.039] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.040] lstrlenW (lpString="image/bmp") returned 9 [0077.040] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.040] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.040] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.040] lstrlenW (lpString="JPEG") returned 4 [0077.040] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.040] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.040] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.040] lstrlenW (lpString="image/jpeg") returned 10 [0077.040] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.040] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.040] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.040] lstrlenW (lpString="GIF") returned 3 [0077.040] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.040] lstrlenW (lpString="*.GIF") returned 5 [0077.040] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.040] lstrlenW (lpString="image/gif") returned 9 [0077.040] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.040] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.040] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.041] lstrlenW (lpString="TIFF") returned 4 [0077.041] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.041] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.041] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.042] lstrlenW (lpString="image/tiff") returned 10 [0077.042] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.042] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.042] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.042] lstrlenW (lpString="PNG") returned 3 [0077.042] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.042] lstrlenW (lpString="*.PNG") returned 5 [0077.042] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.042] lstrlenW (lpString="image/png") returned 9 [0077.042] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.042] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.042] GetLastError () returned 0x0 [0077.042] GdipSaveImageToStream (image=0x6c9b510, stream=0x499f7f0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.049] GetLastError () returned 0x0 [0077.050] GdipCreateBitmapFromStream (stream=0x499f7d0, bitmap=0x69e2b0) returned 0x0 [0077.050] GetLastError () returned 0x0 [0077.050] GdipImageForceValidation (image=0x6d19578) returned 0x0 [0077.051] GetLastError () returned 0x0 [0077.051] GdipGetImageRawFormat (image=0x6d19578, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.051] GetLastError () returned 0x0 [0077.051] GdipBitmapLockBits (bitmap=0x6d19578, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2957c80) returned 0x0 [0077.051] GetLastError () returned 0x0 [0077.051] GdipBitmapUnlockBits (bitmap=0x6d19578, lockedBitmapData=0x2957c80) returned 0x0 [0077.051] GetLastError () returned 0x0 [0077.051] GdipGetImageWidth (image=0x6c9eb18, width=0x69e2a8) returned 0x0 [0077.051] GetLastError () returned 0x0 [0077.051] GdipGetImageHeight (image=0x6c9eb18, height=0x69e2a8) returned 0x0 [0077.051] GetLastError () returned 0x0 [0077.051] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.051] GetLastError () returned 0x0 [0077.051] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.051] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.051] GetLastError () returned 0x0 [0077.051] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.051] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.051] lstrlenW (lpString="BMP") returned 3 [0077.051] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.052] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.052] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.052] lstrlenW (lpString="image/bmp") returned 9 [0077.052] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.052] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.052] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.052] lstrlenW (lpString="JPEG") returned 4 [0077.052] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.052] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.052] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.052] lstrlenW (lpString="image/jpeg") returned 10 [0077.052] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.052] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.052] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.052] lstrlenW (lpString="GIF") returned 3 [0077.052] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.052] lstrlenW (lpString="*.GIF") returned 5 [0077.052] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.052] lstrlenW (lpString="image/gif") returned 9 [0077.052] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.052] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.053] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.053] lstrlenW (lpString="TIFF") returned 4 [0077.053] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.053] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.053] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.053] lstrlenW (lpString="image/tiff") returned 10 [0077.053] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.053] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.053] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.053] lstrlenW (lpString="PNG") returned 3 [0077.053] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.053] lstrlenW (lpString="*.PNG") returned 5 [0077.053] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.053] lstrlenW (lpString="image/png") returned 9 [0077.053] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.053] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.053] GetLastError () returned 0x0 [0077.053] GdipSaveImageToStream (image=0x6c9eb18, stream=0x499f7b0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.061] GetLastError () returned 0x0 [0077.062] GdipCreateBitmapFromStream (stream=0x499f790, bitmap=0x69e2b0) returned 0x0 [0077.062] GetLastError () returned 0x0 [0077.062] GdipImageForceValidation (image=0x6d1a298) returned 0x0 [0077.063] GetLastError () returned 0x0 [0077.063] GdipGetImageRawFormat (image=0x6d1a298, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.063] GetLastError () returned 0x0 [0077.063] GdipBitmapLockBits (bitmap=0x6d1a298, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2960b40) returned 0x0 [0077.063] GetLastError () returned 0x0 [0077.063] GdipBitmapUnlockBits (bitmap=0x6d1a298, lockedBitmapData=0x2960b40) returned 0x0 [0077.063] GetLastError () returned 0x0 [0077.063] GdipGetImageWidth (image=0x6ca2120, width=0x69e2a8) returned 0x0 [0077.063] GetLastError () returned 0x0 [0077.063] GdipGetImageHeight (image=0x6ca2120, height=0x69e2a8) returned 0x0 [0077.063] GetLastError () returned 0x0 [0077.063] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.063] GetLastError () returned 0x0 [0077.063] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.063] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.063] GetLastError () returned 0x0 [0077.063] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.063] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.064] lstrlenW (lpString="BMP") returned 3 [0077.064] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.064] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.064] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.064] lstrlenW (lpString="image/bmp") returned 9 [0077.064] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.064] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.064] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.064] lstrlenW (lpString="JPEG") returned 4 [0077.064] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.064] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.064] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.064] lstrlenW (lpString="image/jpeg") returned 10 [0077.064] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.064] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.064] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.064] lstrlenW (lpString="GIF") returned 3 [0077.064] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.065] lstrlenW (lpString="*.GIF") returned 5 [0077.065] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.065] lstrlenW (lpString="image/gif") returned 9 [0077.065] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.065] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.065] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.065] lstrlenW (lpString="TIFF") returned 4 [0077.065] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.065] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.065] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.065] lstrlenW (lpString="image/tiff") returned 10 [0077.065] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.065] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.065] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.065] lstrlenW (lpString="PNG") returned 3 [0077.065] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.065] lstrlenW (lpString="*.PNG") returned 5 [0077.065] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.066] lstrlenW (lpString="image/png") returned 9 [0077.066] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.066] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.066] GetLastError () returned 0x0 [0077.066] GdipSaveImageToStream (image=0x6ca2120, stream=0x499f770, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.074] GetLastError () returned 0x0 [0077.075] GdipCreateBitmapFromStream (stream=0x499f750, bitmap=0x69e2b0) returned 0x0 [0077.075] GetLastError () returned 0x0 [0077.075] GdipImageForceValidation (image=0x6d1c9f8) returned 0x0 [0077.076] GetLastError () returned 0x0 [0077.076] GdipGetImageRawFormat (image=0x6d1c9f8, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.076] GetLastError () returned 0x0 [0077.076] GdipBitmapLockBits (bitmap=0x6d1c9f8, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x29699f4) returned 0x0 [0077.076] GetLastError () returned 0x0 [0077.076] GdipBitmapUnlockBits (bitmap=0x6d1c9f8, lockedBitmapData=0x29699f4) returned 0x0 [0077.076] GetLastError () returned 0x0 [0077.076] GdipGetImageWidth (image=0x6ca5728, width=0x69e2a8) returned 0x0 [0077.076] GetLastError () returned 0x0 [0077.076] GdipGetImageHeight (image=0x6ca5728, height=0x69e2a8) returned 0x0 [0077.076] GetLastError () returned 0x0 [0077.076] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.076] GetLastError () returned 0x0 [0077.076] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.076] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.077] GetLastError () returned 0x0 [0077.077] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.077] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.077] lstrlenW (lpString="BMP") returned 3 [0077.077] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.077] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.077] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.077] lstrlenW (lpString="image/bmp") returned 9 [0077.077] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.077] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.077] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.077] lstrlenW (lpString="JPEG") returned 4 [0077.077] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.077] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.077] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.077] lstrlenW (lpString="image/jpeg") returned 10 [0077.077] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.078] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.078] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.078] lstrlenW (lpString="GIF") returned 3 [0077.078] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.078] lstrlenW (lpString="*.GIF") returned 5 [0077.078] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.078] lstrlenW (lpString="image/gif") returned 9 [0077.078] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.078] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.078] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.078] lstrlenW (lpString="TIFF") returned 4 [0077.078] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.078] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.078] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.078] lstrlenW (lpString="image/tiff") returned 10 [0077.078] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.079] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.079] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.079] lstrlenW (lpString="PNG") returned 3 [0077.079] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.079] lstrlenW (lpString="*.PNG") returned 5 [0077.079] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.079] lstrlenW (lpString="image/png") returned 9 [0077.079] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.079] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.079] GetLastError () returned 0x0 [0077.079] GdipSaveImageToStream (image=0x6ca5728, stream=0x499f730, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.088] GetLastError () returned 0x0 [0077.089] GdipCreateBitmapFromStream (stream=0x499f710, bitmap=0x69e2b0) returned 0x0 [0077.089] GetLastError () returned 0x0 [0077.089] GdipImageForceValidation (image=0x6d1b648) returned 0x0 [0077.090] GetLastError () returned 0x0 [0077.090] GdipGetImageRawFormat (image=0x6d1b648, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.090] GetLastError () returned 0x0 [0077.090] GdipBitmapLockBits (bitmap=0x6d1b648, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x29728b4) returned 0x0 [0077.090] GetLastError () returned 0x0 [0077.090] GdipBitmapUnlockBits (bitmap=0x6d1b648, lockedBitmapData=0x29728b4) returned 0x0 [0077.090] GetLastError () returned 0x0 [0077.094] GdipGetImageWidth (image=0x6caa798, width=0x69e2a8) returned 0x0 [0077.094] GetLastError () returned 0x1e7 [0077.094] GdipGetImageHeight (image=0x6caa798, height=0x69e2a8) returned 0x0 [0077.094] GetLastError () returned 0x1e7 [0077.094] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.094] GetLastError () returned 0x1e7 [0077.094] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.095] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.095] GetLastError () returned 0x1e7 [0077.095] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.095] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.095] lstrlenW (lpString="BMP") returned 3 [0077.095] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.095] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.095] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.095] lstrlenW (lpString="image/bmp") returned 9 [0077.095] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.095] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.095] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.095] lstrlenW (lpString="JPEG") returned 4 [0077.095] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.096] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.096] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.096] lstrlenW (lpString="image/jpeg") returned 10 [0077.096] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.096] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.096] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.096] lstrlenW (lpString="GIF") returned 3 [0077.096] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.096] lstrlenW (lpString="*.GIF") returned 5 [0077.096] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.096] lstrlenW (lpString="image/gif") returned 9 [0077.096] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.096] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.096] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.096] lstrlenW (lpString="TIFF") returned 4 [0077.096] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.096] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.096] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.097] lstrlenW (lpString="image/tiff") returned 10 [0077.097] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.097] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.097] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.097] lstrlenW (lpString="PNG") returned 3 [0077.097] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.097] lstrlenW (lpString="*.PNG") returned 5 [0077.097] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.097] lstrlenW (lpString="image/png") returned 9 [0077.097] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.097] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.097] GetLastError () returned 0x1e7 [0077.098] GdipSaveImageToStream (image=0x6caa798, stream=0x499f6f0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.114] GetLastError () returned 0x0 [0077.115] GdipCreateBitmapFromStream (stream=0x499fb30, bitmap=0x69e2b0) returned 0x0 [0077.116] GetLastError () returned 0x0 [0077.116] GdipImageForceValidation (image=0x6cceb60) returned 0x0 [0077.116] GetLastError () returned 0x0 [0077.116] GdipGetImageRawFormat (image=0x6cceb60, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.116] GetLastError () returned 0x0 [0077.116] GdipBitmapLockBits (bitmap=0x6cceb60, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x27d6e8c) returned 0x0 [0077.116] GetLastError () returned 0x0 [0077.116] GdipBitmapUnlockBits (bitmap=0x6cceb60, lockedBitmapData=0x27d6e8c) returned 0x0 [0077.116] GetLastError () returned 0x0 [0077.116] GdipGetImageWidth (image=0x6ca9a78, width=0x69e2a8) returned 0x0 [0077.117] GetLastError () returned 0x0 [0077.117] GdipGetImageHeight (image=0x6ca9a78, height=0x69e2a8) returned 0x0 [0077.117] GetLastError () returned 0x0 [0077.117] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.117] GetLastError () returned 0x0 [0077.117] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.117] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.117] GetLastError () returned 0x0 [0077.117] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.117] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.117] lstrlenW (lpString="BMP") returned 3 [0077.117] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.117] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.117] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.117] lstrlenW (lpString="image/bmp") returned 9 [0077.117] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.118] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.118] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.118] lstrlenW (lpString="JPEG") returned 4 [0077.118] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.118] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.118] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.118] lstrlenW (lpString="image/jpeg") returned 10 [0077.118] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.118] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.118] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.118] lstrlenW (lpString="GIF") returned 3 [0077.118] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.118] lstrlenW (lpString="*.GIF") returned 5 [0077.118] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.118] lstrlenW (lpString="image/gif") returned 9 [0077.118] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.118] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.118] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.119] lstrlenW (lpString="TIFF") returned 4 [0077.119] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.119] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.119] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.119] lstrlenW (lpString="image/tiff") returned 10 [0077.119] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.119] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.119] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.119] lstrlenW (lpString="PNG") returned 3 [0077.119] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.119] lstrlenW (lpString="*.PNG") returned 5 [0077.119] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.119] lstrlenW (lpString="image/png") returned 9 [0077.119] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.120] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.120] GetLastError () returned 0x0 [0077.120] GdipSaveImageToStream (image=0x6ca9a78, stream=0x499faf0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.128] GetLastError () returned 0x0 [0077.129] GdipCreateBitmapFromStream (stream=0x499fab0, bitmap=0x69e2b0) returned 0x0 [0077.129] GetLastError () returned 0x0 [0077.130] GdipImageForceValidation (image=0x6cceea8) returned 0x0 [0077.130] GetLastError () returned 0x0 [0077.130] GdipGetImageRawFormat (image=0x6cceea8, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.130] GetLastError () returned 0x0 [0077.130] GdipBitmapLockBits (bitmap=0x6cceea8, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x27dfd40) returned 0x0 [0077.130] GetLastError () returned 0x0 [0077.130] GdipBitmapUnlockBits (bitmap=0x6cceea8, lockedBitmapData=0x27dfd40) returned 0x0 [0077.130] GetLastError () returned 0x0 [0077.130] GdipGetImageWidth (image=0x6ca9730, width=0x69e2a8) returned 0x0 [0077.130] GetLastError () returned 0x0 [0077.130] GdipGetImageHeight (image=0x6ca9730, height=0x69e2a8) returned 0x0 [0077.130] GetLastError () returned 0x0 [0077.130] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.130] GetLastError () returned 0x0 [0077.130] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.131] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.131] GetLastError () returned 0x0 [0077.131] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.131] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.131] lstrlenW (lpString="BMP") returned 3 [0077.131] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.131] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.131] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.131] lstrlenW (lpString="image/bmp") returned 9 [0077.131] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.131] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.131] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.131] lstrlenW (lpString="JPEG") returned 4 [0077.131] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.131] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.131] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.131] lstrlenW (lpString="image/jpeg") returned 10 [0077.131] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.132] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.132] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.132] lstrlenW (lpString="GIF") returned 3 [0077.132] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.132] lstrlenW (lpString="*.GIF") returned 5 [0077.132] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.132] lstrlenW (lpString="image/gif") returned 9 [0077.132] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.132] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.132] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.132] lstrlenW (lpString="TIFF") returned 4 [0077.132] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.132] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.132] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.132] lstrlenW (lpString="image/tiff") returned 10 [0077.132] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.133] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.133] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.133] lstrlenW (lpString="PNG") returned 3 [0077.133] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.133] lstrlenW (lpString="*.PNG") returned 5 [0077.133] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.133] lstrlenW (lpString="image/png") returned 9 [0077.133] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.133] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.133] GetLastError () returned 0x0 [0077.133] GdipSaveImageToStream (image=0x6ca9730, stream=0x499fa70, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.142] GetLastError () returned 0x0 [0077.143] GdipCreateBitmapFromStream (stream=0x499fa30, bitmap=0x69e2b0) returned 0x0 [0077.143] GetLastError () returned 0x0 [0077.143] GdipImageForceValidation (image=0x6cd0c30) returned 0x0 [0077.144] GetLastError () returned 0x0 [0077.144] GdipGetImageRawFormat (image=0x6cd0c30, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.144] GetLastError () returned 0x0 [0077.144] GdipBitmapLockBits (bitmap=0x6cd0c30, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x27e8c00) returned 0x0 [0077.144] GetLastError () returned 0x0 [0077.144] GdipBitmapUnlockBits (bitmap=0x6cd0c30, lockedBitmapData=0x27e8c00) returned 0x0 [0077.144] GetLastError () returned 0x0 [0077.144] GdipGetImageWidth (image=0x6ca8d58, width=0x69e2a8) returned 0x0 [0077.144] GetLastError () returned 0x0 [0077.144] GdipGetImageHeight (image=0x6ca8d58, height=0x69e2a8) returned 0x0 [0077.144] GetLastError () returned 0x0 [0077.144] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.144] GetLastError () returned 0x0 [0077.144] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.144] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.144] GetLastError () returned 0x0 [0077.144] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.144] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.145] lstrlenW (lpString="BMP") returned 3 [0077.145] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.145] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.145] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.145] lstrlenW (lpString="image/bmp") returned 9 [0077.145] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.145] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.145] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.145] lstrlenW (lpString="JPEG") returned 4 [0077.145] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.145] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.145] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.145] lstrlenW (lpString="image/jpeg") returned 10 [0077.145] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.145] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.145] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.145] lstrlenW (lpString="GIF") returned 3 [0077.145] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.145] lstrlenW (lpString="*.GIF") returned 5 [0077.146] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.146] lstrlenW (lpString="image/gif") returned 9 [0077.146] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.146] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.146] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.146] lstrlenW (lpString="TIFF") returned 4 [0077.146] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.146] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.146] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.146] lstrlenW (lpString="image/tiff") returned 10 [0077.146] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.146] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.146] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.146] lstrlenW (lpString="PNG") returned 3 [0077.146] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.146] lstrlenW (lpString="*.PNG") returned 5 [0077.146] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.147] lstrlenW (lpString="image/png") returned 9 [0077.147] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.147] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.147] GetLastError () returned 0x0 [0077.147] GdipSaveImageToStream (image=0x6ca8d58, stream=0x499f9f0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.154] GetLastError () returned 0x0 [0077.155] GdipCreateBitmapFromStream (stream=0x499f9b0, bitmap=0x69e2b0) returned 0x0 [0077.155] GetLastError () returned 0x0 [0077.155] GdipImageForceValidation (image=0x6cce188) returned 0x0 [0077.156] GetLastError () returned 0x0 [0077.156] GdipGetImageRawFormat (image=0x6cce188, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.156] GetLastError () returned 0x0 [0077.156] GdipBitmapLockBits (bitmap=0x6cce188, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x27f1ab4) returned 0x0 [0077.156] GetLastError () returned 0x0 [0077.156] GdipBitmapUnlockBits (bitmap=0x6cce188, lockedBitmapData=0x27f1ab4) returned 0x0 [0077.156] GetLastError () returned 0x0 [0077.156] GdipGetImageWidth (image=0x6ca90a0, width=0x69e2a8) returned 0x0 [0077.156] GetLastError () returned 0x0 [0077.156] GdipGetImageHeight (image=0x6ca90a0, height=0x69e2a8) returned 0x0 [0077.156] GetLastError () returned 0x0 [0077.156] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.156] GetLastError () returned 0x0 [0077.156] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.156] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.156] GetLastError () returned 0x0 [0077.156] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.156] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.156] lstrlenW (lpString="BMP") returned 3 [0077.156] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.156] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.156] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.156] lstrlenW (lpString="image/bmp") returned 9 [0077.156] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.157] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.157] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.157] lstrlenW (lpString="JPEG") returned 4 [0077.157] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.157] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.157] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.157] lstrlenW (lpString="image/jpeg") returned 10 [0077.157] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.157] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.157] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.157] lstrlenW (lpString="GIF") returned 3 [0077.157] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.157] lstrlenW (lpString="*.GIF") returned 5 [0077.157] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.157] lstrlenW (lpString="image/gif") returned 9 [0077.157] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.157] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.157] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.157] lstrlenW (lpString="TIFF") returned 4 [0077.157] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.158] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.158] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.158] lstrlenW (lpString="image/tiff") returned 10 [0077.158] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.158] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.158] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.158] lstrlenW (lpString="PNG") returned 3 [0077.158] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.158] lstrlenW (lpString="*.PNG") returned 5 [0077.158] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.158] lstrlenW (lpString="image/png") returned 9 [0077.158] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.158] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.158] GetLastError () returned 0x0 [0077.158] GdipSaveImageToStream (image=0x6ca90a0, stream=0x499f970, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.165] GetLastError () returned 0x0 [0077.165] GdipCreateBitmapFromStream (stream=0x499f930, bitmap=0x69e2b0) returned 0x0 [0077.166] GetLastError () returned 0x0 [0077.166] GdipImageForceValidation (image=0x6cce818) returned 0x0 [0077.166] GetLastError () returned 0x0 [0077.166] GdipGetImageRawFormat (image=0x6cce818, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.166] GetLastError () returned 0x0 [0077.166] GdipBitmapLockBits (bitmap=0x6cce818, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x27fa974) returned 0x0 [0077.166] GetLastError () returned 0x0 [0077.166] GdipBitmapUnlockBits (bitmap=0x6cce818, lockedBitmapData=0x27fa974) returned 0x0 [0077.166] GetLastError () returned 0x0 [0077.166] GdipGetImageWidth (image=0x6ca93e8, width=0x69e2a8) returned 0x0 [0077.166] GetLastError () returned 0x0 [0077.167] GdipGetImageHeight (image=0x6ca93e8, height=0x69e2a8) returned 0x0 [0077.167] GetLastError () returned 0x0 [0077.167] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.167] GetLastError () returned 0x0 [0077.167] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.167] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.167] GetLastError () returned 0x0 [0077.167] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.167] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.167] lstrlenW (lpString="BMP") returned 3 [0077.167] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.167] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.167] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.167] lstrlenW (lpString="image/bmp") returned 9 [0077.167] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.167] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.167] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.167] lstrlenW (lpString="JPEG") returned 4 [0077.167] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.167] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.167] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.167] lstrlenW (lpString="image/jpeg") returned 10 [0077.168] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.168] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.168] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.168] lstrlenW (lpString="GIF") returned 3 [0077.168] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.168] lstrlenW (lpString="*.GIF") returned 5 [0077.168] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.168] lstrlenW (lpString="image/gif") returned 9 [0077.168] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.168] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.168] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.168] lstrlenW (lpString="TIFF") returned 4 [0077.168] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.168] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.168] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.168] lstrlenW (lpString="image/tiff") returned 10 [0077.168] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.168] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.168] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.168] lstrlenW (lpString="PNG") returned 3 [0077.168] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.169] lstrlenW (lpString="*.PNG") returned 5 [0077.169] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.169] lstrlenW (lpString="image/png") returned 9 [0077.169] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.169] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.169] GetLastError () returned 0x0 [0077.169] GdipSaveImageToStream (image=0x6ca93e8, stream=0x499f8f0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.175] GetLastError () returned 0x0 [0077.175] GdipCreateBitmapFromStream (stream=0x499f8b0, bitmap=0x69e2b0) returned 0x0 [0077.175] GetLastError () returned 0x0 [0077.175] GdipImageForceValidation (image=0x6d1a928) returned 0x0 [0077.176] GetLastError () returned 0x0 [0077.176] GdipGetImageRawFormat (image=0x6d1a928, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.176] GetLastError () returned 0x0 [0077.176] GdipBitmapLockBits (bitmap=0x6d1a928, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x280381c) returned 0x0 [0077.176] GetLastError () returned 0x0 [0077.176] GdipBitmapUnlockBits (bitmap=0x6d1a928, lockedBitmapData=0x280381c) returned 0x0 [0077.176] GetLastError () returned 0x0 [0077.176] GdipGetImageWidth (image=0x6caa450, width=0x69e2a8) returned 0x0 [0077.176] GetLastError () returned 0x0 [0077.176] GdipGetImageHeight (image=0x6caa450, height=0x69e2a8) returned 0x0 [0077.176] GetLastError () returned 0x0 [0077.176] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.176] GetLastError () returned 0x0 [0077.176] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.176] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.176] GetLastError () returned 0x0 [0077.176] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.176] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.176] lstrlenW (lpString="BMP") returned 3 [0077.176] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.176] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.176] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.177] lstrlenW (lpString="image/bmp") returned 9 [0077.177] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.177] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.177] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.177] lstrlenW (lpString="JPEG") returned 4 [0077.177] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.177] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.177] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.177] lstrlenW (lpString="image/jpeg") returned 10 [0077.177] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.177] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.177] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.177] lstrlenW (lpString="GIF") returned 3 [0077.177] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.177] lstrlenW (lpString="*.GIF") returned 5 [0077.177] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.177] lstrlenW (lpString="image/gif") returned 9 [0077.177] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.177] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.177] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.178] lstrlenW (lpString="TIFF") returned 4 [0077.178] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.178] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.178] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.178] lstrlenW (lpString="image/tiff") returned 10 [0077.178] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.178] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.178] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.178] lstrlenW (lpString="PNG") returned 3 [0077.178] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.178] lstrlenW (lpString="*.PNG") returned 5 [0077.178] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.178] lstrlenW (lpString="image/png") returned 9 [0077.178] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.178] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.178] GetLastError () returned 0x0 [0077.179] GdipSaveImageToStream (image=0x6caa450, stream=0x499f870, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.185] GetLastError () returned 0x0 [0077.186] GdipCreateBitmapFromStream (stream=0x499f830, bitmap=0x69e2b0) returned 0x0 [0077.186] GetLastError () returned 0x0 [0077.186] GdipImageForceValidation (image=0x6d1c9f8) returned 0x0 [0077.186] GetLastError () returned 0x0 [0077.186] GdipGetImageRawFormat (image=0x6d1c9f8, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.186] GetLastError () returned 0x0 [0077.186] GdipBitmapLockBits (bitmap=0x6d1c9f8, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x280c6dc) returned 0x0 [0077.186] GetLastError () returned 0x0 [0077.187] GdipBitmapUnlockBits (bitmap=0x6d1c9f8, lockedBitmapData=0x280c6dc) returned 0x0 [0077.187] GetLastError () returned 0x0 [0077.187] GdipGetImageWidth (image=0x6ca9dc0, width=0x69e2a8) returned 0x0 [0077.187] GetLastError () returned 0x0 [0077.187] GdipGetImageHeight (image=0x6ca9dc0, height=0x69e2a8) returned 0x0 [0077.187] GetLastError () returned 0x0 [0077.187] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.187] GetLastError () returned 0x0 [0077.187] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.187] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.187] GetLastError () returned 0x0 [0077.187] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.187] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.187] lstrlenW (lpString="BMP") returned 3 [0077.187] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.187] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.187] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.187] lstrlenW (lpString="image/bmp") returned 9 [0077.187] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.187] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.187] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.187] lstrlenW (lpString="JPEG") returned 4 [0077.187] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.187] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.188] lstrlenW (lpString="image/jpeg") returned 10 [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.188] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.188] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.188] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.188] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.188] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.189] GetLastError () returned 0x0 [0077.189] GdipSaveImageToStream (image=0x6ca9dc0, stream=0x499f7f0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.195] GetLastError () returned 0x0 [0077.195] GdipCreateBitmapFromStream (stream=0x499f7b0, bitmap=0x69e2b0) returned 0x0 [0077.196] GetLastError () returned 0x0 [0077.196] GdipImageForceValidation (image=0x6d1a5e0) returned 0x0 [0077.196] GetLastError () returned 0x0 [0077.196] GdipGetImageRawFormat (image=0x6d1a5e0, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.196] GetLastError () returned 0x0 [0077.196] GdipBitmapLockBits (bitmap=0x6d1a5e0, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2815584) returned 0x0 [0077.196] GetLastError () returned 0x0 [0077.196] GdipBitmapUnlockBits (bitmap=0x6d1a5e0, lockedBitmapData=0x2815584) returned 0x0 [0077.196] GetLastError () returned 0x0 [0077.196] GdipGetImageWidth (image=0x6caa108, width=0x69e2a8) returned 0x0 [0077.196] GetLastError () returned 0x0 [0077.196] GdipGetImageHeight (image=0x6caa108, height=0x69e2a8) returned 0x0 [0077.196] GetLastError () returned 0x0 [0077.196] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.197] GetLastError () returned 0x0 [0077.197] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.197] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.197] GetLastError () returned 0x0 [0077.197] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.197] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.197] lstrlenW (lpString="BMP") returned 3 [0077.197] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.198] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.198] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.198] lstrlenW (lpString="image/bmp") returned 9 [0077.198] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.198] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.198] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.198] lstrlenW (lpString="JPEG") returned 4 [0077.198] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.198] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.198] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.198] lstrlenW (lpString="image/jpeg") returned 10 [0077.198] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.198] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.198] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.198] lstrlenW (lpString="GIF") returned 3 [0077.198] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.198] lstrlenW (lpString="*.GIF") returned 5 [0077.198] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.198] lstrlenW (lpString="image/gif") returned 9 [0077.198] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.198] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.199] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.199] lstrlenW (lpString="TIFF") returned 4 [0077.199] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.199] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.199] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.199] lstrlenW (lpString="image/tiff") returned 10 [0077.199] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.199] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.199] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.199] lstrlenW (lpString="PNG") returned 3 [0077.199] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.199] lstrlenW (lpString="*.PNG") returned 5 [0077.199] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.199] lstrlenW (lpString="image/png") returned 9 [0077.199] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.199] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.199] GetLastError () returned 0x0 [0077.200] GdipSaveImageToStream (image=0x6caa108, stream=0x499f770, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.206] GetLastError () returned 0x0 [0077.206] GdipCreateBitmapFromStream (stream=0x499f730, bitmap=0x69e2b0) returned 0x0 [0077.207] GetLastError () returned 0x0 [0077.207] GdipImageForceValidation (image=0x6d1ac70) returned 0x0 [0077.207] GetLastError () returned 0x0 [0077.207] GdipGetImageRawFormat (image=0x6d1ac70, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.207] GetLastError () returned 0x0 [0077.207] GdipBitmapLockBits (bitmap=0x6d1ac70, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x281e438) returned 0x0 [0077.207] GetLastError () returned 0x0 [0077.208] GdipBitmapUnlockBits (bitmap=0x6d1ac70, lockedBitmapData=0x281e438) returned 0x0 [0077.208] GetLastError () returned 0x0 [0077.208] GdipGetImageWidth (image=0x6cce4d0, width=0x69e2a8) returned 0x0 [0077.208] GetLastError () returned 0x0 [0077.208] GdipGetImageHeight (image=0x6cce4d0, height=0x69e2a8) returned 0x0 [0077.208] GetLastError () returned 0x0 [0077.208] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.208] GetLastError () returned 0x0 [0077.208] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.208] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.208] GetLastError () returned 0x0 [0077.208] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.208] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.208] lstrlenW (lpString="BMP") returned 3 [0077.208] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.208] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.208] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.208] lstrlenW (lpString="image/bmp") returned 9 [0077.208] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.208] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.208] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.208] lstrlenW (lpString="JPEG") returned 4 [0077.209] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.209] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.209] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.209] lstrlenW (lpString="image/jpeg") returned 10 [0077.209] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.209] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.209] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.209] lstrlenW (lpString="GIF") returned 3 [0077.209] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.209] lstrlenW (lpString="*.GIF") returned 5 [0077.209] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.209] lstrlenW (lpString="image/gif") returned 9 [0077.209] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.209] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.209] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.209] lstrlenW (lpString="TIFF") returned 4 [0077.209] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.209] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.209] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.209] lstrlenW (lpString="image/tiff") returned 10 [0077.209] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.210] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.210] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.210] lstrlenW (lpString="PNG") returned 3 [0077.210] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.210] lstrlenW (lpString="*.PNG") returned 5 [0077.210] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.210] lstrlenW (lpString="image/png") returned 9 [0077.210] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.210] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.210] GetLastError () returned 0x0 [0077.210] GdipSaveImageToStream (image=0x6cce4d0, stream=0x499f6d0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.217] GetLastError () returned 0x0 [0077.218] GdipCreateBitmapFromStream (stream=0x499f6b0, bitmap=0x69e2b0) returned 0x0 [0077.218] GetLastError () returned 0x0 [0077.218] GdipImageForceValidation (image=0x6d1b648) returned 0x0 [0077.219] GetLastError () returned 0x0 [0077.219] GdipGetImageRawFormat (image=0x6d1b648, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.219] GetLastError () returned 0x0 [0077.219] GdipBitmapLockBits (bitmap=0x6d1b648, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x28272ec) returned 0x0 [0077.219] GetLastError () returned 0x0 [0077.219] GdipBitmapUnlockBits (bitmap=0x6d1b648, lockedBitmapData=0x28272ec) returned 0x0 [0077.219] GetLastError () returned 0x0 [0077.219] GdipGetImageWidth (image=0x6cd0f78, width=0x69e2a8) returned 0x0 [0077.219] GetLastError () returned 0x0 [0077.219] GdipGetImageHeight (image=0x6cd0f78, height=0x69e2a8) returned 0x0 [0077.219] GetLastError () returned 0x0 [0077.219] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.219] GetLastError () returned 0x0 [0077.219] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.219] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.219] GetLastError () returned 0x0 [0077.219] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.219] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.219] lstrlenW (lpString="BMP") returned 3 [0077.219] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.219] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.219] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.220] lstrlenW (lpString="image/bmp") returned 9 [0077.220] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.220] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.220] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.220] lstrlenW (lpString="JPEG") returned 4 [0077.220] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.220] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.220] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.220] lstrlenW (lpString="image/jpeg") returned 10 [0077.220] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.220] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.220] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.220] lstrlenW (lpString="GIF") returned 3 [0077.220] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.220] lstrlenW (lpString="*.GIF") returned 5 [0077.220] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.220] lstrlenW (lpString="image/gif") returned 9 [0077.220] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.220] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.220] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.220] lstrlenW (lpString="TIFF") returned 4 [0077.221] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.221] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.221] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.221] lstrlenW (lpString="image/tiff") returned 10 [0077.221] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.221] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.221] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.221] lstrlenW (lpString="PNG") returned 3 [0077.221] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.221] lstrlenW (lpString="*.PNG") returned 5 [0077.221] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.221] lstrlenW (lpString="image/png") returned 9 [0077.221] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.221] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.221] GetLastError () returned 0x0 [0077.222] GdipSaveImageToStream (image=0x6cd0f78, stream=0x499f690, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.227] GetLastError () returned 0x0 [0077.228] GdipCreateBitmapFromStream (stream=0x499f670, bitmap=0x69e2b0) returned 0x0 [0077.229] GetLastError () returned 0x0 [0077.229] GdipImageForceValidation (image=0x6d1a298) returned 0x0 [0077.230] GetLastError () returned 0x0 [0077.230] GdipGetImageRawFormat (image=0x6d1a298, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.230] GetLastError () returned 0x0 [0077.230] GdipBitmapLockBits (bitmap=0x6d1a298, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x28301a0) returned 0x0 [0077.230] GetLastError () returned 0x0 [0077.230] GdipBitmapUnlockBits (bitmap=0x6d1a298, lockedBitmapData=0x28301a0) returned 0x0 [0077.230] GetLastError () returned 0x0 [0077.230] GdipGetImageWidth (image=0x6cd12c0, width=0x69e2a8) returned 0x0 [0077.230] GetLastError () returned 0x0 [0077.230] GdipGetImageHeight (image=0x6cd12c0, height=0x69e2a8) returned 0x0 [0077.230] GetLastError () returned 0x0 [0077.230] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.230] GetLastError () returned 0x0 [0077.230] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.230] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.230] GetLastError () returned 0x0 [0077.231] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.231] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.231] lstrlenW (lpString="BMP") returned 3 [0077.231] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.231] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.231] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.231] lstrlenW (lpString="image/bmp") returned 9 [0077.231] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.231] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.231] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.231] lstrlenW (lpString="JPEG") returned 4 [0077.231] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.231] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.231] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.231] lstrlenW (lpString="image/jpeg") returned 10 [0077.231] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.231] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.231] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.231] lstrlenW (lpString="GIF") returned 3 [0077.232] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.232] lstrlenW (lpString="*.GIF") returned 5 [0077.232] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.232] lstrlenW (lpString="image/gif") returned 9 [0077.232] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.232] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.232] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.232] lstrlenW (lpString="TIFF") returned 4 [0077.232] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.232] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.232] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.232] lstrlenW (lpString="image/tiff") returned 10 [0077.232] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.232] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.232] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.232] lstrlenW (lpString="PNG") returned 3 [0077.232] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.232] lstrlenW (lpString="*.PNG") returned 5 [0077.232] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.232] lstrlenW (lpString="image/png") returned 9 [0077.232] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.233] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.233] GetLastError () returned 0x0 [0077.233] GdipSaveImageToStream (image=0x6cd12c0, stream=0x499f650, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.239] GetLastError () returned 0x0 [0077.239] GdipCreateBitmapFromStream (stream=0x499f630, bitmap=0x69e2b0) returned 0x0 [0077.240] GetLastError () returned 0x0 [0077.240] GdipImageForceValidation (image=0x6d1afb8) returned 0x0 [0077.240] GetLastError () returned 0x0 [0077.240] GdipGetImageRawFormat (image=0x6d1afb8, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.240] GetLastError () returned 0x0 [0077.240] GdipBitmapLockBits (bitmap=0x6d1afb8, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2839048) returned 0x0 [0077.240] GetLastError () returned 0x0 [0077.240] GdipBitmapUnlockBits (bitmap=0x6d1afb8, lockedBitmapData=0x2839048) returned 0x0 [0077.240] GetLastError () returned 0x0 [0077.240] GdipGetImageWidth (image=0x6ccfbc8, width=0x69e2a8) returned 0x0 [0077.240] GetLastError () returned 0x0 [0077.240] GdipGetImageHeight (image=0x6ccfbc8, height=0x69e2a8) returned 0x0 [0077.240] GetLastError () returned 0x0 [0077.240] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.240] GetLastError () returned 0x0 [0077.240] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.240] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.241] GetLastError () returned 0x0 [0077.241] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.241] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.241] lstrlenW (lpString="BMP") returned 3 [0077.241] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.241] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.241] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.241] lstrlenW (lpString="image/bmp") returned 9 [0077.241] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.241] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.241] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.241] lstrlenW (lpString="JPEG") returned 4 [0077.241] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.241] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.241] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.241] lstrlenW (lpString="image/jpeg") returned 10 [0077.241] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.241] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.242] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.242] lstrlenW (lpString="GIF") returned 3 [0077.242] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.242] lstrlenW (lpString="*.GIF") returned 5 [0077.242] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.242] lstrlenW (lpString="image/gif") returned 9 [0077.242] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.242] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.242] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.242] lstrlenW (lpString="TIFF") returned 4 [0077.242] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.242] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.242] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.242] lstrlenW (lpString="image/tiff") returned 10 [0077.242] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.242] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.243] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.243] lstrlenW (lpString="PNG") returned 3 [0077.243] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.243] lstrlenW (lpString="*.PNG") returned 5 [0077.243] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.243] lstrlenW (lpString="image/png") returned 9 [0077.243] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.243] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.243] GetLastError () returned 0x0 [0077.243] GdipSaveImageToStream (image=0x6ccfbc8, stream=0x499f610, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.251] GetLastError () returned 0x0 [0077.252] GdipCreateBitmapFromStream (stream=0x499f5f0, bitmap=0x69e2b0) returned 0x0 [0077.252] GetLastError () returned 0x0 [0077.253] GdipImageForceValidation (image=0x6d1b990) returned 0x0 [0077.253] GetLastError () returned 0x0 [0077.253] GdipGetImageRawFormat (image=0x6d1b990, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.253] GetLastError () returned 0x0 [0077.253] GdipBitmapLockBits (bitmap=0x6d1b990, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2841efc) returned 0x0 [0077.253] GetLastError () returned 0x0 [0077.253] GdipBitmapUnlockBits (bitmap=0x6d1b990, lockedBitmapData=0x2841efc) returned 0x0 [0077.253] GetLastError () returned 0x0 [0077.253] GdipGetImageWidth (image=0x6ccf538, width=0x69e2a8) returned 0x0 [0077.253] GetLastError () returned 0x0 [0077.253] GdipGetImageHeight (image=0x6ccf538, height=0x69e2a8) returned 0x0 [0077.253] GetLastError () returned 0x0 [0077.253] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.253] GetLastError () returned 0x0 [0077.253] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.254] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.254] GetLastError () returned 0x0 [0077.254] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.254] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.254] lstrlenW (lpString="BMP") returned 3 [0077.254] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.254] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.254] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.254] lstrlenW (lpString="image/bmp") returned 9 [0077.254] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.254] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.254] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.254] lstrlenW (lpString="JPEG") returned 4 [0077.254] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.254] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.254] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.254] lstrlenW (lpString="image/jpeg") returned 10 [0077.254] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.255] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.255] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.255] lstrlenW (lpString="GIF") returned 3 [0077.255] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.255] lstrlenW (lpString="*.GIF") returned 5 [0077.255] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.255] lstrlenW (lpString="image/gif") returned 9 [0077.255] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.255] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.255] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.255] lstrlenW (lpString="TIFF") returned 4 [0077.255] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.255] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.255] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.255] lstrlenW (lpString="image/tiff") returned 10 [0077.255] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.255] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.255] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.255] lstrlenW (lpString="PNG") returned 3 [0077.255] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.255] lstrlenW (lpString="*.PNG") returned 5 [0077.255] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.256] lstrlenW (lpString="image/png") returned 9 [0077.256] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.256] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.256] GetLastError () returned 0x0 [0077.256] GdipSaveImageToStream (image=0x6ccf538, stream=0x499f5d0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.267] GetLastError () returned 0x0 [0077.267] GdipCreateBitmapFromStream (stream=0x499f5b0, bitmap=0x69e2b0) returned 0x0 [0077.268] GetLastError () returned 0x0 [0077.268] GdipImageForceValidation (image=0x6d1bcd8) returned 0x0 [0077.268] GetLastError () returned 0x0 [0077.268] GdipGetImageRawFormat (image=0x6d1bcd8, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.268] GetLastError () returned 0x0 [0077.268] GdipBitmapLockBits (bitmap=0x6d1bcd8, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x284adb0) returned 0x0 [0077.269] GetLastError () returned 0x0 [0077.269] GdipBitmapUnlockBits (bitmap=0x6d1bcd8, lockedBitmapData=0x284adb0) returned 0x0 [0077.269] GetLastError () returned 0x0 [0077.269] GdipGetImageWidth (image=0x6cd1950, width=0x69e2a8) returned 0x0 [0077.269] GetLastError () returned 0x0 [0077.269] GdipGetImageHeight (image=0x6cd1950, height=0x69e2a8) returned 0x0 [0077.269] GetLastError () returned 0x0 [0077.269] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.269] GetLastError () returned 0x0 [0077.269] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.269] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.269] GetLastError () returned 0x0 [0077.269] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.269] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.269] lstrlenW (lpString="BMP") returned 3 [0077.269] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.269] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.269] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.269] lstrlenW (lpString="image/bmp") returned 9 [0077.269] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.270] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.270] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.270] lstrlenW (lpString="JPEG") returned 4 [0077.270] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.270] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.270] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.270] lstrlenW (lpString="image/jpeg") returned 10 [0077.270] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.270] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.270] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.270] lstrlenW (lpString="GIF") returned 3 [0077.270] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.270] lstrlenW (lpString="*.GIF") returned 5 [0077.270] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.270] lstrlenW (lpString="image/gif") returned 9 [0077.270] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.271] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.271] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.271] lstrlenW (lpString="TIFF") returned 4 [0077.271] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.271] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.271] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.271] lstrlenW (lpString="image/tiff") returned 10 [0077.271] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.271] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.271] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.272] lstrlenW (lpString="PNG") returned 3 [0077.272] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.272] lstrlenW (lpString="*.PNG") returned 5 [0077.272] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.272] lstrlenW (lpString="image/png") returned 9 [0077.272] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.272] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.272] GetLastError () returned 0x0 [0077.272] GdipSaveImageToStream (image=0x6cd1950, stream=0x499f590, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.282] GetLastError () returned 0x0 [0077.283] GdipCreateBitmapFromStream (stream=0x499f570, bitmap=0x69e2b0) returned 0x0 [0077.283] GetLastError () returned 0x0 [0077.283] GdipImageForceValidation (image=0x6d1c6b0) returned 0x0 [0077.285] GetLastError () returned 0x0 [0077.285] GdipGetImageRawFormat (image=0x6d1c6b0, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.285] GetLastError () returned 0x0 [0077.285] GdipBitmapLockBits (bitmap=0x6d1c6b0, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2853c64) returned 0x0 [0077.285] GetLastError () returned 0x0 [0077.285] GdipBitmapUnlockBits (bitmap=0x6d1c6b0, lockedBitmapData=0x2853c64) returned 0x0 [0077.285] GetLastError () returned 0x0 [0077.285] GdipGetImageWidth (image=0x6cd1608, width=0x69e2a8) returned 0x0 [0077.285] GetLastError () returned 0x0 [0077.285] GdipGetImageHeight (image=0x6cd1608, height=0x69e2a8) returned 0x0 [0077.285] GetLastError () returned 0x0 [0077.285] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.285] GetLastError () returned 0x0 [0077.285] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.285] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.285] GetLastError () returned 0x0 [0077.285] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.285] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.285] lstrlenW (lpString="BMP") returned 3 [0077.285] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.285] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.285] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.285] lstrlenW (lpString="image/bmp") returned 9 [0077.286] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.286] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.286] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.286] lstrlenW (lpString="JPEG") returned 4 [0077.286] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.286] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.286] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.286] lstrlenW (lpString="image/jpeg") returned 10 [0077.286] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.286] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.286] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.286] lstrlenW (lpString="GIF") returned 3 [0077.286] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.286] lstrlenW (lpString="*.GIF") returned 5 [0077.286] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.286] lstrlenW (lpString="image/gif") returned 9 [0077.286] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.286] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.287] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.287] lstrlenW (lpString="TIFF") returned 4 [0077.287] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.287] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.287] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.287] lstrlenW (lpString="image/tiff") returned 10 [0077.287] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.287] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.287] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.287] lstrlenW (lpString="PNG") returned 3 [0077.287] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.287] lstrlenW (lpString="*.PNG") returned 5 [0077.287] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.287] lstrlenW (lpString="image/png") returned 9 [0077.287] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.287] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.288] GetLastError () returned 0x0 [0077.288] GdipSaveImageToStream (image=0x6cd1608, stream=0x499f550, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.296] GetLastError () returned 0x0 [0077.297] GdipCreateBitmapFromStream (stream=0x499f530, bitmap=0x69e2b0) returned 0x0 [0077.297] GetLastError () returned 0x0 [0077.297] GdipImageForceValidation (image=0x6d19578) returned 0x0 [0077.298] GetLastError () returned 0x0 [0077.298] GdipGetImageRawFormat (image=0x6d19578, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.298] GetLastError () returned 0x0 [0077.298] GdipBitmapLockBits (bitmap=0x6d19578, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x285cb24) returned 0x0 [0077.298] GetLastError () returned 0x0 [0077.298] GdipBitmapUnlockBits (bitmap=0x6d19578, lockedBitmapData=0x285cb24) returned 0x0 [0077.298] GetLastError () returned 0x0 [0077.298] GdipGetImageWidth (image=0x6ccf1f0, width=0x69e2a8) returned 0x0 [0077.298] GetLastError () returned 0x0 [0077.298] GdipGetImageHeight (image=0x6ccf1f0, height=0x69e2a8) returned 0x0 [0077.298] GetLastError () returned 0x0 [0077.298] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.298] GetLastError () returned 0x0 [0077.298] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.298] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.298] GetLastError () returned 0x0 [0077.298] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.298] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.298] lstrlenW (lpString="BMP") returned 3 [0077.298] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.299] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.299] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.299] lstrlenW (lpString="image/bmp") returned 9 [0077.299] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.299] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.299] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.299] lstrlenW (lpString="JPEG") returned 4 [0077.299] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.299] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.299] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.299] lstrlenW (lpString="image/jpeg") returned 10 [0077.299] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.299] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.299] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.299] lstrlenW (lpString="GIF") returned 3 [0077.299] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.299] lstrlenW (lpString="*.GIF") returned 5 [0077.300] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.300] lstrlenW (lpString="image/gif") returned 9 [0077.300] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.300] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.300] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.300] lstrlenW (lpString="TIFF") returned 4 [0077.300] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.300] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.300] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.300] lstrlenW (lpString="image/tiff") returned 10 [0077.300] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.300] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.300] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.300] lstrlenW (lpString="PNG") returned 3 [0077.300] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.300] lstrlenW (lpString="*.PNG") returned 5 [0077.301] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.301] lstrlenW (lpString="image/png") returned 9 [0077.301] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.301] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.301] GetLastError () returned 0x0 [0077.301] GdipSaveImageToStream (image=0x6ccf1f0, stream=0x499f510, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.308] GetLastError () returned 0x0 [0077.308] GdipCreateBitmapFromStream (stream=0x499f4f0, bitmap=0x69e2b0) returned 0x0 [0077.309] GetLastError () returned 0x0 [0077.309] GdipImageForceValidation (image=0x6d198c0) returned 0x0 [0077.309] GetLastError () returned 0x0 [0077.309] GdipGetImageRawFormat (image=0x6d198c0, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.309] GetLastError () returned 0x0 [0077.309] GdipBitmapLockBits (bitmap=0x6d198c0, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x28659d8) returned 0x0 [0077.309] GetLastError () returned 0x0 [0077.310] GdipBitmapUnlockBits (bitmap=0x6d198c0, lockedBitmapData=0x28659d8) returned 0x0 [0077.310] GetLastError () returned 0x0 [0077.310] GdipGetImageWidth (image=0x6ccff10, width=0x69e2a8) returned 0x0 [0077.310] GetLastError () returned 0x0 [0077.310] GdipGetImageHeight (image=0x6ccff10, height=0x69e2a8) returned 0x0 [0077.310] GetLastError () returned 0x0 [0077.310] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.310] GetLastError () returned 0x0 [0077.310] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c5f0 [0077.310] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c5f0 | out: encoders=0x93c5f0) returned 0x0 [0077.310] GetLastError () returned 0x0 [0077.310] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.310] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c76c, Length=0x26 | out: Destination=0x8f39c0) [0077.310] lstrlenW (lpString="BMP") returned 3 [0077.310] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c792, Length=0x8 | out: Destination=0x8f39c0) [0077.310] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.310] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c79a, Length=0x24 | out: Destination=0x8f39c0) [0077.310] lstrlenW (lpString="image/bmp") returned 9 [0077.310] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7be, Length=0x14 | out: Destination=0x8f39c0) [0077.311] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.311] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7d6, Length=0x28 | out: Destination=0x8f39c0) [0077.311] lstrlenW (lpString="JPEG") returned 4 [0077.311] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0xa | out: Destination=0x8f39c0) [0077.311] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.311] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c808, Length=0x34 | out: Destination=0x8f39c0) [0077.311] lstrlenW (lpString="image/jpeg") returned 10 [0077.311] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83c, Length=0x16 | out: Destination=0x8f39c0) [0077.355] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.355] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c856, Length=0x26 | out: Destination=0x8f39c0) [0077.355] lstrlenW (lpString="GIF") returned 3 [0077.355] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87c, Length=0x8 | out: Destination=0x8f39c0) [0077.355] lstrlenW (lpString="*.GIF") returned 5 [0077.355] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c884, Length=0xc | out: Destination=0x8f39c0) [0077.355] lstrlenW (lpString="image/gif") returned 9 [0077.355] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c890, Length=0x14 | out: Destination=0x8f39c0) [0077.355] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.355] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8bc, Length=0x28 | out: Destination=0x8f39c0) [0077.355] lstrlenW (lpString="TIFF") returned 4 [0077.355] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0xa | out: Destination=0x8f39c0) [0077.355] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.355] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ee, Length=0x1a | out: Destination=0x8f39c0) [0077.355] lstrlenW (lpString="image/tiff") returned 10 [0077.355] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x16 | out: Destination=0x8f39c0) [0077.356] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.356] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c926, Length=0x26 | out: Destination=0x8f39c0) [0077.356] lstrlenW (lpString="PNG") returned 3 [0077.356] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94c, Length=0x8 | out: Destination=0x8f39c0) [0077.356] lstrlenW (lpString="*.PNG") returned 5 [0077.356] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c954, Length=0xc | out: Destination=0x8f39c0) [0077.356] lstrlenW (lpString="image/png") returned 9 [0077.356] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c960, Length=0x14 | out: Destination=0x8f39c0) [0077.356] LocalFree (hMem=0x93c5f0) returned 0x0 [0077.356] GetLastError () returned 0x0 [0077.357] GdipSaveImageToStream (image=0x6ccff10, stream=0x499f4d0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.364] GetLastError () returned 0x0 [0077.365] GdipCreateBitmapFromStream (stream=0x499f4b0, bitmap=0x69e2b0) returned 0x0 [0077.365] GetLastError () returned 0x0 [0077.365] GdipImageForceValidation (image=0x6d1b300) returned 0x0 [0077.366] GetLastError () returned 0x0 [0077.366] GdipGetImageRawFormat (image=0x6d1b300, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.366] GetLastError () returned 0x0 [0077.366] GdipBitmapLockBits (bitmap=0x6d1b300, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x286e898) returned 0x0 [0077.366] GetLastError () returned 0x0 [0077.366] GdipBitmapUnlockBits (bitmap=0x6d1b300, lockedBitmapData=0x286e898) returned 0x0 [0077.366] GetLastError () returned 0x0 [0077.366] GdipGetImageWidth (image=0x6ccf880, width=0x69e2a8) returned 0x0 [0077.366] GetLastError () returned 0x0 [0077.366] GdipGetImageHeight (image=0x6ccf880, height=0x69e2a8) returned 0x0 [0077.366] GetLastError () returned 0x0 [0077.366] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.366] GetLastError () returned 0x0 [0077.366] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c618 [0077.366] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c618 | out: encoders=0x93c618) returned 0x0 [0077.366] GetLastError () returned 0x0 [0077.366] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.366] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c794, Length=0x26 | out: Destination=0x8f39c0) [0077.366] lstrlenW (lpString="BMP") returned 3 [0077.366] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7ba, Length=0x8 | out: Destination=0x8f39c0) [0077.367] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.367] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7c2, Length=0x24 | out: Destination=0x8f39c0) [0077.367] lstrlenW (lpString="image/bmp") returned 9 [0077.367] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7e6, Length=0x14 | out: Destination=0x8f39c0) [0077.367] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.367] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7fe, Length=0x28 | out: Destination=0x8f39c0) [0077.367] lstrlenW (lpString="JPEG") returned 4 [0077.367] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c826, Length=0xa | out: Destination=0x8f39c0) [0077.367] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.367] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c830, Length=0x34 | out: Destination=0x8f39c0) [0077.367] lstrlenW (lpString="image/jpeg") returned 10 [0077.367] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c864, Length=0x16 | out: Destination=0x8f39c0) [0077.367] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.367] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c87e, Length=0x26 | out: Destination=0x8f39c0) [0077.367] lstrlenW (lpString="GIF") returned 3 [0077.367] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8a4, Length=0x8 | out: Destination=0x8f39c0) [0077.367] lstrlenW (lpString="*.GIF") returned 5 [0077.367] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ac, Length=0xc | out: Destination=0x8f39c0) [0077.367] lstrlenW (lpString="image/gif") returned 9 [0077.367] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8b8, Length=0x14 | out: Destination=0x8f39c0) [0077.367] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.368] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e4, Length=0x28 | out: Destination=0x8f39c0) [0077.368] lstrlenW (lpString="TIFF") returned 4 [0077.368] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c90c, Length=0xa | out: Destination=0x8f39c0) [0077.368] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.368] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c916, Length=0x1a | out: Destination=0x8f39c0) [0077.368] lstrlenW (lpString="image/tiff") returned 10 [0077.368] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c930, Length=0x16 | out: Destination=0x8f39c0) [0077.368] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.368] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c94e, Length=0x26 | out: Destination=0x8f39c0) [0077.368] lstrlenW (lpString="PNG") returned 3 [0077.368] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c974, Length=0x8 | out: Destination=0x8f39c0) [0077.368] lstrlenW (lpString="*.PNG") returned 5 [0077.368] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c97c, Length=0xc | out: Destination=0x8f39c0) [0077.368] lstrlenW (lpString="image/png") returned 9 [0077.368] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c988, Length=0x14 | out: Destination=0x8f39c0) [0077.368] LocalFree (hMem=0x93c618) returned 0x0 [0077.368] GetLastError () returned 0x0 [0077.369] GdipSaveImageToStream (image=0x6ccf880, stream=0x499f490, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.375] GetLastError () returned 0x0 [0077.375] GdipCreateBitmapFromStream (stream=0x499f470, bitmap=0x69e2b0) returned 0x0 [0077.375] GetLastError () returned 0x0 [0077.376] GdipImageForceValidation (image=0x6d1c020) returned 0x0 [0077.376] GetLastError () returned 0x0 [0077.376] GdipGetImageRawFormat (image=0x6d1c020, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.376] GetLastError () returned 0x0 [0077.376] GdipBitmapLockBits (bitmap=0x6d1c020, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2877758) returned 0x0 [0077.376] GetLastError () returned 0x0 [0077.376] GdipBitmapUnlockBits (bitmap=0x6d1c020, lockedBitmapData=0x2877758) returned 0x0 [0077.376] GetLastError () returned 0x0 [0077.376] GdipGetImageWidth (image=0x6cd0258, width=0x69e2a8) returned 0x0 [0077.376] GetLastError () returned 0x0 [0077.376] GdipGetImageHeight (image=0x6cd0258, height=0x69e2a8) returned 0x0 [0077.376] GetLastError () returned 0x0 [0077.376] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.376] GetLastError () returned 0x0 [0077.376] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c640 [0077.376] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c640 | out: encoders=0x93c640) returned 0x0 [0077.376] GetLastError () returned 0x0 [0077.376] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.376] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7bc, Length=0x26 | out: Destination=0x8f39c0) [0077.377] lstrlenW (lpString="BMP") returned 3 [0077.377] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7e2, Length=0x8 | out: Destination=0x8f39c0) [0077.377] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.377] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7ea, Length=0x24 | out: Destination=0x8f39c0) [0077.377] lstrlenW (lpString="image/bmp") returned 9 [0077.377] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c80e, Length=0x14 | out: Destination=0x8f39c0) [0077.377] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.377] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c826, Length=0x28 | out: Destination=0x8f39c0) [0077.377] lstrlenW (lpString="JPEG") returned 4 [0077.377] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c84e, Length=0xa | out: Destination=0x8f39c0) [0077.377] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.377] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c858, Length=0x34 | out: Destination=0x8f39c0) [0077.377] lstrlenW (lpString="image/jpeg") returned 10 [0077.377] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c88c, Length=0x16 | out: Destination=0x8f39c0) [0077.377] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.377] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8a6, Length=0x26 | out: Destination=0x8f39c0) [0077.377] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8cc, Length=0x8 | out: Destination=0x8f39c0) [0077.377] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8d4, Length=0xc | out: Destination=0x8f39c0) [0077.377] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8e0, Length=0x14 | out: Destination=0x8f39c0) [0077.377] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.378] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c90c, Length=0x28 | out: Destination=0x8f39c0) [0077.378] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c934, Length=0xa | out: Destination=0x8f39c0) [0077.378] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c93e, Length=0x1a | out: Destination=0x8f39c0) [0077.378] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c958, Length=0x16 | out: Destination=0x8f39c0) [0077.378] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.378] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c976, Length=0x26 | out: Destination=0x8f39c0) [0077.378] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c99c, Length=0x8 | out: Destination=0x8f39c0) [0077.378] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9a4, Length=0xc | out: Destination=0x8f39c0) [0077.378] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9b0, Length=0x14 | out: Destination=0x8f39c0) [0077.378] LocalFree (hMem=0x93c640) returned 0x0 [0077.378] GetLastError () returned 0x0 [0077.378] GdipSaveImageToStream (image=0x6cd0258, stream=0x499f450, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.386] GetLastError () returned 0x0 [0077.386] GdipCreateBitmapFromStream (stream=0x499f430, bitmap=0x69e2b0) returned 0x0 [0077.386] GetLastError () returned 0x0 [0077.387] GdipImageForceValidation (image=0x6d1c368) returned 0x0 [0077.387] GetLastError () returned 0x0 [0077.387] GdipGetImageRawFormat (image=0x6d1c368, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.387] GetLastError () returned 0x0 [0077.387] GdipBitmapLockBits (bitmap=0x6d1c368, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2880624) returned 0x0 [0077.387] GetLastError () returned 0x0 [0077.387] GdipBitmapUnlockBits (bitmap=0x6d1c368, lockedBitmapData=0x2880624) returned 0x0 [0077.387] GetLastError () returned 0x0 [0077.387] GdipGetImageWidth (image=0x6cd05a0, width=0x69e2a8) returned 0x0 [0077.387] GetLastError () returned 0x0 [0077.387] GdipGetImageHeight (image=0x6cd05a0, height=0x69e2a8) returned 0x0 [0077.387] GetLastError () returned 0x0 [0077.387] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.387] GetLastError () returned 0x0 [0077.387] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c668 [0077.387] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c668 | out: encoders=0x93c668) returned 0x0 [0077.387] GetLastError () returned 0x0 [0077.387] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.388] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c7e4, Length=0x26 | out: Destination=0x8f39c0) [0077.388] lstrlenW (lpString="BMP") returned 3 [0077.388] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c80a, Length=0x8 | out: Destination=0x8f39c0) [0077.388] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.388] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c812, Length=0x24 | out: Destination=0x8f39c0) [0077.388] lstrlenW (lpString="image/bmp") returned 9 [0077.388] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c836, Length=0x14 | out: Destination=0x8f39c0) [0077.388] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.388] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c84e, Length=0x28 | out: Destination=0x8f39c0) [0077.388] lstrlenW (lpString="JPEG") returned 4 [0077.388] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c876, Length=0xa | out: Destination=0x8f39c0) [0077.388] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.388] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c880, Length=0x34 | out: Destination=0x8f39c0) [0077.388] lstrlenW (lpString="image/jpeg") returned 10 [0077.388] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8b4, Length=0x16 | out: Destination=0x8f39c0) [0077.388] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.388] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8ce, Length=0x26 | out: Destination=0x8f39c0) [0077.388] lstrlenW (lpString="GIF") returned 3 [0077.388] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8f4, Length=0x8 | out: Destination=0x8f39c0) [0077.388] lstrlenW (lpString="*.GIF") returned 5 [0077.388] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8fc, Length=0xc | out: Destination=0x8f39c0) [0077.389] lstrlenW (lpString="image/gif") returned 9 [0077.389] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c908, Length=0x14 | out: Destination=0x8f39c0) [0077.389] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.389] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c934, Length=0x28 | out: Destination=0x8f39c0) [0077.389] lstrlenW (lpString="TIFF") returned 4 [0077.389] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c95c, Length=0xa | out: Destination=0x8f39c0) [0077.389] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.389] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c966, Length=0x1a | out: Destination=0x8f39c0) [0077.389] lstrlenW (lpString="image/tiff") returned 10 [0077.389] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c980, Length=0x16 | out: Destination=0x8f39c0) [0077.389] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.389] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c99e, Length=0x26 | out: Destination=0x8f39c0) [0077.389] lstrlenW (lpString="PNG") returned 3 [0077.389] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9c4, Length=0x8 | out: Destination=0x8f39c0) [0077.389] lstrlenW (lpString="*.PNG") returned 5 [0077.389] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9cc, Length=0xc | out: Destination=0x8f39c0) [0077.390] lstrlenW (lpString="image/png") returned 9 [0077.390] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9d8, Length=0x14 | out: Destination=0x8f39c0) [0077.390] LocalFree (hMem=0x93c668) returned 0x0 [0077.390] GetLastError () returned 0x0 [0077.390] GdipSaveImageToStream (image=0x6cd05a0, stream=0x499f410, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.396] GetLastError () returned 0x0 [0077.396] GdipCreateBitmapFromStream (stream=0x499f3f0, bitmap=0x69e2b0) returned 0x0 [0077.396] GetLastError () returned 0x0 [0077.397] GdipImageForceValidation (image=0x6d1cd40) returned 0x0 [0077.397] GetLastError () returned 0x0 [0077.397] GdipGetImageRawFormat (image=0x6d1cd40, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.397] GetLastError () returned 0x0 [0077.397] GdipBitmapLockBits (bitmap=0x6d1cd40, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x28894d8) returned 0x0 [0077.397] GetLastError () returned 0x0 [0077.397] GdipBitmapUnlockBits (bitmap=0x6d1cd40, lockedBitmapData=0x28894d8) returned 0x0 [0077.397] GetLastError () returned 0x0 [0077.397] GdipGetImageWidth (image=0x6cd1c98, width=0x69e2a8) returned 0x0 [0077.397] GetLastError () returned 0x0 [0077.397] GdipGetImageHeight (image=0x6cd1c98, height=0x69e2a8) returned 0x0 [0077.397] GetLastError () returned 0x0 [0077.397] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.397] GetLastError () returned 0x0 [0077.397] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c690 [0077.397] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c690 | out: encoders=0x93c690) returned 0x0 [0077.397] GetLastError () returned 0x0 [0077.397] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.397] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c80c, Length=0x26 | out: Destination=0x8f39c0) [0077.397] lstrlenW (lpString="BMP") returned 3 [0077.397] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c832, Length=0x8 | out: Destination=0x8f39c0) [0077.398] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.398] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83a, Length=0x24 | out: Destination=0x8f39c0) [0077.398] lstrlenW (lpString="image/bmp") returned 9 [0077.398] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c85e, Length=0x14 | out: Destination=0x8f39c0) [0077.398] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.398] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c876, Length=0x28 | out: Destination=0x8f39c0) [0077.398] lstrlenW (lpString="JPEG") returned 4 [0077.398] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c89e, Length=0xa | out: Destination=0x8f39c0) [0077.398] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.398] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8a8, Length=0x34 | out: Destination=0x8f39c0) [0077.398] lstrlenW (lpString="image/jpeg") returned 10 [0077.398] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8dc, Length=0x16 | out: Destination=0x8f39c0) [0077.398] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.398] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8f6, Length=0x26 | out: Destination=0x8f39c0) [0077.398] lstrlenW (lpString="GIF") returned 3 [0077.398] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c91c, Length=0x8 | out: Destination=0x8f39c0) [0077.398] lstrlenW (lpString="*.GIF") returned 5 [0077.398] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c924, Length=0xc | out: Destination=0x8f39c0) [0077.398] lstrlenW (lpString="image/gif") returned 9 [0077.398] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c930, Length=0x14 | out: Destination=0x8f39c0) [0077.398] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.399] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c95c, Length=0x28 | out: Destination=0x8f39c0) [0077.399] lstrlenW (lpString="TIFF") returned 4 [0077.399] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c984, Length=0xa | out: Destination=0x8f39c0) [0077.399] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.399] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c98e, Length=0x1a | out: Destination=0x8f39c0) [0077.399] lstrlenW (lpString="image/tiff") returned 10 [0077.399] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9a8, Length=0x16 | out: Destination=0x8f39c0) [0077.399] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.399] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9c6, Length=0x26 | out: Destination=0x8f39c0) [0077.399] lstrlenW (lpString="PNG") returned 3 [0077.399] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9ec, Length=0x8 | out: Destination=0x8f39c0) [0077.399] lstrlenW (lpString="*.PNG") returned 5 [0077.399] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9f4, Length=0xc | out: Destination=0x8f39c0) [0077.399] lstrlenW (lpString="image/png") returned 9 [0077.399] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93ca00, Length=0x14 | out: Destination=0x8f39c0) [0077.399] LocalFree (hMem=0x93c690) returned 0x0 [0077.399] GetLastError () returned 0x0 [0077.399] GdipSaveImageToStream (image=0x6cd1c98, stream=0x499f3d0, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.407] GetLastError () returned 0x0 [0077.407] GdipCreateBitmapFromStream (stream=0x499f3b0, bitmap=0x69e2b0) returned 0x0 [0077.407] GetLastError () returned 0x0 [0077.408] GdipImageForceValidation (image=0x6d19230) returned 0x0 [0077.408] GetLastError () returned 0x0 [0077.408] GdipGetImageRawFormat (image=0x6d19230, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.408] GetLastError () returned 0x0 [0077.408] GdipBitmapLockBits (bitmap=0x6d19230, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2892398) returned 0x0 [0077.408] GetLastError () returned 0x0 [0077.408] GdipBitmapUnlockBits (bitmap=0x6d19230, lockedBitmapData=0x2892398) returned 0x0 [0077.408] GetLastError () returned 0x0 [0077.408] GdipGetImageWidth (image=0x6cd08e8, width=0x69e2a8) returned 0x0 [0077.408] GetLastError () returned 0x0 [0077.408] GdipGetImageHeight (image=0x6cd08e8, height=0x69e2a8) returned 0x0 [0077.408] GetLastError () returned 0x0 [0077.408] GdipGetImageEncodersSize (numEncoders=0x69e258, size=0x69e254) returned 0x0 [0077.408] GetLastError () returned 0x0 [0077.408] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x93c690 [0077.408] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x93c690 | out: encoders=0x93c690) returned 0x0 [0077.408] GetLastError () returned 0x0 [0077.408] lstrlenW (lpString="Built-in BMP Codec") returned 18 [0077.409] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c80c, Length=0x26 | out: Destination=0x8f39c0) [0077.409] lstrlenW (lpString="BMP") returned 3 [0077.409] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c832, Length=0x8 | out: Destination=0x8f39c0) [0077.409] lstrlenW (lpString="*.BMP;*.DIB;*.RLE") returned 17 [0077.409] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c83a, Length=0x24 | out: Destination=0x8f39c0) [0077.409] lstrlenW (lpString="image/bmp") returned 9 [0077.409] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c85e, Length=0x14 | out: Destination=0x8f39c0) [0077.409] lstrlenW (lpString="Built-in JPEG Codec") returned 19 [0077.409] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c876, Length=0x28 | out: Destination=0x8f39c0) [0077.409] lstrlenW (lpString="JPEG") returned 4 [0077.409] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c89e, Length=0xa | out: Destination=0x8f39c0) [0077.409] lstrlenW (lpString="*.JPG;*.JPEG;*.JPE;*.JFIF") returned 25 [0077.409] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8a8, Length=0x34 | out: Destination=0x8f39c0) [0077.409] lstrlenW (lpString="image/jpeg") returned 10 [0077.409] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8dc, Length=0x16 | out: Destination=0x8f39c0) [0077.409] lstrlenW (lpString="Built-in GIF Codec") returned 18 [0077.409] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c8f6, Length=0x26 | out: Destination=0x8f39c0) [0077.409] lstrlenW (lpString="GIF") returned 3 [0077.409] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c91c, Length=0x8 | out: Destination=0x8f39c0) [0077.409] lstrlenW (lpString="*.GIF") returned 5 [0077.409] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c924, Length=0xc | out: Destination=0x8f39c0) [0077.409] lstrlenW (lpString="image/gif") returned 9 [0077.410] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c930, Length=0x14 | out: Destination=0x8f39c0) [0077.410] lstrlenW (lpString="Built-in TIFF Codec") returned 19 [0077.410] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c95c, Length=0x28 | out: Destination=0x8f39c0) [0077.410] lstrlenW (lpString="TIFF") returned 4 [0077.410] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c984, Length=0xa | out: Destination=0x8f39c0) [0077.410] lstrlenW (lpString="*.TIF;*.TIFF") returned 12 [0077.410] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c98e, Length=0x1a | out: Destination=0x8f39c0) [0077.410] lstrlenW (lpString="image/tiff") returned 10 [0077.410] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9a8, Length=0x16 | out: Destination=0x8f39c0) [0077.410] lstrlenW (lpString="Built-in PNG Codec") returned 18 [0077.410] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9c6, Length=0x26 | out: Destination=0x8f39c0) [0077.410] lstrlenW (lpString="PNG") returned 3 [0077.410] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9ec, Length=0x8 | out: Destination=0x8f39c0) [0077.410] lstrlenW (lpString="*.PNG") returned 5 [0077.410] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93c9f4, Length=0xc | out: Destination=0x8f39c0) [0077.410] lstrlenW (lpString="image/png") returned 9 [0077.410] RtlMoveMemory (in: Destination=0x8f39c0, Source=0x93ca00, Length=0x14 | out: Destination=0x8f39c0) [0077.410] LocalFree (hMem=0x93c690) returned 0x0 [0077.410] GetLastError () returned 0x0 [0077.411] GdipSaveImageToStream (image=0x6cd08e8, stream=0x499f390, clsidEncoder=0x69e26c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0077.416] GetLastError () returned 0x0 [0077.417] GdipCreateBitmapFromStream (stream=0x499f370, bitmap=0x69e2b0) returned 0x0 [0077.417] GetLastError () returned 0x0 [0077.417] GdipImageForceValidation (image=0x6d19c08) returned 0x0 [0077.418] GetLastError () returned 0x0 [0077.418] GdipGetImageRawFormat (image=0x6d19c08, format=0x69e218*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0077.418] GetLastError () returned 0x0 [0077.418] GdipBitmapLockBits (bitmap=0x6d19c08, rect=0x69e264, flags=0x1, format=0x21808, lockedBitmapData=0x2898624) returned 0x0 [0077.418] GetLastError () returned 0x0 [0077.418] GdipBitmapUnlockBits (bitmap=0x6d19c08, lockedBitmapData=0x2898624) returned 0x0 [0077.418] GetLastError () returned 0x0 [0079.377] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x91f2b0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0079.377] GetLastError () returned 0x3f0 [0084.529] SHGetFolderPathW (in: hwnd=0x0, csidl=7, hToken=0x0, dwFlags=0x0, pszPath=0x91f2b0 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x0 [0084.529] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", nBufferLength=0x105, lpBuffer=0x69ddd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpFilePart=0x0) returned 0x53 [0084.529] GetLastError () returned 0x3f0 [0084.529] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x69de40, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0084.529] GetLastError () returned 0x3f0 [0084.529] SetErrorMode (uMode=0x1) returned 0x0 [0084.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe"), fInfoLevelId=0x0, lpFileInformation=0x69e2c0 | out: lpFileInformation=0x69e2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53812b5d, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x53812b5d, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0xd2509a00, ftLastWriteTime.dwHighDateTime=0x1d3cb56, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0084.530] GetLastError () returned 0x3f0 [0084.530] SetErrorMode (uMode=0x0) returned 0x1 [0089.627] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x3, phkResult=0x69e28c | out: phkResult=0x69e28c*=0x35c) returned 0x0 [0089.627] RegQueryValueExW (in: hKey=0x35c, lpValueName="dttrgsdcd", lpReserved=0x0, lpType=0x69e2e0, lpData=0x0, lpcbData=0x69e2dc*=0x0 | out: lpType=0x69e2e0*=0x0, lpData=0x0, lpcbData=0x69e2dc*=0x0) returned 0x2 [0089.628] RegQueryValueExW (in: hKey=0x35c, lpValueName="dttrgsdcd", lpReserved=0x0, lpType=0x69e2a4, lpData=0x0, lpcbData=0x69e2a0*=0x0 | out: lpType=0x69e2a4*=0x0, lpData=0x0, lpcbData=0x69e2a0*=0x0) returned 0x2 [0089.663] GetCurrentProcessId () returned 0xe98 [0089.663] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x354 [0089.663] GetLastError () returned 0x3f0 [0089.663] EnumProcessModules (in: hProcess=0x354, lphModule=0x28efd38, cb=0x100, lpcbNeeded=0x69da90 | out: lphModule=0x28efd38, lpcbNeeded=0x69da90) returned 1 [0089.664] GetLastError () returned 0x3f0 [0089.664] GetModuleInformation (in: hProcess=0x354, hModule=0x410000, lpmodinfo=0x28efe78, cb=0xc | out: lpmodinfo=0x28efe78*(lpBaseOfDll=0x410000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0089.664] GetLastError () returned 0x3f0 [0089.664] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x410000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="vfggggg.exe") returned 0xb [0089.664] GetLastError () returned 0x3f0 [0089.664] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x410000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0x31 [0089.664] GetLastError () returned 0x3f0 [0089.664] GetModuleInformation (in: hProcess=0x354, hModule=0x77c40000, lpmodinfo=0x28f0fb8, cb=0xc | out: lpmodinfo=0x28f0fb8*(lpBaseOfDll=0x77c40000, SizeOfImage=0x179000, EntryPoint=0x0)) returned 1 [0089.664] GetLastError () returned 0x3f0 [0089.664] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0089.665] GetLastError () returned 0x3f0 [0089.665] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")) returned 0x1d [0089.665] GetLastError () returned 0x3f0 [0089.665] GetModuleInformation (in: hProcess=0x354, hModule=0x73f90000, lpmodinfo=0x28f20ac, cb=0xc | out: lpmodinfo=0x28f20ac*(lpBaseOfDll=0x73f90000, SizeOfImage=0x59000, EntryPoint=0x73fa0780)) returned 1 [0089.665] GetLastError () returned 0x3f0 [0089.665] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x73f90000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0089.665] GetLastError () returned 0x3f0 [0089.665] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x73f90000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0089.665] GetLastError () returned 0x3f0 [0089.665] GetModuleInformation (in: hProcess=0x354, hModule=0x77670000, lpmodinfo=0x28f31a8, cb=0xc | out: lpmodinfo=0x28f31a8*(lpBaseOfDll=0x77670000, SizeOfImage=0xf0000, EntryPoint=0x776837d0)) returned 1 [0089.665] GetLastError () returned 0x3f0 [0089.666] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77670000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0089.666] GetLastError () returned 0x3f0 [0089.666] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77670000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNEL32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")) returned 0x20 [0089.666] GetLastError () returned 0x3f0 [0089.666] GetModuleInformation (in: hProcess=0x354, hModule=0x76970000, lpmodinfo=0x28f42ac, cb=0xc | out: lpmodinfo=0x28f42ac*(lpBaseOfDll=0x76970000, SizeOfImage=0x176000, EntryPoint=0x76a0c9a0)) returned 1 [0089.666] GetLastError () returned 0x3f0 [0089.666] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x76970000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0089.666] GetLastError () returned 0x3f0 [0089.666] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x76970000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNELBASE.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")) returned 0x22 [0089.666] GetLastError () returned 0x3f0 [0089.667] GetModuleInformation (in: hProcess=0x354, hModule=0x74c40000, lpmodinfo=0x28f53e8, cb=0xc | out: lpmodinfo=0x28f53e8*(lpBaseOfDll=0x74c40000, SizeOfImage=0x91000, EntryPoint=0x74c80ab0)) returned 1 [0089.667] GetLastError () returned 0x3f0 [0089.667] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="apphelp.dll") returned 0xb [0089.667] GetLastError () returned 0x3f0 [0089.667] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")) returned 0x1f [0089.667] GetLastError () returned 0x3f0 [0089.667] GetModuleInformation (in: hProcess=0x354, hModule=0x77990000, lpmodinfo=0x28f64e4, cb=0xc | out: lpmodinfo=0x28f64e4*(lpBaseOfDll=0x77990000, SizeOfImage=0x7b000, EntryPoint=0x779ae3b0)) returned 1 [0089.667] GetLastError () returned 0x3f0 [0089.667] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77990000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0089.668] GetLastError () returned 0x3f0 [0089.668] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77990000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ADVAPI32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")) returned 0x20 [0089.668] GetLastError () returned 0x3f0 [0089.668] GetModuleInformation (in: hProcess=0x354, hModule=0x77a10000, lpmodinfo=0x28f75e8, cb=0xc | out: lpmodinfo=0x28f75e8*(lpBaseOfDll=0x77a10000, SizeOfImage=0xbe000, EntryPoint=0x77a45630)) returned 1 [0089.668] GetLastError () returned 0x3f0 [0089.668] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77a10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0089.668] GetLastError () returned 0x3f0 [0089.668] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77a10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")) returned 0x1e [0089.668] GetLastError () returned 0x3f0 [0089.669] GetModuleInformation (in: hProcess=0x354, hModule=0x77250000, lpmodinfo=0x28f86e4, cb=0xc | out: lpmodinfo=0x28f86e4*(lpBaseOfDll=0x77250000, SizeOfImage=0x43000, EntryPoint=0x7725f570)) returned 1 [0089.669] GetLastError () returned 0x3f0 [0089.669] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77250000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0089.669] GetLastError () returned 0x3f0 [0089.669] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77250000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")) returned 0x1f [0089.669] GetLastError () returned 0x3f0 [0089.669] GetModuleInformation (in: hProcess=0x354, hModule=0x77af0000, lpmodinfo=0x28f9830, cb=0xc | out: lpmodinfo=0x28f9830*(lpBaseOfDll=0x77af0000, SizeOfImage=0xac000, EntryPoint=0x77b236b0)) returned 1 [0089.669] GetLastError () returned 0x3f0 [0089.670] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77af0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0089.670] GetLastError () returned 0x3f0 [0089.670] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77af0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\RPCRT4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")) returned 0x1e [0089.670] GetLastError () returned 0x3f0 [0089.670] GetModuleInformation (in: hProcess=0x354, hModule=0x74d50000, lpmodinfo=0x28fa92c, cb=0xc | out: lpmodinfo=0x28fa92c*(lpBaseOfDll=0x74d50000, SizeOfImage=0x1e000, EntryPoint=0x74d5b640)) returned 1 [0089.670] GetLastError () returned 0x3f0 [0089.670] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74d50000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0089.671] GetLastError () returned 0x3f0 [0089.671] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74d50000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SspiCli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")) returned 0x1f [0089.671] GetLastError () returned 0x3f0 [0089.671] GetModuleInformation (in: hProcess=0x354, hModule=0x74d40000, lpmodinfo=0x28fba28, cb=0xc | out: lpmodinfo=0x28fba28*(lpBaseOfDll=0x74d40000, SizeOfImage=0xa000, EntryPoint=0x74d42aa0)) returned 1 [0089.671] GetLastError () returned 0x3f0 [0089.671] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74d40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0089.671] GetLastError () returned 0x3f0 [0089.672] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74d40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTBASE.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")) returned 0x21 [0089.672] GetLastError () returned 0x3f0 [0089.672] GetModuleInformation (in: hProcess=0x354, hModule=0x74ce0000, lpmodinfo=0x28fcb2c, cb=0xc | out: lpmodinfo=0x28fcb2c*(lpBaseOfDll=0x74ce0000, SizeOfImage=0x59000, EntryPoint=0x74d18cc0)) returned 1 [0089.672] GetLastError () returned 0x3f0 [0089.672] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74ce0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcryptPrimitives.dll") returned 0x14 [0089.672] GetLastError () returned 0x3f0 [0089.673] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74ce0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")) returned 0x28 [0089.673] GetLastError () returned 0x3f0 [0089.673] GetModuleInformation (in: hProcess=0x354, hModule=0x73f10000, lpmodinfo=0x28fdc50, cb=0xc | out: lpmodinfo=0x28fdc50*(lpBaseOfDll=0x73f10000, SizeOfImage=0x78000, EntryPoint=0x73f11000)) returned 1 [0089.673] GetLastError () returned 0x3f0 [0089.673] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x73f10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0089.674] GetLastError () returned 0x3f0 [0089.674] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x73f10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0089.674] GetLastError () returned 0x3f0 [0089.674] GetModuleInformation (in: hProcess=0x354, hModule=0x75080000, lpmodinfo=0x28fed88, cb=0xc | out: lpmodinfo=0x28fed88*(lpBaseOfDll=0x75080000, SizeOfImage=0x44000, EntryPoint=0x7509d810)) returned 1 [0089.674] GetLastError () returned 0x3f0 [0089.674] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x75080000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0089.674] GetLastError () returned 0x3f0 [0089.675] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x75080000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SHLWAPI.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")) returned 0x1f [0089.675] GetLastError () returned 0x3f0 [0089.675] GetModuleInformation (in: hProcess=0x354, hModule=0x77090000, lpmodinfo=0x28ffe84, cb=0xc | out: lpmodinfo=0x28ffe84*(lpBaseOfDll=0x77090000, SizeOfImage=0x1ba000, EntryPoint=0x7716cbb0)) returned 1 [0089.675] GetLastError () returned 0x3f0 [0089.675] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77090000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="combase.dll") returned 0xb [0089.675] GetLastError () returned 0x3f0 [0089.675] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77090000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")) returned 0x1f [0089.676] GetLastError () returned 0x3f0 [0089.676] GetModuleInformation (in: hProcess=0x354, hModule=0x76ca0000, lpmodinfo=0x2900f80, cb=0xc | out: lpmodinfo=0x2900f80*(lpBaseOfDll=0x76ca0000, SizeOfImage=0x14d000, EntryPoint=0x76d525d0)) returned 1 [0089.676] GetLastError () returned 0x3f0 [0089.676] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x76ca0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0089.677] GetLastError () returned 0x3f0 [0089.677] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x76ca0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\GDI32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")) returned 0x1d [0089.677] GetLastError () returned 0x3f0 [0089.677] GetModuleInformation (in: hProcess=0x354, hModule=0x74d70000, lpmodinfo=0x2902104, cb=0xc | out: lpmodinfo=0x2902104*(lpBaseOfDll=0x74d70000, SizeOfImage=0x140000, EntryPoint=0x74d80280)) returned 1 [0089.678] GetLastError () returned 0x3f0 [0089.678] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74d70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0089.678] GetLastError () returned 0x3f0 [0089.678] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74d70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\USER32.dll" (normalized: "c:\\windows\\system32\\user32.dll")) returned 0x1e [0089.678] GetLastError () returned 0x3f0 [0089.678] GetModuleInformation (in: hProcess=0x354, hModule=0x775e0000, lpmodinfo=0x2903200, cb=0xc | out: lpmodinfo=0x2903200*(lpBaseOfDll=0x775e0000, SizeOfImage=0x2b000, EntryPoint=0x775e52b0)) returned 1 [0089.679] GetLastError () returned 0x3f0 [0089.679] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x775e0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0089.679] GetLastError () returned 0x3f0 [0089.679] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x775e0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0089.679] GetLastError () returned 0x3f0 [0089.679] GetModuleInformation (in: hProcess=0x354, hModule=0x76f70000, lpmodinfo=0x29042f4, cb=0xc | out: lpmodinfo=0x29042f4*(lpBaseOfDll=0x76f70000, SizeOfImage=0x120000, EntryPoint=0x76fb46e0)) returned 1 [0089.680] GetLastError () returned 0x3f0 [0089.680] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x76f70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0089.680] GetLastError () returned 0x3f0 [0089.680] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x76f70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCTF.dll" (normalized: "c:\\windows\\system32\\msctf.dll")) returned 0x1d [0089.680] GetLastError () returned 0x3f0 [0089.680] GetModuleInformation (in: hProcess=0x354, hModule=0x76f60000, lpmodinfo=0x29053e8, cb=0xc | out: lpmodinfo=0x29053e8*(lpBaseOfDll=0x76f60000, SizeOfImage=0xc000, EntryPoint=0x76f63920)) returned 1 [0089.681] GetLastError () returned 0x3f0 [0089.681] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x76f60000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="kernel.appcore.dll") returned 0x12 [0089.681] GetLastError () returned 0x3f0 [0089.681] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x76f60000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")) returned 0x26 [0089.681] GetLastError () returned 0x3f0 [0089.682] GetModuleInformation (in: hProcess=0x354, hModule=0x73f00000, lpmodinfo=0x2906504, cb=0xc | out: lpmodinfo=0x2906504*(lpBaseOfDll=0x73f00000, SizeOfImage=0x8000, EntryPoint=0x73f017c0)) returned 1 [0089.682] GetLastError () returned 0x3f0 [0089.682] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x73f00000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0089.682] GetLastError () returned 0x3f0 [0089.682] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x73f00000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0089.683] GetLastError () returned 0x3f0 [0089.683] GetModuleInformation (in: hProcess=0x354, hModule=0x73950000, lpmodinfo=0x2907600, cb=0xc | out: lpmodinfo=0x2907600*(lpBaseOfDll=0x73950000, SizeOfImage=0x5b0000, EntryPoint=0x7399a848)) returned 1 [0089.683] GetLastError () returned 0x3f0 [0089.683] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x73950000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorwks.dll") returned 0xc [0089.683] GetLastError () returned 0x3f0 [0089.683] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x73950000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll")) returned 0x3a [0089.684] GetLastError () returned 0x3f0 [0089.684] GetModuleInformation (in: hProcess=0x354, hModule=0x738b0000, lpmodinfo=0x2908738, cb=0xc | out: lpmodinfo=0x2908738*(lpBaseOfDll=0x738b0000, SizeOfImage=0x9b000, EntryPoint=0x738b232b)) returned 1 [0089.684] GetLastError () returned 0x3f0 [0089.684] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x738b0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSVCR80.dll") returned 0xb [0089.685] GetLastError () returned 0x3f0 [0089.685] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x738b0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\MSVCR80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\msvcr80.dll")) returned 0x6a [0089.685] GetLastError () returned 0x3f0 [0089.685] GetModuleInformation (in: hProcess=0x354, hModule=0x755b0000, lpmodinfo=0x29098cc, cb=0xc | out: lpmodinfo=0x29098cc*(lpBaseOfDll=0x755b0000, SizeOfImage=0x13bf000, EntryPoint=0x75769ea0)) returned 1 [0089.686] GetLastError () returned 0x3f0 [0089.686] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x755b0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shell32.dll") returned 0xb [0089.686] GetLastError () returned 0x3f0 [0089.686] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x755b0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")) returned 0x1f [0089.687] GetLastError () returned 0x3f0 [0089.687] GetModuleInformation (in: hProcess=0x354, hModule=0x750d0000, lpmodinfo=0x290a9c8, cb=0xc | out: lpmodinfo=0x290a9c8*(lpBaseOfDll=0x750d0000, SizeOfImage=0x4dd000, EntryPoint=0x752c7460)) returned 1 [0089.687] GetLastError () returned 0x3f0 [0089.687] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x750d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="windows.storage.dll") returned 0x13 [0089.688] GetLastError () returned 0x3f0 [0089.688] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x750d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")) returned 0x27 [0089.688] GetLastError () returned 0x3f0 [0089.688] GetModuleInformation (in: hProcess=0x354, hModule=0x778a0000, lpmodinfo=0x290bae4, cb=0xc | out: lpmodinfo=0x290bae4*(lpBaseOfDll=0x778a0000, SizeOfImage=0x8d000, EntryPoint=0x778e91a0)) returned 1 [0089.689] GetLastError () returned 0x3f0 [0089.689] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x778a0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shcore.dll") returned 0xa [0089.689] GetLastError () returned 0x3f0 [0089.689] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x778a0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shcore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")) returned 0x1e [0089.689] GetLastError () returned 0x3f0 [0089.690] GetModuleInformation (in: hProcess=0x354, hModule=0x777f0000, lpmodinfo=0x290cbe0, cb=0xc | out: lpmodinfo=0x290cbe0*(lpBaseOfDll=0x777f0000, SizeOfImage=0x44000, EntryPoint=0x777f7280)) returned 1 [0089.690] GetLastError () returned 0x3f0 [0089.690] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x777f0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="powrprof.dll") returned 0xc [0089.690] GetLastError () returned 0x3f0 [0089.690] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x777f0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")) returned 0x20 [0089.691] GetLastError () returned 0x3f0 [0089.691] GetModuleInformation (in: hProcess=0x354, hModule=0x75070000, lpmodinfo=0x290dce4, cb=0xc | out: lpmodinfo=0x290dce4*(lpBaseOfDll=0x75070000, SizeOfImage=0xf000, EntryPoint=0x75072e40)) returned 1 [0089.691] GetLastError () returned 0x3f0 [0089.691] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x75070000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="profapi.dll") returned 0xb [0089.692] GetLastError () returned 0x3f0 [0089.693] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x75070000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")) returned 0x1f [0089.693] GetLastError () returned 0x3f0 [0089.693] GetModuleInformation (in: hProcess=0x354, hModule=0x72db0000, lpmodinfo=0x290ede0, cb=0xc | out: lpmodinfo=0x290ede0*(lpBaseOfDll=0x72db0000, SizeOfImage=0xafa000, EntryPoint=0x0)) returned 1 [0089.694] GetLastError () returned 0x3f0 [0089.694] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x72db0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0089.694] GetLastError () returned 0x3f0 [0089.694] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x72db0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll")) returned 0x68 [0089.695] GetLastError () returned 0x3f0 [0089.695] GetModuleInformation (in: hProcess=0x354, hModule=0x77430000, lpmodinfo=0x290ff78, cb=0xc | out: lpmodinfo=0x290ff78*(lpBaseOfDll=0x77430000, SizeOfImage=0xea000, EntryPoint=0x7746b990)) returned 1 [0089.695] GetLastError () returned 0x3f0 [0089.695] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77430000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0089.696] GetLastError () returned 0x3f0 [0089.696] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77430000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")) returned 0x1d [0089.696] GetLastError () returned 0x3f0 [0089.696] GetModuleInformation (in: hProcess=0x354, hModule=0x74ab0000, lpmodinfo=0x291106c, cb=0xc | out: lpmodinfo=0x291106c*(lpBaseOfDll=0x74ab0000, SizeOfImage=0x5b000, EntryPoint=0x74af8ff8)) returned 1 [0089.697] GetLastError () returned 0x3f0 [0089.697] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74ab0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorjit.dll") returned 0xc [0089.697] GetLastError () returned 0x3f0 [0089.697] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74ab0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll")) returned 0x3a [0089.698] GetLastError () returned 0x3f0 [0089.698] GetModuleInformation (in: hProcess=0x354, hModule=0x74060000, lpmodinfo=0x29121a4, cb=0xc | out: lpmodinfo=0x29121a4*(lpBaseOfDll=0x74060000, SizeOfImage=0x7a3000, EntryPoint=0x0)) returned 1 [0089.698] GetLastError () returned 0x3f0 [0089.698] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74060000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0089.699] GetLastError () returned 0x3f0 [0089.699] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74060000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\b0de8183f9e33cd0fbe10c8db1402653\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\b0de8183f9e33cd0fbe10c8db1402653\\system.ni.dll")) returned 0x64 [0089.699] GetLastError () returned 0x3f0 [0089.699] GetModuleInformation (in: hProcess=0x354, hModule=0x74920000, lpmodinfo=0x2913440, cb=0xc | out: lpmodinfo=0x2913440*(lpBaseOfDll=0x74920000, SizeOfImage=0x189000, EntryPoint=0x0)) returned 1 [0089.700] GetLastError () returned 0x3f0 [0089.700] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74920000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0089.700] GetLastError () returned 0x3f0 [0089.700] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74920000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\cebfffe6cee14413d504056227f496b2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\cebfffe6cee14413d504056227f496b2\\system.drawing.ni.dll")) returned 0x74 [0089.701] GetLastError () returned 0x3f0 [0089.701] GetModuleInformation (in: hProcess=0x354, hModule=0x721d0000, lpmodinfo=0x29145fc, cb=0xc | out: lpmodinfo=0x29145fc*(lpBaseOfDll=0x721d0000, SizeOfImage=0xbe0000, EntryPoint=0x0)) returned 1 [0089.701] GetLastError () returned 0x3f0 [0089.701] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x721d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0089.702] GetLastError () returned 0x3f0 [0089.702] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x721d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\e3f653c6d321c4c528daa164908e0ff8\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\e3f653c6d321c4c528daa164908e0ff8\\system.windows.forms.ni.dll")) returned 0x80 [0089.702] GetLastError () returned 0x3f0 [0089.702] GetModuleInformation (in: hProcess=0x354, hModule=0x74bc0000, lpmodinfo=0x29157dc, cb=0xc | out: lpmodinfo=0x29157dc*(lpBaseOfDll=0x74bc0000, SizeOfImage=0x75000, EntryPoint=0x74bf98d0)) returned 1 [0089.703] GetLastError () returned 0x3f0 [0089.703] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74bc0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0089.703] GetLastError () returned 0x3f0 [0089.703] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74bc0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0089.704] GetLastError () returned 0x3f0 [0089.704] GetModuleInformation (in: hProcess=0x354, hModule=0x74ba0000, lpmodinfo=0x29168d8, cb=0xc | out: lpmodinfo=0x29168d8*(lpBaseOfDll=0x74ba0000, SizeOfImage=0x1d000, EntryPoint=0x74ba3bb0)) returned 1 [0089.704] GetLastError () returned 0x3f0 [0089.705] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74ba0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="dwmapi.dll") returned 0xa [0089.705] GetLastError () returned 0x3f0 [0089.705] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74ba0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")) returned 0x1e [0089.706] GetLastError () returned 0x3f0 [0089.706] GetModuleInformation (in: hProcess=0x354, hModule=0x72060000, lpmodinfo=0x29179d4, cb=0xc | out: lpmodinfo=0x29179d4*(lpBaseOfDll=0x72060000, SizeOfImage=0x16b000, EntryPoint=0x720ce360)) returned 1 [0089.706] GetLastError () returned 0x3f0 [0089.706] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x72060000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="gdiplus.dll") returned 0xb [0089.707] GetLastError () returned 0x3f0 [0089.707] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x72060000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll")) returned 0x72 [0089.707] GetLastError () returned 0x3f0 [0089.707] GetModuleInformation (in: hProcess=0x354, hModule=0x71e70000, lpmodinfo=0x2918b78, cb=0xc | out: lpmodinfo=0x2918b78*(lpBaseOfDll=0x71e70000, SizeOfImage=0x1f0000, EntryPoint=0x71f569e0)) returned 1 [0089.708] GetLastError () returned 0x3f0 [0089.708] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x71e70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="DWrite.dll") returned 0xa [0089.708] GetLastError () returned 0x3f0 [0089.709] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x71e70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll")) returned 0x1e [0089.709] GetLastError () returned 0x3f0 [0089.709] GetModuleInformation (in: hProcess=0x354, hModule=0x71c30000, lpmodinfo=0x2919c74, cb=0xc | out: lpmodinfo=0x2919c74*(lpBaseOfDll=0x71c30000, SizeOfImage=0x236000, EntryPoint=0x0)) returned 1 [0089.710] GetLastError () returned 0x3f0 [0089.710] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x71c30000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0089.710] GetLastError () returned 0x3f0 [0089.710] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x71c30000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\40661cdfbf2201f3d6c5cf6378755082\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\40661cdfbf2201f3d6c5cf6378755082\\system.core.ni.dll")) returned 0x6e [0089.711] GetLastError () returned 0x3f0 [0089.711] GetModuleInformation (in: hProcess=0x354, hModule=0x74b80000, lpmodinfo=0x291ae20, cb=0xc | out: lpmodinfo=0x291ae20*(lpBaseOfDll=0x74b80000, SizeOfImage=0x13000, EntryPoint=0x74b89500)) returned 1 [0089.711] GetLastError () returned 0x3f0 [0089.711] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74b80000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0089.712] GetLastError () returned 0x3f0 [0089.712] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74b80000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0089.713] GetLastError () returned 0x3f0 [0089.713] GetModuleInformation (in: hProcess=0x354, hModule=0x74b60000, lpmodinfo=0x291bf1c, cb=0xc | out: lpmodinfo=0x291bf1c*(lpBaseOfDll=0x74b60000, SizeOfImage=0x1b000, EntryPoint=0x74b69010)) returned 1 [0089.713] GetLastError () returned 0x3f0 [0089.713] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74b60000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcrypt.dll") returned 0xa [0089.714] GetLastError () returned 0x3f0 [0089.714] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74b60000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")) returned 0x1e [0089.714] GetLastError () returned 0x3f0 [0089.714] GetModuleInformation (in: hProcess=0x354, hModule=0x74b30000, lpmodinfo=0x291d018, cb=0xc | out: lpmodinfo=0x291d018*(lpBaseOfDll=0x74b30000, SizeOfImage=0x2f000, EntryPoint=0x74b49530)) returned 1 [0089.715] GetLastError () returned 0x3f0 [0089.715] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74b30000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0089.716] GetLastError () returned 0x3f0 [0089.716] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74b30000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0089.716] GetLastError () returned 0x3f0 [0089.716] GetModuleInformation (in: hProcess=0x354, hModule=0x773d0000, lpmodinfo=0x291e114, cb=0xc | out: lpmodinfo=0x291e114*(lpBaseOfDll=0x773d0000, SizeOfImage=0x6000, EntryPoint=0x773d1480)) returned 1 [0089.717] GetLastError () returned 0x3f0 [0089.717] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x773d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0089.717] GetLastError () returned 0x3f0 [0089.717] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x773d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")) returned 0x1d [0089.718] GetLastError () returned 0x3f0 [0089.718] GetModuleInformation (in: hProcess=0x354, hModule=0x71ab0000, lpmodinfo=0x291f208, cb=0xc | out: lpmodinfo=0x291f208*(lpBaseOfDll=0x71ab0000, SizeOfImage=0x171000, EntryPoint=0x71b5d650)) returned 1 [0089.718] GetLastError () returned 0x3f0 [0089.719] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x71ab0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="WindowsCodecs.dll") returned 0x11 [0089.719] GetLastError () returned 0x3f0 [0089.719] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x71ab0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")) returned 0x25 [0089.720] GetLastError () returned 0x3f0 [0089.720] GetModuleInformation (in: hProcess=0x354, hModule=0x77ba0000, lpmodinfo=0x292031c, cb=0xc | out: lpmodinfo=0x292031c*(lpBaseOfDll=0x77ba0000, SizeOfImage=0x92000, EntryPoint=0x77bd44d0)) returned 1 [0089.720] GetLastError () returned 0x3f0 [0089.720] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77ba0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0089.721] GetLastError () returned 0x3f0 [0089.721] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77ba0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\OLEAUT32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")) returned 0x20 [0089.722] GetLastError () returned 0x3f0 [0089.722] GetModuleInformation (in: hProcess=0x354, hModule=0x74b20000, lpmodinfo=0x2921420, cb=0xc | out: lpmodinfo=0x2921420*(lpBaseOfDll=0x74b20000, SizeOfImage=0x6000, EntryPoint=0x74b21570)) returned 1 [0089.722] GetLastError () returned 0x3f0 [0089.722] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74b20000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shfolder.dll") returned 0xc [0089.723] GetLastError () returned 0x3f0 [0089.723] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74b20000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll")) returned 0x20 [0089.724] GetLastError () returned 0x3f0 [0089.724] CloseHandle (hObject=0x354) returned 1 [0089.724] GetLastError () returned 0x3f0 [0089.779] GetProcAddress (hModule=0x77670000, lpProcName="CreateProcessW") returned 0x7768a510 [0089.779] GetLastError () returned 0x3f0 [0089.787] GetCurrentProcessId () returned 0xe98 [0089.787] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x354 [0089.787] GetLastError () returned 0x3f0 [0089.787] EnumProcessModules (in: hProcess=0x354, lphModule=0x297db70, cb=0x100, lpcbNeeded=0x69da90 | out: lphModule=0x297db70, lpcbNeeded=0x69da90) returned 1 [0089.788] GetLastError () returned 0x3f0 [0089.788] GetModuleInformation (in: hProcess=0x354, hModule=0x410000, lpmodinfo=0x297dcb0, cb=0xc | out: lpmodinfo=0x297dcb0*(lpBaseOfDll=0x410000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0089.788] GetLastError () returned 0x3f0 [0089.788] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x410000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="vfggggg.exe") returned 0xb [0089.788] GetLastError () returned 0x3f0 [0089.788] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x410000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0x31 [0089.788] GetLastError () returned 0x3f0 [0089.788] GetModuleInformation (in: hProcess=0x354, hModule=0x77c40000, lpmodinfo=0x297edf0, cb=0xc | out: lpmodinfo=0x297edf0*(lpBaseOfDll=0x77c40000, SizeOfImage=0x179000, EntryPoint=0x0)) returned 1 [0089.789] GetLastError () returned 0x3f0 [0089.789] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0089.789] GetLastError () returned 0x3f0 [0089.789] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")) returned 0x1d [0089.789] GetLastError () returned 0x3f0 [0089.789] GetModuleInformation (in: hProcess=0x354, hModule=0x73f90000, lpmodinfo=0x297fee4, cb=0xc | out: lpmodinfo=0x297fee4*(lpBaseOfDll=0x73f90000, SizeOfImage=0x59000, EntryPoint=0x73fa0780)) returned 1 [0089.789] GetLastError () returned 0x3f0 [0089.789] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x73f90000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0089.789] GetLastError () returned 0x3f0 [0089.789] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x73f90000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0089.790] GetLastError () returned 0x3f0 [0089.790] GetModuleInformation (in: hProcess=0x354, hModule=0x77670000, lpmodinfo=0x2980fe0, cb=0xc | out: lpmodinfo=0x2980fe0*(lpBaseOfDll=0x77670000, SizeOfImage=0xf0000, EntryPoint=0x776837d0)) returned 1 [0089.790] GetLastError () returned 0x3f0 [0089.790] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77670000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0089.790] GetLastError () returned 0x3f0 [0089.790] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77670000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNEL32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")) returned 0x20 [0089.790] GetLastError () returned 0x3f0 [0089.790] GetModuleInformation (in: hProcess=0x354, hModule=0x76970000, lpmodinfo=0x29820e4, cb=0xc | out: lpmodinfo=0x29820e4*(lpBaseOfDll=0x76970000, SizeOfImage=0x176000, EntryPoint=0x76a0c9a0)) returned 1 [0089.791] GetLastError () returned 0x3f0 [0089.791] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x76970000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0089.791] GetLastError () returned 0x3f0 [0089.791] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x76970000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNELBASE.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")) returned 0x22 [0089.791] GetLastError () returned 0x3f0 [0089.791] GetModuleInformation (in: hProcess=0x354, hModule=0x74c40000, lpmodinfo=0x2983220, cb=0xc | out: lpmodinfo=0x2983220*(lpBaseOfDll=0x74c40000, SizeOfImage=0x91000, EntryPoint=0x74c80ab0)) returned 1 [0089.791] GetLastError () returned 0x3f0 [0089.791] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="apphelp.dll") returned 0xb [0089.792] GetLastError () returned 0x3f0 [0089.792] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")) returned 0x1f [0089.792] GetLastError () returned 0x3f0 [0089.792] GetModuleInformation (in: hProcess=0x354, hModule=0x77990000, lpmodinfo=0x298431c, cb=0xc | out: lpmodinfo=0x298431c*(lpBaseOfDll=0x77990000, SizeOfImage=0x7b000, EntryPoint=0x779ae3b0)) returned 1 [0089.792] GetLastError () returned 0x3f0 [0089.792] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77990000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0089.792] GetLastError () returned 0x3f0 [0089.793] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77990000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ADVAPI32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")) returned 0x20 [0089.793] GetLastError () returned 0x3f0 [0089.793] GetModuleInformation (in: hProcess=0x354, hModule=0x77a10000, lpmodinfo=0x2985420, cb=0xc | out: lpmodinfo=0x2985420*(lpBaseOfDll=0x77a10000, SizeOfImage=0xbe000, EntryPoint=0x77a45630)) returned 1 [0089.793] GetLastError () returned 0x3f0 [0089.793] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77a10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0089.793] GetLastError () returned 0x3f0 [0089.793] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77a10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")) returned 0x1e [0089.794] GetLastError () returned 0x3f0 [0089.794] GetModuleInformation (in: hProcess=0x354, hModule=0x77250000, lpmodinfo=0x298651c, cb=0xc | out: lpmodinfo=0x298651c*(lpBaseOfDll=0x77250000, SizeOfImage=0x43000, EntryPoint=0x7725f570)) returned 1 [0089.794] GetLastError () returned 0x3f0 [0089.794] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77250000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0089.794] GetLastError () returned 0x3f0 [0089.794] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77250000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")) returned 0x1f [0089.794] GetLastError () returned 0x3f0 [0089.795] GetModuleInformation (in: hProcess=0x354, hModule=0x77af0000, lpmodinfo=0x2987668, cb=0xc | out: lpmodinfo=0x2987668*(lpBaseOfDll=0x77af0000, SizeOfImage=0xac000, EntryPoint=0x77b236b0)) returned 1 [0089.795] GetLastError () returned 0x3f0 [0089.795] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77af0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0089.795] GetLastError () returned 0x3f0 [0089.795] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77af0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\RPCRT4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")) returned 0x1e [0089.795] GetLastError () returned 0x3f0 [0089.796] GetModuleInformation (in: hProcess=0x354, hModule=0x74d50000, lpmodinfo=0x2988764, cb=0xc | out: lpmodinfo=0x2988764*(lpBaseOfDll=0x74d50000, SizeOfImage=0x1e000, EntryPoint=0x74d5b640)) returned 1 [0089.796] GetLastError () returned 0x3f0 [0089.796] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74d50000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0089.796] GetLastError () returned 0x3f0 [0089.796] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74d50000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SspiCli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")) returned 0x1f [0089.796] GetLastError () returned 0x3f0 [0089.796] GetModuleInformation (in: hProcess=0x354, hModule=0x74d40000, lpmodinfo=0x2989860, cb=0xc | out: lpmodinfo=0x2989860*(lpBaseOfDll=0x74d40000, SizeOfImage=0xa000, EntryPoint=0x74d42aa0)) returned 1 [0089.797] GetLastError () returned 0x3f0 [0089.797] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74d40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0089.797] GetLastError () returned 0x3f0 [0089.797] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74d40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTBASE.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")) returned 0x21 [0089.797] GetLastError () returned 0x3f0 [0089.798] GetModuleInformation (in: hProcess=0x354, hModule=0x74ce0000, lpmodinfo=0x298a964, cb=0xc | out: lpmodinfo=0x298a964*(lpBaseOfDll=0x74ce0000, SizeOfImage=0x59000, EntryPoint=0x74d18cc0)) returned 1 [0089.798] GetLastError () returned 0x3f0 [0089.798] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74ce0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcryptPrimitives.dll") returned 0x14 [0089.798] GetLastError () returned 0x3f0 [0089.798] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74ce0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")) returned 0x28 [0089.798] GetLastError () returned 0x3f0 [0089.799] GetModuleInformation (in: hProcess=0x354, hModule=0x73f10000, lpmodinfo=0x298ba88, cb=0xc | out: lpmodinfo=0x298ba88*(lpBaseOfDll=0x73f10000, SizeOfImage=0x78000, EntryPoint=0x73f11000)) returned 1 [0089.799] GetLastError () returned 0x3f0 [0089.799] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x73f10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0089.799] GetLastError () returned 0x3f0 [0089.799] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x73f10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0089.800] GetLastError () returned 0x3f0 [0089.800] GetModuleInformation (in: hProcess=0x354, hModule=0x75080000, lpmodinfo=0x298cbc0, cb=0xc | out: lpmodinfo=0x298cbc0*(lpBaseOfDll=0x75080000, SizeOfImage=0x44000, EntryPoint=0x7509d810)) returned 1 [0089.800] GetLastError () returned 0x3f0 [0089.800] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x75080000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0089.800] GetLastError () returned 0x3f0 [0089.800] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x75080000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SHLWAPI.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")) returned 0x1f [0089.801] GetLastError () returned 0x3f0 [0089.801] GetModuleInformation (in: hProcess=0x354, hModule=0x77090000, lpmodinfo=0x298dcbc, cb=0xc | out: lpmodinfo=0x298dcbc*(lpBaseOfDll=0x77090000, SizeOfImage=0x1ba000, EntryPoint=0x7716cbb0)) returned 1 [0089.801] GetLastError () returned 0x3f0 [0089.801] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77090000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="combase.dll") returned 0xb [0089.802] GetLastError () returned 0x3f0 [0089.802] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77090000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")) returned 0x1f [0089.802] GetLastError () returned 0x3f0 [0089.802] GetModuleInformation (in: hProcess=0x354, hModule=0x76ca0000, lpmodinfo=0x298edb8, cb=0xc | out: lpmodinfo=0x298edb8*(lpBaseOfDll=0x76ca0000, SizeOfImage=0x14d000, EntryPoint=0x76d525d0)) returned 1 [0089.802] GetLastError () returned 0x3f0 [0089.803] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x76ca0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0089.803] GetLastError () returned 0x3f0 [0089.803] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x76ca0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\GDI32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")) returned 0x1d [0089.803] GetLastError () returned 0x3f0 [0089.803] GetModuleInformation (in: hProcess=0x354, hModule=0x74d70000, lpmodinfo=0x298ff3c, cb=0xc | out: lpmodinfo=0x298ff3c*(lpBaseOfDll=0x74d70000, SizeOfImage=0x140000, EntryPoint=0x74d80280)) returned 1 [0089.804] GetLastError () returned 0x3f0 [0089.804] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74d70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0089.804] GetLastError () returned 0x3f0 [0089.804] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74d70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\USER32.dll" (normalized: "c:\\windows\\system32\\user32.dll")) returned 0x1e [0089.804] GetLastError () returned 0x3f0 [0089.805] GetModuleInformation (in: hProcess=0x354, hModule=0x775e0000, lpmodinfo=0x2991038, cb=0xc | out: lpmodinfo=0x2991038*(lpBaseOfDll=0x775e0000, SizeOfImage=0x2b000, EntryPoint=0x775e52b0)) returned 1 [0089.805] GetLastError () returned 0x3f0 [0089.805] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x775e0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0089.805] GetLastError () returned 0x3f0 [0089.805] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x775e0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0089.806] GetLastError () returned 0x3f0 [0089.806] GetModuleInformation (in: hProcess=0x354, hModule=0x76f70000, lpmodinfo=0x299212c, cb=0xc | out: lpmodinfo=0x299212c*(lpBaseOfDll=0x76f70000, SizeOfImage=0x120000, EntryPoint=0x76fb46e0)) returned 1 [0089.806] GetLastError () returned 0x3f0 [0089.806] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x76f70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0089.807] GetLastError () returned 0x3f0 [0089.807] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x76f70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCTF.dll" (normalized: "c:\\windows\\system32\\msctf.dll")) returned 0x1d [0089.807] GetLastError () returned 0x3f0 [0089.807] GetModuleInformation (in: hProcess=0x354, hModule=0x76f60000, lpmodinfo=0x2993220, cb=0xc | out: lpmodinfo=0x2993220*(lpBaseOfDll=0x76f60000, SizeOfImage=0xc000, EntryPoint=0x76f63920)) returned 1 [0089.808] GetLastError () returned 0x3f0 [0089.808] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x76f60000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="kernel.appcore.dll") returned 0x12 [0089.808] GetLastError () returned 0x3f0 [0089.808] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x76f60000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")) returned 0x26 [0089.808] GetLastError () returned 0x3f0 [0089.809] GetModuleInformation (in: hProcess=0x354, hModule=0x73f00000, lpmodinfo=0x299433c, cb=0xc | out: lpmodinfo=0x299433c*(lpBaseOfDll=0x73f00000, SizeOfImage=0x8000, EntryPoint=0x73f017c0)) returned 1 [0089.809] GetLastError () returned 0x3f0 [0089.809] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x73f00000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0089.809] GetLastError () returned 0x3f0 [0089.809] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x73f00000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0089.810] GetLastError () returned 0x3f0 [0089.810] GetModuleInformation (in: hProcess=0x354, hModule=0x73950000, lpmodinfo=0x2995438, cb=0xc | out: lpmodinfo=0x2995438*(lpBaseOfDll=0x73950000, SizeOfImage=0x5b0000, EntryPoint=0x7399a848)) returned 1 [0089.810] GetLastError () returned 0x3f0 [0089.810] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x73950000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorwks.dll") returned 0xc [0089.811] GetLastError () returned 0x3f0 [0089.811] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x73950000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll")) returned 0x3a [0089.811] GetLastError () returned 0x3f0 [0089.811] GetModuleInformation (in: hProcess=0x354, hModule=0x738b0000, lpmodinfo=0x2996570, cb=0xc | out: lpmodinfo=0x2996570*(lpBaseOfDll=0x738b0000, SizeOfImage=0x9b000, EntryPoint=0x738b232b)) returned 1 [0089.812] GetLastError () returned 0x3f0 [0089.812] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x738b0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSVCR80.dll") returned 0xb [0089.812] GetLastError () returned 0x3f0 [0089.812] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x738b0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\MSVCR80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\msvcr80.dll")) returned 0x6a [0089.813] GetLastError () returned 0x3f0 [0089.813] GetModuleInformation (in: hProcess=0x354, hModule=0x755b0000, lpmodinfo=0x2997704, cb=0xc | out: lpmodinfo=0x2997704*(lpBaseOfDll=0x755b0000, SizeOfImage=0x13bf000, EntryPoint=0x75769ea0)) returned 1 [0089.813] GetLastError () returned 0x3f0 [0089.813] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x755b0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shell32.dll") returned 0xb [0089.814] GetLastError () returned 0x3f0 [0089.814] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x755b0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")) returned 0x1f [0089.814] GetLastError () returned 0x3f0 [0089.814] GetModuleInformation (in: hProcess=0x354, hModule=0x750d0000, lpmodinfo=0x2998800, cb=0xc | out: lpmodinfo=0x2998800*(lpBaseOfDll=0x750d0000, SizeOfImage=0x4dd000, EntryPoint=0x752c7460)) returned 1 [0089.815] GetLastError () returned 0x3f0 [0089.815] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x750d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="windows.storage.dll") returned 0x13 [0089.815] GetLastError () returned 0x3f0 [0089.815] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x750d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")) returned 0x27 [0089.816] GetLastError () returned 0x3f0 [0089.816] GetModuleInformation (in: hProcess=0x354, hModule=0x778a0000, lpmodinfo=0x299991c, cb=0xc | out: lpmodinfo=0x299991c*(lpBaseOfDll=0x778a0000, SizeOfImage=0x8d000, EntryPoint=0x778e91a0)) returned 1 [0089.816] GetLastError () returned 0x3f0 [0089.816] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x778a0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shcore.dll") returned 0xa [0089.817] GetLastError () returned 0x3f0 [0089.817] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x778a0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shcore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")) returned 0x1e [0089.818] GetLastError () returned 0x3f0 [0089.818] GetModuleInformation (in: hProcess=0x354, hModule=0x777f0000, lpmodinfo=0x299aa18, cb=0xc | out: lpmodinfo=0x299aa18*(lpBaseOfDll=0x777f0000, SizeOfImage=0x44000, EntryPoint=0x777f7280)) returned 1 [0089.818] GetLastError () returned 0x3f0 [0089.818] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x777f0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="powrprof.dll") returned 0xc [0089.819] GetLastError () returned 0x3f0 [0089.819] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x777f0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")) returned 0x20 [0089.819] GetLastError () returned 0x3f0 [0089.819] GetModuleInformation (in: hProcess=0x354, hModule=0x75070000, lpmodinfo=0x299bb1c, cb=0xc | out: lpmodinfo=0x299bb1c*(lpBaseOfDll=0x75070000, SizeOfImage=0xf000, EntryPoint=0x75072e40)) returned 1 [0089.820] GetLastError () returned 0x3f0 [0089.820] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x75070000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="profapi.dll") returned 0xb [0089.820] GetLastError () returned 0x3f0 [0089.820] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x75070000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")) returned 0x1f [0089.821] GetLastError () returned 0x3f0 [0089.821] GetModuleInformation (in: hProcess=0x354, hModule=0x72db0000, lpmodinfo=0x299cc18, cb=0xc | out: lpmodinfo=0x299cc18*(lpBaseOfDll=0x72db0000, SizeOfImage=0xafa000, EntryPoint=0x0)) returned 1 [0089.821] GetLastError () returned 0x3f0 [0089.822] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x72db0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0089.822] GetLastError () returned 0x3f0 [0089.822] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x72db0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll")) returned 0x68 [0089.823] GetLastError () returned 0x3f0 [0089.823] GetModuleInformation (in: hProcess=0x354, hModule=0x77430000, lpmodinfo=0x299ddb0, cb=0xc | out: lpmodinfo=0x299ddb0*(lpBaseOfDll=0x77430000, SizeOfImage=0xea000, EntryPoint=0x7746b990)) returned 1 [0089.823] GetLastError () returned 0x3f0 [0089.823] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77430000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0089.824] GetLastError () returned 0x3f0 [0089.824] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77430000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")) returned 0x1d [0089.824] GetLastError () returned 0x3f0 [0089.824] GetModuleInformation (in: hProcess=0x354, hModule=0x74ab0000, lpmodinfo=0x299eea4, cb=0xc | out: lpmodinfo=0x299eea4*(lpBaseOfDll=0x74ab0000, SizeOfImage=0x5b000, EntryPoint=0x74af8ff8)) returned 1 [0089.825] GetLastError () returned 0x3f0 [0089.825] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74ab0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorjit.dll") returned 0xc [0089.825] GetLastError () returned 0x3f0 [0089.826] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74ab0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll")) returned 0x3a [0089.826] GetLastError () returned 0x3f0 [0089.826] GetModuleInformation (in: hProcess=0x354, hModule=0x74060000, lpmodinfo=0x299ffdc, cb=0xc | out: lpmodinfo=0x299ffdc*(lpBaseOfDll=0x74060000, SizeOfImage=0x7a3000, EntryPoint=0x0)) returned 1 [0089.827] GetLastError () returned 0x3f0 [0089.827] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74060000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0089.827] GetLastError () returned 0x3f0 [0089.827] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74060000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\b0de8183f9e33cd0fbe10c8db1402653\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\b0de8183f9e33cd0fbe10c8db1402653\\system.ni.dll")) returned 0x64 [0089.828] GetLastError () returned 0x3f0 [0089.828] GetModuleInformation (in: hProcess=0x354, hModule=0x74920000, lpmodinfo=0x29a1278, cb=0xc | out: lpmodinfo=0x29a1278*(lpBaseOfDll=0x74920000, SizeOfImage=0x189000, EntryPoint=0x0)) returned 1 [0089.829] GetLastError () returned 0x3f0 [0089.829] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74920000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0089.829] GetLastError () returned 0x3f0 [0089.829] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74920000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\cebfffe6cee14413d504056227f496b2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\cebfffe6cee14413d504056227f496b2\\system.drawing.ni.dll")) returned 0x74 [0089.830] GetLastError () returned 0x3f0 [0089.830] GetModuleInformation (in: hProcess=0x354, hModule=0x721d0000, lpmodinfo=0x29a2434, cb=0xc | out: lpmodinfo=0x29a2434*(lpBaseOfDll=0x721d0000, SizeOfImage=0xbe0000, EntryPoint=0x0)) returned 1 [0089.830] GetLastError () returned 0x3f0 [0089.830] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x721d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0089.831] GetLastError () returned 0x3f0 [0089.831] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x721d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\e3f653c6d321c4c528daa164908e0ff8\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\e3f653c6d321c4c528daa164908e0ff8\\system.windows.forms.ni.dll")) returned 0x80 [0089.832] GetLastError () returned 0x3f0 [0089.832] GetModuleInformation (in: hProcess=0x354, hModule=0x74bc0000, lpmodinfo=0x29a3614, cb=0xc | out: lpmodinfo=0x29a3614*(lpBaseOfDll=0x74bc0000, SizeOfImage=0x75000, EntryPoint=0x74bf98d0)) returned 1 [0089.832] GetLastError () returned 0x3f0 [0089.833] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74bc0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0089.834] GetLastError () returned 0x3f0 [0089.834] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74bc0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0089.834] GetLastError () returned 0x3f0 [0089.835] GetModuleInformation (in: hProcess=0x354, hModule=0x74ba0000, lpmodinfo=0x29a4710, cb=0xc | out: lpmodinfo=0x29a4710*(lpBaseOfDll=0x74ba0000, SizeOfImage=0x1d000, EntryPoint=0x74ba3bb0)) returned 1 [0089.835] GetLastError () returned 0x3f0 [0089.835] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74ba0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="dwmapi.dll") returned 0xa [0089.836] GetLastError () returned 0x3f0 [0089.836] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74ba0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")) returned 0x1e [0089.836] GetLastError () returned 0x3f0 [0089.837] GetModuleInformation (in: hProcess=0x354, hModule=0x72060000, lpmodinfo=0x29a580c, cb=0xc | out: lpmodinfo=0x29a580c*(lpBaseOfDll=0x72060000, SizeOfImage=0x16b000, EntryPoint=0x720ce360)) returned 1 [0089.837] GetLastError () returned 0x3f0 [0089.837] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x72060000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="gdiplus.dll") returned 0xb [0089.838] GetLastError () returned 0x3f0 [0089.838] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x72060000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll")) returned 0x72 [0089.839] GetLastError () returned 0x3f0 [0089.839] GetModuleInformation (in: hProcess=0x354, hModule=0x71e70000, lpmodinfo=0x29a69b0, cb=0xc | out: lpmodinfo=0x29a69b0*(lpBaseOfDll=0x71e70000, SizeOfImage=0x1f0000, EntryPoint=0x71f569e0)) returned 1 [0089.839] GetLastError () returned 0x3f0 [0089.839] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x71e70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="DWrite.dll") returned 0xa [0089.840] GetLastError () returned 0x3f0 [0089.840] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x71e70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll")) returned 0x1e [0089.841] GetLastError () returned 0x3f0 [0089.841] GetModuleInformation (in: hProcess=0x354, hModule=0x71c30000, lpmodinfo=0x29a7aac, cb=0xc | out: lpmodinfo=0x29a7aac*(lpBaseOfDll=0x71c30000, SizeOfImage=0x236000, EntryPoint=0x0)) returned 1 [0089.841] GetLastError () returned 0x3f0 [0089.841] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x71c30000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0089.842] GetLastError () returned 0x3f0 [0089.842] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x71c30000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\40661cdfbf2201f3d6c5cf6378755082\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\40661cdfbf2201f3d6c5cf6378755082\\system.core.ni.dll")) returned 0x6e [0089.843] GetLastError () returned 0x3f0 [0089.843] GetModuleInformation (in: hProcess=0x354, hModule=0x74b80000, lpmodinfo=0x29a8c58, cb=0xc | out: lpmodinfo=0x29a8c58*(lpBaseOfDll=0x74b80000, SizeOfImage=0x13000, EntryPoint=0x74b89500)) returned 1 [0089.843] GetLastError () returned 0x3f0 [0089.844] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74b80000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0089.844] GetLastError () returned 0x3f0 [0089.844] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74b80000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0089.845] GetLastError () returned 0x3f0 [0089.845] GetModuleInformation (in: hProcess=0x354, hModule=0x74b60000, lpmodinfo=0x29a9d54, cb=0xc | out: lpmodinfo=0x29a9d54*(lpBaseOfDll=0x74b60000, SizeOfImage=0x1b000, EntryPoint=0x74b69010)) returned 1 [0089.846] GetLastError () returned 0x3f0 [0089.846] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74b60000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcrypt.dll") returned 0xa [0089.846] GetLastError () returned 0x3f0 [0089.846] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74b60000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")) returned 0x1e [0089.847] GetLastError () returned 0x3f0 [0089.847] GetModuleInformation (in: hProcess=0x354, hModule=0x74b30000, lpmodinfo=0x29aae50, cb=0xc | out: lpmodinfo=0x29aae50*(lpBaseOfDll=0x74b30000, SizeOfImage=0x2f000, EntryPoint=0x74b49530)) returned 1 [0089.848] GetLastError () returned 0x3f0 [0089.848] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74b30000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0089.849] GetLastError () returned 0x3f0 [0089.849] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74b30000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0089.849] GetLastError () returned 0x3f0 [0089.849] GetModuleInformation (in: hProcess=0x354, hModule=0x773d0000, lpmodinfo=0x29abf4c, cb=0xc | out: lpmodinfo=0x29abf4c*(lpBaseOfDll=0x773d0000, SizeOfImage=0x6000, EntryPoint=0x773d1480)) returned 1 [0089.850] GetLastError () returned 0x3f0 [0089.850] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x773d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0089.851] GetLastError () returned 0x3f0 [0089.851] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x773d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")) returned 0x1d [0089.852] GetLastError () returned 0x3f0 [0089.852] GetModuleInformation (in: hProcess=0x354, hModule=0x71ab0000, lpmodinfo=0x29ad040, cb=0xc | out: lpmodinfo=0x29ad040*(lpBaseOfDll=0x71ab0000, SizeOfImage=0x171000, EntryPoint=0x71b5d650)) returned 1 [0089.852] GetLastError () returned 0x3f0 [0089.852] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x71ab0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="WindowsCodecs.dll") returned 0x11 [0089.853] GetLastError () returned 0x3f0 [0089.853] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x71ab0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")) returned 0x25 [0089.854] GetLastError () returned 0x3f0 [0089.854] GetModuleInformation (in: hProcess=0x354, hModule=0x77ba0000, lpmodinfo=0x29ae154, cb=0xc | out: lpmodinfo=0x29ae154*(lpBaseOfDll=0x77ba0000, SizeOfImage=0x92000, EntryPoint=0x77bd44d0)) returned 1 [0089.855] GetLastError () returned 0x3f0 [0089.855] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x77ba0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0089.855] GetLastError () returned 0x3f0 [0089.855] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x77ba0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\OLEAUT32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")) returned 0x20 [0089.856] GetLastError () returned 0x3f0 [0089.856] GetModuleInformation (in: hProcess=0x354, hModule=0x74b20000, lpmodinfo=0x29af258, cb=0xc | out: lpmodinfo=0x29af258*(lpBaseOfDll=0x74b20000, SizeOfImage=0x6000, EntryPoint=0x74b21570)) returned 1 [0089.857] GetLastError () returned 0x3f0 [0089.857] GetModuleBaseNameW (in: hProcess=0x354, hModule=0x74b20000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shfolder.dll") returned 0xc [0089.858] GetLastError () returned 0x3f0 [0089.858] GetModuleFileNameExW (in: hProcess=0x354, hModule=0x74b20000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll")) returned 0x20 [0089.858] GetLastError () returned 0x3f0 [0089.858] CloseHandle (hObject=0x354) returned 1 [0089.859] GetLastError () returned 0x3f0 [0089.925] GetCurrentProcessId () returned 0xe98 [0089.925] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x35c [0089.925] GetLastError () returned 0x3f0 [0089.925] EnumProcessModules (in: hProcess=0x35c, lphModule=0x2811774, cb=0x100, lpcbNeeded=0x69da90 | out: lphModule=0x2811774, lpcbNeeded=0x69da90) returned 1 [0089.926] GetLastError () returned 0x3f0 [0089.926] GetModuleInformation (in: hProcess=0x35c, hModule=0x410000, lpmodinfo=0x28118b4, cb=0xc | out: lpmodinfo=0x28118b4*(lpBaseOfDll=0x410000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0089.927] GetLastError () returned 0x3f0 [0089.927] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x410000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="vfggggg.exe") returned 0xb [0089.927] GetLastError () returned 0x3f0 [0089.927] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x410000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0x31 [0089.927] GetLastError () returned 0x3f0 [0089.927] GetModuleInformation (in: hProcess=0x35c, hModule=0x77c40000, lpmodinfo=0x28129f4, cb=0xc | out: lpmodinfo=0x28129f4*(lpBaseOfDll=0x77c40000, SizeOfImage=0x179000, EntryPoint=0x0)) returned 1 [0089.927] GetLastError () returned 0x3f0 [0089.927] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0089.927] GetLastError () returned 0x3f0 [0089.927] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")) returned 0x1d [0089.927] GetLastError () returned 0x3f0 [0089.927] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f90000, lpmodinfo=0x2813ae8, cb=0xc | out: lpmodinfo=0x2813ae8*(lpBaseOfDll=0x73f90000, SizeOfImage=0x59000, EntryPoint=0x73fa0780)) returned 1 [0089.928] GetLastError () returned 0x3f0 [0089.928] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f90000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0089.928] GetLastError () returned 0x3f0 [0089.928] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f90000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0089.928] GetLastError () returned 0x3f0 [0089.928] GetModuleInformation (in: hProcess=0x35c, hModule=0x77670000, lpmodinfo=0x2814be4, cb=0xc | out: lpmodinfo=0x2814be4*(lpBaseOfDll=0x77670000, SizeOfImage=0xf0000, EntryPoint=0x776837d0)) returned 1 [0089.928] GetLastError () returned 0x3f0 [0089.928] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77670000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0089.928] GetLastError () returned 0x3f0 [0089.928] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77670000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNEL32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")) returned 0x20 [0089.929] GetLastError () returned 0x3f0 [0089.929] GetModuleInformation (in: hProcess=0x35c, hModule=0x76970000, lpmodinfo=0x2815ce8, cb=0xc | out: lpmodinfo=0x2815ce8*(lpBaseOfDll=0x76970000, SizeOfImage=0x176000, EntryPoint=0x76a0c9a0)) returned 1 [0089.929] GetLastError () returned 0x3f0 [0089.929] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76970000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0089.929] GetLastError () returned 0x3f0 [0089.929] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76970000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNELBASE.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")) returned 0x22 [0089.929] GetLastError () returned 0x3f0 [0089.929] GetModuleInformation (in: hProcess=0x35c, hModule=0x74c40000, lpmodinfo=0x2816e24, cb=0xc | out: lpmodinfo=0x2816e24*(lpBaseOfDll=0x74c40000, SizeOfImage=0x91000, EntryPoint=0x74c80ab0)) returned 1 [0089.930] GetLastError () returned 0x3f0 [0089.930] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="apphelp.dll") returned 0xb [0089.930] GetLastError () returned 0x3f0 [0089.930] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")) returned 0x1f [0089.930] GetLastError () returned 0x3f0 [0089.930] GetModuleInformation (in: hProcess=0x35c, hModule=0x77990000, lpmodinfo=0x2817f20, cb=0xc | out: lpmodinfo=0x2817f20*(lpBaseOfDll=0x77990000, SizeOfImage=0x7b000, EntryPoint=0x779ae3b0)) returned 1 [0089.930] GetLastError () returned 0x3f0 [0089.930] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77990000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0089.930] GetLastError () returned 0x3f0 [0089.930] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77990000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ADVAPI32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")) returned 0x20 [0089.931] GetLastError () returned 0x3f0 [0089.931] GetModuleInformation (in: hProcess=0x35c, hModule=0x77a10000, lpmodinfo=0x2819024, cb=0xc | out: lpmodinfo=0x2819024*(lpBaseOfDll=0x77a10000, SizeOfImage=0xbe000, EntryPoint=0x77a45630)) returned 1 [0089.931] GetLastError () returned 0x3f0 [0089.931] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77a10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0089.931] GetLastError () returned 0x3f0 [0089.931] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77a10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")) returned 0x1e [0089.931] GetLastError () returned 0x3f0 [0089.932] GetModuleInformation (in: hProcess=0x35c, hModule=0x77250000, lpmodinfo=0x281a120, cb=0xc | out: lpmodinfo=0x281a120*(lpBaseOfDll=0x77250000, SizeOfImage=0x43000, EntryPoint=0x7725f570)) returned 1 [0089.932] GetLastError () returned 0x3f0 [0089.932] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77250000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0089.932] GetLastError () returned 0x3f0 [0089.932] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77250000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")) returned 0x1f [0089.932] GetLastError () returned 0x3f0 [0089.932] GetModuleInformation (in: hProcess=0x35c, hModule=0x77af0000, lpmodinfo=0x281b26c, cb=0xc | out: lpmodinfo=0x281b26c*(lpBaseOfDll=0x77af0000, SizeOfImage=0xac000, EntryPoint=0x77b236b0)) returned 1 [0089.933] GetLastError () returned 0x3f0 [0089.933] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77af0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0089.933] GetLastError () returned 0x3f0 [0089.933] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77af0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\RPCRT4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")) returned 0x1e [0089.933] GetLastError () returned 0x3f0 [0089.933] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d50000, lpmodinfo=0x281c368, cb=0xc | out: lpmodinfo=0x281c368*(lpBaseOfDll=0x74d50000, SizeOfImage=0x1e000, EntryPoint=0x74d5b640)) returned 1 [0089.933] GetLastError () returned 0x3f0 [0089.933] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d50000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0089.934] GetLastError () returned 0x3f0 [0089.934] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d50000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SspiCli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")) returned 0x1f [0089.934] GetLastError () returned 0x3f0 [0089.934] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d40000, lpmodinfo=0x281d464, cb=0xc | out: lpmodinfo=0x281d464*(lpBaseOfDll=0x74d40000, SizeOfImage=0xa000, EntryPoint=0x74d42aa0)) returned 1 [0089.934] GetLastError () returned 0x3f0 [0089.934] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0089.935] GetLastError () returned 0x3f0 [0089.935] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTBASE.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")) returned 0x21 [0089.935] GetLastError () returned 0x3f0 [0089.935] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ce0000, lpmodinfo=0x281e568, cb=0xc | out: lpmodinfo=0x281e568*(lpBaseOfDll=0x74ce0000, SizeOfImage=0x59000, EntryPoint=0x74d18cc0)) returned 1 [0089.935] GetLastError () returned 0x3f0 [0089.935] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ce0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcryptPrimitives.dll") returned 0x14 [0089.936] GetLastError () returned 0x3f0 [0089.936] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ce0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")) returned 0x28 [0089.936] GetLastError () returned 0x3f0 [0089.936] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f10000, lpmodinfo=0x281f68c, cb=0xc | out: lpmodinfo=0x281f68c*(lpBaseOfDll=0x73f10000, SizeOfImage=0x78000, EntryPoint=0x73f11000)) returned 1 [0089.936] GetLastError () returned 0x3f0 [0089.936] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0089.937] GetLastError () returned 0x3f0 [0089.937] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0089.937] GetLastError () returned 0x3f0 [0089.937] GetModuleInformation (in: hProcess=0x35c, hModule=0x75080000, lpmodinfo=0x28207c4, cb=0xc | out: lpmodinfo=0x28207c4*(lpBaseOfDll=0x75080000, SizeOfImage=0x44000, EntryPoint=0x7509d810)) returned 1 [0089.937] GetLastError () returned 0x3f0 [0089.937] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x75080000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0089.938] GetLastError () returned 0x3f0 [0089.938] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x75080000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SHLWAPI.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")) returned 0x1f [0089.938] GetLastError () returned 0x3f0 [0089.938] GetModuleInformation (in: hProcess=0x35c, hModule=0x77090000, lpmodinfo=0x28218c0, cb=0xc | out: lpmodinfo=0x28218c0*(lpBaseOfDll=0x77090000, SizeOfImage=0x1ba000, EntryPoint=0x7716cbb0)) returned 1 [0089.938] GetLastError () returned 0x3f0 [0089.938] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77090000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="combase.dll") returned 0xb [0089.939] GetLastError () returned 0x3f0 [0089.939] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77090000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")) returned 0x1f [0089.939] GetLastError () returned 0x3f0 [0089.939] GetModuleInformation (in: hProcess=0x35c, hModule=0x76ca0000, lpmodinfo=0x28229bc, cb=0xc | out: lpmodinfo=0x28229bc*(lpBaseOfDll=0x76ca0000, SizeOfImage=0x14d000, EntryPoint=0x76d525d0)) returned 1 [0089.939] GetLastError () returned 0x3f0 [0089.939] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76ca0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0089.940] GetLastError () returned 0x3f0 [0089.940] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76ca0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\GDI32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")) returned 0x1d [0089.940] GetLastError () returned 0x3f0 [0089.940] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d70000, lpmodinfo=0x2823b40, cb=0xc | out: lpmodinfo=0x2823b40*(lpBaseOfDll=0x74d70000, SizeOfImage=0x140000, EntryPoint=0x74d80280)) returned 1 [0089.940] GetLastError () returned 0x3f0 [0089.941] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0089.941] GetLastError () returned 0x3f0 [0089.941] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\USER32.dll" (normalized: "c:\\windows\\system32\\user32.dll")) returned 0x1e [0089.941] GetLastError () returned 0x3f0 [0089.941] GetModuleInformation (in: hProcess=0x35c, hModule=0x775e0000, lpmodinfo=0x2824c3c, cb=0xc | out: lpmodinfo=0x2824c3c*(lpBaseOfDll=0x775e0000, SizeOfImage=0x2b000, EntryPoint=0x775e52b0)) returned 1 [0089.942] GetLastError () returned 0x3f0 [0089.942] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x775e0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0089.942] GetLastError () returned 0x3f0 [0089.942] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x775e0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0089.943] GetLastError () returned 0x3f0 [0089.943] GetModuleInformation (in: hProcess=0x35c, hModule=0x76f70000, lpmodinfo=0x2825d30, cb=0xc | out: lpmodinfo=0x2825d30*(lpBaseOfDll=0x76f70000, SizeOfImage=0x120000, EntryPoint=0x76fb46e0)) returned 1 [0089.943] GetLastError () returned 0x3f0 [0089.943] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76f70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0089.943] GetLastError () returned 0x3f0 [0089.943] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76f70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCTF.dll" (normalized: "c:\\windows\\system32\\msctf.dll")) returned 0x1d [0089.944] GetLastError () returned 0x3f0 [0089.944] GetModuleInformation (in: hProcess=0x35c, hModule=0x76f60000, lpmodinfo=0x2826e24, cb=0xc | out: lpmodinfo=0x2826e24*(lpBaseOfDll=0x76f60000, SizeOfImage=0xc000, EntryPoint=0x76f63920)) returned 1 [0089.944] GetLastError () returned 0x3f0 [0089.944] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76f60000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="kernel.appcore.dll") returned 0x12 [0089.945] GetLastError () returned 0x3f0 [0089.945] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76f60000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")) returned 0x26 [0089.945] GetLastError () returned 0x3f0 [0089.945] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f00000, lpmodinfo=0x2827f40, cb=0xc | out: lpmodinfo=0x2827f40*(lpBaseOfDll=0x73f00000, SizeOfImage=0x8000, EntryPoint=0x73f017c0)) returned 1 [0089.945] GetLastError () returned 0x3f0 [0089.946] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f00000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0089.946] GetLastError () returned 0x3f0 [0089.946] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f00000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0089.946] GetLastError () returned 0x3f0 [0089.946] GetModuleInformation (in: hProcess=0x35c, hModule=0x73950000, lpmodinfo=0x282903c, cb=0xc | out: lpmodinfo=0x282903c*(lpBaseOfDll=0x73950000, SizeOfImage=0x5b0000, EntryPoint=0x7399a848)) returned 1 [0089.947] GetLastError () returned 0x3f0 [0089.947] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73950000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorwks.dll") returned 0xc [0089.947] GetLastError () returned 0x3f0 [0089.947] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73950000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll")) returned 0x3a [0089.948] GetLastError () returned 0x3f0 [0089.948] GetModuleInformation (in: hProcess=0x35c, hModule=0x738b0000, lpmodinfo=0x282a174, cb=0xc | out: lpmodinfo=0x282a174*(lpBaseOfDll=0x738b0000, SizeOfImage=0x9b000, EntryPoint=0x738b232b)) returned 1 [0089.948] GetLastError () returned 0x3f0 [0089.948] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x738b0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSVCR80.dll") returned 0xb [0089.949] GetLastError () returned 0x3f0 [0089.949] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x738b0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\MSVCR80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\msvcr80.dll")) returned 0x6a [0089.949] GetLastError () returned 0x3f0 [0089.949] GetModuleInformation (in: hProcess=0x35c, hModule=0x755b0000, lpmodinfo=0x282b308, cb=0xc | out: lpmodinfo=0x282b308*(lpBaseOfDll=0x755b0000, SizeOfImage=0x13bf000, EntryPoint=0x75769ea0)) returned 1 [0089.950] GetLastError () returned 0x3f0 [0089.950] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x755b0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shell32.dll") returned 0xb [0089.950] GetLastError () returned 0x3f0 [0089.950] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x755b0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")) returned 0x1f [0089.950] GetLastError () returned 0x3f0 [0089.951] GetModuleInformation (in: hProcess=0x35c, hModule=0x750d0000, lpmodinfo=0x282c404, cb=0xc | out: lpmodinfo=0x282c404*(lpBaseOfDll=0x750d0000, SizeOfImage=0x4dd000, EntryPoint=0x752c7460)) returned 1 [0089.951] GetLastError () returned 0x3f0 [0089.951] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x750d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="windows.storage.dll") returned 0x13 [0089.951] GetLastError () returned 0x3f0 [0089.951] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x750d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")) returned 0x27 [0089.952] GetLastError () returned 0x3f0 [0089.952] GetModuleInformation (in: hProcess=0x35c, hModule=0x778a0000, lpmodinfo=0x282d520, cb=0xc | out: lpmodinfo=0x282d520*(lpBaseOfDll=0x778a0000, SizeOfImage=0x8d000, EntryPoint=0x778e91a0)) returned 1 [0089.952] GetLastError () returned 0x3f0 [0089.952] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x778a0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shcore.dll") returned 0xa [0089.953] GetLastError () returned 0x3f0 [0089.953] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x778a0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shcore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")) returned 0x1e [0089.953] GetLastError () returned 0x3f0 [0089.953] GetModuleInformation (in: hProcess=0x35c, hModule=0x777f0000, lpmodinfo=0x282e61c, cb=0xc | out: lpmodinfo=0x282e61c*(lpBaseOfDll=0x777f0000, SizeOfImage=0x44000, EntryPoint=0x777f7280)) returned 1 [0089.954] GetLastError () returned 0x3f0 [0089.954] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x777f0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="powrprof.dll") returned 0xc [0089.954] GetLastError () returned 0x3f0 [0089.954] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x777f0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")) returned 0x20 [0089.955] GetLastError () returned 0x3f0 [0089.955] GetModuleInformation (in: hProcess=0x35c, hModule=0x75070000, lpmodinfo=0x282f720, cb=0xc | out: lpmodinfo=0x282f720*(lpBaseOfDll=0x75070000, SizeOfImage=0xf000, EntryPoint=0x75072e40)) returned 1 [0089.955] GetLastError () returned 0x3f0 [0089.955] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x75070000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="profapi.dll") returned 0xb [0089.956] GetLastError () returned 0x3f0 [0089.956] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x75070000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")) returned 0x1f [0089.956] GetLastError () returned 0x3f0 [0089.956] GetModuleInformation (in: hProcess=0x35c, hModule=0x72db0000, lpmodinfo=0x283081c, cb=0xc | out: lpmodinfo=0x283081c*(lpBaseOfDll=0x72db0000, SizeOfImage=0xafa000, EntryPoint=0x0)) returned 1 [0089.957] GetLastError () returned 0x3f0 [0089.957] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x72db0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0089.958] GetLastError () returned 0x3f0 [0089.958] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x72db0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll")) returned 0x68 [0089.958] GetLastError () returned 0x3f0 [0089.958] GetModuleInformation (in: hProcess=0x35c, hModule=0x77430000, lpmodinfo=0x28319b4, cb=0xc | out: lpmodinfo=0x28319b4*(lpBaseOfDll=0x77430000, SizeOfImage=0xea000, EntryPoint=0x7746b990)) returned 1 [0089.959] GetLastError () returned 0x3f0 [0089.959] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77430000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0089.959] GetLastError () returned 0x3f0 [0089.959] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77430000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")) returned 0x1d [0089.960] GetLastError () returned 0x3f0 [0089.960] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ab0000, lpmodinfo=0x2832aa8, cb=0xc | out: lpmodinfo=0x2832aa8*(lpBaseOfDll=0x74ab0000, SizeOfImage=0x5b000, EntryPoint=0x74af8ff8)) returned 1 [0089.960] GetLastError () returned 0x3f0 [0089.960] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ab0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorjit.dll") returned 0xc [0089.961] GetLastError () returned 0x3f0 [0089.961] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ab0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll")) returned 0x3a [0089.961] GetLastError () returned 0x3f0 [0089.962] GetModuleInformation (in: hProcess=0x35c, hModule=0x74060000, lpmodinfo=0x2833be0, cb=0xc | out: lpmodinfo=0x2833be0*(lpBaseOfDll=0x74060000, SizeOfImage=0x7a3000, EntryPoint=0x0)) returned 1 [0089.962] GetLastError () returned 0x3f0 [0089.962] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74060000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0089.963] GetLastError () returned 0x3f0 [0089.963] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74060000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\b0de8183f9e33cd0fbe10c8db1402653\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\b0de8183f9e33cd0fbe10c8db1402653\\system.ni.dll")) returned 0x64 [0089.963] GetLastError () returned 0x3f0 [0089.963] GetModuleInformation (in: hProcess=0x35c, hModule=0x74920000, lpmodinfo=0x2834e7c, cb=0xc | out: lpmodinfo=0x2834e7c*(lpBaseOfDll=0x74920000, SizeOfImage=0x189000, EntryPoint=0x0)) returned 1 [0089.964] GetLastError () returned 0x3f0 [0089.964] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74920000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0089.964] GetLastError () returned 0x3f0 [0089.964] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74920000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\cebfffe6cee14413d504056227f496b2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\cebfffe6cee14413d504056227f496b2\\system.drawing.ni.dll")) returned 0x74 [0089.965] GetLastError () returned 0x3f0 [0089.965] GetModuleInformation (in: hProcess=0x35c, hModule=0x721d0000, lpmodinfo=0x2836038, cb=0xc | out: lpmodinfo=0x2836038*(lpBaseOfDll=0x721d0000, SizeOfImage=0xbe0000, EntryPoint=0x0)) returned 1 [0089.966] GetLastError () returned 0x3f0 [0089.966] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x721d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0089.966] GetLastError () returned 0x3f0 [0089.966] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x721d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\e3f653c6d321c4c528daa164908e0ff8\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\e3f653c6d321c4c528daa164908e0ff8\\system.windows.forms.ni.dll")) returned 0x80 [0089.967] GetLastError () returned 0x3f0 [0089.967] GetModuleInformation (in: hProcess=0x35c, hModule=0x74bc0000, lpmodinfo=0x2837218, cb=0xc | out: lpmodinfo=0x2837218*(lpBaseOfDll=0x74bc0000, SizeOfImage=0x75000, EntryPoint=0x74bf98d0)) returned 1 [0089.967] GetLastError () returned 0x3f0 [0089.967] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74bc0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0089.968] GetLastError () returned 0x3f0 [0089.968] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74bc0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0089.969] GetLastError () returned 0x3f0 [0089.969] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ba0000, lpmodinfo=0x2838314, cb=0xc | out: lpmodinfo=0x2838314*(lpBaseOfDll=0x74ba0000, SizeOfImage=0x1d000, EntryPoint=0x74ba3bb0)) returned 1 [0089.969] GetLastError () returned 0x3f0 [0089.969] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ba0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="dwmapi.dll") returned 0xa [0089.970] GetLastError () returned 0x3f0 [0089.970] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ba0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")) returned 0x1e [0089.970] GetLastError () returned 0x3f0 [0089.970] GetModuleInformation (in: hProcess=0x35c, hModule=0x72060000, lpmodinfo=0x2839410, cb=0xc | out: lpmodinfo=0x2839410*(lpBaseOfDll=0x72060000, SizeOfImage=0x16b000, EntryPoint=0x720ce360)) returned 1 [0089.971] GetLastError () returned 0x3f0 [0089.971] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x72060000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="gdiplus.dll") returned 0xb [0089.972] GetLastError () returned 0x3f0 [0089.972] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x72060000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll")) returned 0x72 [0089.972] GetLastError () returned 0x3f0 [0089.972] GetModuleInformation (in: hProcess=0x35c, hModule=0x71e70000, lpmodinfo=0x283a5b4, cb=0xc | out: lpmodinfo=0x283a5b4*(lpBaseOfDll=0x71e70000, SizeOfImage=0x1f0000, EntryPoint=0x71f569e0)) returned 1 [0089.973] GetLastError () returned 0x3f0 [0089.973] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x71e70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="DWrite.dll") returned 0xa [0089.974] GetLastError () returned 0x3f0 [0089.974] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x71e70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll")) returned 0x1e [0089.974] GetLastError () returned 0x3f0 [0089.974] GetModuleInformation (in: hProcess=0x35c, hModule=0x71c30000, lpmodinfo=0x283b6b0, cb=0xc | out: lpmodinfo=0x283b6b0*(lpBaseOfDll=0x71c30000, SizeOfImage=0x236000, EntryPoint=0x0)) returned 1 [0089.975] GetLastError () returned 0x3f0 [0089.975] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x71c30000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0089.976] GetLastError () returned 0x3f0 [0089.976] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x71c30000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\40661cdfbf2201f3d6c5cf6378755082\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\40661cdfbf2201f3d6c5cf6378755082\\system.core.ni.dll")) returned 0x6e [0089.976] GetLastError () returned 0x3f0 [0089.976] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b80000, lpmodinfo=0x283c85c, cb=0xc | out: lpmodinfo=0x283c85c*(lpBaseOfDll=0x74b80000, SizeOfImage=0x13000, EntryPoint=0x74b89500)) returned 1 [0089.977] GetLastError () returned 0x3f0 [0089.977] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b80000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0089.978] GetLastError () returned 0x3f0 [0089.978] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b80000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0089.978] GetLastError () returned 0x3f0 [0089.978] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b60000, lpmodinfo=0x283d958, cb=0xc | out: lpmodinfo=0x283d958*(lpBaseOfDll=0x74b60000, SizeOfImage=0x1b000, EntryPoint=0x74b69010)) returned 1 [0089.979] GetLastError () returned 0x3f0 [0089.979] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b60000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcrypt.dll") returned 0xa [0089.980] GetLastError () returned 0x3f0 [0089.980] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b60000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")) returned 0x1e [0089.980] GetLastError () returned 0x3f0 [0089.980] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b30000, lpmodinfo=0x283ea54, cb=0xc | out: lpmodinfo=0x283ea54*(lpBaseOfDll=0x74b30000, SizeOfImage=0x2f000, EntryPoint=0x74b49530)) returned 1 [0089.981] GetLastError () returned 0x3f0 [0089.981] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b30000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0089.982] GetLastError () returned 0x3f0 [0089.982] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b30000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0089.982] GetLastError () returned 0x3f0 [0089.982] GetModuleInformation (in: hProcess=0x35c, hModule=0x773d0000, lpmodinfo=0x283fb50, cb=0xc | out: lpmodinfo=0x283fb50*(lpBaseOfDll=0x773d0000, SizeOfImage=0x6000, EntryPoint=0x773d1480)) returned 1 [0089.983] GetLastError () returned 0x3f0 [0089.983] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x773d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0089.984] GetLastError () returned 0x3f0 [0089.984] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x773d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")) returned 0x1d [0089.985] GetLastError () returned 0x3f0 [0089.985] GetModuleInformation (in: hProcess=0x35c, hModule=0x71ab0000, lpmodinfo=0x2840c44, cb=0xc | out: lpmodinfo=0x2840c44*(lpBaseOfDll=0x71ab0000, SizeOfImage=0x171000, EntryPoint=0x71b5d650)) returned 1 [0089.985] GetLastError () returned 0x3f0 [0089.985] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x71ab0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="WindowsCodecs.dll") returned 0x11 [0089.986] GetLastError () returned 0x3f0 [0089.986] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x71ab0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")) returned 0x25 [0089.987] GetLastError () returned 0x3f0 [0089.987] GetModuleInformation (in: hProcess=0x35c, hModule=0x77ba0000, lpmodinfo=0x2841d58, cb=0xc | out: lpmodinfo=0x2841d58*(lpBaseOfDll=0x77ba0000, SizeOfImage=0x92000, EntryPoint=0x77bd44d0)) returned 1 [0089.987] GetLastError () returned 0x3f0 [0089.987] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77ba0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0089.988] GetLastError () returned 0x3f0 [0089.988] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77ba0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\OLEAUT32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")) returned 0x20 [0089.989] GetLastError () returned 0x3f0 [0089.989] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b20000, lpmodinfo=0x2842e5c, cb=0xc | out: lpmodinfo=0x2842e5c*(lpBaseOfDll=0x74b20000, SizeOfImage=0x6000, EntryPoint=0x74b21570)) returned 1 [0089.990] GetLastError () returned 0x3f0 [0089.990] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b20000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shfolder.dll") returned 0xc [0089.990] GetLastError () returned 0x3f0 [0089.991] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b20000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll")) returned 0x20 [0089.991] GetLastError () returned 0x3f0 [0089.991] CloseHandle (hObject=0x35c) returned 1 [0089.991] GetLastError () returned 0x3f0 [0090.022] GetCurrentProcessId () returned 0xe98 [0090.022] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x35c [0090.022] GetLastError () returned 0x3f0 [0090.022] EnumProcessModules (in: hProcess=0x35c, lphModule=0x289f5a4, cb=0x100, lpcbNeeded=0x69da90 | out: lphModule=0x289f5a4, lpcbNeeded=0x69da90) returned 1 [0090.022] GetLastError () returned 0x3f0 [0090.022] GetModuleInformation (in: hProcess=0x35c, hModule=0x410000, lpmodinfo=0x289f6e4, cb=0xc | out: lpmodinfo=0x289f6e4*(lpBaseOfDll=0x410000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0090.023] GetLastError () returned 0x3f0 [0090.023] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x410000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="vfggggg.exe") returned 0xb [0090.023] GetLastError () returned 0x3f0 [0090.023] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x410000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0x31 [0090.023] GetLastError () returned 0x3f0 [0090.023] GetModuleInformation (in: hProcess=0x35c, hModule=0x77c40000, lpmodinfo=0x28a0824, cb=0xc | out: lpmodinfo=0x28a0824*(lpBaseOfDll=0x77c40000, SizeOfImage=0x179000, EntryPoint=0x0)) returned 1 [0090.023] GetLastError () returned 0x3f0 [0090.023] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0090.023] GetLastError () returned 0x3f0 [0090.023] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")) returned 0x1d [0090.024] GetLastError () returned 0x3f0 [0090.024] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f90000, lpmodinfo=0x28a1918, cb=0xc | out: lpmodinfo=0x28a1918*(lpBaseOfDll=0x73f90000, SizeOfImage=0x59000, EntryPoint=0x73fa0780)) returned 1 [0090.024] GetLastError () returned 0x3f0 [0090.024] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f90000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0090.024] GetLastError () returned 0x3f0 [0090.024] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f90000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0090.024] GetLastError () returned 0x3f0 [0090.024] GetModuleInformation (in: hProcess=0x35c, hModule=0x77670000, lpmodinfo=0x28a2a14, cb=0xc | out: lpmodinfo=0x28a2a14*(lpBaseOfDll=0x77670000, SizeOfImage=0xf0000, EntryPoint=0x776837d0)) returned 1 [0090.024] GetLastError () returned 0x3f0 [0090.024] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77670000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0090.025] GetLastError () returned 0x3f0 [0090.025] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77670000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNEL32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")) returned 0x20 [0090.025] GetLastError () returned 0x3f0 [0090.025] GetModuleInformation (in: hProcess=0x35c, hModule=0x76970000, lpmodinfo=0x28a3b18, cb=0xc | out: lpmodinfo=0x28a3b18*(lpBaseOfDll=0x76970000, SizeOfImage=0x176000, EntryPoint=0x76a0c9a0)) returned 1 [0090.025] GetLastError () returned 0x3f0 [0090.025] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76970000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0090.025] GetLastError () returned 0x3f0 [0090.025] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76970000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNELBASE.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")) returned 0x22 [0090.025] GetLastError () returned 0x3f0 [0090.025] GetModuleInformation (in: hProcess=0x35c, hModule=0x74c40000, lpmodinfo=0x28a4c54, cb=0xc | out: lpmodinfo=0x28a4c54*(lpBaseOfDll=0x74c40000, SizeOfImage=0x91000, EntryPoint=0x74c80ab0)) returned 1 [0090.026] GetLastError () returned 0x3f0 [0090.026] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="apphelp.dll") returned 0xb [0090.026] GetLastError () returned 0x3f0 [0090.026] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")) returned 0x1f [0090.026] GetLastError () returned 0x3f0 [0090.026] GetModuleInformation (in: hProcess=0x35c, hModule=0x77990000, lpmodinfo=0x28a5d50, cb=0xc | out: lpmodinfo=0x28a5d50*(lpBaseOfDll=0x77990000, SizeOfImage=0x7b000, EntryPoint=0x779ae3b0)) returned 1 [0090.026] GetLastError () returned 0x3f0 [0090.026] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77990000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0090.027] GetLastError () returned 0x3f0 [0090.027] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77990000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ADVAPI32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")) returned 0x20 [0090.027] GetLastError () returned 0x3f0 [0090.027] GetModuleInformation (in: hProcess=0x35c, hModule=0x77a10000, lpmodinfo=0x28a6e54, cb=0xc | out: lpmodinfo=0x28a6e54*(lpBaseOfDll=0x77a10000, SizeOfImage=0xbe000, EntryPoint=0x77a45630)) returned 1 [0090.027] GetLastError () returned 0x3f0 [0090.027] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77a10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0090.027] GetLastError () returned 0x3f0 [0090.027] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77a10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")) returned 0x1e [0090.028] GetLastError () returned 0x3f0 [0090.028] GetModuleInformation (in: hProcess=0x35c, hModule=0x77250000, lpmodinfo=0x28a7f50, cb=0xc | out: lpmodinfo=0x28a7f50*(lpBaseOfDll=0x77250000, SizeOfImage=0x43000, EntryPoint=0x7725f570)) returned 1 [0090.028] GetLastError () returned 0x3f0 [0090.028] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77250000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0090.028] GetLastError () returned 0x3f0 [0090.028] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77250000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")) returned 0x1f [0090.028] GetLastError () returned 0x3f0 [0090.028] GetModuleInformation (in: hProcess=0x35c, hModule=0x77af0000, lpmodinfo=0x28a909c, cb=0xc | out: lpmodinfo=0x28a909c*(lpBaseOfDll=0x77af0000, SizeOfImage=0xac000, EntryPoint=0x77b236b0)) returned 1 [0090.029] GetLastError () returned 0x3f0 [0090.029] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77af0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0090.029] GetLastError () returned 0x3f0 [0090.029] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77af0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\RPCRT4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")) returned 0x1e [0090.029] GetLastError () returned 0x3f0 [0090.029] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d50000, lpmodinfo=0x28aa198, cb=0xc | out: lpmodinfo=0x28aa198*(lpBaseOfDll=0x74d50000, SizeOfImage=0x1e000, EntryPoint=0x74d5b640)) returned 1 [0090.030] GetLastError () returned 0x3f0 [0090.030] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d50000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0090.030] GetLastError () returned 0x3f0 [0090.030] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d50000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SspiCli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")) returned 0x1f [0090.030] GetLastError () returned 0x3f0 [0090.030] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d40000, lpmodinfo=0x28ab294, cb=0xc | out: lpmodinfo=0x28ab294*(lpBaseOfDll=0x74d40000, SizeOfImage=0xa000, EntryPoint=0x74d42aa0)) returned 1 [0090.030] GetLastError () returned 0x3f0 [0090.030] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0090.031] GetLastError () returned 0x3f0 [0090.031] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTBASE.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")) returned 0x21 [0090.031] GetLastError () returned 0x3f0 [0090.031] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ce0000, lpmodinfo=0x28ac398, cb=0xc | out: lpmodinfo=0x28ac398*(lpBaseOfDll=0x74ce0000, SizeOfImage=0x59000, EntryPoint=0x74d18cc0)) returned 1 [0090.031] GetLastError () returned 0x3f0 [0090.031] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ce0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcryptPrimitives.dll") returned 0x14 [0090.032] GetLastError () returned 0x3f0 [0090.032] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ce0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")) returned 0x28 [0090.032] GetLastError () returned 0x3f0 [0090.032] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f10000, lpmodinfo=0x28ad4bc, cb=0xc | out: lpmodinfo=0x28ad4bc*(lpBaseOfDll=0x73f10000, SizeOfImage=0x78000, EntryPoint=0x73f11000)) returned 1 [0090.032] GetLastError () returned 0x3f0 [0090.032] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0090.033] GetLastError () returned 0x3f0 [0090.033] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0090.033] GetLastError () returned 0x3f0 [0090.033] GetModuleInformation (in: hProcess=0x35c, hModule=0x75080000, lpmodinfo=0x28ae5f4, cb=0xc | out: lpmodinfo=0x28ae5f4*(lpBaseOfDll=0x75080000, SizeOfImage=0x44000, EntryPoint=0x7509d810)) returned 1 [0090.033] GetLastError () returned 0x3f0 [0090.033] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x75080000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0090.034] GetLastError () returned 0x3f0 [0090.034] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x75080000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SHLWAPI.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")) returned 0x1f [0090.034] GetLastError () returned 0x3f0 [0090.034] GetModuleInformation (in: hProcess=0x35c, hModule=0x77090000, lpmodinfo=0x28af6f0, cb=0xc | out: lpmodinfo=0x28af6f0*(lpBaseOfDll=0x77090000, SizeOfImage=0x1ba000, EntryPoint=0x7716cbb0)) returned 1 [0090.034] GetLastError () returned 0x3f0 [0090.034] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77090000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="combase.dll") returned 0xb [0090.035] GetLastError () returned 0x3f0 [0090.035] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77090000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")) returned 0x1f [0090.035] GetLastError () returned 0x3f0 [0090.035] GetModuleInformation (in: hProcess=0x35c, hModule=0x76ca0000, lpmodinfo=0x28b07ec, cb=0xc | out: lpmodinfo=0x28b07ec*(lpBaseOfDll=0x76ca0000, SizeOfImage=0x14d000, EntryPoint=0x76d525d0)) returned 1 [0090.035] GetLastError () returned 0x3f0 [0090.036] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76ca0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0090.036] GetLastError () returned 0x3f0 [0090.036] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76ca0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\GDI32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")) returned 0x1d [0090.036] GetLastError () returned 0x3f0 [0090.036] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d70000, lpmodinfo=0x28b1970, cb=0xc | out: lpmodinfo=0x28b1970*(lpBaseOfDll=0x74d70000, SizeOfImage=0x140000, EntryPoint=0x74d80280)) returned 1 [0090.037] GetLastError () returned 0x3f0 [0090.037] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0090.037] GetLastError () returned 0x3f0 [0090.037] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\USER32.dll" (normalized: "c:\\windows\\system32\\user32.dll")) returned 0x1e [0090.038] GetLastError () returned 0x3f0 [0090.038] GetModuleInformation (in: hProcess=0x35c, hModule=0x775e0000, lpmodinfo=0x28b2a6c, cb=0xc | out: lpmodinfo=0x28b2a6c*(lpBaseOfDll=0x775e0000, SizeOfImage=0x2b000, EntryPoint=0x775e52b0)) returned 1 [0090.038] GetLastError () returned 0x3f0 [0090.038] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x775e0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0090.038] GetLastError () returned 0x3f0 [0090.038] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x775e0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0090.039] GetLastError () returned 0x3f0 [0090.039] GetModuleInformation (in: hProcess=0x35c, hModule=0x76f70000, lpmodinfo=0x28b3b60, cb=0xc | out: lpmodinfo=0x28b3b60*(lpBaseOfDll=0x76f70000, SizeOfImage=0x120000, EntryPoint=0x76fb46e0)) returned 1 [0090.039] GetLastError () returned 0x3f0 [0090.039] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76f70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0090.040] GetLastError () returned 0x3f0 [0090.040] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76f70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCTF.dll" (normalized: "c:\\windows\\system32\\msctf.dll")) returned 0x1d [0090.040] GetLastError () returned 0x3f0 [0090.040] GetModuleInformation (in: hProcess=0x35c, hModule=0x76f60000, lpmodinfo=0x28b4c54, cb=0xc | out: lpmodinfo=0x28b4c54*(lpBaseOfDll=0x76f60000, SizeOfImage=0xc000, EntryPoint=0x76f63920)) returned 1 [0090.040] GetLastError () returned 0x3f0 [0090.040] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76f60000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="kernel.appcore.dll") returned 0x12 [0090.041] GetLastError () returned 0x3f0 [0090.041] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76f60000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")) returned 0x26 [0090.041] GetLastError () returned 0x3f0 [0090.041] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f00000, lpmodinfo=0x28b5d70, cb=0xc | out: lpmodinfo=0x28b5d70*(lpBaseOfDll=0x73f00000, SizeOfImage=0x8000, EntryPoint=0x73f017c0)) returned 1 [0090.042] GetLastError () returned 0x3f0 [0090.042] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f00000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0090.042] GetLastError () returned 0x3f0 [0090.042] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f00000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0090.043] GetLastError () returned 0x3f0 [0090.043] GetModuleInformation (in: hProcess=0x35c, hModule=0x73950000, lpmodinfo=0x28b6e6c, cb=0xc | out: lpmodinfo=0x28b6e6c*(lpBaseOfDll=0x73950000, SizeOfImage=0x5b0000, EntryPoint=0x7399a848)) returned 1 [0090.043] GetLastError () returned 0x3f0 [0090.043] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73950000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorwks.dll") returned 0xc [0090.043] GetLastError () returned 0x3f0 [0090.043] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73950000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll")) returned 0x3a [0090.044] GetLastError () returned 0x3f0 [0090.044] GetModuleInformation (in: hProcess=0x35c, hModule=0x738b0000, lpmodinfo=0x28b7fa4, cb=0xc | out: lpmodinfo=0x28b7fa4*(lpBaseOfDll=0x738b0000, SizeOfImage=0x9b000, EntryPoint=0x738b232b)) returned 1 [0090.044] GetLastError () returned 0x3f0 [0090.044] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x738b0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSVCR80.dll") returned 0xb [0090.045] GetLastError () returned 0x3f0 [0090.045] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x738b0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\MSVCR80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\msvcr80.dll")) returned 0x6a [0090.045] GetLastError () returned 0x3f0 [0090.045] GetModuleInformation (in: hProcess=0x35c, hModule=0x755b0000, lpmodinfo=0x28b9138, cb=0xc | out: lpmodinfo=0x28b9138*(lpBaseOfDll=0x755b0000, SizeOfImage=0x13bf000, EntryPoint=0x75769ea0)) returned 1 [0090.046] GetLastError () returned 0x3f0 [0090.046] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x755b0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shell32.dll") returned 0xb [0090.046] GetLastError () returned 0x3f0 [0090.046] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x755b0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")) returned 0x1f [0090.047] GetLastError () returned 0x3f0 [0090.047] GetModuleInformation (in: hProcess=0x35c, hModule=0x750d0000, lpmodinfo=0x28ba234, cb=0xc | out: lpmodinfo=0x28ba234*(lpBaseOfDll=0x750d0000, SizeOfImage=0x4dd000, EntryPoint=0x752c7460)) returned 1 [0090.047] GetLastError () returned 0x3f0 [0090.047] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x750d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="windows.storage.dll") returned 0x13 [0090.048] GetLastError () returned 0x3f0 [0090.048] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x750d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")) returned 0x27 [0090.048] GetLastError () returned 0x3f0 [0090.048] GetModuleInformation (in: hProcess=0x35c, hModule=0x778a0000, lpmodinfo=0x28bb350, cb=0xc | out: lpmodinfo=0x28bb350*(lpBaseOfDll=0x778a0000, SizeOfImage=0x8d000, EntryPoint=0x778e91a0)) returned 1 [0090.049] GetLastError () returned 0x3f0 [0090.049] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x778a0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shcore.dll") returned 0xa [0090.049] GetLastError () returned 0x3f0 [0090.049] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x778a0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shcore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")) returned 0x1e [0090.050] GetLastError () returned 0x3f0 [0090.050] GetModuleInformation (in: hProcess=0x35c, hModule=0x777f0000, lpmodinfo=0x28bc44c, cb=0xc | out: lpmodinfo=0x28bc44c*(lpBaseOfDll=0x777f0000, SizeOfImage=0x44000, EntryPoint=0x777f7280)) returned 1 [0090.050] GetLastError () returned 0x3f0 [0090.050] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x777f0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="powrprof.dll") returned 0xc [0090.051] GetLastError () returned 0x3f0 [0090.051] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x777f0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")) returned 0x20 [0090.052] GetLastError () returned 0x3f0 [0090.052] GetModuleInformation (in: hProcess=0x35c, hModule=0x75070000, lpmodinfo=0x28bd550, cb=0xc | out: lpmodinfo=0x28bd550*(lpBaseOfDll=0x75070000, SizeOfImage=0xf000, EntryPoint=0x75072e40)) returned 1 [0090.052] GetLastError () returned 0x3f0 [0090.052] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x75070000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="profapi.dll") returned 0xb [0090.053] GetLastError () returned 0x3f0 [0090.053] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x75070000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")) returned 0x1f [0090.053] GetLastError () returned 0x3f0 [0090.053] GetModuleInformation (in: hProcess=0x35c, hModule=0x72db0000, lpmodinfo=0x28be64c, cb=0xc | out: lpmodinfo=0x28be64c*(lpBaseOfDll=0x72db0000, SizeOfImage=0xafa000, EntryPoint=0x0)) returned 1 [0090.054] GetLastError () returned 0x3f0 [0090.054] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x72db0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0090.054] GetLastError () returned 0x3f0 [0090.054] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x72db0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll")) returned 0x68 [0090.055] GetLastError () returned 0x3f0 [0090.055] GetModuleInformation (in: hProcess=0x35c, hModule=0x77430000, lpmodinfo=0x28bf7e4, cb=0xc | out: lpmodinfo=0x28bf7e4*(lpBaseOfDll=0x77430000, SizeOfImage=0xea000, EntryPoint=0x7746b990)) returned 1 [0090.055] GetLastError () returned 0x3f0 [0090.055] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77430000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0090.056] GetLastError () returned 0x3f0 [0090.056] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77430000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")) returned 0x1d [0090.056] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ab0000, lpmodinfo=0x28c08d8, cb=0xc | out: lpmodinfo=0x28c08d8*(lpBaseOfDll=0x74ab0000, SizeOfImage=0x5b000, EntryPoint=0x74af8ff8)) returned 1 [0090.057] GetLastError () returned 0x3f0 [0090.057] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ab0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorjit.dll") returned 0xc [0090.057] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ab0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll")) returned 0x3a [0090.058] GetModuleInformation (in: hProcess=0x35c, hModule=0x74060000, lpmodinfo=0x28c1a10, cb=0xc | out: lpmodinfo=0x28c1a10*(lpBaseOfDll=0x74060000, SizeOfImage=0x7a3000, EntryPoint=0x0)) returned 1 [0090.058] GetLastError () returned 0x3f0 [0090.059] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74060000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0090.059] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74060000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\b0de8183f9e33cd0fbe10c8db1402653\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\b0de8183f9e33cd0fbe10c8db1402653\\system.ni.dll")) returned 0x64 [0090.060] GetModuleInformation (in: hProcess=0x35c, hModule=0x74920000, lpmodinfo=0x28c2cac, cb=0xc | out: lpmodinfo=0x28c2cac*(lpBaseOfDll=0x74920000, SizeOfImage=0x189000, EntryPoint=0x0)) returned 1 [0090.060] GetLastError () returned 0x3f0 [0090.060] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74920000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0090.061] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74920000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\cebfffe6cee14413d504056227f496b2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\cebfffe6cee14413d504056227f496b2\\system.drawing.ni.dll")) returned 0x74 [0090.061] GetModuleInformation (in: hProcess=0x35c, hModule=0x721d0000, lpmodinfo=0x28c3e68, cb=0xc | out: lpmodinfo=0x28c3e68*(lpBaseOfDll=0x721d0000, SizeOfImage=0xbe0000, EntryPoint=0x0)) returned 1 [0090.062] GetLastError () returned 0x3f0 [0090.062] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x721d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0090.062] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x721d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\e3f653c6d321c4c528daa164908e0ff8\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\e3f653c6d321c4c528daa164908e0ff8\\system.windows.forms.ni.dll")) returned 0x80 [0090.063] GetModuleInformation (in: hProcess=0x35c, hModule=0x74bc0000, lpmodinfo=0x28c5048, cb=0xc | out: lpmodinfo=0x28c5048*(lpBaseOfDll=0x74bc0000, SizeOfImage=0x75000, EntryPoint=0x74bf98d0)) returned 1 [0090.064] GetLastError () returned 0x3f0 [0090.064] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74bc0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0090.064] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74bc0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0090.065] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ba0000, lpmodinfo=0x28c6144, cb=0xc | out: lpmodinfo=0x28c6144*(lpBaseOfDll=0x74ba0000, SizeOfImage=0x1d000, EntryPoint=0x74ba3bb0)) returned 1 [0090.065] GetLastError () returned 0x3f0 [0090.065] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ba0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="dwmapi.dll") returned 0xa [0090.066] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ba0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")) returned 0x1e [0090.067] GetModuleInformation (in: hProcess=0x35c, hModule=0x72060000, lpmodinfo=0x28c7240, cb=0xc | out: lpmodinfo=0x28c7240*(lpBaseOfDll=0x72060000, SizeOfImage=0x16b000, EntryPoint=0x720ce360)) returned 1 [0090.067] GetLastError () returned 0x3f0 [0090.067] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x72060000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="gdiplus.dll") returned 0xb [0090.068] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x72060000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll")) returned 0x72 [0090.069] GetModuleInformation (in: hProcess=0x35c, hModule=0x71e70000, lpmodinfo=0x28c83e4, cb=0xc | out: lpmodinfo=0x28c83e4*(lpBaseOfDll=0x71e70000, SizeOfImage=0x1f0000, EntryPoint=0x71f569e0)) returned 1 [0090.069] GetLastError () returned 0x3f0 [0090.069] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x71e70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="DWrite.dll") returned 0xa [0090.070] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x71e70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll")) returned 0x1e [0090.070] GetModuleInformation (in: hProcess=0x35c, hModule=0x71c30000, lpmodinfo=0x28c94e0, cb=0xc | out: lpmodinfo=0x28c94e0*(lpBaseOfDll=0x71c30000, SizeOfImage=0x236000, EntryPoint=0x0)) returned 1 [0090.071] GetLastError () returned 0x3f0 [0090.071] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x71c30000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0090.072] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x71c30000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\40661cdfbf2201f3d6c5cf6378755082\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\40661cdfbf2201f3d6c5cf6378755082\\system.core.ni.dll")) returned 0x6e [0090.072] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b80000, lpmodinfo=0x28ca68c, cb=0xc | out: lpmodinfo=0x28ca68c*(lpBaseOfDll=0x74b80000, SizeOfImage=0x13000, EntryPoint=0x74b89500)) returned 1 [0090.073] GetLastError () returned 0x3f0 [0090.073] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b80000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0090.074] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b80000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0090.074] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b60000, lpmodinfo=0x28cb788, cb=0xc | out: lpmodinfo=0x28cb788*(lpBaseOfDll=0x74b60000, SizeOfImage=0x1b000, EntryPoint=0x74b69010)) returned 1 [0090.075] GetLastError () returned 0x3f0 [0090.075] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b60000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcrypt.dll") returned 0xa [0090.076] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b60000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")) returned 0x1e [0090.076] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b30000, lpmodinfo=0x28cc884, cb=0xc | out: lpmodinfo=0x28cc884*(lpBaseOfDll=0x74b30000, SizeOfImage=0x2f000, EntryPoint=0x74b49530)) returned 1 [0090.077] GetLastError () returned 0x3f0 [0090.077] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b30000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0090.078] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b30000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0090.078] GetModuleInformation (in: hProcess=0x35c, hModule=0x773d0000, lpmodinfo=0x28cd980, cb=0xc | out: lpmodinfo=0x28cd980*(lpBaseOfDll=0x773d0000, SizeOfImage=0x6000, EntryPoint=0x773d1480)) returned 1 [0090.079] GetLastError () returned 0x3f0 [0090.079] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x773d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0090.080] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x773d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")) returned 0x1d [0090.080] GetModuleInformation (in: hProcess=0x35c, hModule=0x71ab0000, lpmodinfo=0x28cea74, cb=0xc | out: lpmodinfo=0x28cea74*(lpBaseOfDll=0x71ab0000, SizeOfImage=0x171000, EntryPoint=0x71b5d650)) returned 1 [0090.081] GetLastError () returned 0x3f0 [0090.081] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x71ab0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="WindowsCodecs.dll") returned 0x11 [0090.082] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x71ab0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")) returned 0x25 [0090.082] GetModuleInformation (in: hProcess=0x35c, hModule=0x77ba0000, lpmodinfo=0x28cfb88, cb=0xc | out: lpmodinfo=0x28cfb88*(lpBaseOfDll=0x77ba0000, SizeOfImage=0x92000, EntryPoint=0x77bd44d0)) returned 1 [0090.083] GetLastError () returned 0x3f0 [0090.083] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77ba0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0090.084] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77ba0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\OLEAUT32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")) returned 0x20 [0090.085] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b20000, lpmodinfo=0x28d0c8c, cb=0xc | out: lpmodinfo=0x28d0c8c*(lpBaseOfDll=0x74b20000, SizeOfImage=0x6000, EntryPoint=0x74b21570)) returned 1 [0090.085] GetLastError () returned 0x3f0 [0090.085] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b20000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shfolder.dll") returned 0xc [0090.086] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b20000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll")) returned 0x20 [0090.087] CloseHandle (hObject=0x35c) returned 1 [0090.087] GetLastError () returned 0x3f0 [0090.107] GetCurrentProcessId () returned 0xe98 [0090.107] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x35c [0090.107] GetLastError () returned 0x3f0 [0090.107] EnumProcessModules (in: hProcess=0x35c, lphModule=0x292d3ec, cb=0x100, lpcbNeeded=0x69da90 | out: lphModule=0x292d3ec, lpcbNeeded=0x69da90) returned 1 [0090.107] GetLastError () returned 0x3f0 [0090.107] GetModuleInformation (in: hProcess=0x35c, hModule=0x410000, lpmodinfo=0x292d52c, cb=0xc | out: lpmodinfo=0x292d52c*(lpBaseOfDll=0x410000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0090.108] GetLastError () returned 0x3f0 [0090.108] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x410000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="vfggggg.exe") returned 0xb [0090.108] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x410000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0x31 [0090.108] GetModuleInformation (in: hProcess=0x35c, hModule=0x77c40000, lpmodinfo=0x292e66c, cb=0xc | out: lpmodinfo=0x292e66c*(lpBaseOfDll=0x77c40000, SizeOfImage=0x179000, EntryPoint=0x0)) returned 1 [0090.108] GetLastError () returned 0x3f0 [0090.108] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0090.108] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")) returned 0x1d [0090.108] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f90000, lpmodinfo=0x292f760, cb=0xc | out: lpmodinfo=0x292f760*(lpBaseOfDll=0x73f90000, SizeOfImage=0x59000, EntryPoint=0x73fa0780)) returned 1 [0090.109] GetLastError () returned 0x3f0 [0090.109] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f90000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0090.109] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f90000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0090.109] GetModuleInformation (in: hProcess=0x35c, hModule=0x77670000, lpmodinfo=0x293085c, cb=0xc | out: lpmodinfo=0x293085c*(lpBaseOfDll=0x77670000, SizeOfImage=0xf0000, EntryPoint=0x776837d0)) returned 1 [0090.109] GetLastError () returned 0x3f0 [0090.109] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77670000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0090.109] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77670000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNEL32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")) returned 0x20 [0090.109] GetModuleInformation (in: hProcess=0x35c, hModule=0x76970000, lpmodinfo=0x2931960, cb=0xc | out: lpmodinfo=0x2931960*(lpBaseOfDll=0x76970000, SizeOfImage=0x176000, EntryPoint=0x76a0c9a0)) returned 1 [0090.110] GetLastError () returned 0x3f0 [0090.110] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76970000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0090.110] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76970000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNELBASE.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")) returned 0x22 [0090.110] GetModuleInformation (in: hProcess=0x35c, hModule=0x74c40000, lpmodinfo=0x2932a9c, cb=0xc | out: lpmodinfo=0x2932a9c*(lpBaseOfDll=0x74c40000, SizeOfImage=0x91000, EntryPoint=0x74c80ab0)) returned 1 [0090.110] GetLastError () returned 0x3f0 [0090.110] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="apphelp.dll") returned 0xb [0090.110] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")) returned 0x1f [0090.111] GetModuleInformation (in: hProcess=0x35c, hModule=0x77990000, lpmodinfo=0x2933b98, cb=0xc | out: lpmodinfo=0x2933b98*(lpBaseOfDll=0x77990000, SizeOfImage=0x7b000, EntryPoint=0x779ae3b0)) returned 1 [0090.111] GetLastError () returned 0x3f0 [0090.111] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77990000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0090.111] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77990000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ADVAPI32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")) returned 0x20 [0090.111] GetModuleInformation (in: hProcess=0x35c, hModule=0x77a10000, lpmodinfo=0x2934c9c, cb=0xc | out: lpmodinfo=0x2934c9c*(lpBaseOfDll=0x77a10000, SizeOfImage=0xbe000, EntryPoint=0x77a45630)) returned 1 [0090.112] GetLastError () returned 0x3f0 [0090.112] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77a10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0090.112] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77a10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")) returned 0x1e [0090.112] GetModuleInformation (in: hProcess=0x35c, hModule=0x77250000, lpmodinfo=0x2935d98, cb=0xc | out: lpmodinfo=0x2935d98*(lpBaseOfDll=0x77250000, SizeOfImage=0x43000, EntryPoint=0x7725f570)) returned 1 [0090.112] GetLastError () returned 0x3f0 [0090.112] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77250000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0090.113] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77250000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")) returned 0x1f [0090.113] GetModuleInformation (in: hProcess=0x35c, hModule=0x77af0000, lpmodinfo=0x2936ee4, cb=0xc | out: lpmodinfo=0x2936ee4*(lpBaseOfDll=0x77af0000, SizeOfImage=0xac000, EntryPoint=0x77b236b0)) returned 1 [0090.113] GetLastError () returned 0x3f0 [0090.113] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77af0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0090.113] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77af0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\RPCRT4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")) returned 0x1e [0090.114] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d50000, lpmodinfo=0x2937fe0, cb=0xc | out: lpmodinfo=0x2937fe0*(lpBaseOfDll=0x74d50000, SizeOfImage=0x1e000, EntryPoint=0x74d5b640)) returned 1 [0090.114] GetLastError () returned 0x3f0 [0090.114] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d50000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0090.115] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d50000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SspiCli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")) returned 0x1f [0090.115] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d40000, lpmodinfo=0x29390dc, cb=0xc | out: lpmodinfo=0x29390dc*(lpBaseOfDll=0x74d40000, SizeOfImage=0xa000, EntryPoint=0x74d42aa0)) returned 1 [0090.115] GetLastError () returned 0x3f0 [0090.115] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0090.115] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTBASE.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")) returned 0x21 [0090.116] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ce0000, lpmodinfo=0x293a1e0, cb=0xc | out: lpmodinfo=0x293a1e0*(lpBaseOfDll=0x74ce0000, SizeOfImage=0x59000, EntryPoint=0x74d18cc0)) returned 1 [0090.116] GetLastError () returned 0x3f0 [0090.116] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ce0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcryptPrimitives.dll") returned 0x14 [0090.116] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ce0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")) returned 0x28 [0090.117] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f10000, lpmodinfo=0x293b304, cb=0xc | out: lpmodinfo=0x293b304*(lpBaseOfDll=0x73f10000, SizeOfImage=0x78000, EntryPoint=0x73f11000)) returned 1 [0090.117] GetLastError () returned 0x3f0 [0090.117] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0090.117] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0090.118] GetModuleInformation (in: hProcess=0x35c, hModule=0x75080000, lpmodinfo=0x293c43c, cb=0xc | out: lpmodinfo=0x293c43c*(lpBaseOfDll=0x75080000, SizeOfImage=0x44000, EntryPoint=0x7509d810)) returned 1 [0090.118] GetLastError () returned 0x3f0 [0090.118] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x75080000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0090.118] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x75080000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SHLWAPI.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")) returned 0x1f [0090.118] GetModuleInformation (in: hProcess=0x35c, hModule=0x77090000, lpmodinfo=0x293d538, cb=0xc | out: lpmodinfo=0x293d538*(lpBaseOfDll=0x77090000, SizeOfImage=0x1ba000, EntryPoint=0x7716cbb0)) returned 1 [0090.119] GetLastError () returned 0x3f0 [0090.119] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77090000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="combase.dll") returned 0xb [0090.119] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77090000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")) returned 0x1f [0090.119] GetModuleInformation (in: hProcess=0x35c, hModule=0x76ca0000, lpmodinfo=0x293e634, cb=0xc | out: lpmodinfo=0x293e634*(lpBaseOfDll=0x76ca0000, SizeOfImage=0x14d000, EntryPoint=0x76d525d0)) returned 1 [0090.120] GetLastError () returned 0x3f0 [0090.120] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76ca0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0090.120] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76ca0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\GDI32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")) returned 0x1d [0090.121] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d70000, lpmodinfo=0x293f7b8, cb=0xc | out: lpmodinfo=0x293f7b8*(lpBaseOfDll=0x74d70000, SizeOfImage=0x140000, EntryPoint=0x74d80280)) returned 1 [0090.121] GetLastError () returned 0x3f0 [0090.121] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0090.121] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\USER32.dll" (normalized: "c:\\windows\\system32\\user32.dll")) returned 0x1e [0090.122] GetModuleInformation (in: hProcess=0x35c, hModule=0x775e0000, lpmodinfo=0x29408b4, cb=0xc | out: lpmodinfo=0x29408b4*(lpBaseOfDll=0x775e0000, SizeOfImage=0x2b000, EntryPoint=0x775e52b0)) returned 1 [0090.122] GetLastError () returned 0x3f0 [0090.122] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x775e0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0090.122] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x775e0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0090.123] GetModuleInformation (in: hProcess=0x35c, hModule=0x76f70000, lpmodinfo=0x29419a8, cb=0xc | out: lpmodinfo=0x29419a8*(lpBaseOfDll=0x76f70000, SizeOfImage=0x120000, EntryPoint=0x76fb46e0)) returned 1 [0090.123] GetLastError () returned 0x3f0 [0090.123] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76f70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0090.123] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76f70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCTF.dll" (normalized: "c:\\windows\\system32\\msctf.dll")) returned 0x1d [0090.124] GetModuleInformation (in: hProcess=0x35c, hModule=0x76f60000, lpmodinfo=0x2942a9c, cb=0xc | out: lpmodinfo=0x2942a9c*(lpBaseOfDll=0x76f60000, SizeOfImage=0xc000, EntryPoint=0x76f63920)) returned 1 [0090.124] GetLastError () returned 0x3f0 [0090.124] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76f60000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="kernel.appcore.dll") returned 0x12 [0090.125] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76f60000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")) returned 0x26 [0090.125] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f00000, lpmodinfo=0x2943bb8, cb=0xc | out: lpmodinfo=0x2943bb8*(lpBaseOfDll=0x73f00000, SizeOfImage=0x8000, EntryPoint=0x73f017c0)) returned 1 [0090.125] GetLastError () returned 0x3f0 [0090.125] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f00000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0090.126] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f00000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0090.126] GetModuleInformation (in: hProcess=0x35c, hModule=0x73950000, lpmodinfo=0x2944cb4, cb=0xc | out: lpmodinfo=0x2944cb4*(lpBaseOfDll=0x73950000, SizeOfImage=0x5b0000, EntryPoint=0x7399a848)) returned 1 [0090.127] GetLastError () returned 0x3f0 [0090.127] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73950000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorwks.dll") returned 0xc [0090.127] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73950000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll")) returned 0x3a [0090.128] GetModuleInformation (in: hProcess=0x35c, hModule=0x738b0000, lpmodinfo=0x2945dec, cb=0xc | out: lpmodinfo=0x2945dec*(lpBaseOfDll=0x738b0000, SizeOfImage=0x9b000, EntryPoint=0x738b232b)) returned 1 [0090.128] GetLastError () returned 0x3f0 [0090.128] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x738b0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSVCR80.dll") returned 0xb [0090.128] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x738b0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\MSVCR80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\msvcr80.dll")) returned 0x6a [0090.129] GetModuleInformation (in: hProcess=0x35c, hModule=0x755b0000, lpmodinfo=0x2946f80, cb=0xc | out: lpmodinfo=0x2946f80*(lpBaseOfDll=0x755b0000, SizeOfImage=0x13bf000, EntryPoint=0x75769ea0)) returned 1 [0090.129] GetLastError () returned 0x3f0 [0090.129] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x755b0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shell32.dll") returned 0xb [0090.130] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x755b0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")) returned 0x1f [0090.130] GetModuleInformation (in: hProcess=0x35c, hModule=0x750d0000, lpmodinfo=0x294807c, cb=0xc | out: lpmodinfo=0x294807c*(lpBaseOfDll=0x750d0000, SizeOfImage=0x4dd000, EntryPoint=0x752c7460)) returned 1 [0090.131] GetLastError () returned 0x3f0 [0090.131] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x750d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="windows.storage.dll") returned 0x13 [0090.131] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x750d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")) returned 0x27 [0090.132] GetModuleInformation (in: hProcess=0x35c, hModule=0x778a0000, lpmodinfo=0x2949198, cb=0xc | out: lpmodinfo=0x2949198*(lpBaseOfDll=0x778a0000, SizeOfImage=0x8d000, EntryPoint=0x778e91a0)) returned 1 [0090.132] GetLastError () returned 0x3f0 [0090.132] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x778a0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shcore.dll") returned 0xa [0090.133] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x778a0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shcore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")) returned 0x1e [0090.133] GetModuleInformation (in: hProcess=0x35c, hModule=0x777f0000, lpmodinfo=0x294a294, cb=0xc | out: lpmodinfo=0x294a294*(lpBaseOfDll=0x777f0000, SizeOfImage=0x44000, EntryPoint=0x777f7280)) returned 1 [0090.134] GetLastError () returned 0x3f0 [0090.134] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x777f0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="powrprof.dll") returned 0xc [0090.134] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x777f0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")) returned 0x20 [0090.135] GetModuleInformation (in: hProcess=0x35c, hModule=0x75070000, lpmodinfo=0x294b398, cb=0xc | out: lpmodinfo=0x294b398*(lpBaseOfDll=0x75070000, SizeOfImage=0xf000, EntryPoint=0x75072e40)) returned 1 [0090.135] GetLastError () returned 0x3f0 [0090.135] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x75070000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="profapi.dll") returned 0xb [0090.136] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x75070000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")) returned 0x1f [0090.136] GetModuleInformation (in: hProcess=0x35c, hModule=0x72db0000, lpmodinfo=0x294c494, cb=0xc | out: lpmodinfo=0x294c494*(lpBaseOfDll=0x72db0000, SizeOfImage=0xafa000, EntryPoint=0x0)) returned 1 [0090.137] GetLastError () returned 0x3f0 [0090.137] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x72db0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0090.137] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x72db0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll")) returned 0x68 [0090.138] GetModuleInformation (in: hProcess=0x35c, hModule=0x77430000, lpmodinfo=0x294d62c, cb=0xc | out: lpmodinfo=0x294d62c*(lpBaseOfDll=0x77430000, SizeOfImage=0xea000, EntryPoint=0x7746b990)) returned 1 [0090.138] GetLastError () returned 0x3f0 [0090.138] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77430000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0090.139] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77430000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")) returned 0x1d [0090.139] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ab0000, lpmodinfo=0x294e720, cb=0xc | out: lpmodinfo=0x294e720*(lpBaseOfDll=0x74ab0000, SizeOfImage=0x5b000, EntryPoint=0x74af8ff8)) returned 1 [0090.140] GetLastError () returned 0x3f0 [0090.140] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ab0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorjit.dll") returned 0xc [0090.140] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ab0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll")) returned 0x3a [0090.141] GetModuleInformation (in: hProcess=0x35c, hModule=0x74060000, lpmodinfo=0x294f858, cb=0xc | out: lpmodinfo=0x294f858*(lpBaseOfDll=0x74060000, SizeOfImage=0x7a3000, EntryPoint=0x0)) returned 1 [0090.141] GetLastError () returned 0x3f0 [0090.141] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74060000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0090.142] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74060000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\b0de8183f9e33cd0fbe10c8db1402653\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\b0de8183f9e33cd0fbe10c8db1402653\\system.ni.dll")) returned 0x64 [0090.142] GetModuleInformation (in: hProcess=0x35c, hModule=0x74920000, lpmodinfo=0x2950af4, cb=0xc | out: lpmodinfo=0x2950af4*(lpBaseOfDll=0x74920000, SizeOfImage=0x189000, EntryPoint=0x0)) returned 1 [0090.143] GetLastError () returned 0x3f0 [0090.143] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74920000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0090.144] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74920000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\cebfffe6cee14413d504056227f496b2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\cebfffe6cee14413d504056227f496b2\\system.drawing.ni.dll")) returned 0x74 [0090.144] GetModuleInformation (in: hProcess=0x35c, hModule=0x721d0000, lpmodinfo=0x2951cb0, cb=0xc | out: lpmodinfo=0x2951cb0*(lpBaseOfDll=0x721d0000, SizeOfImage=0xbe0000, EntryPoint=0x0)) returned 1 [0090.145] GetLastError () returned 0x3f0 [0090.145] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x721d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0090.145] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x721d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\e3f653c6d321c4c528daa164908e0ff8\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\e3f653c6d321c4c528daa164908e0ff8\\system.windows.forms.ni.dll")) returned 0x80 [0090.146] GetModuleInformation (in: hProcess=0x35c, hModule=0x74bc0000, lpmodinfo=0x2952e90, cb=0xc | out: lpmodinfo=0x2952e90*(lpBaseOfDll=0x74bc0000, SizeOfImage=0x75000, EntryPoint=0x74bf98d0)) returned 1 [0090.147] GetLastError () returned 0x3f0 [0090.147] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74bc0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0090.147] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74bc0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0090.148] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ba0000, lpmodinfo=0x2953f8c, cb=0xc | out: lpmodinfo=0x2953f8c*(lpBaseOfDll=0x74ba0000, SizeOfImage=0x1d000, EntryPoint=0x74ba3bb0)) returned 1 [0090.148] GetLastError () returned 0x3f0 [0090.148] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ba0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="dwmapi.dll") returned 0xa [0090.149] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ba0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")) returned 0x1e [0090.150] GetModuleInformation (in: hProcess=0x35c, hModule=0x72060000, lpmodinfo=0x2955088, cb=0xc | out: lpmodinfo=0x2955088*(lpBaseOfDll=0x72060000, SizeOfImage=0x16b000, EntryPoint=0x720ce360)) returned 1 [0090.150] GetLastError () returned 0x3f0 [0090.150] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x72060000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="gdiplus.dll") returned 0xb [0090.151] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x72060000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll")) returned 0x72 [0090.151] GetModuleInformation (in: hProcess=0x35c, hModule=0x71e70000, lpmodinfo=0x295622c, cb=0xc | out: lpmodinfo=0x295622c*(lpBaseOfDll=0x71e70000, SizeOfImage=0x1f0000, EntryPoint=0x71f569e0)) returned 1 [0090.152] GetLastError () returned 0x3f0 [0090.152] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x71e70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="DWrite.dll") returned 0xa [0090.153] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x71e70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll")) returned 0x1e [0090.153] GetModuleInformation (in: hProcess=0x35c, hModule=0x71c30000, lpmodinfo=0x2957328, cb=0xc | out: lpmodinfo=0x2957328*(lpBaseOfDll=0x71c30000, SizeOfImage=0x236000, EntryPoint=0x0)) returned 1 [0090.154] GetLastError () returned 0x3f0 [0090.154] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x71c30000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0090.155] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x71c30000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\40661cdfbf2201f3d6c5cf6378755082\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\40661cdfbf2201f3d6c5cf6378755082\\system.core.ni.dll")) returned 0x6e [0090.155] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b80000, lpmodinfo=0x29584d4, cb=0xc | out: lpmodinfo=0x29584d4*(lpBaseOfDll=0x74b80000, SizeOfImage=0x13000, EntryPoint=0x74b89500)) returned 1 [0090.156] GetLastError () returned 0x3f0 [0090.156] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b80000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0090.157] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b80000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0090.157] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b60000, lpmodinfo=0x29595d0, cb=0xc | out: lpmodinfo=0x29595d0*(lpBaseOfDll=0x74b60000, SizeOfImage=0x1b000, EntryPoint=0x74b69010)) returned 1 [0090.158] GetLastError () returned 0x3f0 [0090.158] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b60000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcrypt.dll") returned 0xa [0090.158] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b60000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")) returned 0x1e [0090.159] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b30000, lpmodinfo=0x295a6cc, cb=0xc | out: lpmodinfo=0x295a6cc*(lpBaseOfDll=0x74b30000, SizeOfImage=0x2f000, EntryPoint=0x74b49530)) returned 1 [0090.160] GetLastError () returned 0x3f0 [0090.160] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b30000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0090.160] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b30000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0090.161] GetModuleInformation (in: hProcess=0x35c, hModule=0x773d0000, lpmodinfo=0x295b7c8, cb=0xc | out: lpmodinfo=0x295b7c8*(lpBaseOfDll=0x773d0000, SizeOfImage=0x6000, EntryPoint=0x773d1480)) returned 1 [0090.162] GetLastError () returned 0x3f0 [0090.162] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x773d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0090.163] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x773d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")) returned 0x1d [0090.163] GetModuleInformation (in: hProcess=0x35c, hModule=0x71ab0000, lpmodinfo=0x295c8bc, cb=0xc | out: lpmodinfo=0x295c8bc*(lpBaseOfDll=0x71ab0000, SizeOfImage=0x171000, EntryPoint=0x71b5d650)) returned 1 [0090.164] GetLastError () returned 0x3f0 [0090.164] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x71ab0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="WindowsCodecs.dll") returned 0x11 [0090.165] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x71ab0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")) returned 0x25 [0090.165] GetModuleInformation (in: hProcess=0x35c, hModule=0x77ba0000, lpmodinfo=0x295d9d0, cb=0xc | out: lpmodinfo=0x295d9d0*(lpBaseOfDll=0x77ba0000, SizeOfImage=0x92000, EntryPoint=0x77bd44d0)) returned 1 [0090.166] GetLastError () returned 0x3f0 [0090.166] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77ba0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0090.167] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77ba0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\OLEAUT32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")) returned 0x20 [0090.167] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b20000, lpmodinfo=0x295ead4, cb=0xc | out: lpmodinfo=0x295ead4*(lpBaseOfDll=0x74b20000, SizeOfImage=0x6000, EntryPoint=0x74b21570)) returned 1 [0090.168] GetLastError () returned 0x3f0 [0090.168] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b20000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shfolder.dll") returned 0xc [0090.169] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b20000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll")) returned 0x20 [0090.170] CloseHandle (hObject=0x35c) returned 1 [0090.170] GetLastError () returned 0x3f0 [0090.188] GetCurrentProcessId () returned 0xe98 [0090.188] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x35c [0090.188] GetLastError () returned 0x3f0 [0090.188] EnumProcessModules (in: hProcess=0x35c, lphModule=0x29bb20c, cb=0x100, lpcbNeeded=0x69da90 | out: lphModule=0x29bb20c, lpcbNeeded=0x69da90) returned 1 [0090.189] GetLastError () returned 0x3f0 [0090.189] GetModuleInformation (in: hProcess=0x35c, hModule=0x410000, lpmodinfo=0x29bb34c, cb=0xc | out: lpmodinfo=0x29bb34c*(lpBaseOfDll=0x410000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0090.189] GetLastError () returned 0x3f0 [0090.189] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x410000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="vfggggg.exe") returned 0xb [0090.189] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x410000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0x31 [0090.189] GetModuleInformation (in: hProcess=0x35c, hModule=0x77c40000, lpmodinfo=0x29bc48c, cb=0xc | out: lpmodinfo=0x29bc48c*(lpBaseOfDll=0x77c40000, SizeOfImage=0x179000, EntryPoint=0x0)) returned 1 [0090.189] GetLastError () returned 0x3f0 [0090.189] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0090.189] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")) returned 0x1d [0090.190] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f90000, lpmodinfo=0x29bd580, cb=0xc | out: lpmodinfo=0x29bd580*(lpBaseOfDll=0x73f90000, SizeOfImage=0x59000, EntryPoint=0x73fa0780)) returned 1 [0090.190] GetLastError () returned 0x3f0 [0090.190] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f90000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0090.190] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f90000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0090.190] GetModuleInformation (in: hProcess=0x35c, hModule=0x77670000, lpmodinfo=0x29be67c, cb=0xc | out: lpmodinfo=0x29be67c*(lpBaseOfDll=0x77670000, SizeOfImage=0xf0000, EntryPoint=0x776837d0)) returned 1 [0090.190] GetLastError () returned 0x3f0 [0090.190] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77670000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0090.191] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77670000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNEL32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")) returned 0x20 [0090.191] GetModuleInformation (in: hProcess=0x35c, hModule=0x76970000, lpmodinfo=0x29bf780, cb=0xc | out: lpmodinfo=0x29bf780*(lpBaseOfDll=0x76970000, SizeOfImage=0x176000, EntryPoint=0x76a0c9a0)) returned 1 [0090.191] GetLastError () returned 0x3f0 [0090.191] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76970000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0090.191] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76970000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNELBASE.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")) returned 0x22 [0090.191] GetModuleInformation (in: hProcess=0x35c, hModule=0x74c40000, lpmodinfo=0x29c08bc, cb=0xc | out: lpmodinfo=0x29c08bc*(lpBaseOfDll=0x74c40000, SizeOfImage=0x91000, EntryPoint=0x74c80ab0)) returned 1 [0090.191] GetLastError () returned 0x3f0 [0090.192] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="apphelp.dll") returned 0xb [0090.192] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")) returned 0x1f [0090.193] GetModuleInformation (in: hProcess=0x35c, hModule=0x77990000, lpmodinfo=0x29c19b8, cb=0xc | out: lpmodinfo=0x29c19b8*(lpBaseOfDll=0x77990000, SizeOfImage=0x7b000, EntryPoint=0x779ae3b0)) returned 1 [0090.193] GetLastError () returned 0x3f0 [0090.193] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77990000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0090.193] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77990000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ADVAPI32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")) returned 0x20 [0090.194] GetModuleInformation (in: hProcess=0x35c, hModule=0x77a10000, lpmodinfo=0x29c2abc, cb=0xc | out: lpmodinfo=0x29c2abc*(lpBaseOfDll=0x77a10000, SizeOfImage=0xbe000, EntryPoint=0x77a45630)) returned 1 [0090.194] GetLastError () returned 0x3f0 [0090.194] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77a10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0090.194] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77a10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")) returned 0x1e [0090.194] GetModuleInformation (in: hProcess=0x35c, hModule=0x77250000, lpmodinfo=0x29c3bb8, cb=0xc | out: lpmodinfo=0x29c3bb8*(lpBaseOfDll=0x77250000, SizeOfImage=0x43000, EntryPoint=0x7725f570)) returned 1 [0090.194] GetLastError () returned 0x3f0 [0090.194] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77250000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0090.195] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77250000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")) returned 0x1f [0090.195] GetModuleInformation (in: hProcess=0x35c, hModule=0x77af0000, lpmodinfo=0x29c4d04, cb=0xc | out: lpmodinfo=0x29c4d04*(lpBaseOfDll=0x77af0000, SizeOfImage=0xac000, EntryPoint=0x77b236b0)) returned 1 [0090.195] GetLastError () returned 0x3f0 [0090.195] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77af0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0090.195] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77af0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\RPCRT4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")) returned 0x1e [0090.196] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d50000, lpmodinfo=0x29c5e00, cb=0xc | out: lpmodinfo=0x29c5e00*(lpBaseOfDll=0x74d50000, SizeOfImage=0x1e000, EntryPoint=0x74d5b640)) returned 1 [0090.196] GetLastError () returned 0x3f0 [0090.196] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d50000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0090.196] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d50000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SspiCli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")) returned 0x1f [0090.197] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d40000, lpmodinfo=0x29c6efc, cb=0xc | out: lpmodinfo=0x29c6efc*(lpBaseOfDll=0x74d40000, SizeOfImage=0xa000, EntryPoint=0x74d42aa0)) returned 1 [0090.197] GetLastError () returned 0x3f0 [0090.197] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0090.197] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTBASE.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")) returned 0x21 [0090.197] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ce0000, lpmodinfo=0x29c8000, cb=0xc | out: lpmodinfo=0x29c8000*(lpBaseOfDll=0x74ce0000, SizeOfImage=0x59000, EntryPoint=0x74d18cc0)) returned 1 [0090.198] GetLastError () returned 0x3f0 [0090.198] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ce0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcryptPrimitives.dll") returned 0x14 [0090.198] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ce0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")) returned 0x28 [0090.198] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f10000, lpmodinfo=0x29c9124, cb=0xc | out: lpmodinfo=0x29c9124*(lpBaseOfDll=0x73f10000, SizeOfImage=0x78000, EntryPoint=0x73f11000)) returned 1 [0090.199] GetLastError () returned 0x3f0 [0090.199] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0090.199] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0090.199] GetModuleInformation (in: hProcess=0x35c, hModule=0x75080000, lpmodinfo=0x29ca25c, cb=0xc | out: lpmodinfo=0x29ca25c*(lpBaseOfDll=0x75080000, SizeOfImage=0x44000, EntryPoint=0x7509d810)) returned 1 [0090.199] GetLastError () returned 0x3f0 [0090.200] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x75080000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0090.200] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x75080000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SHLWAPI.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")) returned 0x1f [0090.200] GetModuleInformation (in: hProcess=0x35c, hModule=0x77090000, lpmodinfo=0x29cb358, cb=0xc | out: lpmodinfo=0x29cb358*(lpBaseOfDll=0x77090000, SizeOfImage=0x1ba000, EntryPoint=0x7716cbb0)) returned 1 [0090.200] GetLastError () returned 0x3f0 [0090.201] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77090000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="combase.dll") returned 0xb [0090.201] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77090000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")) returned 0x1f [0090.201] GetModuleInformation (in: hProcess=0x35c, hModule=0x76ca0000, lpmodinfo=0x29cc454, cb=0xc | out: lpmodinfo=0x29cc454*(lpBaseOfDll=0x76ca0000, SizeOfImage=0x14d000, EntryPoint=0x76d525d0)) returned 1 [0090.201] GetLastError () returned 0x3f0 [0090.202] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76ca0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0090.202] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76ca0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\GDI32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")) returned 0x1d [0090.202] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d70000, lpmodinfo=0x29cd5d8, cb=0xc | out: lpmodinfo=0x29cd5d8*(lpBaseOfDll=0x74d70000, SizeOfImage=0x140000, EntryPoint=0x74d80280)) returned 1 [0090.203] GetLastError () returned 0x3f0 [0090.203] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0090.203] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\USER32.dll" (normalized: "c:\\windows\\system32\\user32.dll")) returned 0x1e [0090.203] GetModuleInformation (in: hProcess=0x35c, hModule=0x775e0000, lpmodinfo=0x29ce6d4, cb=0xc | out: lpmodinfo=0x29ce6d4*(lpBaseOfDll=0x775e0000, SizeOfImage=0x2b000, EntryPoint=0x775e52b0)) returned 1 [0090.204] GetLastError () returned 0x3f0 [0090.204] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x775e0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0090.204] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x775e0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0090.204] GetModuleInformation (in: hProcess=0x35c, hModule=0x76f70000, lpmodinfo=0x29cf7c8, cb=0xc | out: lpmodinfo=0x29cf7c8*(lpBaseOfDll=0x76f70000, SizeOfImage=0x120000, EntryPoint=0x76fb46e0)) returned 1 [0090.205] GetLastError () returned 0x3f0 [0090.205] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76f70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0090.205] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76f70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCTF.dll" (normalized: "c:\\windows\\system32\\msctf.dll")) returned 0x1d [0090.206] GetModuleInformation (in: hProcess=0x35c, hModule=0x76f60000, lpmodinfo=0x29d08bc, cb=0xc | out: lpmodinfo=0x29d08bc*(lpBaseOfDll=0x76f60000, SizeOfImage=0xc000, EntryPoint=0x76f63920)) returned 1 [0090.206] GetLastError () returned 0x3f0 [0090.206] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76f60000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="kernel.appcore.dll") returned 0x12 [0090.206] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76f60000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")) returned 0x26 [0090.207] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f00000, lpmodinfo=0x29d19d8, cb=0xc | out: lpmodinfo=0x29d19d8*(lpBaseOfDll=0x73f00000, SizeOfImage=0x8000, EntryPoint=0x73f017c0)) returned 1 [0090.207] GetLastError () returned 0x3f0 [0090.207] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f00000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0090.208] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f00000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0090.208] GetModuleInformation (in: hProcess=0x35c, hModule=0x73950000, lpmodinfo=0x29d2ad4, cb=0xc | out: lpmodinfo=0x29d2ad4*(lpBaseOfDll=0x73950000, SizeOfImage=0x5b0000, EntryPoint=0x7399a848)) returned 1 [0090.209] GetLastError () returned 0x3f0 [0090.209] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73950000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorwks.dll") returned 0xc [0090.209] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73950000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll")) returned 0x3a [0090.209] GetModuleInformation (in: hProcess=0x35c, hModule=0x738b0000, lpmodinfo=0x29d3c0c, cb=0xc | out: lpmodinfo=0x29d3c0c*(lpBaseOfDll=0x738b0000, SizeOfImage=0x9b000, EntryPoint=0x738b232b)) returned 1 [0090.210] GetLastError () returned 0x3f0 [0090.210] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x738b0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSVCR80.dll") returned 0xb [0090.210] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x738b0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\MSVCR80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\msvcr80.dll")) returned 0x6a [0090.211] GetModuleInformation (in: hProcess=0x35c, hModule=0x755b0000, lpmodinfo=0x29d4da0, cb=0xc | out: lpmodinfo=0x29d4da0*(lpBaseOfDll=0x755b0000, SizeOfImage=0x13bf000, EntryPoint=0x75769ea0)) returned 1 [0090.211] GetLastError () returned 0x3f0 [0090.211] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x755b0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shell32.dll") returned 0xb [0090.212] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x755b0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")) returned 0x1f [0090.212] GetModuleInformation (in: hProcess=0x35c, hModule=0x750d0000, lpmodinfo=0x29d5e9c, cb=0xc | out: lpmodinfo=0x29d5e9c*(lpBaseOfDll=0x750d0000, SizeOfImage=0x4dd000, EntryPoint=0x752c7460)) returned 1 [0090.213] GetLastError () returned 0x3f0 [0090.213] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x750d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="windows.storage.dll") returned 0x13 [0090.213] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x750d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")) returned 0x27 [0090.214] GetModuleInformation (in: hProcess=0x35c, hModule=0x778a0000, lpmodinfo=0x29d6fb8, cb=0xc | out: lpmodinfo=0x29d6fb8*(lpBaseOfDll=0x778a0000, SizeOfImage=0x8d000, EntryPoint=0x778e91a0)) returned 1 [0090.214] GetLastError () returned 0x3f0 [0090.214] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x778a0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shcore.dll") returned 0xa [0090.214] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x778a0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shcore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")) returned 0x1e [0090.215] GetModuleInformation (in: hProcess=0x35c, hModule=0x777f0000, lpmodinfo=0x29d80b4, cb=0xc | out: lpmodinfo=0x29d80b4*(lpBaseOfDll=0x777f0000, SizeOfImage=0x44000, EntryPoint=0x777f7280)) returned 1 [0090.215] GetLastError () returned 0x3f0 [0090.215] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x777f0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="powrprof.dll") returned 0xc [0090.216] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x777f0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")) returned 0x20 [0090.216] GetModuleInformation (in: hProcess=0x35c, hModule=0x75070000, lpmodinfo=0x29d91b8, cb=0xc | out: lpmodinfo=0x29d91b8*(lpBaseOfDll=0x75070000, SizeOfImage=0xf000, EntryPoint=0x75072e40)) returned 1 [0090.217] GetLastError () returned 0x3f0 [0090.217] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x75070000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="profapi.dll") returned 0xb [0090.217] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x75070000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")) returned 0x1f [0090.218] GetModuleInformation (in: hProcess=0x35c, hModule=0x72db0000, lpmodinfo=0x29da2b4, cb=0xc | out: lpmodinfo=0x29da2b4*(lpBaseOfDll=0x72db0000, SizeOfImage=0xafa000, EntryPoint=0x0)) returned 1 [0090.218] GetLastError () returned 0x3f0 [0090.218] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x72db0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0090.219] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x72db0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll")) returned 0x68 [0090.219] GetModuleInformation (in: hProcess=0x35c, hModule=0x77430000, lpmodinfo=0x29db44c, cb=0xc | out: lpmodinfo=0x29db44c*(lpBaseOfDll=0x77430000, SizeOfImage=0xea000, EntryPoint=0x7746b990)) returned 1 [0090.220] GetLastError () returned 0x3f0 [0090.220] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77430000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0090.220] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77430000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")) returned 0x1d [0090.221] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ab0000, lpmodinfo=0x29dc540, cb=0xc | out: lpmodinfo=0x29dc540*(lpBaseOfDll=0x74ab0000, SizeOfImage=0x5b000, EntryPoint=0x74af8ff8)) returned 1 [0090.221] GetLastError () returned 0x3f0 [0090.221] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ab0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscorjit.dll") returned 0xc [0090.222] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ab0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll")) returned 0x3a [0090.223] GetModuleInformation (in: hProcess=0x35c, hModule=0x74060000, lpmodinfo=0x29dd678, cb=0xc | out: lpmodinfo=0x29dd678*(lpBaseOfDll=0x74060000, SizeOfImage=0x7a3000, EntryPoint=0x0)) returned 1 [0090.223] GetLastError () returned 0x3f0 [0090.223] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74060000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0090.224] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74060000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\b0de8183f9e33cd0fbe10c8db1402653\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\b0de8183f9e33cd0fbe10c8db1402653\\system.ni.dll")) returned 0x64 [0090.224] GetModuleInformation (in: hProcess=0x35c, hModule=0x74920000, lpmodinfo=0x29de914, cb=0xc | out: lpmodinfo=0x29de914*(lpBaseOfDll=0x74920000, SizeOfImage=0x189000, EntryPoint=0x0)) returned 1 [0090.225] GetLastError () returned 0x3f0 [0090.225] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74920000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0090.226] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74920000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\cebfffe6cee14413d504056227f496b2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\cebfffe6cee14413d504056227f496b2\\system.drawing.ni.dll")) returned 0x74 [0090.226] GetModuleInformation (in: hProcess=0x35c, hModule=0x721d0000, lpmodinfo=0x29dfad0, cb=0xc | out: lpmodinfo=0x29dfad0*(lpBaseOfDll=0x721d0000, SizeOfImage=0xbe0000, EntryPoint=0x0)) returned 1 [0090.227] GetLastError () returned 0x3f0 [0090.227] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x721d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0090.227] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x721d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\e3f653c6d321c4c528daa164908e0ff8\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\e3f653c6d321c4c528daa164908e0ff8\\system.windows.forms.ni.dll")) returned 0x80 [0090.228] GetModuleInformation (in: hProcess=0x35c, hModule=0x74bc0000, lpmodinfo=0x29e0cb0, cb=0xc | out: lpmodinfo=0x29e0cb0*(lpBaseOfDll=0x74bc0000, SizeOfImage=0x75000, EntryPoint=0x74bf98d0)) returned 1 [0090.228] GetLastError () returned 0x3f0 [0090.228] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74bc0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0090.229] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74bc0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0090.230] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ba0000, lpmodinfo=0x29e1dac, cb=0xc | out: lpmodinfo=0x29e1dac*(lpBaseOfDll=0x74ba0000, SizeOfImage=0x1d000, EntryPoint=0x74ba3bb0)) returned 1 [0090.230] GetLastError () returned 0x3f0 [0090.230] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ba0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="dwmapi.dll") returned 0xa [0090.231] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ba0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")) returned 0x1e [0090.231] GetModuleInformation (in: hProcess=0x35c, hModule=0x72060000, lpmodinfo=0x29e2ea8, cb=0xc | out: lpmodinfo=0x29e2ea8*(lpBaseOfDll=0x72060000, SizeOfImage=0x16b000, EntryPoint=0x720ce360)) returned 1 [0090.232] GetLastError () returned 0x3f0 [0090.232] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x72060000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="gdiplus.dll") returned 0xb [0090.233] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x72060000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_d15682eeaf714889\\gdiplus.dll")) returned 0x72 [0090.233] GetModuleInformation (in: hProcess=0x35c, hModule=0x71e70000, lpmodinfo=0x29e404c, cb=0xc | out: lpmodinfo=0x29e404c*(lpBaseOfDll=0x71e70000, SizeOfImage=0x1f0000, EntryPoint=0x71f569e0)) returned 1 [0090.234] GetLastError () returned 0x3f0 [0090.234] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x71e70000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="DWrite.dll") returned 0xa [0090.234] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x71e70000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\DWrite.dll" (normalized: "c:\\windows\\system32\\dwrite.dll")) returned 0x1e [0090.235] GetModuleInformation (in: hProcess=0x35c, hModule=0x71c30000, lpmodinfo=0x29e5148, cb=0xc | out: lpmodinfo=0x29e5148*(lpBaseOfDll=0x71c30000, SizeOfImage=0x236000, EntryPoint=0x0)) returned 1 [0090.236] GetLastError () returned 0x3f0 [0090.236] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x71c30000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0090.236] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x71c30000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Core\\40661cdfbf2201f3d6c5cf6378755082\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.core\\40661cdfbf2201f3d6c5cf6378755082\\system.core.ni.dll")) returned 0x6e [0090.237] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b80000, lpmodinfo=0x29e62f4, cb=0xc | out: lpmodinfo=0x29e62f4*(lpBaseOfDll=0x74b80000, SizeOfImage=0x13000, EntryPoint=0x74b89500)) returned 1 [0090.238] GetLastError () returned 0x3f0 [0090.238] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b80000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0090.238] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b80000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0090.239] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b60000, lpmodinfo=0x29e73f0, cb=0xc | out: lpmodinfo=0x29e73f0*(lpBaseOfDll=0x74b60000, SizeOfImage=0x1b000, EntryPoint=0x74b69010)) returned 1 [0090.240] GetLastError () returned 0x3f0 [0090.240] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b60000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcrypt.dll") returned 0xa [0090.241] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b60000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")) returned 0x1e [0090.241] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b30000, lpmodinfo=0x29e84ec, cb=0xc | out: lpmodinfo=0x29e84ec*(lpBaseOfDll=0x74b30000, SizeOfImage=0x2f000, EntryPoint=0x74b49530)) returned 1 [0090.242] GetLastError () returned 0x3f0 [0090.242] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b30000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0090.243] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b30000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0090.243] GetModuleInformation (in: hProcess=0x35c, hModule=0x773d0000, lpmodinfo=0x29e95e8, cb=0xc | out: lpmodinfo=0x29e95e8*(lpBaseOfDll=0x773d0000, SizeOfImage=0x6000, EntryPoint=0x773d1480)) returned 1 [0090.244] GetLastError () returned 0x3f0 [0090.244] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x773d0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0090.245] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x773d0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll")) returned 0x1d [0090.245] GetModuleInformation (in: hProcess=0x35c, hModule=0x71ab0000, lpmodinfo=0x29ea6dc, cb=0xc | out: lpmodinfo=0x29ea6dc*(lpBaseOfDll=0x71ab0000, SizeOfImage=0x171000, EntryPoint=0x71b5d650)) returned 1 [0090.246] GetLastError () returned 0x3f0 [0090.246] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x71ab0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="WindowsCodecs.dll") returned 0x11 [0090.247] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x71ab0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")) returned 0x25 [0090.247] GetModuleInformation (in: hProcess=0x35c, hModule=0x77ba0000, lpmodinfo=0x29eb7f0, cb=0xc | out: lpmodinfo=0x29eb7f0*(lpBaseOfDll=0x77ba0000, SizeOfImage=0x92000, EntryPoint=0x77bd44d0)) returned 1 [0090.248] GetLastError () returned 0x3f0 [0090.248] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77ba0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0090.249] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77ba0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\OLEAUT32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")) returned 0x20 [0090.250] GetModuleInformation (in: hProcess=0x35c, hModule=0x74b20000, lpmodinfo=0x29ec8f4, cb=0xc | out: lpmodinfo=0x29ec8f4*(lpBaseOfDll=0x74b20000, SizeOfImage=0x6000, EntryPoint=0x74b21570)) returned 1 [0090.250] GetLastError () returned 0x3f0 [0090.250] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74b20000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="shfolder.dll") returned 0xc [0090.251] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74b20000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll")) returned 0x20 [0090.252] CloseHandle (hObject=0x35c) returned 1 [0090.252] GetLastError () returned 0x3f0 [0090.281] GetCurrentProcessId () returned 0xe98 [0090.281] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x35c [0090.281] GetLastError () returned 0x3f0 [0090.281] EnumProcessModules (in: hProcess=0x35c, lphModule=0x284e768, cb=0x100, lpcbNeeded=0x69da90 | out: lphModule=0x284e768, lpcbNeeded=0x69da90) returned 1 [0090.282] GetLastError () returned 0x3f0 [0090.282] GetModuleInformation (in: hProcess=0x35c, hModule=0x410000, lpmodinfo=0x284e8a8, cb=0xc | out: lpmodinfo=0x284e8a8*(lpBaseOfDll=0x410000, SizeOfImage=0xf2000, EntryPoint=0x0)) returned 1 [0090.282] GetLastError () returned 0x3f0 [0090.282] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x410000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="vfggggg.exe") returned 0xb [0090.282] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x410000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe")) returned 0x31 [0090.282] GetModuleInformation (in: hProcess=0x35c, hModule=0x77c40000, lpmodinfo=0x284f9e8, cb=0xc | out: lpmodinfo=0x284f9e8*(lpBaseOfDll=0x77c40000, SizeOfImage=0x179000, EntryPoint=0x0)) returned 1 [0090.282] GetLastError () returned 0x3f0 [0090.282] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0090.283] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")) returned 0x1d [0090.283] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f90000, lpmodinfo=0x2850adc, cb=0xc | out: lpmodinfo=0x2850adc*(lpBaseOfDll=0x73f90000, SizeOfImage=0x59000, EntryPoint=0x73fa0780)) returned 1 [0090.283] GetLastError () returned 0x3f0 [0090.283] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f90000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0090.283] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f90000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0090.283] GetModuleInformation (in: hProcess=0x35c, hModule=0x77670000, lpmodinfo=0x2851bd8, cb=0xc | out: lpmodinfo=0x2851bd8*(lpBaseOfDll=0x77670000, SizeOfImage=0xf0000, EntryPoint=0x776837d0)) returned 1 [0090.283] GetLastError () returned 0x3f0 [0090.283] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77670000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0090.284] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77670000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNEL32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")) returned 0x20 [0090.284] GetModuleInformation (in: hProcess=0x35c, hModule=0x76970000, lpmodinfo=0x2852cdc, cb=0xc | out: lpmodinfo=0x2852cdc*(lpBaseOfDll=0x76970000, SizeOfImage=0x176000, EntryPoint=0x76a0c9a0)) returned 1 [0090.284] GetLastError () returned 0x3f0 [0090.284] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x76970000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0090.284] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x76970000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\KERNELBASE.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")) returned 0x22 [0090.284] GetModuleInformation (in: hProcess=0x35c, hModule=0x74c40000, lpmodinfo=0x2853e18, cb=0xc | out: lpmodinfo=0x2853e18*(lpBaseOfDll=0x74c40000, SizeOfImage=0x91000, EntryPoint=0x74c80ab0)) returned 1 [0090.285] GetLastError () returned 0x3f0 [0090.285] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74c40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="apphelp.dll") returned 0xb [0090.285] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74c40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")) returned 0x1f [0090.285] GetModuleInformation (in: hProcess=0x35c, hModule=0x77990000, lpmodinfo=0x2854f14, cb=0xc | out: lpmodinfo=0x2854f14*(lpBaseOfDll=0x77990000, SizeOfImage=0x7b000, EntryPoint=0x779ae3b0)) returned 1 [0090.285] GetLastError () returned 0x3f0 [0090.285] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77990000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0090.285] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77990000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\ADVAPI32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")) returned 0x20 [0090.286] GetModuleInformation (in: hProcess=0x35c, hModule=0x77a10000, lpmodinfo=0x2856018, cb=0xc | out: lpmodinfo=0x2856018*(lpBaseOfDll=0x77a10000, SizeOfImage=0xbe000, EntryPoint=0x77a45630)) returned 1 [0090.287] GetLastError () returned 0x3f0 [0090.287] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77a10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0090.287] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77a10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")) returned 0x1e [0090.287] GetModuleInformation (in: hProcess=0x35c, hModule=0x77250000, lpmodinfo=0x2857114, cb=0xc | out: lpmodinfo=0x2857114*(lpBaseOfDll=0x77250000, SizeOfImage=0x43000, EntryPoint=0x7725f570)) returned 1 [0090.287] GetLastError () returned 0x3f0 [0090.287] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77250000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0090.288] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77250000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")) returned 0x1f [0090.288] GetModuleInformation (in: hProcess=0x35c, hModule=0x77af0000, lpmodinfo=0x2858260, cb=0xc | out: lpmodinfo=0x2858260*(lpBaseOfDll=0x77af0000, SizeOfImage=0xac000, EntryPoint=0x77b236b0)) returned 1 [0090.288] GetLastError () returned 0x3f0 [0090.288] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x77af0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0090.288] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x77af0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\RPCRT4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")) returned 0x1e [0090.289] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d50000, lpmodinfo=0x285935c, cb=0xc | out: lpmodinfo=0x285935c*(lpBaseOfDll=0x74d50000, SizeOfImage=0x1e000, EntryPoint=0x74d5b640)) returned 1 [0090.289] GetLastError () returned 0x3f0 [0090.289] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d50000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0090.289] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d50000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\SspiCli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")) returned 0x1f [0090.289] GetModuleInformation (in: hProcess=0x35c, hModule=0x74d40000, lpmodinfo=0x285a458, cb=0xc | out: lpmodinfo=0x285a458*(lpBaseOfDll=0x74d40000, SizeOfImage=0xa000, EntryPoint=0x74d42aa0)) returned 1 [0090.290] GetLastError () returned 0x3f0 [0090.290] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74d40000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0090.290] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74d40000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\CRYPTBASE.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")) returned 0x21 [0090.290] GetModuleInformation (in: hProcess=0x35c, hModule=0x74ce0000, lpmodinfo=0x285b55c, cb=0xc | out: lpmodinfo=0x285b55c*(lpBaseOfDll=0x74ce0000, SizeOfImage=0x59000, EntryPoint=0x74d18cc0)) returned 1 [0090.290] GetLastError () returned 0x3f0 [0090.291] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x74ce0000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="bcryptPrimitives.dll") returned 0x14 [0090.291] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x74ce0000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\bcryptPrimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")) returned 0x28 [0090.291] GetModuleInformation (in: hProcess=0x35c, hModule=0x73f10000, lpmodinfo=0x285c680, cb=0xc | out: lpmodinfo=0x285c680*(lpBaseOfDll=0x73f10000, SizeOfImage=0x78000, EntryPoint=0x73f11000)) returned 1 [0090.291] GetLastError () returned 0x3f0 [0090.291] GetModuleBaseNameW (in: hProcess=0x35c, hModule=0x73f10000, lpBaseName=0x91f2b0, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0090.296] GetModuleFileNameExW (in: hProcess=0x35c, hModule=0x73f10000, lpFilename=0x91f2b0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0090.297] CloseHandle (hObject=0x35c) returned 1 [0090.297] GetLastError () returned 0x3f0 [0090.317] GetCurrentProcessId () returned 0xe98 [0090.317] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x35c [0090.317] GetLastError () returned 0x3f0 [0090.319] CloseHandle (hObject=0x35c) returned 1 [0090.319] GetLastError () returned 0x3f0 [0090.338] GetCurrentProcessId () returned 0xe98 [0090.338] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x35c [0090.338] GetLastError () returned 0x3f0 [0090.340] CloseHandle (hObject=0x35c) returned 1 [0090.340] GetLastError () returned 0x3f0 [0090.358] GetCurrentProcessId () returned 0xe98 [0090.358] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x35c [0090.358] GetLastError () returned 0x3f0 [0090.379] CloseHandle (hObject=0x35c) returned 1 [0090.379] GetLastError () returned 0x3f0 [0090.398] GetCurrentProcessId () returned 0xe98 [0090.398] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x35c [0090.398] GetLastError () returned 0x3f0 [0090.400] CloseHandle (hObject=0x35c) returned 1 [0090.400] GetLastError () returned 0x3f0 [0090.419] GetCurrentProcessId () returned 0xe98 [0090.419] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0xe98) returned 0x35c [0090.419] GetLastError () returned 0x3f0 [0090.420] CloseHandle (hObject=0x35c) returned 1 [0090.420] GetLastError () returned 0x3f0 [0104.647] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x69dd74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0104.647] GetLastError () returned 0x57 [0104.647] SetErrorMode (uMode=0x1) returned 0x0 [0104.649] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x29a0e54, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x364 [0104.649] GetLastError () returned 0x0 [0104.650] GetFileType (hFile=0x364) returned 0x1 [0104.650] SetErrorMode (uMode=0x0) returned 0x1 [0104.650] GetFileType (hFile=0x364) returned 0x1 [0104.713] DestroyCursor (hCursor=0x500f1) returned 1 [0104.713] GetLastError () returned 0x0 [0104.713] GetWindowLongW (hWnd=0x601ca, nIndex=-20) returned 327936 [0104.713] DestroyWindow (hWnd=0x601ca) returned 1 [0104.714] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0104.715] PostThreadMessageW (idThread=0xe9c, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0104.715] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0104.717] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x601ca, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0104.721] OleInitialize (pvReserved=0x0) returned 0x80010106 [0104.721] GetLastError () returned 0x0 [0104.721] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x69f0e8 | out: lplpMessageFilter=0x69f0e8*=0x0) returned 0x80004021 [0104.723] PeekMessageW (in: lpMsg=0x69f0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x69f0c0) returned 1 [0104.725] GetMessageA (in: lpMsg=0x69f0c0, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x69f0c0) returned 0 [0104.725] GetCurrentThreadId () returned 0xe9c [0104.812] EnumThreadWindows (dwThreadId=0xe9c, lpfn=0x85159a, lParam=0x0) returned 1 [0104.812] GetCurrentThreadId () returned 0xe9c [0104.812] GetCurrentThreadId () returned 0xe9c [0104.813] EnumThreadWindows (dwThreadId=0xe9c, lpfn=0x8516b2, lParam=0x0) returned 1 [0104.813] CloseHandle (hObject=0x270) returned 1 [0104.813] GetLastError () returned 0x0 [0104.813] DeactivateActCtx (dwFlags=0x0, ulCookie=0x181b0002) returned 1 [0104.814] CoGetContextToken (in: pToken=0x69fbac | out: pToken=0x69fbac) returned 0x0 [0104.814] CObjectContext::QueryInterface () returned 0x0 [0104.814] CObjectContext::GetCurrentThreadType () returned 0x0 [0104.814] Release () returned 0x0 [0104.816] CoGetContextToken (in: pToken=0x69f984 | out: pToken=0x69f984) returned 0x0 [0104.816] CObjectContext::QueryInterface () returned 0x0 [0104.816] CObjectContext::GetCurrentThreadType () returned 0x0 [0104.816] Release () returned 0x0 [0104.842] CoGetContextToken (in: pToken=0x69f984 | out: pToken=0x69f984) returned 0x0 [0104.842] CObjectContext::QueryInterface () returned 0x0 [0104.842] CObjectContext::GetCurrentThreadType () returned 0x0 [0104.842] Release () returned 0x0 [0104.855] CoGetContextToken (in: pToken=0x69f984 | out: pToken=0x69f984) returned 0x0 [0104.855] CObjectContext::QueryInterface () returned 0x0 [0104.855] CObjectContext::GetCurrentThreadType () returned 0x0 [0104.855] Release () returned 0x0 [0104.856] CoGetContextToken (in: pToken=0x69f964 | out: pToken=0x69f964) returned 0x0 [0104.856] CObjectContext::QueryInterface () returned 0x0 [0104.856] CObjectContext::GetCurrentThreadType () returned 0x0 [0104.856] Release () returned 0x0 [0105.408] CoUninitialize () Thread: id = 34 os_tid = 0xea0 Thread: id = 35 os_tid = 0xea4 Thread: id = 36 os_tid = 0xea8 [0072.388] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0077.106] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.106] GetLastError () returned 0x0 [0077.106] GdipDisposeImage (image=0x6d1bcd8) returned 0x0 [0077.106] GetLastError () returned 0x0 [0077.107] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.107] GetLastError () returned 0x0 [0077.107] GdipDisposeImage (image=0x6d19c08) returned 0x0 [0077.107] GetLastError () returned 0x0 [0077.107] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.107] GetLastError () returned 0x0 [0077.107] GdipDisposeImage (image=0x6d19f50) returned 0x0 [0077.107] GetLastError () returned 0x0 [0077.107] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.107] GetLastError () returned 0x0 [0077.107] GdipDisposeImage (image=0x6d19230) returned 0x0 [0077.107] GetLastError () returned 0x0 [0077.107] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.107] GetLastError () returned 0x0 [0077.107] GdipDisposeImage (image=0x6cd0c30) returned 0x0 [0077.107] GetLastError () returned 0x0 [0077.107] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.107] GetLastError () returned 0x0 [0077.107] GdipDisposeImage (image=0x6cceea8) returned 0x0 [0077.107] GetLastError () returned 0x0 [0077.107] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.107] GetLastError () returned 0x0 [0077.107] GdipDisposeImage (image=0x6cceb60) returned 0x0 [0077.107] GetLastError () returned 0x0 [0077.107] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.107] GetLastError () returned 0x0 [0077.107] GdipDisposeImage (image=0x6cce818) returned 0x0 [0077.108] GetLastError () returned 0x0 [0077.108] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.108] GetLastError () returned 0x0 [0077.108] GdipDisposeImage (image=0x6cce188) returned 0x0 [0077.108] GetLastError () returned 0x0 [0077.108] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.108] GetLastError () returned 0x0 [0077.108] GdipDisposeImage (image=0x6d1b648) returned 0x0 [0077.108] GetLastError () returned 0x0 [0077.108] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.108] GetLastError () returned 0x0 [0077.108] GdipDisposeImage (image=0x6d1c9f8) returned 0x0 [0077.109] GetLastError () returned 0x0 [0077.109] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.109] GetLastError () returned 0x0 [0077.109] GdipDisposeImage (image=0x6d1a298) returned 0x0 [0077.109] GetLastError () returned 0x0 [0077.109] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.109] GetLastError () returned 0x0 [0077.109] GdipDisposeImage (image=0x6d19578) returned 0x0 [0077.109] GetLastError () returned 0x0 [0077.109] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.109] GetLastError () returned 0x0 [0077.109] GdipDisposeImage (image=0x6d1a928) returned 0x0 [0077.109] GetLastError () returned 0x0 [0077.109] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.109] GetLastError () returned 0x0 [0077.109] GdipDisposeImage (image=0x6d1b300) returned 0x0 [0077.109] GetLastError () returned 0x0 [0077.109] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.109] GetLastError () returned 0x0 [0077.109] GdipDisposeImage (image=0x6d198c0) returned 0x0 [0077.109] GetLastError () returned 0x0 [0077.109] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0077.109] GetLastError () returned 0x0 [0077.109] GdipDisposeImage (image=0x6d1afb8) returned 0x0 [0077.109] GetLastError () returned 0x0 [0079.079] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.079] GetLastError () returned 0x0 [0079.079] GdipDisposeImage (image=0x6d1c368) returned 0x0 [0079.079] GetLastError () returned 0x0 [0079.079] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.079] GetLastError () returned 0x0 [0079.079] GdipDisposeImage (image=0x6d1c020) returned 0x0 [0079.079] GetLastError () returned 0x0 [0079.079] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.079] GetLastError () returned 0x0 [0079.079] GdipDisposeImage (image=0x6d1b300) returned 0x0 [0079.079] GetLastError () returned 0x0 [0079.079] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.079] GetLastError () returned 0x0 [0079.079] GdipDisposeImage (image=0x6d198c0) returned 0x0 [0079.079] GetLastError () returned 0x0 [0079.080] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.080] GetLastError () returned 0x0 [0079.080] GdipDisposeImage (image=0x6d19578) returned 0x0 [0079.080] GetLastError () returned 0x0 [0079.080] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.080] GetLastError () returned 0x0 [0079.080] GdipDisposeImage (image=0x6d1c6b0) returned 0x0 [0079.080] GetLastError () returned 0x0 [0079.080] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.080] GetLastError () returned 0x0 [0079.080] GdipDisposeImage (image=0x6d1bcd8) returned 0x0 [0079.080] GetLastError () returned 0x0 [0079.080] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.080] GetLastError () returned 0x0 [0079.080] GdipDisposeImage (image=0x6d1b990) returned 0x0 [0079.080] GetLastError () returned 0x0 [0079.080] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.080] GetLastError () returned 0x0 [0079.080] GdipDisposeImage (image=0x6d1afb8) returned 0x0 [0079.082] GetLastError () returned 0x0 [0079.082] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.082] GetLastError () returned 0x0 [0079.082] GdipDisposeImage (image=0x6d1a298) returned 0x0 [0079.083] GetLastError () returned 0x0 [0079.083] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.083] GetLastError () returned 0x0 [0079.083] GdipDisposeImage (image=0x6d1b648) returned 0x0 [0079.083] GetLastError () returned 0x0 [0079.083] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.083] GetLastError () returned 0x0 [0079.083] GdipDisposeImage (image=0x6d1ac70) returned 0x0 [0079.083] GetLastError () returned 0x0 [0079.083] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.083] GetLastError () returned 0x0 [0079.083] GdipDisposeImage (image=0x6d1a5e0) returned 0x0 [0079.083] GetLastError () returned 0x0 [0079.083] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.083] GetLastError () returned 0x0 [0079.083] GdipDisposeImage (image=0x6d1c9f8) returned 0x0 [0079.083] GetLastError () returned 0x0 [0079.084] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.084] GetLastError () returned 0x0 [0079.084] GdipDisposeImage (image=0x6d1a928) returned 0x0 [0079.084] GetLastError () returned 0x0 [0079.084] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.084] GetLastError () returned 0x0 [0079.084] GdipDisposeImage (image=0x6cce818) returned 0x0 [0079.084] GetLastError () returned 0x0 [0079.084] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.084] GetLastError () returned 0x0 [0079.084] GdipDisposeImage (image=0x6cce188) returned 0x0 [0079.085] GetLastError () returned 0x0 [0079.085] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.085] GetLastError () returned 0x0 [0079.085] GdipDisposeImage (image=0x6cd0c30) returned 0x0 [0079.085] GetLastError () returned 0x0 [0079.085] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.085] GetLastError () returned 0x0 [0079.086] GdipDisposeImage (image=0x6cceea8) returned 0x0 [0079.086] GetLastError () returned 0x0 [0079.086] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.086] GetLastError () returned 0x0 [0079.086] GdipDisposeImage (image=0x6cceb60) returned 0x0 [0079.086] GetLastError () returned 0x0 [0079.086] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.086] GetLastError () returned 0x0 [0079.086] GdipDisposeImage (image=0x6d19c08) returned 0x0 [0079.087] GetLastError () returned 0x0 [0079.087] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.087] GetLastError () returned 0x0 [0079.087] GdipDisposeImage (image=0x6d19230) returned 0x0 [0079.087] GetLastError () returned 0x0 [0079.087] FindAtomW (lpString="GDI+Atom_3736_1") returned 0xc000 [0079.087] GetLastError () returned 0x0 [0079.087] GdipDisposeImage (image=0x6d1cd40) returned 0x0 [0079.087] GetLastError () returned 0x0 [0089.921] RegCloseKey (hKey=0x35c) returned 0x0 [0104.816] SetWindowLongW (hWnd=0x80166, nIndex=-4, dwNewLong=2009844384) returned 8718514 [0104.818] SetClassLongW (hWnd=0x80166, nIndex=-24, dwNewLong=2009844384) returned 0x850772 [0104.818] PostMessageW (hWnd=0x80166, Msg=0x10, wParam=0x0, lParam=0x0) returned 1 [0104.818] GetModuleHandleW (lpModuleName=0x0) returned 0x410000 [0104.819] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.378734a", hInstance=0x410000) returned 0 [0104.819] GetLastError () returned 0x584 [0104.820] DeleteAtom (nAtom=0xc000) returned 0x0 [0104.820] GetLastError () returned 0x584 [0104.820] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.820] GetLastError () returned 0x2 [0104.821] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x360 [0104.821] GetLastError () returned 0x0 [0104.821] PostMessageW (hWnd=0x701f4, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0104.822] CoGetContextToken (in: pToken=0x48af114 | out: pToken=0x48af114) returned 0x0 [0104.822] CObjectContext::QueryInterface () returned 0x0 [0104.822] CObjectContext::GetCurrentThreadType () returned 0x0 [0104.822] Release () returned 0x0 [0104.831] CoGetContextToken (in: pToken=0x48af10c | out: pToken=0x48af10c) returned 0x0 [0104.831] CObjectContext::QueryInterface () returned 0x0 [0104.831] CObjectContext::GetCurrentThreadType () returned 0x0 [0104.831] Release () returned 0x0 [0104.845] CloseHandle (hObject=0x364) returned 1 [0104.845] GetLastError () returned 0x0 [0104.845] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.845] GetLastError () returned 0x2 [0104.845] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.845] GetLastError () returned 0x2 [0104.845] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.845] GetLastError () returned 0x2 [0104.845] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.845] GetLastError () returned 0x2 [0104.845] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.846] GetLastError () returned 0x2 [0104.846] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.846] GetLastError () returned 0x2 [0104.846] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.846] GetLastError () returned 0x2 [0104.846] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.846] GetLastError () returned 0x2 [0104.846] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.846] GetLastError () returned 0x2 [0104.846] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.846] GetLastError () returned 0x2 [0104.846] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.846] GetLastError () returned 0x2 [0104.847] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.847] GetLastError () returned 0x2 [0104.847] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.847] GetLastError () returned 0x2 [0104.847] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.847] GetLastError () returned 0x2 [0104.847] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.847] GetLastError () returned 0x2 [0104.847] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.847] GetLastError () returned 0x2 [0104.847] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.847] GetLastError () returned 0x2 [0104.847] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.847] GetLastError () returned 0x2 [0104.848] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.848] GetLastError () returned 0x2 [0104.848] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.848] GetLastError () returned 0x2 [0104.848] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.848] GetLastError () returned 0x2 [0104.848] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.848] GetLastError () returned 0x2 [0104.848] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.848] GetLastError () returned 0x2 [0104.848] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.848] GetLastError () returned 0x2 [0104.849] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.849] GetLastError () returned 0x2 [0104.849] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.849] GetLastError () returned 0x2 [0104.849] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.849] GetLastError () returned 0x2 [0104.849] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.849] GetLastError () returned 0x2 [0104.849] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.849] GetLastError () returned 0x2 [0104.849] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.849] GetLastError () returned 0x2 [0104.850] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.850] GetLastError () returned 0x2 [0104.850] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.850] GetLastError () returned 0x2 [0104.850] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.850] GetLastError () returned 0x2 [0104.850] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.850] GetLastError () returned 0x2 [0104.850] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.850] GetLastError () returned 0x2 [0104.850] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.850] GetLastError () returned 0x2 [0104.850] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.851] GetLastError () returned 0x2 [0104.851] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.851] GetLastError () returned 0x2 [0104.851] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.851] GetLastError () returned 0x2 [0104.851] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.851] GetLastError () returned 0x2 [0104.851] DestroyCursor (hCursor=0x501a7) returned 1 [0104.851] GetLastError () returned 0x2 [0104.851] FindAtomW (lpString="GDI+Atom_3736_1") returned 0x0 [0104.851] GetLastError () returned 0x2 [0104.852] DeleteObject (ho=0x300a0658) returned 1 [0104.852] GetLastError () returned 0x2 [0104.852] CloseHandle (hObject=0x360) returned 1 [0104.852] GetLastError () returned 0x2 [0104.854] CloseHandle (hObject=0x2b0) returned 1 [0104.854] GetLastError () returned 0x2 [0104.854] RegCloseKey (hKey=0x80000004) returned 0x0 Thread: id = 37 os_tid = 0xeb0 Thread: id = 38 os_tid = 0xeb4 [0074.405] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0074.410] SetConsoleCtrlHandler (HandlerRoutine=0x850a1a, Add=1) returned 1 [0074.410] GetModuleHandleW (lpModuleName=0x0) returned 0x410000 [0074.411] GetModuleHandleW (lpModuleName=0x0) returned 0x410000 [0074.413] GetClassInfoW (in: hInstance=0x410000, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", lpWndClass=0x273bfe8 | out: lpWndClass=0x273bfe8) returned 0 [0074.415] CoTaskMemAlloc (cb=0x58) returned 0x9029d8 [0074.415] RegisterClassW (lpWndClass=0x90aa50) returned 0xc174 [0074.415] GetLastError () returned 0x583 [0074.415] CoTaskMemFree (pv=0x9029d8) [0074.417] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", lpWindowName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x410000, lpParam=0x0) returned 0x701f4 [0074.418] NtdllDefWindowProc_W (hWnd=0x701f4, Msg=0x81, wParam=0x0, lParam=0x745f050) returned 0x1 [0074.420] NtdllDefWindowProc_W (hWnd=0x701f4, Msg=0x83, wParam=0x0, lParam=0x745f03c) returned 0x0 [0074.420] NtdllDefWindowProc_W (hWnd=0x701f4, Msg=0x1, wParam=0x0, lParam=0x745f050) returned 0x0 [0074.420] NtdllDefWindowProc_W (hWnd=0x701f4, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0074.420] NtdllDefWindowProc_W (hWnd=0x701f4, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0074.421] GetLastError () returned 0x0 [0074.421] SetEvent (hEvent=0x2b0) returned 1 [0074.421] GetLastError () returned 0x0 [0074.422] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0074.681] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0074.853] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0075.041] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0075.181] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0075.308] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0075.432] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0075.635] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0075.760] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0075.885] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0076.056] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0076.259] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0076.463] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0076.744] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0076.900] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0077.088] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0077.261] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0077.436] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0077.655] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0077.780] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0077.905] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0078.015] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0078.142] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0078.327] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0078.452] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0079.013] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0079.190] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0079.378] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0079.503] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0079.893] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0080.018] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0080.143] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0080.268] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0080.394] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0081.660] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0081.784] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0081.909] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0082.034] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0082.160] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0082.279] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0082.421] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0083.888] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0084.013] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0084.138] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0084.263] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0084.394] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0084.530] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0084.654] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0084.779] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0084.904] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0085.028] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0085.154] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0085.416] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0085.529] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0085.779] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0085.903] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0086.028] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0086.154] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0086.279] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0086.404] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0086.528] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0086.700] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0086.825] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0086.985] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0087.107] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0087.232] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0087.349] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0087.474] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0087.677] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0087.802] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0087.927] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0088.052] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0088.177] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0088.302] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0088.427] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0088.552] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0088.677] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0088.802] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0088.904] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0089.030] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0089.161] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0089.286] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0089.411] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0089.591] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0089.739] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0089.922] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0090.098] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0090.286] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0090.442] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0090.567] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0090.692] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0090.825] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0090.942] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0091.068] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0091.192] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0091.317] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0091.442] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0091.567] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0091.692] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0091.817] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0091.942] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0092.067] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0092.209] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0092.317] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0092.438] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0092.563] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0092.688] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0092.813] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0092.938] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0093.063] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0093.188] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0093.313] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0093.438] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0093.563] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0093.688] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0093.813] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0093.938] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0094.063] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0094.188] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0094.313] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0094.438] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0094.563] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0094.690] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0094.813] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0094.939] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0095.074] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0095.188] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0095.314] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0095.438] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0095.563] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0095.688] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0095.813] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0095.938] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0096.063] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0096.189] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0096.313] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0096.438] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0096.563] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0096.688] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0096.814] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0096.938] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0097.063] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0097.188] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0097.313] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0097.415] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0097.545] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0097.670] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0097.795] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0097.920] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0098.040] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0098.171] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0098.302] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0098.427] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0098.551] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0098.677] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0098.802] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0098.927] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0099.051] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0099.176] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0099.302] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0099.427] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0099.551] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0099.677] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0099.801] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0099.927] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0100.051] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0100.176] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0100.302] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0100.431] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0100.552] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0100.677] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0100.802] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0100.926] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0101.052] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0101.176] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0101.302] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0101.426] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0101.551] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0101.676] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0101.802] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0101.927] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0102.052] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0102.176] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0102.302] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0102.427] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0102.552] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0102.677] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0102.802] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0102.927] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0103.052] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0103.177] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0103.302] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0103.427] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0103.553] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0103.677] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0103.802] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0103.927] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0104.052] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0104.255] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0104.411] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0104.599] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0104.764] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x0 [0104.822] PeekMessageW (in: lpMsg=0x745f62c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x745f62c) returned 1 [0104.822] IsWindow (hWnd=0x701f4) returned 1 [0104.823] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74d70000 [0104.824] GetProcAddress (hModule=0x74d70000, lpProcName="DefWindowProcW") returned 0x77cbcaa0 [0104.824] SetWindowLongW (hWnd=0x701f4, nIndex=-4, dwNewLong=2009844384) returned 8718922 [0104.825] SetClassLongW (hWnd=0x701f4, nIndex=-24, dwNewLong=2009844384) returned 0x850a4a [0104.825] IsWindow (hWnd=0x701f4) returned 1 [0104.825] DestroyWindow (hWnd=0x701f4) returned 1 [0104.828] GetModuleHandleW (lpModuleName=0x0) returned 0x410000 [0104.830] UnregisterClassW (lpClassName=".NET-BroadcastEventWindow.2.0.0.0.378734a.0", hInstance=0x410000) returned 1 [0104.830] GetLastError () returned 0x0 [0104.830] SetConsoleCtrlHandler (HandlerRoutine=0x850a1a, Add=0) returned 1 [0104.830] SetEvent (hEvent=0x360) returned 1 [0104.831] GetLastError () returned 0x0 Process: id = "5" image_name = "vfggggg.exe" filename = "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe" page_root = "0xa071000" os_pid = "0xec8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xe98" cmd_line = "\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "LHNIWSJ\\CIiHmnxMn6Ps" os_groups = "LHNIWSJ\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0001714b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 838 start_va = 0xf00000 end_va = 0xff1fff entry_point = 0xf00000 region_type = mapped_file name = "vfggggg.exe" filename = "\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe") Region: id = 839 start_va = 0x1000000 end_va = 0x101ffff entry_point = 0x0 region_type = private name = "private_0x0000000001000000" filename = "" Region: id = 840 start_va = 0x1020000 end_va = 0x1021fff entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 841 start_va = 0x1030000 end_va = 0x1043fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001030000" filename = "" Region: id = 842 start_va = 0x1050000 end_va = 0x108ffff entry_point = 0x0 region_type = private name = "private_0x0000000001050000" filename = "" Region: id = 843 start_va = 0x1090000 end_va = 0x118ffff entry_point = 0x0 region_type = private name = "private_0x0000000001090000" filename = "" Region: id = 844 start_va = 0x1190000 end_va = 0x1193fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001190000" filename = "" Region: id = 845 start_va = 0x11a0000 end_va = 0x11a0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011a0000" filename = "" Region: id = 846 start_va = 0x11b0000 end_va = 0x11b1fff entry_point = 0x0 region_type = private name = "private_0x00000000011b0000" filename = "" Region: id = 847 start_va = 0x77c40000 end_va = 0x77db8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 848 start_va = 0x7fc60000 end_va = 0x7fc82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fc60000" filename = "" Region: id = 849 start_va = 0x7fc83000 end_va = 0x7fc83fff entry_point = 0x0 region_type = private name = "private_0x000000007fc83000" filename = "" Region: id = 850 start_va = 0x7fc89000 end_va = 0x7fc89fff entry_point = 0x0 region_type = private name = "private_0x000000007fc89000" filename = "" Region: id = 851 start_va = 0x7fc8d000 end_va = 0x7fc8ffff entry_point = 0x0 region_type = private name = "private_0x000000007fc8d000" filename = "" Region: id = 852 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 853 start_va = 0x7fff0000 end_va = 0x7ffc03e6ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 854 start_va = 0x7ffc03e70000 end_va = 0x7ffc04031fff entry_point = 0x7ffc03e70000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 855 start_va = 0x7ffc04032000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc04032000" filename = "" Region: id = 856 start_va = 0x400000 end_va = 0x455fff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 857 start_va = 0x1260000 end_va = 0x126ffff entry_point = 0x0 region_type = private name = "private_0x0000000001260000" filename = "" Region: id = 858 start_va = 0x59300000 end_va = 0x5934efff entry_point = 0x59300000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 859 start_va = 0x59360000 end_va = 0x593d2fff entry_point = 0x59360000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 860 start_va = 0x1300000 end_va = 0x13fffff entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 861 start_va = 0x59350000 end_va = 0x59357fff entry_point = 0x59350000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 862 start_va = 0x1000000 end_va = 0x100ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001000000" filename = "" Region: id = 863 start_va = 0x1400000 end_va = 0x14bdfff entry_point = 0x1400000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 864 start_va = 0x73f90000 end_va = 0x73fe8fff entry_point = 0x73f90000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 865 start_va = 0x76970000 end_va = 0x76ae5fff entry_point = 0x76970000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 866 start_va = 0x77670000 end_va = 0x7775ffff entry_point = 0x77670000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 867 start_va = 0x7fb60000 end_va = 0x7fc5ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007fb60000" filename = "" Region: id = 868 start_va = 0x1010000 end_va = 0x1013fff entry_point = 0x0 region_type = private name = "private_0x0000000001010000" filename = "" Region: id = 869 start_va = 0x11c0000 end_va = 0x11fffff entry_point = 0x0 region_type = private name = "private_0x00000000011c0000" filename = "" Region: id = 870 start_va = 0x1230000 end_va = 0x123ffff entry_point = 0x0 region_type = private name = "private_0x0000000001230000" filename = "" Region: id = 871 start_va = 0x14c0000 end_va = 0x15bffff entry_point = 0x0 region_type = private name = "private_0x00000000014c0000" filename = "" Region: id = 872 start_va = 0x16a0000 end_va = 0x16affff entry_point = 0x0 region_type = private name = "private_0x00000000016a0000" filename = "" Region: id = 873 start_va = 0x74ce0000 end_va = 0x74d38fff entry_point = 0x74ce0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 874 start_va = 0x74d40000 end_va = 0x74d49fff entry_point = 0x74d40000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 875 start_va = 0x74d50000 end_va = 0x74d6dfff entry_point = 0x74d50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 876 start_va = 0x77250000 end_va = 0x77292fff entry_point = 0x77250000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 877 start_va = 0x77990000 end_va = 0x77a0afff entry_point = 0x77990000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 878 start_va = 0x77a10000 end_va = 0x77acdfff entry_point = 0x77a10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 879 start_va = 0x77af0000 end_va = 0x77b9bfff entry_point = 0x77af0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 880 start_va = 0x7fc8a000 end_va = 0x7fc8cfff entry_point = 0x0 region_type = private name = "private_0x000000007fc8a000" filename = "" Region: id = 881 start_va = 0x73f10000 end_va = 0x73f87fff entry_point = 0x73f10000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 882 start_va = 0x1020000 end_va = 0x1020fff entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 883 start_va = 0x1200000 end_va = 0x1200fff entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 884 start_va = 0x16b0000 end_va = 0x1837fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000016b0000" filename = "" Region: id = 885 start_va = 0x1840000 end_va = 0x19c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001840000" filename = "" Region: id = 886 start_va = 0x19d0000 end_va = 0x2dcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019d0000" filename = "" Region: id = 887 start_va = 0x74d70000 end_va = 0x74eaffff entry_point = 0x74d70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 888 start_va = 0x75080000 end_va = 0x750c3fff entry_point = 0x75080000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 889 start_va = 0x76ca0000 end_va = 0x76decfff entry_point = 0x76ca0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 890 start_va = 0x76f70000 end_va = 0x7708ffff entry_point = 0x76f70000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 891 start_va = 0x77090000 end_va = 0x77249fff entry_point = 0x77090000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 892 start_va = 0x775e0000 end_va = 0x7760afff entry_point = 0x775e0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 893 start_va = 0x76f60000 end_va = 0x76f6bfff entry_point = 0x76f60000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 894 start_va = 0x73f00000 end_va = 0x73f07fff entry_point = 0x73f00000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 895 start_va = 0x1210000 end_va = 0x1210fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001210000" filename = "" Region: id = 896 start_va = 0x1650000 end_va = 0x165ffff entry_point = 0x0 region_type = private name = "private_0x0000000001650000" filename = "" Region: id = 897 start_va = 0x2f90000 end_va = 0x2f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f90000" filename = "" Region: id = 898 start_va = 0x738b0000 end_va = 0x7394afff entry_point = 0x738b0000 region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9185_none_d0905a48442809b8\\msvcr80.dll") Region: id = 899 start_va = 0x73950000 end_va = 0x73efffff entry_point = 0x73950000 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll") Region: id = 900 start_va = 0x1220000 end_va = 0x1220fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001220000" filename = "" Region: id = 901 start_va = 0x1240000 end_va = 0x1240fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001240000" filename = "" Region: id = 902 start_va = 0x1250000 end_va = 0x125ffff entry_point = 0x0 region_type = private name = "private_0x0000000001250000" filename = "" Region: id = 903 start_va = 0x1270000 end_va = 0x127ffff entry_point = 0x0 region_type = private name = "private_0x0000000001270000" filename = "" Region: id = 904 start_va = 0x1280000 end_va = 0x128ffff entry_point = 0x0 region_type = private name = "private_0x0000000001280000" filename = "" Region: id = 905 start_va = 0x1290000 end_va = 0x129ffff entry_point = 0x0 region_type = private name = "private_0x0000000001290000" filename = "" Region: id = 906 start_va = 0x12a0000 end_va = 0x12affff entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 907 start_va = 0x12b0000 end_va = 0x12bffff entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 908 start_va = 0x12c0000 end_va = 0x12fffff entry_point = 0x0 region_type = private name = "private_0x00000000012c0000" filename = "" Region: id = 909 start_va = 0x2dd0000 end_va = 0x2ecffff entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 910 start_va = 0x75070000 end_va = 0x7507efff entry_point = 0x75070000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 911 start_va = 0x750d0000 end_va = 0x755acfff entry_point = 0x750d0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 912 start_va = 0x755b0000 end_va = 0x7696efff entry_point = 0x755b0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 913 start_va = 0x777f0000 end_va = 0x77833fff entry_point = 0x777f0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 914 start_va = 0x778a0000 end_va = 0x7792cfff entry_point = 0x778a0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 915 start_va = 0x7fc86000 end_va = 0x7fc88fff entry_point = 0x0 region_type = private name = "private_0x000000007fc86000" filename = "" Region: id = 916 start_va = 0x15c0000 end_va = 0x15c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015c0000" filename = "" Region: id = 917 start_va = 0x15d0000 end_va = 0x160ffff entry_point = 0x0 region_type = private name = "private_0x00000000015d0000" filename = "" Region: id = 918 start_va = 0x2ed0000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 919 start_va = 0x2fa0000 end_va = 0x32d6fff entry_point = 0x2fa0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 920 start_va = 0x32e0000 end_va = 0x52dffff entry_point = 0x0 region_type = private name = "private_0x00000000032e0000" filename = "" Region: id = 921 start_va = 0x52e0000 end_va = 0x53dffff entry_point = 0x0 region_type = private name = "private_0x00000000052e0000" filename = "" Region: id = 922 start_va = 0x72db0000 end_va = 0x738a9fff entry_point = 0x72db0000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\f87e9c65bcfc0dde0655ce19fb05fe8c\\mscorlib.ni.dll") Region: id = 923 start_va = 0x77430000 end_va = 0x77519fff entry_point = 0x77430000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 924 start_va = 0x7fb5d000 end_va = 0x7fb5ffff entry_point = 0x0 region_type = private name = "private_0x000000007fb5d000" filename = "" Region: id = 925 start_va = 0x74bc0000 end_va = 0x74c34fff entry_point = 0x74bc0000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 926 start_va = 0x53e0000 end_va = 0x543ffff entry_point = 0x0 region_type = private name = "private_0x00000000053e0000" filename = "" Region: id = 927 start_va = 0x1610000 end_va = 0x1612fff entry_point = 0x1610000 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\SysWOW64\\l_intl.nls" (normalized: "c:\\windows\\syswow64\\l_intl.nls") Region: id = 928 start_va = 0x1620000 end_va = 0x1620fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001620000" filename = "" Region: id = 929 start_va = 0x74ab0000 end_va = 0x74b0afff entry_point = 0x74ab0000 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll") Region: id = 930 start_va = 0x1630000 end_va = 0x163ffff entry_point = 0x0 region_type = private name = "private_0x0000000001630000" filename = "" Region: id = 931 start_va = 0x1660000 end_va = 0x166ffff entry_point = 0x0 region_type = private name = "private_0x0000000001660000" filename = "" Region: id = 932 start_va = 0x1640000 end_va = 0x1644fff entry_point = 0x1640000 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 933 start_va = 0x1670000 end_va = 0x1670fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001670000" filename = "" Region: id = 934 start_va = 0x1690000 end_va = 0x169ffff entry_point = 0x0 region_type = private name = "private_0x0000000001690000" filename = "" Region: id = 935 start_va = 0x53e0000 end_va = 0x5420fff entry_point = 0x53e0000 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 936 start_va = 0x5430000 end_va = 0x543ffff entry_point = 0x0 region_type = private name = "private_0x0000000005430000" filename = "" Region: id = 937 start_va = 0x74b10000 end_va = 0x74b17fff entry_point = 0x74b10000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\culture.dll") Region: id = 938 start_va = 0x5440000 end_va = 0x5493fff entry_point = 0x5440000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorrc.dll") Region: id = 939 start_va = 0x74060000 end_va = 0x74802fff entry_point = 0x74060000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\b0de8183f9e33cd0fbe10c8db1402653\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\b0de8183f9e33cd0fbe10c8db1402653\\system.ni.dll") Region: id = 940 start_va = 0x1670000 end_va = 0x167afff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001670000" filename = "" Region: id = 941 start_va = 0x2ed0000 end_va = 0x2ef3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ed0000" filename = "" Region: id = 942 start_va = 0x2f00000 end_va = 0x2f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 943 start_va = 0x2f10000 end_va = 0x2f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 944 start_va = 0x2f50000 end_va = 0x2f5ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 945 start_va = 0x2f60000 end_va = 0x2f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f60000" filename = "" Region: id = 946 start_va = 0x54a0000 end_va = 0x5547fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000054a0000" filename = "" Region: id = 947 start_va = 0x5550000 end_va = 0x654ffff entry_point = 0x0 region_type = private name = "private_0x0000000005550000" filename = "" Region: id = 948 start_va = 0x6550000 end_va = 0x667ffff entry_point = 0x0 region_type = private name = "private_0x0000000006550000" filename = "" Region: id = 949 start_va = 0x6680000 end_va = 0x767ffff entry_point = 0x0 region_type = private name = "private_0x0000000006680000" filename = "" Region: id = 950 start_va = 0x7680000 end_va = 0x78cffff entry_point = 0x0 region_type = private name = "private_0x0000000007680000" filename = "" Region: id = 951 start_va = 0x78d0000 end_va = 0x79cffff entry_point = 0x0 region_type = private name = "private_0x00000000078d0000" filename = "" Region: id = 952 start_va = 0x79d0000 end_va = 0x7a0ffff entry_point = 0x0 region_type = private name = "private_0x00000000079d0000" filename = "" Region: id = 953 start_va = 0x7a10000 end_va = 0x7b0ffff entry_point = 0x0 region_type = private name = "private_0x0000000007a10000" filename = "" Region: id = 954 start_va = 0x7b10000 end_va = 0x7beefff entry_point = 0x7b10000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 955 start_va = 0x72020000 end_va = 0x721c4fff entry_point = 0x72020000 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualBas#\\daf407adee4c100cc714ef63f3b1b9c3\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualbas#\\daf407adee4c100cc714ef63f3b1b9c3\\microsoft.visualbasic.ni.dll") Region: id = 956 start_va = 0x721d0000 end_va = 0x72daffff entry_point = 0x721d0000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Windows.Forms\\e3f653c6d321c4c528daa164908e0ff8\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.windows.forms\\e3f653c6d321c4c528daa164908e0ff8\\system.windows.forms.ni.dll") Region: id = 957 start_va = 0x74920000 end_va = 0x74aa8fff entry_point = 0x74920000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\cebfffe6cee14413d504056227f496b2\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\cebfffe6cee14413d504056227f496b2\\system.drawing.ni.dll") Region: id = 958 start_va = 0x7fb57000 end_va = 0x7fb59fff entry_point = 0x0 region_type = private name = "private_0x000000007fb57000" filename = "" Region: id = 959 start_va = 0x7fb5a000 end_va = 0x7fb5cfff entry_point = 0x0 region_type = private name = "private_0x000000007fb5a000" filename = "" Region: id = 960 start_va = 0x74b80000 end_va = 0x74b92fff entry_point = 0x74b80000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 961 start_va = 0x74b60000 end_va = 0x74b7afff entry_point = 0x74b60000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 962 start_va = 0x74b30000 end_va = 0x74b5efff entry_point = 0x74b30000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 963 start_va = 0x7bf0000 end_va = 0x7c2ffff entry_point = 0x0 region_type = private name = "private_0x0000000007bf0000" filename = "" Region: id = 964 start_va = 0x7c30000 end_va = 0x7d2ffff entry_point = 0x0 region_type = private name = "private_0x0000000007c30000" filename = "" Region: id = 965 start_va = 0x7d30000 end_va = 0x7d6ffff entry_point = 0x0 region_type = private name = "private_0x0000000007d30000" filename = "" Region: id = 966 start_va = 0x7d70000 end_va = 0x7e6ffff entry_point = 0x0 region_type = private name = "private_0x0000000007d70000" filename = "" Region: id = 967 start_va = 0x7e70000 end_va = 0x7eaffff entry_point = 0x0 region_type = private name = "private_0x0000000007e70000" filename = "" Region: id = 968 start_va = 0x7eb0000 end_va = 0x7faffff entry_point = 0x0 region_type = private name = "private_0x0000000007eb0000" filename = "" Region: id = 969 start_va = 0x7fb4e000 end_va = 0x7fb50fff entry_point = 0x0 region_type = private name = "private_0x000000007fb4e000" filename = "" Region: id = 970 start_va = 0x7fb51000 end_va = 0x7fb53fff entry_point = 0x0 region_type = private name = "private_0x000000007fb51000" filename = "" Region: id = 971 start_va = 0x7fb54000 end_va = 0x7fb56fff entry_point = 0x0 region_type = private name = "private_0x000000007fb54000" filename = "" Region: id = 972 start_va = 0x748f0000 end_va = 0x7491ffff entry_point = 0x748f0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 973 start_va = 0x74b20000 end_va = 0x74b27fff entry_point = 0x74b20000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 974 start_va = 0x77ad0000 end_va = 0x77ad6fff entry_point = 0x77ad0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 975 start_va = 0x74860000 end_va = 0x748e3fff entry_point = 0x74860000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 976 start_va = 0x77930000 end_va = 0x7798bfff entry_point = 0x77930000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 977 start_va = 0x74840000 end_va = 0x74852fff entry_point = 0x74840000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 978 start_va = 0x74820000 end_va = 0x74833fff entry_point = 0x74820000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 979 start_va = 0x74010000 end_va = 0x7405dfff entry_point = 0x74010000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 980 start_va = 0x71f20000 end_va = 0x72012fff entry_point = 0x71f20000 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Configuration\\996056d1eff1504e6304b70484c24115\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.configuration\\996056d1eff1504e6304b70484c24115\\system.configuration.ni.dll") Region: id = 981 start_va = 0x719e0000 end_va = 0x71f1afff entry_point = 0x719e0000 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Xml\\58c73277ac94d5bd748ccafea8b1af02\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.xml\\58c73277ac94d5bd748ccafea8b1af02\\system.xml.ni.dll") Region: id = 982 start_va = 0x2f70000 end_va = 0x2f8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002f70000" filename = "" Region: id = 983 start_va = 0x1680000 end_va = 0x168ffff entry_point = 0x0 region_type = private name = "private_0x0000000001680000" filename = "" Region: id = 984 start_va = 0x718d0000 end_va = 0x719d3fff entry_point = 0x718d0000 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Management\\dc469620ee7f5d9d576c86f998ca129a\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.management\\dc469620ee7f5d9d576c86f998ca129a\\system.management.ni.dll") Region: id = 985 start_va = 0x7fb0000 end_va = 0x7feffff entry_point = 0x0 region_type = private name = "private_0x0000000007fb0000" filename = "" Region: id = 986 start_va = 0x7ff0000 end_va = 0x80effff entry_point = 0x0 region_type = private name = "private_0x0000000007ff0000" filename = "" Region: id = 987 start_va = 0x7fb4b000 end_va = 0x7fb4dfff entry_point = 0x0 region_type = private name = "private_0x000000007fb4b000" filename = "" Region: id = 988 start_va = 0x7fae0000 end_va = 0x7faeffff entry_point = 0x0 region_type = private name = "private_0x000000007fae0000" filename = "" Region: id = 989 start_va = 0x7faf0000 end_va = 0x7fb3ffff entry_point = 0x0 region_type = private name = "private_0x000000007faf0000" filename = "" Region: id = 990 start_va = 0x80f0000 end_va = 0x80f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000080f0000" filename = "" Region: id = 991 start_va = 0x77760000 end_va = 0x777e1fff entry_point = 0x77760000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 992 start_va = 0x8100000 end_va = 0x8100fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008100000" filename = "" Region: id = 993 start_va = 0x73ff0000 end_va = 0x7400dfff entry_point = 0x73ff0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 994 start_va = 0x77ba0000 end_va = 0x77c31fff entry_point = 0x77ba0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 995 start_va = 0x71860000 end_va = 0x718c5fff entry_point = 0x71860000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 996 start_va = 0x8110000 end_va = 0x814ffff entry_point = 0x0 region_type = private name = "private_0x0000000008110000" filename = "" Region: id = 997 start_va = 0x8150000 end_va = 0x824ffff entry_point = 0x0 region_type = private name = "private_0x0000000008150000" filename = "" Region: id = 998 start_va = 0x74b10000 end_va = 0x74b1cfff entry_point = 0x74b10000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 999 start_va = 0x7fb48000 end_va = 0x7fb4afff entry_point = 0x0 region_type = private name = "private_0x000000007fb48000" filename = "" Region: id = 1000 start_va = 0x74810000 end_va = 0x74818fff entry_point = 0x74810000 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\wminet_utils.dll") Region: id = 1001 start_va = 0x8250000 end_va = 0x8250fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008250000" filename = "" Region: id = 1002 start_va = 0x8260000 end_va = 0x826ffff entry_point = 0x0 region_type = private name = "private_0x0000000008260000" filename = "" Region: id = 1003 start_va = 0x71840000 end_va = 0x71850fff entry_point = 0x71840000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 1431 start_va = 0x71780000 end_va = 0x7183bfff entry_point = 0x71780000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1432 start_va = 0x8110000 end_va = 0x814ffff entry_point = 0x0 region_type = private name = "private_0x0000000008110000" filename = "" Region: id = 1433 start_va = 0x8150000 end_va = 0x824ffff entry_point = 0x0 region_type = private name = "private_0x0000000008150000" filename = "" Region: id = 1434 start_va = 0x7fb48000 end_va = 0x7fb4afff entry_point = 0x0 region_type = private name = "private_0x000000007fb48000" filename = "" Region: id = 1532 start_va = 0x8270000 end_va = 0x8272fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008270000" filename = "" Region: id = 1533 start_va = 0x71760000 end_va = 0x71771fff entry_point = 0x71760000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\SysWOW64\\NapiNSP.dll" (normalized: "c:\\windows\\syswow64\\napinsp.dll") Region: id = 1534 start_va = 0x8270000 end_va = 0x8273fff entry_point = 0x0 region_type = private name = "private_0x0000000008270000" filename = "" Region: id = 1535 start_va = 0x71740000 end_va = 0x71755fff entry_point = 0x71740000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\SysWOW64\\pnrpnsp.dll" (normalized: "c:\\windows\\syswow64\\pnrpnsp.dll") Region: id = 1536 start_va = 0x71720000 end_va = 0x71732fff entry_point = 0x71720000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\SysWOW64\\nlaapi.dll" (normalized: "c:\\windows\\syswow64\\nlaapi.dll") Region: id = 1537 start_va = 0x71710000 end_va = 0x7171afff entry_point = 0x71710000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\SysWOW64\\winrnr.dll" (normalized: "c:\\windows\\syswow64\\winrnr.dll") Region: id = 1538 start_va = 0x716c0000 end_va = 0x71705fff entry_point = 0x716c0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 1539 start_va = 0x716b0000 end_va = 0x716b7fff entry_point = 0x716b0000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 1540 start_va = 0x71660000 end_va = 0x716a1fff entry_point = 0x71660000 region_type = mapped_file name = "wbemdisp.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.dll") Region: id = 1541 start_va = 0x715e0000 end_va = 0x7165ffff entry_point = 0x715e0000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll") Region: id = 1542 start_va = 0x8280000 end_va = 0x828efff entry_point = 0x8280000 region_type = mapped_file name = "wbemdisp.tlb" filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.tlb") Region: id = 1546 start_va = 0x8290000 end_va = 0x82a4fff entry_point = 0x8290000 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\assembly\\gac_32\\custommarshalers\\2.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1547 start_va = 0x82b0000 end_va = 0x82b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000082b0000" filename = "" Region: id = 1548 start_va = 0x71580000 end_va = 0x71594fff entry_point = 0x71580000 region_type = mapped_file name = "custommarshalers.dll" filename = "\\Windows\\assembly\\GAC_32\\CustomMarshalers\\2.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\assembly\\gac_32\\custommarshalers\\2.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll") Region: id = 1549 start_va = 0x715a0000 end_va = 0x715d9fff entry_point = 0x715a0000 region_type = mapped_file name = "custommarshalers.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\CustomMarshalers\\62ab28c0ecd4e1cc529b9f8a03dfa8b7\\CustomMarshalers.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\custommarshalers\\62ab28c0ecd4e1cc529b9f8a03dfa8b7\\custommarshalers.ni.dll") Region: id = 1550 start_va = 0x82c0000 end_va = 0x82cffff entry_point = 0x0 region_type = private name = "private_0x00000000082c0000" filename = "" Region: id = 1569 start_va = 0x82d0000 end_va = 0x82d4fff entry_point = 0x82d0000 region_type = mapped_file name = "stdole2.tlb" filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb") Region: id = 1575 start_va = 0x82e0000 end_va = 0x831ffff entry_point = 0x0 region_type = private name = "private_0x00000000082e0000" filename = "" Region: id = 1576 start_va = 0x8320000 end_va = 0x841ffff entry_point = 0x0 region_type = private name = "private_0x0000000008320000" filename = "" Region: id = 1577 start_va = 0x7fb45000 end_va = 0x7fb47fff entry_point = 0x0 region_type = private name = "private_0x000000007fb45000" filename = "" Region: id = 1578 start_va = 0x71570000 end_va = 0x71575fff entry_point = 0x71570000 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\SysWOW64\\shfolder.dll" (normalized: "c:\\windows\\syswow64\\shfolder.dll") Region: id = 1579 start_va = 0x8420000 end_va = 0x842efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008420000" filename = "" Region: id = 1580 start_va = 0x8430000 end_va = 0x8430fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008430000" filename = "" Region: id = 1581 start_va = 0x714b0000 end_va = 0x71541fff entry_point = 0x714b0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_49c02355cf03478c\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_49c02355cf03478c\\comctl32.dll") Region: id = 1582 start_va = 0x71550000 end_va = 0x7156dfff entry_point = 0x71550000 region_type = mapped_file name = "shfusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\shfusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\shfusion.dll") Region: id = 1583 start_va = 0x8440000 end_va = 0x84f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008440000" filename = "" Region: id = 1584 start_va = 0x8500000 end_va = 0x8503fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008500000" filename = "" Region: id = 1585 start_va = 0x8510000 end_va = 0x8513fff entry_point = 0x0 region_type = private name = "private_0x0000000008510000" filename = "" Region: id = 1586 start_va = 0x8520000 end_va = 0x8520fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008520000" filename = "" Region: id = 1587 start_va = 0x8610000 end_va = 0x861ffff entry_point = 0x0 region_type = private name = "private_0x0000000008610000" filename = "" Region: id = 1588 start_va = 0x714a0000 end_va = 0x714a5fff entry_point = 0x714a0000 region_type = mapped_file name = "fusion.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\fusion.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\fusion.dll") Region: id = 1589 start_va = 0x8530000 end_va = 0x8530fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008530000" filename = "" Region: id = 1590 start_va = 0x71490000 end_va = 0x71497fff entry_point = 0x71490000 region_type = mapped_file name = "culture.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Culture.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\culture.dll") Region: id = 1591 start_va = 0x8540000 end_va = 0x8540fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000008540000" filename = "" Region: id = 1592 start_va = 0x71470000 end_va = 0x71487fff entry_point = 0x71470000 region_type = mapped_file name = "shfusres.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\ShFusRes.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\shfusres.dll") Region: id = 1593 start_va = 0x71450000 end_va = 0x71464fff entry_point = 0x71450000 region_type = mapped_file name = "devenum.dll" filename = "\\Windows\\SysWOW64\\devenum.dll" (normalized: "c:\\windows\\syswow64\\devenum.dll") Region: id = 1594 start_va = 0x71420000 end_va = 0x71443fff entry_point = 0x71420000 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 1595 start_va = 0x713f0000 end_va = 0x71412fff entry_point = 0x713f0000 region_type = mapped_file name = "winmmbase.dll" filename = "\\Windows\\SysWOW64\\winmmbase.dll" (normalized: "c:\\windows\\syswow64\\winmmbase.dll") Region: id = 1596 start_va = 0x75030000 end_va = 0x75065fff entry_point = 0x75030000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 1597 start_va = 0x713c0000 end_va = 0x713e0fff entry_point = 0x713c0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 1598 start_va = 0x76af0000 end_va = 0x76c94fff entry_point = 0x76af0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 1599 start_va = 0x71390000 end_va = 0x713b7fff entry_point = 0x71390000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 1600 start_va = 0x773e0000 end_va = 0x77421fff entry_point = 0x773e0000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 1601 start_va = 0x77ae0000 end_va = 0x77aedfff entry_point = 0x77ae0000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 1602 start_va = 0x74eb0000 end_va = 0x75024fff entry_point = 0x74eb0000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 1603 start_va = 0x71380000 end_va = 0x71388fff entry_point = 0x71380000 region_type = mapped_file name = "msdmo.dll" filename = "\\Windows\\SysWOW64\\msdmo.dll" (normalized: "c:\\windows\\syswow64\\msdmo.dll") Region: id = 1604 start_va = 0x71360000 end_va = 0x71373fff entry_point = 0x71360000 region_type = mapped_file name = "avicap32.dll" filename = "\\Windows\\SysWOW64\\avicap32.dll" (normalized: "c:\\windows\\syswow64\\avicap32.dll") Region: id = 1605 start_va = 0x71330000 end_va = 0x71352fff entry_point = 0x71330000 region_type = mapped_file name = "msvfw32.dll" filename = "\\Windows\\SysWOW64\\msvfw32.dll" (normalized: "c:\\windows\\syswow64\\msvfw32.dll") Region: id = 1606 start_va = 0x8550000 end_va = 0x8551fff entry_point = 0x8550000 region_type = mapped_file name = "msvfw32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\msvfw32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\msvfw32.dll.mui") Region: id = 1607 start_va = 0x8560000 end_va = 0x8562fff entry_point = 0x8560000 region_type = mapped_file name = "avicap32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\avicap32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\avicap32.dll.mui") Region: id = 1608 start_va = 0x8570000 end_va = 0x85effff entry_point = 0x0 region_type = private name = "private_0x0000000008570000" filename = "" Region: id = 1609 start_va = 0x85f0000 end_va = 0x85f6fff entry_point = 0x0 region_type = private name = "private_0x00000000085f0000" filename = "" Region: id = 1610 start_va = 0x74ba0000 end_va = 0x74bbcfff entry_point = 0x74ba0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 1611 start_va = 0x8550000 end_va = 0x855ffff entry_point = 0x0 region_type = private name = "private_0x0000000008550000" filename = "" Region: id = 1612 start_va = 0x8560000 end_va = 0x856ffff entry_point = 0x0 region_type = private name = "private_0x0000000008560000" filename = "" Region: id = 1613 start_va = 0x8620000 end_va = 0x865ffff entry_point = 0x0 region_type = private name = "private_0x0000000008620000" filename = "" Region: id = 1614 start_va = 0x8660000 end_va = 0x875ffff entry_point = 0x0 region_type = private name = "private_0x0000000008660000" filename = "" Region: id = 1615 start_va = 0x8760000 end_va = 0x879ffff entry_point = 0x0 region_type = private name = "private_0x0000000008760000" filename = "" Region: id = 1616 start_va = 0x87a0000 end_va = 0x889ffff entry_point = 0x0 region_type = private name = "private_0x00000000087a0000" filename = "" Region: id = 1617 start_va = 0x7fadd000 end_va = 0x7fadffff entry_point = 0x0 region_type = private name = "private_0x000000007fadd000" filename = "" Region: id = 1618 start_va = 0x7fb42000 end_va = 0x7fb44fff entry_point = 0x0 region_type = private name = "private_0x000000007fb42000" filename = "" Region: id = 1619 start_va = 0x88a0000 end_va = 0x88dffff entry_point = 0x0 region_type = private name = "private_0x00000000088a0000" filename = "" Region: id = 1620 start_va = 0x88e0000 end_va = 0x89dffff entry_point = 0x0 region_type = private name = "private_0x00000000088e0000" filename = "" Region: id = 1621 start_va = 0x89e0000 end_va = 0x8a1ffff entry_point = 0x0 region_type = private name = "private_0x00000000089e0000" filename = "" Region: id = 1622 start_va = 0x8a20000 end_va = 0x8b1ffff entry_point = 0x0 region_type = private name = "private_0x0000000008a20000" filename = "" Region: id = 1623 start_va = 0x7fad7000 end_va = 0x7fad9fff entry_point = 0x0 region_type = private name = "private_0x000000007fad7000" filename = "" Region: id = 1624 start_va = 0x7fada000 end_va = 0x7fadcfff entry_point = 0x0 region_type = private name = "private_0x000000007fada000" filename = "" Region: id = 1625 start_va = 0x8600000 end_va = 0x8603fff entry_point = 0x0 region_type = private name = "private_0x0000000008600000" filename = "" Region: id = 1626 start_va = 0x8b20000 end_va = 0x8b5ffff entry_point = 0x0 region_type = private name = "private_0x0000000008b20000" filename = "" Region: id = 1627 start_va = 0x8b60000 end_va = 0x8c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000008b60000" filename = "" Region: id = 1628 start_va = 0x8c60000 end_va = 0x8c9ffff entry_point = 0x0 region_type = private name = "private_0x0000000008c60000" filename = "" Region: id = 1629 start_va = 0x8ca0000 end_va = 0x8d9ffff entry_point = 0x0 region_type = private name = "private_0x0000000008ca0000" filename = "" Region: id = 1630 start_va = 0x8da0000 end_va = 0x8ddffff entry_point = 0x0 region_type = private name = "private_0x0000000008da0000" filename = "" Region: id = 1631 start_va = 0x8de0000 end_va = 0x8edffff entry_point = 0x0 region_type = private name = "private_0x0000000008de0000" filename = "" Region: id = 1632 start_va = 0x7face000 end_va = 0x7fad0fff entry_point = 0x0 region_type = private name = "private_0x000000007face000" filename = "" Region: id = 1633 start_va = 0x7fad1000 end_va = 0x7fad3fff entry_point = 0x0 region_type = private name = "private_0x000000007fad1000" filename = "" Region: id = 1634 start_va = 0x7fad4000 end_va = 0x7fad6fff entry_point = 0x0 region_type = private name = "private_0x000000007fad4000" filename = "" Region: id = 1635 start_va = 0x8ee0000 end_va = 0x8ee3fff entry_point = 0x0 region_type = private name = "private_0x0000000008ee0000" filename = "" Region: id = 1636 start_va = 0x8ef0000 end_va = 0x8efffff entry_point = 0x0 region_type = private name = "private_0x0000000008ef0000" filename = "" Region: id = 1637 start_va = 0x8f00000 end_va = 0x8f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000008f00000" filename = "" Region: id = 1638 start_va = 0x8f40000 end_va = 0x903ffff entry_point = 0x0 region_type = private name = "private_0x0000000008f40000" filename = "" Region: id = 1639 start_va = 0x9040000 end_va = 0x904ffff entry_point = 0x0 region_type = private name = "private_0x0000000009040000" filename = "" Region: id = 1640 start_va = 0x7facb000 end_va = 0x7facdfff entry_point = 0x0 region_type = private name = "private_0x000000007facb000" filename = "" Region: id = 1666 start_va = 0x9040000 end_va = 0x907ffff entry_point = 0x0 region_type = private name = "private_0x0000000009040000" filename = "" Region: id = 1667 start_va = 0x9080000 end_va = 0x917ffff entry_point = 0x0 region_type = private name = "private_0x0000000009080000" filename = "" Region: id = 1668 start_va = 0x7fac8000 end_va = 0x7facafff entry_point = 0x0 region_type = private name = "private_0x000000007fac8000" filename = "" Region: id = 1742 start_va = 0x9180000 end_va = 0x91bffff entry_point = 0x0 region_type = private name = "private_0x0000000009180000" filename = "" Region: id = 1743 start_va = 0x91c0000 end_va = 0x92bffff entry_point = 0x0 region_type = private name = "private_0x00000000091c0000" filename = "" Region: id = 1744 start_va = 0x92c0000 end_va = 0x92fffff entry_point = 0x0 region_type = private name = "private_0x00000000092c0000" filename = "" Region: id = 1745 start_va = 0x9300000 end_va = 0x93fffff entry_point = 0x0 region_type = private name = "private_0x0000000009300000" filename = "" Region: id = 1746 start_va = 0x7fac2000 end_va = 0x7fac4fff entry_point = 0x0 region_type = private name = "private_0x000000007fac2000" filename = "" Region: id = 1747 start_va = 0x7fac5000 end_va = 0x7fac7fff entry_point = 0x0 region_type = private name = "private_0x000000007fac5000" filename = "" Region: id = 1748 start_va = 0x9400000 end_va = 0x943ffff entry_point = 0x0 region_type = private name = "private_0x0000000009400000" filename = "" Region: id = 1749 start_va = 0x9440000 end_va = 0x953ffff entry_point = 0x0 region_type = private name = "private_0x0000000009440000" filename = "" Region: id = 1750 start_va = 0x7fabf000 end_va = 0x7fac1fff entry_point = 0x0 region_type = private name = "private_0x000000007fabf000" filename = "" Region: id = 1751 start_va = 0x9540000 end_va = 0x957ffff entry_point = 0x0 region_type = private name = "private_0x0000000009540000" filename = "" Region: id = 1752 start_va = 0x9580000 end_va = 0x967ffff entry_point = 0x0 region_type = private name = "private_0x0000000009580000" filename = "" Region: id = 1753 start_va = 0x9680000 end_va = 0x96bffff entry_point = 0x0 region_type = private name = "private_0x0000000009680000" filename = "" Region: id = 1754 start_va = 0x96c0000 end_va = 0x97bffff entry_point = 0x0 region_type = private name = "private_0x00000000096c0000" filename = "" Region: id = 1755 start_va = 0x7fab9000 end_va = 0x7fabbfff entry_point = 0x0 region_type = private name = "private_0x000000007fab9000" filename = "" Region: id = 1756 start_va = 0x7fabc000 end_va = 0x7fabefff entry_point = 0x0 region_type = private name = "private_0x000000007fabc000" filename = "" Region: id = 1767 start_va = 0x8b20000 end_va = 0x8b5ffff entry_point = 0x0 region_type = private name = "private_0x0000000008b20000" filename = "" Region: id = 1768 start_va = 0x8b60000 end_va = 0x8c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000008b60000" filename = "" Region: id = 1769 start_va = 0x7fad4000 end_va = 0x7fad6fff entry_point = 0x0 region_type = private name = "private_0x000000007fad4000" filename = "" Region: id = 1770 start_va = 0x70b00000 end_va = 0x70b22fff entry_point = 0x70b00000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 1771 start_va = 0x70b30000 end_va = 0x70bd3fff entry_point = 0x70b30000 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 1772 start_va = 0x71270000 end_va = 0x71280fff entry_point = 0x71270000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 1774 start_va = 0x97c0000 end_va = 0x97fffff entry_point = 0x0 region_type = private name = "private_0x00000000097c0000" filename = "" Region: id = 1775 start_va = 0x9800000 end_va = 0x98fffff entry_point = 0x0 region_type = private name = "private_0x0000000009800000" filename = "" Region: id = 1776 start_va = 0x7fab6000 end_va = 0x7fab8fff entry_point = 0x0 region_type = private name = "private_0x000000007fab6000" filename = "" Region: id = 1777 start_va = 0x9900000 end_va = 0x993ffff entry_point = 0x0 region_type = private name = "private_0x0000000009900000" filename = "" Region: id = 1778 start_va = 0x9940000 end_va = 0x9a3ffff entry_point = 0x0 region_type = private name = "private_0x0000000009940000" filename = "" Region: id = 1779 start_va = 0x71180000 end_va = 0x71226fff entry_point = 0x71180000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 1780 start_va = 0x7fab3000 end_va = 0x7fab5fff entry_point = 0x0 region_type = private name = "private_0x000000007fab3000" filename = "" Region: id = 1781 start_va = 0x71160000 end_va = 0x71170fff entry_point = 0x71160000 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 1782 start_va = 0x9a40000 end_va = 0x9b3ffff entry_point = 0x0 region_type = private name = "private_0x0000000009a40000" filename = "" Region: id = 1783 start_va = 0x9b40000 end_va = 0x9b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000009b40000" filename = "" Region: id = 1784 start_va = 0x9b80000 end_va = 0x9c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000009b80000" filename = "" Region: id = 1785 start_va = 0x7fab0000 end_va = 0x7fab2fff entry_point = 0x0 region_type = private name = "private_0x000000007fab0000" filename = "" Region: id = 1786 start_va = 0x9c80000 end_va = 0x9c90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000009c80000" filename = "" Region: id = 1791 start_va = 0x8ef0000 end_va = 0x8ef2fff entry_point = 0x8ef0000 region_type = mapped_file name = "security.dll" filename = "\\Windows\\SysWOW64\\security.dll" (normalized: "c:\\windows\\syswow64\\security.dll") Region: id = 1792 start_va = 0x71020000 end_va = 0x71029fff entry_point = 0x71020000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 1793 start_va = 0x70fc0000 end_va = 0x7101ffff entry_point = 0x70fc0000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 1835 start_va = 0x70cb0000 end_va = 0x70cbffff entry_point = 0x70cb0000 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll") Region: id = 1836 start_va = 0x70c90000 end_va = 0x70caffff entry_point = 0x70c90000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 1841 start_va = 0x9ca0000 end_va = 0x9cdffff entry_point = 0x0 region_type = private name = "private_0x0000000009ca0000" filename = "" Region: id = 1842 start_va = 0x9ce0000 end_va = 0x9ddffff entry_point = 0x0 region_type = private name = "private_0x0000000009ce0000" filename = "" Region: id = 1843 start_va = 0x70c50000 end_va = 0x70c77fff entry_point = 0x70c50000 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll") Region: id = 1844 start_va = 0x7faad000 end_va = 0x7faaffff entry_point = 0x0 region_type = private name = "private_0x000000007faad000" filename = "" Region: id = 1847 start_va = 0x70be0000 end_va = 0x70bf9fff entry_point = 0x70be0000 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll") Region: id = 1852 start_va = 0x9de0000 end_va = 0x9e1ffff entry_point = 0x0 region_type = private name = "private_0x0000000009de0000" filename = "" Region: id = 1853 start_va = 0x9e20000 end_va = 0x9f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000009e20000" filename = "" Region: id = 1854 start_va = 0x7faaa000 end_va = 0x7faacfff entry_point = 0x0 region_type = private name = "private_0x000000007faaa000" filename = "" Region: id = 1855 start_va = 0x70ad0000 end_va = 0x70aeefff entry_point = 0x70ad0000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\SysWOW64\\gpapi.dll" (normalized: "c:\\windows\\syswow64\\gpapi.dll") Region: id = 1857 start_va = 0x9f20000 end_va = 0x9f29fff entry_point = 0x9f20000 region_type = mapped_file name = "crypt32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\crypt32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\crypt32.dll.mui") Region: id = 1858 start_va = 0x70a90000 end_va = 0x70ab5fff entry_point = 0x70a90000 region_type = mapped_file name = "cryptnet.dll" filename = "\\Windows\\SysWOW64\\cryptnet.dll" (normalized: "c:\\windows\\syswow64\\cryptnet.dll") Region: id = 1859 start_va = 0x77350000 end_va = 0x773a2fff entry_point = 0x77350000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 1865 start_va = 0x9f30000 end_va = 0x9f6ffff entry_point = 0x0 region_type = private name = "private_0x0000000009f30000" filename = "" Region: id = 1866 start_va = 0x9f70000 end_va = 0xa06ffff entry_point = 0x0 region_type = private name = "private_0x0000000009f70000" filename = "" Region: id = 1867 start_va = 0x709b0000 end_va = 0x70a17fff entry_point = 0x709b0000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\SysWOW64\\webio.dll" (normalized: "c:\\windows\\syswow64\\webio.dll") Region: id = 1868 start_va = 0x7faa7000 end_va = 0x7faa9fff entry_point = 0x0 region_type = private name = "private_0x000000007faa7000" filename = "" Region: id = 1880 start_va = 0xa070000 end_va = 0xa074fff entry_point = 0xa070000 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll") Region: id = 1881 start_va = 0xa080000 end_va = 0xa08ffff entry_point = 0xa080000 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui") Region: id = 1882 start_va = 0xa090000 end_va = 0xa0cffff entry_point = 0x0 region_type = private name = "private_0x000000000a090000" filename = "" Region: id = 1883 start_va = 0xa0d0000 end_va = 0xa1cffff entry_point = 0x0 region_type = private name = "private_0x000000000a0d0000" filename = "" Region: id = 1884 start_va = 0xa1d0000 end_va = 0xa1d2fff entry_point = 0xa1d0000 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mswsock.dll.mui") Region: id = 1885 start_va = 0x7faa4000 end_va = 0x7faa6fff entry_point = 0x0 region_type = private name = "private_0x000000007faa4000" filename = "" Region: id = 1888 start_va = 0xa1e0000 end_va = 0xa21ffff entry_point = 0x0 region_type = private name = "private_0x000000000a1e0000" filename = "" Region: id = 1889 start_va = 0xa220000 end_va = 0xa31ffff entry_point = 0x0 region_type = private name = "private_0x000000000a220000" filename = "" Region: id = 1890 start_va = 0x70840000 end_va = 0x70861fff entry_point = 0x70840000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\SysWOW64\\cabinet.dll" (normalized: "c:\\windows\\syswow64\\cabinet.dll") Region: id = 1891 start_va = 0x7faa1000 end_va = 0x7faa3fff entry_point = 0x0 region_type = private name = "private_0x000000007faa1000" filename = "" Region: id = 1894 start_va = 0xa1e0000 end_va = 0xa3dffff entry_point = 0x0 region_type = private name = "private_0x000000000a1e0000" filename = "" Thread: id = 39 os_tid = 0xecc [0104.362] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0104.413] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x118e8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0104.413] GetLastError () returned 0x2 [0104.417] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x118e87c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0104.417] GetLastError () returned 0x2 [0104.419] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x118e844, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x26 [0104.419] GetLastError () returned 0x2 [0104.423] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x118e8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x26 [0104.423] GetLastError () returned 0x2 [0104.423] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x118e87c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x26 [0104.423] GetLastError () returned 0x2 [0104.428] GetVersionExW (in: lpVersionInformation=0x1337ce8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1337ce8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0104.428] GetLastError () returned 0x2 [0104.429] GetVersionExW (in: lpVersionInformation=0x1337ce8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1337ce8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0104.429] GetLastError () returned 0x2 [0104.859] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config", nBufferLength=0x105, lpBuffer=0x118e974, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config", lpFilePart=0x0) returned 0x34 [0104.859] GetLastError () returned 0x0 [0104.859] GetVersionExW (in: lpVersionInformation=0x13381c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x13381c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0104.859] GetLastError () returned 0x0 [0104.860] SetErrorMode (uMode=0x1) returned 0x0 [0104.861] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.config"), fInfoLevelId=0x0, lpFileInformation=0x118ee1c | out: lpFileInformation=0x118ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0104.861] GetLastError () returned 0x2 [0104.861] SetErrorMode (uMode=0x0) returned 0x1 [0107.111] VirtualProtect (in: lpAddress=0x54a0178, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.148] VirtualProtect (in: lpAddress=0x54a01a0, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.148] VirtualProtect (in: lpAddress=0x54a01c8, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.154] VirtualProtect (in: lpAddress=0x554773e, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.171] VirtualProtect (in: lpAddress=0x5547732, dwSize=0xb, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.177] VirtualProtect (in: lpAddress=0x54a0208, dwSize=0x48, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.180] VirtualProtect (in: lpAddress=0x54f80d0, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.180] VirtualProtect (in: lpAddress=0x54f80f4, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.180] VirtualProtect (in: lpAddress=0x54f80fc, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.180] VirtualProtect (in: lpAddress=0x54f8100, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.180] VirtualProtect (in: lpAddress=0x54f8108, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.183] VirtualProtect (in: lpAddress=0x54f810c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.183] VirtualProtect (in: lpAddress=0x54f8110, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.183] VirtualProtect (in: lpAddress=0x54f8114, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.183] VirtualProtect (in: lpAddress=0x54f811c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.183] VirtualProtect (in: lpAddress=0x54f8120, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.183] VirtualProtect (in: lpAddress=0x54f8124, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.183] VirtualProtect (in: lpAddress=0x54f812c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.183] VirtualProtect (in: lpAddress=0x54f8130, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.183] VirtualProtect (in: lpAddress=0x54f8134, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.183] VirtualProtect (in: lpAddress=0x54f813c, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.183] VirtualProtect (in: lpAddress=0x54f8140, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.183] VirtualProtect (in: lpAddress=0x54f8144, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.184] VirtualProtect (in: lpAddress=0x54f8148, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.184] VirtualProtect (in: lpAddress=0x54f8150, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.184] VirtualProtect (in: lpAddress=0x54f8154, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.184] VirtualProtect (in: lpAddress=0x54f8158, dwSize=0x8, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.184] VirtualProtect (in: lpAddress=0x54f8160, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.184] VirtualProtect (in: lpAddress=0x54f8164, dwSize=0x4, flNewProtect=0x40, lpflOldProtect=0x118e358 | out: lpflOldProtect=0x118e358*=0x1) returned 0 [0107.188] GetEnvironmentVariableW (in: lpName="COR_PROFILER", lpBuffer=0x13381a8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.188] GetLastError () returned 0xcb [0107.190] GetEnvironmentVariableW (in: lpName="COR_ENABLE_PROFILING", lpBuffer=0x13381a8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0107.190] GetLastError () returned 0xcb [0108.371] SetProcessDPIAware () returned 1 [0108.371] GetLastError () returned 0x0 [0108.685] GetCurrentProcess () returned 0xffffffff [0108.686] GetCurrentThread () returned 0xfffffffe [0108.686] GetCurrentProcess () returned 0xffffffff [0108.687] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x118e9a0, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x118e9a0*=0x294) returned 1 [0108.687] GetLastError () returned 0x3 [0108.690] GetCurrentThreadId () returned 0xecc [0108.837] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="d6255d76-fd1b-49c2-b1bf-bb2df53c6c67") returned 0x298 [0108.837] GetLastError () returned 0x0 [0108.837] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x118e94c*=0x298, lpdwindex=0x118e704 | out: lpdwindex=0x118e704) returned 0x0 [0108.993] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x118d714 | out: pFixedInfo=0x0, pOutBufLen=0x118d714) returned 0x6f [0109.659] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x13689c0 [0109.659] GetLastError () returned 0x0 [0109.660] GetNetworkParams (in: pFixedInfo=0x13689c0, pOutBufLen=0x118d714 | out: pFixedInfo=0x13689c0, pOutBufLen=0x118d714) returned 0x0 [0109.704] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x136fd10 | out: lpWSAData=0x136fd10) returned 0 [0109.707] GetLastError () returned 0x0 [0109.718] lstrlenW (lpString="䅁") returned 1 [0109.721] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x118cd8c | out: phkResult=0x118cd8c*=0x3a0) returned 0x0 [0109.721] RegQueryValueExW (in: hKey=0x3a0, lpValueName="InstallationType", lpReserved=0x0, lpType=0x118cdd4, lpData=0x0, lpcbData=0x118cdd0*=0x0 | out: lpType=0x118cdd4*=0x1, lpData=0x0, lpcbData=0x118cdd0*=0xe) returned 0x0 [0109.722] RegQueryValueExW (in: hKey=0x3a0, lpValueName="InstallationType", lpReserved=0x0, lpType=0x118cdd4, lpData=0x13381a8, lpcbData=0x118cdd0*=0xe | out: lpType=0x118cdd4*=0x1, lpData="Client", lpcbData=0x118cdd0*=0xe) returned 0x0 [0109.722] RegCloseKey (hKey=0x3a0) returned 0x0 [0109.724] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x3a4 [0109.874] GetLastError () returned 0x0 [0109.874] setsockopt (s=0x3a4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0109.874] GetLastError () returned 0x273a [0109.874] closesocket (s=0x3a4) returned 0 [0109.875] GetLastError () returned 0x0 [0109.875] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x3a4 [0109.876] GetLastError () returned 0x0 [0109.876] setsockopt (s=0x3a4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0109.876] GetLastError () returned 0x273a [0109.876] closesocket (s=0x3a4) returned 0 [0109.876] GetLastError () returned 0x0 [0110.372] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config", nBufferLength=0x105, lpBuffer=0x118cff0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config", lpFilePart=0x0) returned 0x34 [0110.372] GetLastError () returned 0x0 [0110.372] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config", nBufferLength=0x105, lpBuffer=0x118cfa4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config", lpFilePart=0x0) returned 0x34 [0110.372] GetLastError () returned 0x0 [0110.373] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x118cfa8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0110.373] GetLastError () returned 0x0 [0111.198] GetVersionExW (in: lpVersionInformation=0x13381c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x13381c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0111.198] GetLastError () returned 0x0 [0111.253] GetCurrentProcess () returned 0xffffffff [0111.253] GetLastError () returned 0x3f0 [0111.254] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x118d13c | out: TokenHandle=0x118d13c*=0x3a4) returned 1 [0111.254] GetLastError () returned 0x3f0 [0111.258] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x118ccd4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0111.258] GetLastError () returned 0x0 [0111.288] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x118d17c | out: lpFileInformation=0x118d17c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a6fa1b, ftCreationTime.dwHighDateTime=0x1d2d447, ftLastAccessTime.dwLowDateTime=0x128030a, ftLastAccessTime.dwHighDateTime=0x1d2d447, ftLastWriteTime.dwLowDateTime=0x969f9f4, ftLastWriteTime.dwHighDateTime=0x1d2d447, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0111.288] GetLastError () returned 0x0 [0111.289] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x118cc94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0111.289] GetLastError () returned 0x0 [0111.290] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x118d178 | out: lpFileInformation=0x118d178*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a6fa1b, ftCreationTime.dwHighDateTime=0x1d2d447, ftLastAccessTime.dwLowDateTime=0x128030a, ftLastAccessTime.dwHighDateTime=0x1d2d447, ftLastWriteTime.dwLowDateTime=0x969f9f4, ftLastWriteTime.dwHighDateTime=0x1d2d447, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0111.290] GetLastError () returned 0x0 [0111.291] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x118cbe0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0111.291] GetLastError () returned 0x0 [0111.291] SetErrorMode (uMode=0x1) returned 0x0 [0111.292] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3ac [0111.293] GetLastError () returned 0x0 [0111.293] GetFileType (hFile=0x3ac) returned 0x1 [0111.293] SetErrorMode (uMode=0x0) returned 0x1 [0111.293] GetFileType (hFile=0x3ac) returned 0x1 [0111.499] GetFileSize (in: hFile=0x3ac, lpFileSizeHigh=0x118d14c | out: lpFileSizeHigh=0x118d14c*=0x0) returned 0x65b3 [0111.499] GetLastError () returned 0x0 [0111.501] ReadFile (in: hFile=0x3ac, lpBuffer=0x333e028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x118d104, lpOverlapped=0x0 | out: lpBuffer=0x333e028*, lpNumberOfBytesRead=0x118d104*=0x1000, lpOverlapped=0x0) returned 1 [0111.501] GetLastError () returned 0x0 [0111.576] ReadFile (in: hFile=0x3ac, lpBuffer=0x333e028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x118cf14, lpOverlapped=0x0 | out: lpBuffer=0x333e028*, lpNumberOfBytesRead=0x118cf14*=0x1000, lpOverlapped=0x0) returned 1 [0111.576] GetLastError () returned 0x0 [0111.577] ReadFile (in: hFile=0x3ac, lpBuffer=0x333e028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x118cdbc, lpOverlapped=0x0 | out: lpBuffer=0x333e028*, lpNumberOfBytesRead=0x118cdbc*=0x1000, lpOverlapped=0x0) returned 1 [0111.577] GetLastError () returned 0x0 [0111.577] ReadFile (in: hFile=0x3ac, lpBuffer=0x333e028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x118cdbc, lpOverlapped=0x0 | out: lpBuffer=0x333e028*, lpNumberOfBytesRead=0x118cdbc*=0x1000, lpOverlapped=0x0) returned 1 [0111.577] GetLastError () returned 0x0 [0111.577] ReadFile (in: hFile=0x3ac, lpBuffer=0x333e028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x118cdbc, lpOverlapped=0x0 | out: lpBuffer=0x333e028*, lpNumberOfBytesRead=0x118cdbc*=0x1000, lpOverlapped=0x0) returned 1 [0111.578] GetLastError () returned 0x0 [0111.583] ReadFile (in: hFile=0x3ac, lpBuffer=0x333e028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x118cef0, lpOverlapped=0x0 | out: lpBuffer=0x333e028*, lpNumberOfBytesRead=0x118cef0*=0x1000, lpOverlapped=0x0) returned 1 [0111.583] GetLastError () returned 0x0 [0111.583] ReadFile (in: hFile=0x3ac, lpBuffer=0x333e028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x118cd84, lpOverlapped=0x0 | out: lpBuffer=0x333e028*, lpNumberOfBytesRead=0x118cd84*=0x5b3, lpOverlapped=0x0) returned 1 [0111.584] GetLastError () returned 0x0 [0111.584] ReadFile (in: hFile=0x3ac, lpBuffer=0x333e028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x118ce70, lpOverlapped=0x0 | out: lpBuffer=0x333e028*, lpNumberOfBytesRead=0x118ce70*=0x0, lpOverlapped=0x0) returned 1 [0111.584] GetLastError () returned 0x0 [0111.584] CloseHandle (hObject=0x3ac) returned 1 [0111.584] GetLastError () returned 0x0 [0111.587] GetCurrentProcess () returned 0xffffffff [0111.587] GetLastError () returned 0x3f0 [0111.587] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x118d3cc | out: TokenHandle=0x118d3cc*=0x3ac) returned 1 [0111.587] GetLastError () returned 0x3f0 [0111.587] GetCurrentProcess () returned 0xffffffff [0111.587] GetLastError () returned 0x3f0 [0111.587] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x118d3cc | out: TokenHandle=0x118d3cc*=0x3a8) returned 1 [0111.587] GetLastError () returned 0x3f0 [0111.588] GetCurrentProcess () returned 0xffffffff [0111.589] GetLastError () returned 0x3f0 [0111.589] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x118d13c | out: TokenHandle=0x118d13c*=0x3b0) returned 1 [0111.589] GetLastError () returned 0x3f0 [0111.589] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.config"), fInfoLevelId=0x0, lpFileInformation=0x118d17c | out: lpFileInformation=0x118d17c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.589] GetLastError () returned 0x2 [0111.589] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config", nBufferLength=0x105, lpBuffer=0x118cc94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config", lpFilePart=0x0) returned 0x34 [0111.589] GetLastError () returned 0x2 [0111.589] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.config" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.config"), fInfoLevelId=0x0, lpFileInformation=0x118d178 | out: lpFileInformation=0x118d178*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0111.589] GetLastError () returned 0x2 [0111.589] GetCurrentProcess () returned 0xffffffff [0111.589] GetLastError () returned 0x3f0 [0111.589] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x118d3cc | out: TokenHandle=0x118d3cc*=0x3b4) returned 1 [0111.589] GetLastError () returned 0x3f0 [0111.590] GetCurrentProcess () returned 0xffffffff [0111.590] GetLastError () returned 0x3f0 [0111.590] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x118d3cc | out: TokenHandle=0x118d3cc*=0x3b8) returned 1 [0111.590] GetLastError () returned 0x3f0 [0111.672] GetCurrentProcess () returned 0xffffffff [0111.672] GetLastError () returned 0x3f0 [0111.672] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x118d1a8 | out: TokenHandle=0x118d1a8*=0x3bc) returned 1 [0111.672] GetLastError () returned 0x3f0 [0111.680] GetCurrentProcess () returned 0xffffffff [0111.680] GetLastError () returned 0x3f0 [0111.680] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x118d1b8 | out: TokenHandle=0x118d1b8*=0x3c0) returned 1 [0111.680] GetLastError () returned 0x3f0 [0111.752] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x118cfb4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0111.752] GetLastError () returned 0x3f0 [0111.755] GetCurrentProcessId () returned 0xec8 [0111.783] GetComputerNameW (in: lpBuffer=0x136fd10, nSize=0x3358d90 | out: lpBuffer="LHNIWSJ", nSize=0x3358d90) returned 1 [0111.785] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\.NET CLR Networking\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x118d418 | out: phkResult=0x118d418*=0x3c4) returned 0x0 [0111.785] RegQueryValueExW (in: hKey=0x3c4, lpValueName="Library", lpReserved=0x0, lpType=0x118d454, lpData=0x0, lpcbData=0x118d450*=0x0 | out: lpType=0x118d454*=0x2, lpData=0x0, lpcbData=0x118d450*=0x48) returned 0x0 [0111.786] RegQueryValueExW (in: hKey=0x3c4, lpValueName="Library", lpReserved=0x0, lpType=0x118d454, lpData=0x13381a8, lpcbData=0x118d450*=0x48 | out: lpType=0x118d454*=0x2, lpData="%systemroot%\\system32\\netfxperf.dll", lpcbData=0x118d450*=0x48) returned 0x0 [0111.786] RegQueryValueExW (in: hKey=0x3c4, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x118d460, lpData=0x0, lpcbData=0x118d45c*=0x0 | out: lpType=0x118d460*=0x4, lpData=0x0, lpcbData=0x118d45c*=0x4) returned 0x0 [0111.787] RegQueryValueExW (in: hKey=0x3c4, lpValueName="IsMultiInstance", lpReserved=0x0, lpType=0x118d460, lpData=0x118d44c, lpcbData=0x118d45c*=0x4 | out: lpType=0x118d460*=0x4, lpData=0x118d44c*=0x1, lpcbData=0x118d45c*=0x4) returned 0x0 [0111.787] RegQueryValueExW (in: hKey=0x3c4, lpValueName="First Counter", lpReserved=0x0, lpType=0x118d460, lpData=0x0, lpcbData=0x118d45c*=0x0 | out: lpType=0x118d460*=0x4, lpData=0x0, lpcbData=0x118d45c*=0x4) returned 0x0 [0111.787] RegQueryValueExW (in: hKey=0x3c4, lpValueName="First Counter", lpReserved=0x0, lpType=0x118d460, lpData=0x118d44c, lpcbData=0x118d45c*=0x4 | out: lpType=0x118d460*=0x4, lpData=0x118d44c*=0x16d0, lpcbData=0x118d45c*=0x4) returned 0x0 [0111.787] RegCloseKey (hKey=0x3c4) returned 0x0 [0111.789] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\.net clr networking\\Performance", ulOptions=0x0, samDesired=0x20019, phkResult=0x118d408 | out: phkResult=0x118d408*=0x3c4) returned 0x0 [0111.789] RegQueryValueExW (in: hKey=0x3c4, lpValueName="CategoryOptions", lpReserved=0x0, lpType=0x118d450, lpData=0x0, lpcbData=0x118d44c*=0x0 | out: lpType=0x118d450*=0x4, lpData=0x0, lpcbData=0x118d44c*=0x4) returned 0x0 [0111.789] RegQueryValueExW (in: hKey=0x3c4, lpValueName="CategoryOptions", lpReserved=0x0, lpType=0x118d450, lpData=0x118d43c, lpcbData=0x118d44c*=0x4 | out: lpType=0x118d450*=0x4, lpData=0x118d43c*=0x3, lpcbData=0x118d44c*=0x4) returned 0x0 [0111.790] RegQueryValueExW (in: hKey=0x3c4, lpValueName="FileMappingSize", lpReserved=0x0, lpType=0x118d450, lpData=0x0, lpcbData=0x118d44c*=0x0 | out: lpType=0x118d450*=0x4, lpData=0x0, lpcbData=0x118d44c*=0x4) returned 0x0 [0111.790] RegQueryValueExW (in: hKey=0x3c4, lpValueName="FileMappingSize", lpReserved=0x0, lpType=0x118d450, lpData=0x118d43c, lpcbData=0x118d44c*=0x4 | out: lpType=0x118d450*=0x4, lpData=0x118d43c*=0x20000, lpcbData=0x118d44c*=0x4) returned 0x0 [0111.790] RegQueryValueExW (in: hKey=0x3c4, lpValueName="Counter Names", lpReserved=0x0, lpType=0x118d450, lpData=0x0, lpcbData=0x118d44c*=0x0 | out: lpType=0x118d450*=0x3, lpData=0x0, lpcbData=0x118d44c*=0xaa) returned 0x0 [0111.790] RegQueryValueExW (in: hKey=0x3c4, lpValueName="Counter Names", lpReserved=0x0, lpType=0x118d450, lpData=0x335b4b4, lpcbData=0x118d44c*=0xaa | out: lpType=0x118d450*=0x3, lpData=0x335b4b4*, lpcbData=0x118d44c*=0xaa) returned 0x0 [0111.792] ConvertStringSecurityDescriptorToSecurityDescriptorW () returned 0x1 [0111.794] GetLastError () returned 0x0 [0111.795] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x13381d8, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x20000, lpName="Global\\netfxcustomperfcounters.1.0.net clr networking") returned 0x364 [0111.796] GetLastError () returned 0x0 [0111.797] MapViewOfFile (hFileMappingObject=0x364, dwDesiredAccess=0x2, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x0) returned 0x2f70000 [0111.798] VirtualQuery (in: lpAddress=0x2f70000, lpBuffer=0x118d420, dwLength=0x1c | out: lpBuffer=0x118d420*(BaseAddress=0x2f70000, AllocationBase=0x2f70000, AllocationProtect=0x4, RegionSize=0x20000, State=0x1000, Protect=0x4, Type=0x40000)) returned 0x1c [0111.798] GetLastError () returned 0x0 [0111.798] LocalFree (hMem=0x1352528) returned 0x0 [0111.798] RegCloseKey (hKey=0x3c4) returned 0x0 [0111.800] GetVersionExW (in: lpVersionInformation=0x13381c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x13381c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0111.800] GetLastError () returned 0x0 [0111.801] GetVersionExW (in: lpVersionInformation=0x13381c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x13381c0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0111.801] GetLastError () returned 0x0 [0111.802] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x335befc, cbSid=0x118d400 | out: pSid=0x335befc*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x118d400) returned 1 [0111.802] GetLastError () returned 0x0 [0111.803] CreateMutexW (lpMutexAttributes=0x335c04c, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3c4 [0111.803] GetLastError () returned 0x0 [0111.804] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x1f4) returned 0x0 [0111.804] GetLastError () returned 0x0 [0111.804] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x335c220, cbSid=0x118d3c0 | out: pSid=0x335c220*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x118d3c0) returned 1 [0111.805] GetLastError () returned 0x0 [0111.805] CreateMutexW (lpMutexAttributes=0x335c330, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x0 [0111.805] GetLastError () returned 0x5 [0111.807] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="Global\\.net clr networking") returned 0x3cc [0111.807] GetLastError () returned 0x5 [0111.807] WaitForSingleObject (hHandle=0x3cc, dwMilliseconds=0x1f4) returned 0x0 [0111.807] GetLastError () returned 0x5 [0111.807] ReleaseMutex (hMutex=0x3cc) returned 1 [0111.807] GetLastError () returned 0x5 [0111.808] CloseHandle (hObject=0x3cc) returned 1 [0111.808] GetLastError () returned 0x5 [0111.808] GetCurrentProcessId () returned 0xec8 [0111.810] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0xec8) returned 0x3cc [0111.810] GetLastError () returned 0x5 [0111.810] GetProcessTimes (in: hProcess=0x3cc, lpCreationTime=0x118d3c4, lpExitTime=0x118d3bc, lpKernelTime=0x118d3bc, lpUserTime=0x118d3bc | out: lpCreationTime=0x118d3c4, lpExitTime=0x118d3bc, lpKernelTime=0x118d3bc, lpUserTime=0x118d3bc) returned 1 [0111.810] GetLastError () returned 0x5 [0111.811] CloseHandle (hObject=0x3cc) returned 1 [0111.811] GetLastError () returned 0x5 [0111.811] ReleaseMutex (hMutex=0x3c4) returned 1 [0111.811] GetLastError () returned 0x5 [0111.811] CloseHandle (hObject=0x3c4) returned 1 [0111.811] GetLastError () returned 0x5 [0111.811] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x335cb24, cbSid=0x118d400 | out: pSid=0x335cb24*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x118d400) returned 1 [0111.812] GetLastError () returned 0x5 [0111.812] CreateMutexW (lpMutexAttributes=0x335cc34, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3c4 [0111.812] GetLastError () returned 0x0 [0111.812] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x1f4) returned 0x0 [0111.812] GetLastError () returned 0x0 [0111.823] ReleaseMutex (hMutex=0x3c4) returned 1 [0111.823] GetLastError () returned 0x0 [0111.823] CloseHandle (hObject=0x3c4) returned 1 [0111.823] GetLastError () returned 0x0 [0111.823] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x335d400, cbSid=0x118d400 | out: pSid=0x335d400*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x118d400) returned 1 [0111.823] GetLastError () returned 0x0 [0111.823] CreateMutexW (lpMutexAttributes=0x335d510, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3c4 [0111.823] GetLastError () returned 0x0 [0111.823] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x1f4) returned 0x0 [0111.824] GetLastError () returned 0x0 [0111.824] ReleaseMutex (hMutex=0x3c4) returned 1 [0111.824] GetLastError () returned 0x0 [0111.824] CloseHandle (hObject=0x3c4) returned 1 [0111.824] GetLastError () returned 0x0 [0111.824] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x335db94, cbSid=0x118d400 | out: pSid=0x335db94*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x118d400) returned 1 [0111.824] GetLastError () returned 0x0 [0111.824] CreateMutexW (lpMutexAttributes=0x335dca4, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3c4 [0111.825] GetLastError () returned 0x0 [0111.825] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x1f4) returned 0x0 [0111.825] GetLastError () returned 0x0 [0111.825] ReleaseMutex (hMutex=0x3c4) returned 1 [0111.825] GetLastError () returned 0x0 [0111.825] CloseHandle (hObject=0x3c4) returned 1 [0111.825] GetLastError () returned 0x0 [0111.825] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x335e320, cbSid=0x118d400 | out: pSid=0x335e320*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x118d400) returned 1 [0111.825] GetLastError () returned 0x0 [0111.826] CreateMutexW (lpMutexAttributes=0x335e430, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3c4 [0111.826] GetLastError () returned 0x0 [0111.826] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x1f4) returned 0x0 [0111.826] GetLastError () returned 0x0 [0111.826] ReleaseMutex (hMutex=0x3c4) returned 1 [0111.826] GetLastError () returned 0x0 [0111.826] CloseHandle (hObject=0x3c4) returned 1 [0111.826] GetLastError () returned 0x0 [0111.826] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x335eab4, cbSid=0x118d3f8 | out: pSid=0x335eab4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x118d3f8) returned 1 [0111.826] GetLastError () returned 0x0 [0111.827] CreateMutexW (lpMutexAttributes=0x335ebc4, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3c4 [0111.827] GetLastError () returned 0x0 [0111.827] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x1f4) returned 0x0 [0111.827] GetLastError () returned 0x0 [0111.827] ReleaseMutex (hMutex=0x3c4) returned 1 [0111.827] GetLastError () returned 0x0 [0111.827] CloseHandle (hObject=0x3c4) returned 1 [0111.827] GetLastError () returned 0x0 [0111.827] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x335f254, cbSid=0x118d3f8 | out: pSid=0x335f254*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x118d3f8) returned 1 [0111.827] GetLastError () returned 0x0 [0111.827] CreateMutexW (lpMutexAttributes=0x335f364, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3c4 [0111.828] GetLastError () returned 0x0 [0111.828] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x1f4) returned 0x0 [0111.828] GetLastError () returned 0x0 [0111.828] ReleaseMutex (hMutex=0x3c4) returned 1 [0111.828] GetLastError () returned 0x0 [0111.828] CloseHandle (hObject=0x3c4) returned 1 [0111.828] GetLastError () returned 0x0 [0111.829] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x335f9d0, cbSid=0x118d3f8 | out: pSid=0x335f9d0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x118d3f8) returned 1 [0111.829] GetLastError () returned 0x0 [0111.829] CreateMutexW (lpMutexAttributes=0x335fae0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3c4 [0111.829] GetLastError () returned 0x0 [0111.829] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x1f4) returned 0x0 [0111.829] GetLastError () returned 0x0 [0111.829] ReleaseMutex (hMutex=0x3c4) returned 1 [0111.829] GetLastError () returned 0x0 [0111.829] CloseHandle (hObject=0x3c4) returned 1 [0111.829] GetLastError () returned 0x0 [0111.830] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x336015c, cbSid=0x118d3f8 | out: pSid=0x336015c*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x118d3f8) returned 1 [0111.830] GetLastError () returned 0x0 [0111.830] CreateMutexW (lpMutexAttributes=0x336026c, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3c4 [0111.830] GetLastError () returned 0x0 [0111.830] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x1f4) returned 0x0 [0111.830] GetLastError () returned 0x0 [0111.830] ReleaseMutex (hMutex=0x3c4) returned 1 [0111.830] GetLastError () returned 0x0 [0111.830] CloseHandle (hObject=0x3c4) returned 1 [0111.831] GetLastError () returned 0x0 [0111.831] CreateWellKnownSid (in: WellKnownSidType=0x11, DomainSid=0x0, pSid=0x33608e0, cbSid=0x118d3f8 | out: pSid=0x33608e0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0xb), cbSid=0x118d3f8) returned 1 [0111.831] GetLastError () returned 0x0 [0111.831] CreateMutexW (lpMutexAttributes=0x33609f0, bInitialOwner=0, lpName="Global\\.net clr networking") returned 0x3c4 [0111.831] GetLastError () returned 0x0 [0111.831] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x1f4) returned 0x0 [0111.831] GetLastError () returned 0x0 [0111.831] ReleaseMutex (hMutex=0x3c4) returned 1 [0111.831] GetLastError () returned 0x0 [0111.831] CloseHandle (hObject=0x3c4) returned 1 [0111.831] GetLastError () returned 0x0 [0111.912] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0111.912] GetLastError () returned 0x0 [0111.933] LocalFree (hMem=0x13689c0) returned 0x0 [0111.934] GetLastError () returned 0x0 [0113.106] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c4 [0113.106] GetLastError () returned 0x0 [0113.107] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3cc [0113.107] GetLastError () returned 0x0 [0113.115] SetEvent (hEvent=0x3cc) returned 1 [0113.115] GetLastError () returned 0x0 [0113.116] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x118e840*=0x3c4, lpdwindex=0x118e5f8 | out: lpdwindex=0x118e5f8) returned 0x0 [0113.665] CoGetContextToken (in: pToken=0x118e690 | out: pToken=0x118e690) returned 0x0 [0113.665] CoGetContextToken (in: pToken=0x118e650 | out: pToken=0x118e650) returned 0x0 [0113.665] IUnknown:AddRef (This=0x1375330) returned 0x2 [0113.665] IUnknown:QueryInterface (in: This=0x1375330, riid=0x118e6cc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e6c8 | out: ppvObject=0x118e6c8*=0x1375330) returned 0x0 [0113.665] IUnknown:Release (This=0x1375330) returned 0x2 [0113.665] IUnknown:Release (This=0x1375330) returned 0x1 [0113.666] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x420 [0113.666] GetLastError () returned 0x0 [0113.666] SetEvent (hEvent=0x3cc) returned 1 [0113.666] GetLastError () returned 0x0 [0113.666] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x118e064*=0x420, lpdwindex=0x118de1c | out: lpdwindex=0x118de1c) returned 0x0 [0113.669] CoGetContextToken (in: pToken=0x118deb4 | out: pToken=0x118deb4) returned 0x0 [0113.669] CoGetContextToken (in: pToken=0x118de74 | out: pToken=0x118de74) returned 0x0 [0113.669] IUnknown:AddRef (This=0x1375100) returned 0x2 [0113.669] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118def0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118deec | out: ppvObject=0x118deec*=0x1375100) returned 0x0 [0113.669] IUnknown:Release (This=0x1375100) returned 0x2 [0113.669] IUnknown:Release (This=0x1375100) returned 0x1 [0113.674] CoGetContextToken (in: pToken=0x118df34 | out: pToken=0x118df34) returned 0x0 [0113.674] CoGetContextToken (in: pToken=0x118def4 | out: pToken=0x118def4) returned 0x0 [0113.674] IUnknown:AddRef (This=0x1375100) returned 0x2 [0113.675] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118df70*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118df6c | out: ppvObject=0x118df6c*=0x1375100) returned 0x0 [0113.675] IUnknown:Release (This=0x1375100) returned 0x2 [0113.675] IWbemPath:SetText (This=0x1375100, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0113.675] IUnknown:Release (This=0x1375100) returned 0x1 [0113.675] CoGetContextToken (in: pToken=0x118e710 | out: pToken=0x118e710) returned 0x0 [0113.675] CoGetContextToken (in: pToken=0x118e6d0 | out: pToken=0x118e6d0) returned 0x0 [0113.675] IUnknown:AddRef (This=0x1375330) returned 0x2 [0113.675] IUnknown:QueryInterface (in: This=0x1375330, riid=0x118e74c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e748 | out: ppvObject=0x118e748*=0x1375330) returned 0x0 [0113.676] IUnknown:Release (This=0x1375330) returned 0x2 [0113.676] IWbemPath:SetText (This=0x1375330, uMode=0x4, pszPath="Win32_OperatingSystem") returned 0x0 [0113.676] IUnknown:Release (This=0x1375330) returned 0x1 [0113.679] CoGetContextToken (in: pToken=0x118e72c | out: pToken=0x118e72c) returned 0x0 [0113.679] CoGetContextToken (in: pToken=0x118e6ec | out: pToken=0x118e6ec) returned 0x0 [0113.679] IUnknown:AddRef (This=0x1375330) returned 0x2 [0113.679] IUnknown:QueryInterface (in: This=0x1375330, riid=0x118e768*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e764 | out: ppvObject=0x118e764*=0x1375330) returned 0x0 [0113.680] IUnknown:Release (This=0x1375330) returned 0x2 [0113.680] IWbemPath:GetInfo (in: This=0x1375330, uRequestedInfo=0x0, puResponse=0x118e8e0 | out: puResponse=0x118e8e0*=0xc15) returned 0x0 [0113.680] IUnknown:Release (This=0x1375330) returned 0x1 [0113.682] CoGetContextToken (in: pToken=0x118e728 | out: pToken=0x118e728) returned 0x0 [0113.682] CoGetContextToken (in: pToken=0x118e6e8 | out: pToken=0x118e6e8) returned 0x0 [0113.682] IUnknown:AddRef (This=0x1375330) returned 0x2 [0113.682] IUnknown:QueryInterface (in: This=0x1375330, riid=0x118e764*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e760 | out: ppvObject=0x118e760*=0x1375330) returned 0x0 [0113.682] IUnknown:Release (This=0x1375330) returned 0x2 [0113.682] IWbemPath:GetNamespaceCount (in: This=0x1375330, puCount=0x118e8dc | out: puCount=0x118e8dc*=0x0) returned 0x0 [0113.682] IUnknown:Release (This=0x1375330) returned 0x1 [0113.683] CoGetContextToken (in: pToken=0x118e6f4 | out: pToken=0x118e6f4) returned 0x0 [0113.683] CoGetContextToken (in: pToken=0x118e6b4 | out: pToken=0x118e6b4) returned 0x0 [0113.684] IUnknown:AddRef (This=0x1375100) returned 0x2 [0113.684] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e730*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e72c | out: ppvObject=0x118e72c*=0x1375100) returned 0x0 [0113.684] IUnknown:Release (This=0x1375100) returned 0x2 [0113.684] IWbemPath:GetNamespaceCount (in: This=0x1375100, puCount=0x118e8a8 | out: puCount=0x118e8a8*=0x2) returned 0x0 [0113.684] IUnknown:Release (This=0x1375100) returned 0x1 [0113.686] CoGetContextToken (in: pToken=0x118e6e4 | out: pToken=0x118e6e4) returned 0x0 [0113.686] CoGetContextToken (in: pToken=0x118e6a4 | out: pToken=0x118e6a4) returned 0x0 [0113.686] IUnknown:AddRef (This=0x1375100) returned 0x2 [0113.686] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e720*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e71c | out: ppvObject=0x118e71c*=0x1375100) returned 0x0 [0113.686] IUnknown:Release (This=0x1375100) returned 0x2 [0113.687] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e8a4*=0x0, pszText=0x0 | out: puBuffLength=0x118e8a4*=0xf, pszText=0x0) returned 0x0 [0113.687] IUnknown:Release (This=0x1375100) returned 0x1 [0113.687] CoGetContextToken (in: pToken=0x118e6e4 | out: pToken=0x118e6e4) returned 0x0 [0113.687] CoGetContextToken (in: pToken=0x118e6a4 | out: pToken=0x118e6a4) returned 0x0 [0113.687] IUnknown:AddRef (This=0x1375100) returned 0x2 [0113.687] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e720*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e71c | out: ppvObject=0x118e71c*=0x1375100) returned 0x0 [0113.687] IUnknown:Release (This=0x1375100) returned 0x2 [0113.687] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e8a4*=0xf, pszText="00000000000000" | out: puBuffLength=0x118e8a4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0113.687] IUnknown:Release (This=0x1375100) returned 0x1 [0113.696] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x118e728*=0x434, lpdwindex=0x118e584 | out: lpdwindex=0x118e584) returned 0x0 [0115.607] CoGetContextToken (in: pToken=0x118e774 | out: pToken=0x118e774) returned 0x0 [0115.607] CoGetContextToken (in: pToken=0x118e720 | out: pToken=0x118e720) returned 0x0 [0115.607] IUnknown:QueryInterface (in: This=0x1332db8, riid=0x73b4db1c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e6f4 | out: ppvObject=0x118e6f4*=0x1332dc8) returned 0x0 [0115.607] CObjectContext::ContextCallback () returned 0x0 [0115.642] IUnknown:Release (This=0x1332dc8) returned 0x1 [0115.643] CoUnmarshalInterface (in: pStm=0x1387458, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x118e778 | out: ppv=0x118e778*=0x138b4b8) returned 0x0 [0115.643] CoMarshalInterface (pStm=0x1387458, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x138b4b8, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0115.644] IUnknown:QueryInterface (in: This=0x138b4b8, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e398 | out: ppvObject=0x118e398*=0x138b4b8) returned 0x0 [0115.644] IUnknown:QueryInterface (in: This=0x138b4b8, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118e354 | out: ppvObject=0x118e354*=0x0) returned 0x80004002 [0115.709] IUnknown:QueryInterface (in: This=0x138b4b8, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118e248 | out: ppvObject=0x118e248*=0x0) returned 0x80004002 [0115.765] IUnknown:AddRef (This=0x138b4b8) returned 0x3 [0115.765] CoGetContextToken (in: pToken=0x118e1e0 | out: pToken=0x118e1e0) returned 0x0 [0115.765] CoGetContextToken (in: pToken=0x118e1a4 | out: pToken=0x118e1a4) returned 0x0 [0115.765] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e1d8 | out: ppvObject=0x118e1d8*=0x1332d0c) returned 0x0 [0115.766] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118e208 | out: pAptType=0x118e208*=3) returned 0x0 [0115.766] IUnknown:Release (This=0x1332d0c) returned 0x0 [0115.766] CoGetObjectContext (in: riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x13885bc | out: ppv=0x13885bc*=0x1332d00) returned 0x0 [0115.766] IUnknown:QueryInterface (in: This=0x138b4b8, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e1c8 | out: ppvObject=0x118e1c8*=0x138b414) returned 0x0 [0115.766] IMarshal:GetUnmarshalClass (in: This=0x138b414, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118e1d0 | out: pCid=0x118e1d0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.766] IUnknown:Release (This=0x138b414) returned 0x3 [0115.766] CoGetContextToken (in: pToken=0x118e1d8 | out: pToken=0x118e1d8) returned 0x0 [0115.766] IUnknown:AddRef (This=0x138b4b8) returned 0x4 [0115.766] IUnknown:QueryInterface (in: This=0x138b4b8, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e24c | out: ppvObject=0x118e24c*=0x138b49c) returned 0x0 [0115.766] IUnknown:Release (This=0x138b4b8) returned 0x4 [0115.766] IRpcOptions:Query (in: This=0x138b49c, pPrx=0x138b4b8, dwProperty=2, pdwValue=0x118e270 | out: pdwValue=0x118e270) returned 0x0 [0115.767] IUnknown:Release (This=0x138b49c) returned 0x3 [0115.767] IUnknown:Release (This=0x138b4b8) returned 0x2 [0115.767] IUnknown:Release (This=0x138b4b8) returned 0x1 [0115.767] CoGetContextToken (in: pToken=0x118e234 | out: pToken=0x118e234) returned 0x0 [0115.767] IUnknown:AddRef (This=0x138b4b8) returned 0x2 [0115.767] IUnknown:QueryInterface (in: This=0x138b4b8, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4d8 | out: ppvObject=0x118e4d8*=0x138b494) returned 0x0 [0115.767] IClientSecurity:QueryBlanket (in: This=0x138b494, pProxy=0x138b4b8, pAuthnSvc=0x118e520, pAuthzSvc=0x118e51c, pServerPrincName=0x118e52c, pAuthnLevel=0x118e524, pImpLevel=0x118e510, pAuthInfo=0x118e514, pCapabilites=0x118e518 | out: pAuthnSvc=0x118e520*=0xa, pAuthzSvc=0x118e51c*=0x0, pServerPrincName=0x118e52c, pAuthnLevel=0x118e524*=0x6, pImpLevel=0x118e510*=0x2, pAuthInfo=0x118e514, pCapabilites=0x118e518*=0x1) returned 0x0 [0115.767] IUnknown:Release (This=0x138b494) returned 0x2 [0115.767] IUnknown:QueryInterface (in: This=0x138b4b8, riid=0x74811250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4cc | out: ppvObject=0x118e4cc*=0x138b4b8) returned 0x0 [0115.768] IUnknown:QueryInterface (in: This=0x138b4b8, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4c8 | out: ppvObject=0x118e4c8*=0x138b494) returned 0x0 [0115.768] IClientSecurity:SetBlanket (This=0x138b494, pProxy=0x138b4b8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0115.768] IUnknown:Release (This=0x138b494) returned 0x3 [0115.768] IUnknown:Release (This=0x138b4b8) returned 0x2 [0115.768] CoTaskMemFree (pv=0x1388430) [0115.768] IUnknown:Release (This=0x138b4b8) returned 0x1 [0115.768] SysStringLen (param_1=0x0) returned 0x0 [0115.768] GetLastError () returned 0x0 [0115.768] CoGetContextToken (in: pToken=0x118e654 | out: pToken=0x118e654) returned 0x0 [0115.768] CoGetContextToken (in: pToken=0x118e614 | out: pToken=0x118e614) returned 0x0 [0115.768] IUnknown:AddRef (This=0x138b4b8) returned 0x2 [0115.768] IUnknown:QueryInterface (in: This=0x138b4b8, riid=0x118e690*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x118e68c | out: ppvObject=0x118e68c*=0x1384980) returned 0x0 [0115.775] IUnknown:Release (This=0x138b4b8) returned 0x2 [0115.775] IUnknown:Release (This=0x1384980) returned 0x1 [0115.775] CoGetContextToken (in: pToken=0x118e1e8 | out: pToken=0x118e1e8) returned 0x0 [0115.775] CoGetContextToken (in: pToken=0x118e1a8 | out: pToken=0x118e1a8) returned 0x0 [0115.775] IUnknown:AddRef (This=0x138b4b8) returned 0x2 [0115.775] IUnknown:QueryInterface (in: This=0x138b4b8, riid=0x118e224*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x118e220 | out: ppvObject=0x118e220*=0x1384980) returned 0x0 [0115.776] IUnknown:Release (This=0x138b4b8) returned 0x2 [0115.776] IUnknown:AddRef (This=0x1384980) returned 0x3 [0115.776] IUnknown:QueryInterface (in: This=0x1384980, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4d8 | out: ppvObject=0x118e4d8*=0x138b494) returned 0x0 [0115.776] IClientSecurity:QueryBlanket (in: This=0x138b494, pProxy=0x1384980, pAuthnSvc=0x118e520, pAuthzSvc=0x118e51c, pServerPrincName=0x118e52c, pAuthnLevel=0x118e524, pImpLevel=0x118e510, pAuthInfo=0x118e514, pCapabilites=0x118e518 | out: pAuthnSvc=0x118e520*=0xa, pAuthzSvc=0x118e51c*=0x0, pServerPrincName=0x118e52c, pAuthnLevel=0x118e524*=0x6, pImpLevel=0x118e510*=0x2, pAuthInfo=0x118e514, pCapabilites=0x118e518*=0x1) returned 0x0 [0115.776] IUnknown:Release (This=0x138b494) returned 0x3 [0115.776] IUnknown:QueryInterface (in: This=0x1384980, riid=0x74811250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4cc | out: ppvObject=0x118e4cc*=0x138b4b8) returned 0x0 [0115.776] IUnknown:QueryInterface (in: This=0x1384980, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4c8 | out: ppvObject=0x118e4c8*=0x138b494) returned 0x0 [0115.776] IClientSecurity:SetBlanket (This=0x138b494, pProxy=0x1384980, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0115.776] IUnknown:Release (This=0x138b494) returned 0x4 [0115.776] IUnknown:Release (This=0x138b4b8) returned 0x3 [0115.776] CoTaskMemFree (pv=0x1388250) [0115.777] IUnknown:Release (This=0x1384980) returned 0x2 [0115.777] SysStringLen (param_1=0x0) returned 0x0 [0115.777] GetLastError () returned 0x0 [0115.777] CoGetContextToken (in: pToken=0x118df78 | out: pToken=0x118df78) returned 0x0 [0115.777] IUnknown:AddRef (This=0x1384980) returned 0x3 [0115.777] IWbemServices:ExecQuery (in: This=0x1384980, strQueryLanguage="WQL", strQuery="select * from Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x118e5bc | out: ppEnum=0x118e5bc*=0x138d8c8) returned 0x0 [0115.784] IUnknown:QueryInterface (in: This=0x138d8c8, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e268 | out: ppvObject=0x118e268*=0x138d8cc) returned 0x0 [0115.784] IClientSecurity:QueryBlanket (in: This=0x138d8cc, pProxy=0x138d8c8, pAuthnSvc=0x118e2b0, pAuthzSvc=0x118e2ac, pServerPrincName=0x118e2bc, pAuthnLevel=0x118e2b4, pImpLevel=0x118e2a0, pAuthInfo=0x118e2a4, pCapabilites=0x118e2a8 | out: pAuthnSvc=0x118e2b0*=0xa, pAuthzSvc=0x118e2ac*=0x0, pServerPrincName=0x118e2bc, pAuthnLevel=0x118e2b4*=0x6, pImpLevel=0x118e2a0*=0x2, pAuthInfo=0x118e2a4, pCapabilites=0x118e2a8*=0x1) returned 0x0 [0115.784] IUnknown:Release (This=0x138d8cc) returned 0x1 [0115.784] IUnknown:QueryInterface (in: This=0x138d8c8, riid=0x74811250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e25c | out: ppvObject=0x118e25c*=0x138d608) returned 0x0 [0115.784] IUnknown:QueryInterface (in: This=0x138d8c8, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e258 | out: ppvObject=0x118e258*=0x138d8cc) returned 0x0 [0115.784] IClientSecurity:SetBlanket (This=0x138d8cc, pProxy=0x138d8c8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0115.822] IUnknown:Release (This=0x138d8cc) returned 0x2 [0115.822] IUnknown:Release (This=0x138d608) returned 0x1 [0115.822] CoTaskMemFree (pv=0x1388520) [0115.823] IUnknown:Release (This=0x1384980) returned 0x2 [0115.823] IUnknown:QueryInterface (in: This=0x138d8c8, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc14 | out: ppvObject=0x118dc14*=0x138d608) returned 0x0 [0115.823] IUnknown:QueryInterface (in: This=0x138d608, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118dbd0 | out: ppvObject=0x118dbd0*=0x0) returned 0x80004002 [0115.824] IUnknown:QueryInterface (in: This=0x138d608, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118dac4 | out: ppvObject=0x118dac4*=0x0) returned 0x80004002 [0115.824] IUnknown:AddRef (This=0x138d608) returned 0x3 [0115.824] CoGetContextToken (in: pToken=0x118da5c | out: pToken=0x118da5c) returned 0x0 [0115.824] CoGetContextToken (in: pToken=0x118da20 | out: pToken=0x118da20) returned 0x0 [0115.824] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118da54 | out: ppvObject=0x118da54*=0x1332d0c) returned 0x0 [0115.825] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118da84 | out: pAptType=0x118da84*=3) returned 0x0 [0115.825] IUnknown:Release (This=0x1332d0c) returned 0x1 [0115.825] IUnknown:QueryInterface (in: This=0x138d608, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118da44 | out: ppvObject=0x118da44*=0x138d564) returned 0x0 [0115.825] IMarshal:GetUnmarshalClass (in: This=0x138d564, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118da4c | out: pCid=0x118da4c*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.825] IUnknown:Release (This=0x138d564) returned 0x3 [0115.825] CoGetContextToken (in: pToken=0x118da54 | out: pToken=0x118da54) returned 0x0 [0115.825] IUnknown:AddRef (This=0x138d608) returned 0x4 [0115.825] IUnknown:QueryInterface (in: This=0x138d608, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dac8 | out: ppvObject=0x118dac8*=0x138d5ec) returned 0x0 [0115.825] IUnknown:Release (This=0x138d608) returned 0x4 [0115.825] IRpcOptions:Query (in: This=0x138d5ec, pPrx=0x138d608, dwProperty=2, pdwValue=0x118daec | out: pdwValue=0x118daec) returned 0x80004002 [0115.825] IUnknown:Release (This=0x138d5ec) returned 0x3 [0115.826] IUnknown:Release (This=0x138d608) returned 0x2 [0115.826] CoGetContextToken (in: pToken=0x118dec8 | out: pToken=0x118dec8) returned 0x0 [0115.826] CoGetContextToken (in: pToken=0x118de88 | out: pToken=0x118de88) returned 0x0 [0115.826] IUnknown:AddRef (This=0x138d608) returned 0x3 [0115.826] IUnknown:QueryInterface (in: This=0x138d608, riid=0x118df04*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x118df00 | out: ppvObject=0x118df00*=0x138d8c8) returned 0x0 [0115.826] IUnknown:Release (This=0x138d608) returned 0x3 [0115.826] IUnknown:Release (This=0x138d8c8) returned 0x2 [0115.826] IUnknown:Release (This=0x138d8c8) returned 0x1 [0115.826] SysStringLen (param_1=0x0) returned 0x0 [0115.826] GetLastError () returned 0x0 [0115.826] CoGetContextToken (in: pToken=0x118e6a0 | out: pToken=0x118e6a0) returned 0x0 [0115.826] CoGetContextToken (in: pToken=0x118e660 | out: pToken=0x118e660) returned 0x0 [0115.826] IUnknown:AddRef (This=0x1375100) returned 0x3 [0115.827] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e6dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e6d8 | out: ppvObject=0x118e6d8*=0x1375100) returned 0x0 [0115.827] IUnknown:Release (This=0x1375100) returned 0x3 [0115.827] IWbemPath:GetNamespaceCount (in: This=0x1375100, puCount=0x118e854 | out: puCount=0x118e854*=0x2) returned 0x0 [0115.827] IUnknown:Release (This=0x1375100) returned 0x2 [0115.827] CoGetContextToken (in: pToken=0x118e690 | out: pToken=0x118e690) returned 0x0 [0115.827] CoGetContextToken (in: pToken=0x118e650 | out: pToken=0x118e650) returned 0x0 [0115.827] IUnknown:AddRef (This=0x1375100) returned 0x3 [0115.827] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e6cc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e6c8 | out: ppvObject=0x118e6c8*=0x1375100) returned 0x0 [0115.827] IUnknown:Release (This=0x1375100) returned 0x3 [0115.827] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e850*=0x0, pszText=0x0 | out: puBuffLength=0x118e850*=0xf, pszText=0x0) returned 0x0 [0115.827] IUnknown:Release (This=0x1375100) returned 0x2 [0115.827] CoGetContextToken (in: pToken=0x118e690 | out: pToken=0x118e690) returned 0x0 [0115.827] CoGetContextToken (in: pToken=0x118e650 | out: pToken=0x118e650) returned 0x0 [0115.827] IUnknown:AddRef (This=0x1375100) returned 0x3 [0115.827] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e6cc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e6c8 | out: ppvObject=0x118e6c8*=0x1375100) returned 0x0 [0115.828] IUnknown:Release (This=0x1375100) returned 0x3 [0115.828] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e850*=0xf, pszText="00000000000000" | out: puBuffLength=0x118e850*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0115.828] IUnknown:Release (This=0x1375100) returned 0x2 [0115.828] CoGetContextToken (in: pToken=0x118e1e0 | out: pToken=0x118e1e0) returned 0x0 [0115.828] CoGetContextToken (in: pToken=0x118e1a0 | out: pToken=0x118e1a0) returned 0x0 [0115.828] IUnknown:AddRef (This=0x138d608) returned 0x2 [0115.828] IUnknown:QueryInterface (in: This=0x138d608, riid=0x118e21c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x118e218 | out: ppvObject=0x118e218*=0x138d8c8) returned 0x0 [0115.828] IUnknown:Release (This=0x138d608) returned 0x2 [0115.828] IUnknown:AddRef (This=0x138d8c8) returned 0x3 [0115.828] IEnumWbemClassObject:Clone (in: This=0x138d8c8, ppEnum=0x118e814 | out: ppEnum=0x118e814*=0x138d990) returned 0x0 [0115.829] IUnknown:QueryInterface (in: This=0x138d990, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4d0 | out: ppvObject=0x118e4d0*=0x138d994) returned 0x0 [0115.830] IClientSecurity:QueryBlanket (in: This=0x138d994, pProxy=0x138d990, pAuthnSvc=0x118e518, pAuthzSvc=0x118e514, pServerPrincName=0x118e524, pAuthnLevel=0x118e51c, pImpLevel=0x118e508, pAuthInfo=0x118e50c, pCapabilites=0x118e510 | out: pAuthnSvc=0x118e518*=0xa, pAuthzSvc=0x118e514*=0x0, pServerPrincName=0x118e524, pAuthnLevel=0x118e51c*=0x6, pImpLevel=0x118e508*=0x2, pAuthInfo=0x118e50c, pCapabilites=0x118e510*=0x1) returned 0x0 [0115.830] IUnknown:Release (This=0x138d994) returned 0x1 [0115.830] IUnknown:QueryInterface (in: This=0x138d990, riid=0x74811250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4c4 | out: ppvObject=0x118e4c4*=0x138c108) returned 0x0 [0115.830] IUnknown:QueryInterface (in: This=0x138d990, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4c0 | out: ppvObject=0x118e4c0*=0x138d994) returned 0x0 [0115.830] IClientSecurity:SetBlanket (This=0x138d994, pProxy=0x138d990, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0115.833] IUnknown:Release (This=0x138d994) returned 0x2 [0115.833] IUnknown:Release (This=0x138c108) returned 0x1 [0115.833] CoTaskMemFree (pv=0x1388490) [0115.833] IUnknown:Release (This=0x138d8c8) returned 0x2 [0115.834] IUnknown:QueryInterface (in: This=0x138d990, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de6c | out: ppvObject=0x118de6c*=0x138c108) returned 0x0 [0115.834] IUnknown:QueryInterface (in: This=0x138c108, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118de28 | out: ppvObject=0x118de28*=0x0) returned 0x80004002 [0115.834] IUnknown:QueryInterface (in: This=0x138c108, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118dd1c | out: ppvObject=0x118dd1c*=0x0) returned 0x80004002 [0115.835] IUnknown:AddRef (This=0x138c108) returned 0x3 [0115.835] CoGetContextToken (in: pToken=0x118dcb4 | out: pToken=0x118dcb4) returned 0x0 [0115.835] CoGetContextToken (in: pToken=0x118dc78 | out: pToken=0x118dc78) returned 0x0 [0115.835] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dcac | out: ppvObject=0x118dcac*=0x1332d0c) returned 0x0 [0115.835] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118dcdc | out: pAptType=0x118dcdc*=3) returned 0x0 [0115.835] IUnknown:Release (This=0x1332d0c) returned 0x1 [0115.835] IUnknown:QueryInterface (in: This=0x138c108, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc9c | out: ppvObject=0x118dc9c*=0x138c064) returned 0x0 [0115.835] IMarshal:GetUnmarshalClass (in: This=0x138c064, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118dca4 | out: pCid=0x118dca4*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.835] IUnknown:Release (This=0x138c064) returned 0x3 [0115.836] CoGetContextToken (in: pToken=0x118dcac | out: pToken=0x118dcac) returned 0x0 [0115.836] IUnknown:AddRef (This=0x138c108) returned 0x4 [0115.836] IUnknown:QueryInterface (in: This=0x138c108, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dd20 | out: ppvObject=0x118dd20*=0x138c0ec) returned 0x0 [0115.836] IUnknown:Release (This=0x138c108) returned 0x4 [0115.836] IRpcOptions:Query (in: This=0x138c0ec, pPrx=0x138c108, dwProperty=2, pdwValue=0x118dd44 | out: pdwValue=0x118dd44) returned 0x80004002 [0115.836] IUnknown:Release (This=0x138c0ec) returned 0x3 [0115.836] IUnknown:Release (This=0x138c108) returned 0x2 [0115.836] CoGetContextToken (in: pToken=0x118e120 | out: pToken=0x118e120) returned 0x0 [0115.836] CoGetContextToken (in: pToken=0x118e0e0 | out: pToken=0x118e0e0) returned 0x0 [0115.836] IUnknown:AddRef (This=0x138c108) returned 0x3 [0115.836] IUnknown:QueryInterface (in: This=0x138c108, riid=0x118e15c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x118e158 | out: ppvObject=0x118e158*=0x138d990) returned 0x0 [0115.836] IUnknown:Release (This=0x138c108) returned 0x3 [0115.836] IUnknown:Release (This=0x138d990) returned 0x2 [0115.837] IUnknown:Release (This=0x138d990) returned 0x1 [0115.837] SysStringLen (param_1=0x0) returned 0x0 [0115.837] GetLastError () returned 0x0 [0115.843] CoGetContextToken (in: pToken=0x118e714 | out: pToken=0x118e714) returned 0x0 [0115.843] CoGetContextToken (in: pToken=0x118e6d4 | out: pToken=0x118e6d4) returned 0x0 [0115.843] IUnknown:AddRef (This=0x138c108) returned 0x2 [0115.843] IUnknown:QueryInterface (in: This=0x138c108, riid=0x118e750*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x118e74c | out: ppvObject=0x118e74c*=0x138d990) returned 0x0 [0115.843] IUnknown:Release (This=0x138c108) returned 0x2 [0115.843] IUnknown:AddRef (This=0x138d990) returned 0x3 [0115.843] IEnumWbemClassObject:Reset (This=0x138d990) returned 0x0 [0115.844] IUnknown:Release (This=0x138d990) returned 0x2 [0115.848] CoGetContextToken (in: pToken=0x118e5fc | out: pToken=0x118e5fc) returned 0x0 [0115.848] IUnknown:AddRef (This=0x138d990) returned 0x3 [0115.848] IEnumWbemClassObject:Next (in: This=0x138d990, lTimeout=-1, uCount=0x1, apObjects=0x13381c0, puReturned=0x336626c | out: apObjects=0x13381c0*=0x1390a80, puReturned=0x336626c*=0x1) returned 0x0 [0117.322] IUnknown:QueryInterface (in: This=0x1390a80, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc08 | out: ppvObject=0x118dc08*=0x1390a80) returned 0x0 [0117.322] IUnknown:QueryInterface (in: This=0x1390a80, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118dbc4 | out: ppvObject=0x118dbc4*=0x0) returned 0x80004002 [0117.322] IUnknown:QueryInterface (in: This=0x1390a80, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118dab8 | out: ppvObject=0x118dab8*=0x0) returned 0x80004002 [0117.322] IUnknown:AddRef (This=0x1390a80) returned 0x3 [0117.322] CoGetContextToken (in: pToken=0x118da50 | out: pToken=0x118da50) returned 0x0 [0117.322] CoGetContextToken (in: pToken=0x118da14 | out: pToken=0x118da14) returned 0x0 [0117.322] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118da48 | out: ppvObject=0x118da48*=0x1332d0c) returned 0x0 [0117.322] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118da78 | out: pAptType=0x118da78*=3) returned 0x0 [0117.322] IUnknown:Release (This=0x1332d0c) returned 0x1 [0117.322] IUnknown:QueryInterface (in: This=0x1390a80, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118da38 | out: ppvObject=0x118da38*=0x1390a84) returned 0x0 [0117.323] IMarshal:GetUnmarshalClass (in: This=0x1390a84, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118da40 | out: pCid=0x118da40*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0117.323] IUnknown:Release (This=0x1390a84) returned 0x3 [0117.323] CoGetContextToken (in: pToken=0x118da48 | out: pToken=0x118da48) returned 0x0 [0117.323] IUnknown:AddRef (This=0x1390a80) returned 0x4 [0117.323] IUnknown:QueryInterface (in: This=0x1390a80, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dabc | out: ppvObject=0x118dabc*=0x0) returned 0x80004002 [0117.323] IUnknown:Release (This=0x1390a80) returned 0x3 [0117.323] IUnknown:Release (This=0x1390a80) returned 0x2 [0117.323] CoGetContextToken (in: pToken=0x118dea8 | out: pToken=0x118dea8) returned 0x0 [0117.323] CoGetContextToken (in: pToken=0x118de68 | out: pToken=0x118de68) returned 0x0 [0117.323] IUnknown:AddRef (This=0x1390a80) returned 0x3 [0117.323] IUnknown:QueryInterface (in: This=0x1390a80, riid=0x118dee4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x118dee0 | out: ppvObject=0x118dee0*=0x1390a80) returned 0x0 [0117.323] IUnknown:Release (This=0x1390a80) returned 0x3 [0117.323] IUnknown:Release (This=0x1390a80) returned 0x2 [0117.323] IUnknown:Release (This=0x1390a80) returned 0x1 [0117.324] IUnknown:Release (This=0x138d990) returned 0x2 [0117.324] CoGetContextToken (in: pToken=0x118e798 | out: pToken=0x118e798) returned 0x0 [0117.324] IUnknown:AddRef (This=0x1390a80) returned 0x2 [0117.324] CoGetContextToken (in: pToken=0x118e5fc | out: pToken=0x118e5fc) returned 0x0 [0117.324] IUnknown:AddRef (This=0x138d990) returned 0x3 [0117.324] IEnumWbemClassObject:Next (in: This=0x138d990, lTimeout=-1, uCount=0x1, apObjects=0x13381c0, puReturned=0x336626c | out: apObjects=0x13381c0*=0x0, puReturned=0x336626c*=0x0) returned 0x1 [0117.324] IUnknown:Release (This=0x138d990) returned 0x2 [0117.324] CoGetContextToken (in: pToken=0x118e1f0 | out: pToken=0x118e1f0) returned 0x0 [0117.324] IUnknown:AddRef (This=0x138d8c8) returned 0x3 [0117.324] IEnumWbemClassObject:Clone (in: This=0x138d8c8, ppEnum=0x118e824 | out: ppEnum=0x118e824*=0x13968c0) returned 0x0 [0117.325] IUnknown:QueryInterface (in: This=0x13968c0, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4e0 | out: ppvObject=0x118e4e0*=0x13968c4) returned 0x0 [0117.325] IClientSecurity:QueryBlanket (in: This=0x13968c4, pProxy=0x13968c0, pAuthnSvc=0x118e528, pAuthzSvc=0x118e524, pServerPrincName=0x118e534, pAuthnLevel=0x118e52c, pImpLevel=0x118e518, pAuthInfo=0x118e51c, pCapabilites=0x118e520 | out: pAuthnSvc=0x118e528*=0xa, pAuthzSvc=0x118e524*=0x0, pServerPrincName=0x118e534, pAuthnLevel=0x118e52c*=0x6, pImpLevel=0x118e518*=0x2, pAuthInfo=0x118e51c, pCapabilites=0x118e520*=0x1) returned 0x0 [0117.325] IUnknown:Release (This=0x13968c4) returned 0x1 [0117.325] IUnknown:QueryInterface (in: This=0x13968c0, riid=0x74811250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4d4 | out: ppvObject=0x118e4d4*=0x138c008) returned 0x0 [0117.325] IUnknown:QueryInterface (in: This=0x13968c0, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4d0 | out: ppvObject=0x118e4d0*=0x13968c4) returned 0x0 [0117.325] IClientSecurity:SetBlanket (This=0x13968c4, pProxy=0x13968c0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0117.327] IUnknown:Release (This=0x13968c4) returned 0x2 [0117.327] IUnknown:Release (This=0x138c008) returned 0x1 [0117.327] CoTaskMemFree (pv=0x1388520) [0117.327] IUnknown:Release (This=0x138d8c8) returned 0x2 [0117.327] IUnknown:QueryInterface (in: This=0x13968c0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de7c | out: ppvObject=0x118de7c*=0x138c008) returned 0x0 [0117.327] IUnknown:QueryInterface (in: This=0x138c008, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118de38 | out: ppvObject=0x118de38*=0x0) returned 0x80004002 [0117.327] IUnknown:QueryInterface (in: This=0x138c008, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118dd2c | out: ppvObject=0x118dd2c*=0x0) returned 0x80004002 [0117.328] IUnknown:AddRef (This=0x138c008) returned 0x3 [0117.328] CoGetContextToken (in: pToken=0x118dcc4 | out: pToken=0x118dcc4) returned 0x0 [0117.328] CoGetContextToken (in: pToken=0x118dc88 | out: pToken=0x118dc88) returned 0x0 [0117.328] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dcbc | out: ppvObject=0x118dcbc*=0x1332d0c) returned 0x0 [0117.328] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118dcec | out: pAptType=0x118dcec*=3) returned 0x0 [0117.328] IUnknown:Release (This=0x1332d0c) returned 0x1 [0117.328] IUnknown:QueryInterface (in: This=0x138c008, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dcac | out: ppvObject=0x118dcac*=0x138bf64) returned 0x0 [0117.328] IMarshal:GetUnmarshalClass (in: This=0x138bf64, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118dcb4 | out: pCid=0x118dcb4*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.328] IUnknown:Release (This=0x138bf64) returned 0x3 [0117.328] CoGetContextToken (in: pToken=0x118dcbc | out: pToken=0x118dcbc) returned 0x0 [0117.328] IUnknown:AddRef (This=0x138c008) returned 0x4 [0117.328] IUnknown:QueryInterface (in: This=0x138c008, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dd30 | out: ppvObject=0x118dd30*=0x138bfec) returned 0x0 [0117.328] IUnknown:Release (This=0x138c008) returned 0x4 [0117.328] IRpcOptions:Query (in: This=0x138bfec, pPrx=0x138c008, dwProperty=2, pdwValue=0x118dd54 | out: pdwValue=0x118dd54) returned 0x80004002 [0117.328] IUnknown:Release (This=0x138bfec) returned 0x3 [0117.328] IUnknown:Release (This=0x138c008) returned 0x2 [0117.328] CoGetContextToken (in: pToken=0x118e130 | out: pToken=0x118e130) returned 0x0 [0117.328] CoGetContextToken (in: pToken=0x118e0f0 | out: pToken=0x118e0f0) returned 0x0 [0117.328] IUnknown:AddRef (This=0x138c008) returned 0x3 [0117.328] IUnknown:QueryInterface (in: This=0x138c008, riid=0x118e16c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x118e168 | out: ppvObject=0x118e168*=0x13968c0) returned 0x0 [0117.329] IUnknown:Release (This=0x138c008) returned 0x3 [0117.329] IUnknown:Release (This=0x13968c0) returned 0x2 [0117.329] IUnknown:Release (This=0x13968c0) returned 0x1 [0117.329] SysStringLen (param_1=0x0) returned 0x0 [0117.329] GetLastError () returned 0x0 [0117.329] CoGetContextToken (in: pToken=0x118e724 | out: pToken=0x118e724) returned 0x0 [0117.329] CoGetContextToken (in: pToken=0x118e6e4 | out: pToken=0x118e6e4) returned 0x0 [0117.329] IUnknown:AddRef (This=0x138c008) returned 0x2 [0117.329] IUnknown:QueryInterface (in: This=0x138c008, riid=0x118e760*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x118e75c | out: ppvObject=0x118e75c*=0x13968c0) returned 0x0 [0117.329] IUnknown:Release (This=0x138c008) returned 0x2 [0117.329] IUnknown:AddRef (This=0x13968c0) returned 0x3 [0117.329] IEnumWbemClassObject:Reset (This=0x13968c0) returned 0x0 [0117.329] IUnknown:Release (This=0x13968c0) returned 0x2 [0117.329] CoGetContextToken (in: pToken=0x118e60c | out: pToken=0x118e60c) returned 0x0 [0117.329] IUnknown:AddRef (This=0x13968c0) returned 0x3 [0117.330] IEnumWbemClassObject:Next (in: This=0x13968c0, lTimeout=-1, uCount=0x1, apObjects=0x13381c0, puReturned=0x336637c | out: apObjects=0x13381c0*=0x139b910, puReturned=0x336637c*=0x1) returned 0x0 [0117.331] IUnknown:QueryInterface (in: This=0x139b910, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc18 | out: ppvObject=0x118dc18*=0x139b910) returned 0x0 [0117.331] IUnknown:QueryInterface (in: This=0x139b910, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118dbd4 | out: ppvObject=0x118dbd4*=0x0) returned 0x80004002 [0117.331] IUnknown:QueryInterface (in: This=0x139b910, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118dac8 | out: ppvObject=0x118dac8*=0x0) returned 0x80004002 [0117.332] IUnknown:AddRef (This=0x139b910) returned 0x3 [0117.332] CoGetContextToken (in: pToken=0x118da60 | out: pToken=0x118da60) returned 0x0 [0117.332] CoGetContextToken (in: pToken=0x118da24 | out: pToken=0x118da24) returned 0x0 [0117.332] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118da58 | out: ppvObject=0x118da58*=0x1332d0c) returned 0x0 [0117.332] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118da88 | out: pAptType=0x118da88*=3) returned 0x0 [0117.332] IUnknown:Release (This=0x1332d0c) returned 0x1 [0117.332] IUnknown:QueryInterface (in: This=0x139b910, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118da48 | out: ppvObject=0x118da48*=0x139b914) returned 0x0 [0117.332] IMarshal:GetUnmarshalClass (in: This=0x139b914, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118da50 | out: pCid=0x118da50*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0117.332] IUnknown:Release (This=0x139b914) returned 0x3 [0117.332] CoGetContextToken (in: pToken=0x118da58 | out: pToken=0x118da58) returned 0x0 [0117.332] IUnknown:AddRef (This=0x139b910) returned 0x4 [0117.332] IUnknown:QueryInterface (in: This=0x139b910, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dacc | out: ppvObject=0x118dacc*=0x0) returned 0x80004002 [0117.332] IUnknown:Release (This=0x139b910) returned 0x3 [0117.332] IUnknown:Release (This=0x139b910) returned 0x2 [0117.332] CoGetContextToken (in: pToken=0x118deb8 | out: pToken=0x118deb8) returned 0x0 [0117.332] CoGetContextToken (in: pToken=0x118de78 | out: pToken=0x118de78) returned 0x0 [0117.332] IUnknown:AddRef (This=0x139b910) returned 0x3 [0117.332] IUnknown:QueryInterface (in: This=0x139b910, riid=0x118def4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x118def0 | out: ppvObject=0x118def0*=0x139b910) returned 0x0 [0117.333] IUnknown:Release (This=0x139b910) returned 0x3 [0117.333] IUnknown:Release (This=0x139b910) returned 0x2 [0117.333] IUnknown:Release (This=0x139b910) returned 0x1 [0117.333] IUnknown:Release (This=0x13968c0) returned 0x2 [0117.333] CoGetContextToken (in: pToken=0x118e7a8 | out: pToken=0x118e7a8) returned 0x0 [0117.333] IUnknown:AddRef (This=0x139b910) returned 0x2 [0117.335] IWbemClassObject:Get (in: This=0x139b910, wszName="__GENUS", lFlags=0, pVal=0x118e824*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x118e8d8*=0, plFlavor=0x118e8d4*=0 | out: pVal=0x118e824*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x118e8d8*=3, plFlavor=0x118e8d4*=64) returned 0x0 [0117.336] IWbemClassObject:Get (in: This=0x139b910, wszName="__PATH", lFlags=0, pVal=0x118e804*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x118e8bc*=0, plFlavor=0x118e8b8*=0 | out: pVal=0x118e804*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\LHNIWSJ\\root\\cimv2:Win32_OperatingSystem=@", varVal2=0x0), pType=0x118e8bc*=8, plFlavor=0x118e8b8*=64) returned 0x0 [0117.355] SysStringLen (param_1="\\\\LHNIWSJ\\root\\cimv2:Win32_OperatingSystem=@") returned 0x2c [0117.355] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x48c [0117.355] GetLastError () returned 0x0 [0117.355] SetEvent (hEvent=0x3cc) returned 1 [0117.355] GetLastError () returned 0x0 [0117.355] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x118e820*=0x48c, lpdwindex=0x118e5d8 | out: lpdwindex=0x118e5d8) returned 0x0 [0117.357] CoGetContextToken (in: pToken=0x118e670 | out: pToken=0x118e670) returned 0x0 [0117.357] CoGetContextToken (in: pToken=0x118e630 | out: pToken=0x118e630) returned 0x0 [0117.357] IUnknown:AddRef (This=0x1375640) returned 0x2 [0117.357] IUnknown:QueryInterface (in: This=0x1375640, riid=0x118e6ac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e6a8 | out: ppvObject=0x118e6a8*=0x1375640) returned 0x0 [0117.357] IUnknown:Release (This=0x1375640) returned 0x2 [0117.357] IUnknown:Release (This=0x1375640) returned 0x1 [0117.357] CoGetContextToken (in: pToken=0x118e6f0 | out: pToken=0x118e6f0) returned 0x0 [0117.357] CoGetContextToken (in: pToken=0x118e6b0 | out: pToken=0x118e6b0) returned 0x0 [0117.357] IUnknown:AddRef (This=0x1375640) returned 0x2 [0117.357] IUnknown:QueryInterface (in: This=0x1375640, riid=0x118e72c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e728 | out: ppvObject=0x118e728*=0x1375640) returned 0x0 [0117.357] IUnknown:Release (This=0x1375640) returned 0x2 [0117.357] IWbemPath:SetText (This=0x1375640, uMode=0x4, pszPath="\\\\LHNIWSJ\\root\\cimv2:Win32_OperatingSystem=@") returned 0x0 [0117.357] IUnknown:Release (This=0x1375640) returned 0x1 [0117.358] CoGetContextToken (in: pToken=0x118e6dc | out: pToken=0x118e6dc) returned 0x0 [0117.358] CoGetContextToken (in: pToken=0x118e69c | out: pToken=0x118e69c) returned 0x0 [0117.358] IUnknown:AddRef (This=0x1375100) returned 0x3 [0117.358] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e718*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e714 | out: ppvObject=0x118e714*=0x1375100) returned 0x0 [0117.358] IUnknown:Release (This=0x1375100) returned 0x3 [0117.358] IWbemPath:GetNamespaceCount (in: This=0x1375100, puCount=0x118e890 | out: puCount=0x118e890*=0x2) returned 0x0 [0117.358] IUnknown:Release (This=0x1375100) returned 0x2 [0117.358] CoGetContextToken (in: pToken=0x118e6cc | out: pToken=0x118e6cc) returned 0x0 [0117.358] CoGetContextToken (in: pToken=0x118e68c | out: pToken=0x118e68c) returned 0x0 [0117.358] IUnknown:AddRef (This=0x1375100) returned 0x3 [0117.358] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e708*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e704 | out: ppvObject=0x118e704*=0x1375100) returned 0x0 [0117.358] IUnknown:Release (This=0x1375100) returned 0x3 [0117.358] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e88c*=0x0, pszText=0x0 | out: puBuffLength=0x118e88c*=0xf, pszText=0x0) returned 0x0 [0117.358] IUnknown:Release (This=0x1375100) returned 0x2 [0117.358] CoGetContextToken (in: pToken=0x118e6cc | out: pToken=0x118e6cc) returned 0x0 [0117.358] CoGetContextToken (in: pToken=0x118e68c | out: pToken=0x118e68c) returned 0x0 [0117.358] IUnknown:AddRef (This=0x1375100) returned 0x3 [0117.358] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e708*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e704 | out: ppvObject=0x118e704*=0x1375100) returned 0x0 [0117.358] IUnknown:Release (This=0x1375100) returned 0x3 [0117.358] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e88c*=0xf, pszText="00000000000000" | out: puBuffLength=0x118e88c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.358] IUnknown:Release (This=0x1375100) returned 0x2 [0117.358] CoGetContextToken (in: pToken=0x118e6dc | out: pToken=0x118e6dc) returned 0x0 [0117.358] CoGetContextToken (in: pToken=0x118e69c | out: pToken=0x118e69c) returned 0x0 [0117.358] IUnknown:AddRef (This=0x1375100) returned 0x3 [0117.358] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e718*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e714 | out: ppvObject=0x118e714*=0x1375100) returned 0x0 [0117.359] IUnknown:Release (This=0x1375100) returned 0x3 [0117.359] IWbemPath:GetNamespaceCount (in: This=0x1375100, puCount=0x118e890 | out: puCount=0x118e890*=0x2) returned 0x0 [0117.359] IUnknown:Release (This=0x1375100) returned 0x2 [0117.359] CoGetContextToken (in: pToken=0x118e6cc | out: pToken=0x118e6cc) returned 0x0 [0117.359] CoGetContextToken (in: pToken=0x118e68c | out: pToken=0x118e68c) returned 0x0 [0117.359] IUnknown:AddRef (This=0x1375100) returned 0x3 [0117.359] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e708*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e704 | out: ppvObject=0x118e704*=0x1375100) returned 0x0 [0117.359] IUnknown:Release (This=0x1375100) returned 0x3 [0117.359] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e88c*=0x0, pszText=0x0 | out: puBuffLength=0x118e88c*=0xf, pszText=0x0) returned 0x0 [0117.359] IUnknown:Release (This=0x1375100) returned 0x2 [0117.359] CoGetContextToken (in: pToken=0x118e6cc | out: pToken=0x118e6cc) returned 0x0 [0117.359] CoGetContextToken (in: pToken=0x118e68c | out: pToken=0x118e68c) returned 0x0 [0117.359] IUnknown:AddRef (This=0x1375100) returned 0x3 [0117.359] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e708*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e704 | out: ppvObject=0x118e704*=0x1375100) returned 0x0 [0117.359] IUnknown:Release (This=0x1375100) returned 0x3 [0117.359] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e88c*=0xf, pszText="00000000000000" | out: puBuffLength=0x118e88c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.359] IUnknown:Release (This=0x1375100) returned 0x2 [0117.359] IWbemClassObject:Get (in: This=0x139b910, wszName="Name", lFlags=0, pVal=0x118e84c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x3366e48*=0, plFlavor=0x3366e4c*=0 | out: pVal=0x118e84c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x3366e48*=8, plFlavor=0x3366e4c*=0) returned 0x0 [0117.360] SysStringLen (param_1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x40 [0117.360] IWbemClassObject:Get (in: This=0x139b910, wszName="Name", lFlags=0, pVal=0x118e850*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x3366e48*=8, plFlavor=0x3366e4c*=0 | out: pVal=0x118e850*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x3366e48*=8, plFlavor=0x3366e4c*=0) returned 0x0 [0117.360] SysStringLen (param_1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x40 [0117.405] CoGetContextToken (in: pToken=0x118e6dc | out: pToken=0x118e6dc) returned 0x0 [0117.405] CoGetContextToken (in: pToken=0x118e69c | out: pToken=0x118e69c) returned 0x0 [0117.405] IUnknown:AddRef (This=0x1375100) returned 0x3 [0117.405] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e718*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e714 | out: ppvObject=0x118e714*=0x1375100) returned 0x0 [0117.405] IUnknown:Release (This=0x1375100) returned 0x3 [0117.405] IWbemPath:GetNamespaceCount (in: This=0x1375100, puCount=0x118e890 | out: puCount=0x118e890*=0x2) returned 0x0 [0117.405] IUnknown:Release (This=0x1375100) returned 0x2 [0117.405] CoGetContextToken (in: pToken=0x118e6cc | out: pToken=0x118e6cc) returned 0x0 [0117.405] CoGetContextToken (in: pToken=0x118e68c | out: pToken=0x118e68c) returned 0x0 [0117.405] IUnknown:AddRef (This=0x1375100) returned 0x3 [0117.405] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e708*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e704 | out: ppvObject=0x118e704*=0x1375100) returned 0x0 [0117.405] IUnknown:Release (This=0x1375100) returned 0x3 [0117.405] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e88c*=0x0, pszText=0x0 | out: puBuffLength=0x118e88c*=0xf, pszText=0x0) returned 0x0 [0117.405] IUnknown:Release (This=0x1375100) returned 0x2 [0117.405] CoGetContextToken (in: pToken=0x118e6cc | out: pToken=0x118e6cc) returned 0x0 [0117.405] CoGetContextToken (in: pToken=0x118e68c | out: pToken=0x118e68c) returned 0x0 [0117.405] IUnknown:AddRef (This=0x1375100) returned 0x3 [0117.405] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e708*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e704 | out: ppvObject=0x118e704*=0x1375100) returned 0x0 [0117.406] IUnknown:Release (This=0x1375100) returned 0x3 [0117.406] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e88c*=0xf, pszText="00000000000000" | out: puBuffLength=0x118e88c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0117.406] IUnknown:Release (This=0x1375100) returned 0x2 [0117.406] IWbemClassObject:Get (in: This=0x139b910, wszName="Name", lFlags=0, pVal=0x118e84c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x3367074*=0, plFlavor=0x3367078*=0 | out: pVal=0x118e84c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x3367074*=8, plFlavor=0x3367078*=0) returned 0x0 [0117.406] SysStringLen (param_1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x40 [0117.406] IWbemClassObject:Get (in: This=0x139b910, wszName="Name", lFlags=0, pVal=0x118e850*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x3367074*=8, plFlavor=0x3367078*=0 | out: pVal=0x118e850*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1", varVal2=0x0), pType=0x3367074*=8, plFlavor=0x3367078*=0) returned 0x0 [0117.406] SysStringLen (param_1="Microsoft Windows 10 Pro|C:\\Windows|\\Device\\Harddisk0\\Partition1") returned 0x40 [0117.407] GetUserNameW (in: lpBuffer=0x136fd10, pcbBuffer=0x118e984 | out: lpBuffer="CIiHmnxMn6Ps", pcbBuffer=0x118e984) returned 1 [0117.503] GetSystemMetrics (nIndex=80) returned 1 [0117.505] GetDC (hWnd=0x0) returned 0xa010691 [0117.509] EnumDisplayMonitors (hdc=0xa010691, lprcClip=0x0, lpfnEnum=0x16508ea, dwData=0x0) returned 1 [0117.512] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x1338218 | out: lpmi=0x1338218) returned 1 [0117.514] GetDeviceCaps (hdc=0x2b01068c, index=12) returned 32 [0117.514] GetLastError () returned 0x0 [0117.514] GetDeviceCaps (hdc=0x2b01068c, index=14) returned 1 [0117.514] GetLastError () returned 0x0 [0117.515] ReleaseDC (hWnd=0x0, hDC=0xa010691) returned 1 [0117.516] GetProcessWindowStation () returned 0xd4 [0117.518] GetUserObjectInformationA (in: hObj=0xd4, nIndex=1, pvInfo=0x3367a50, nLength=0xc, lpnLengthNeeded=0x118e8cc | out: pvInfo=0x3367a50, lpnLengthNeeded=0x118e8cc) returned 1 [0117.518] GetLastError () returned 0x0 [0117.520] SetConsoleCtrlHandler (HandlerRoutine=0x1650b22, Add=1) returned 1 [0117.521] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0117.522] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0117.523] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", lpWndClass=0x3367a98 | out: lpWndClass=0x3367a98) returned 0 [0117.526] CoTaskMemAlloc (cb=0x58) returned 0x13973b0 [0117.526] RegisterClassW (lpWndClass=0x13381c0) returned 0xc172 [0117.526] GetLastError () returned 0x583 [0117.526] CoTaskMemFree (pv=0x13973b0) [0117.527] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", lpWindowName=".NET-BroadcastEventWindow.2.0.0.0.33c0d9d.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x160022 [0117.528] NtdllDefWindowProc_W (hWnd=0x160022, Msg=0x81, wParam=0x0, lParam=0x118e340) returned 0x1 [0117.531] NtdllDefWindowProc_W (hWnd=0x160022, Msg=0x83, wParam=0x0, lParam=0x118e32c) returned 0x0 [0117.531] NtdllDefWindowProc_W (hWnd=0x160022, Msg=0x1, wParam=0x0, lParam=0x118e340) returned 0x0 [0117.532] NtdllDefWindowProc_W (hWnd=0x160022, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0117.532] NtdllDefWindowProc_W (hWnd=0x160022, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0117.532] GetLastError () returned 0x0 [0117.557] gethostname (in: name=0x13381c0, namelen=256 | out: name="LHnIwsj") returned 0 [0118.003] GetLastError () returned 0x0 [0118.023] GetCurrentProcess () returned 0xffffffff [0118.023] GetLastError () returned 0x3f0 [0118.023] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x118e454 | out: TokenHandle=0x118e454*=0x4f4) returned 1 [0118.023] GetLastError () returned 0x3f0 [0118.045] GetCurrentProcess () returned 0xffffffff [0118.045] GetLastError () returned 0x3f0 [0118.045] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x118e464 | out: TokenHandle=0x118e464*=0x4f8) returned 1 [0118.045] GetLastError () returned 0x3f0 [0118.054] gethostbyname (name="LHnIwsj") returned 0x1388490*(h_name="LHnIwsj", h_aliases=0x13884a0*=0x0, h_addrtype=2, h_length=4, h_addr_list=0x13884a4*=([0]="192.168.0.96")) [0118.324] GetLastError () returned 0x0 [0118.324] lstrlenA (lpString="LHnIwsj") returned 7 [0118.326] RtlMoveMemory (in: Destination=0x1338188, Source=0x13884b0, Length=0x8 | out: Destination=0x1338188) [0118.396] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x118e778 | out: pFixedInfo=0x0, pOutBufLen=0x118e778) returned 0x6f [0118.407] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x13a52e8 [0118.407] GetLastError () returned 0x0 [0118.407] GetNetworkParams (in: pFixedInfo=0x13a52e8, pOutBufLen=0x118e778 | out: pFixedInfo=0x13a52e8, pOutBufLen=0x118e778) returned 0x0 [0118.417] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0118.417] GetLastError () returned 0x0 [0118.417] LocalFree (hMem=0x13a52e8) returned 0x0 [0118.417] GetLastError () returned 0x0 [0118.418] GetAdaptersAddresses () returned 0x6f [0118.426] LocalAlloc (uFlags=0x0, uBytes=0xea4) returned 0x13ab438 [0118.426] GetLastError () returned 0x0 [0118.426] GetAdaptersAddresses () returned 0x0 [0118.443] LocalFree (hMem=0x13ab438) returned 0x0 [0118.443] GetLastError () returned 0x0 [0118.443] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x118e838 | out: AdapterInfo=0x0, SizePointer=0x118e838) returned 0x6f [0118.446] LocalAlloc (uFlags=0x0, uBytes=0x280) returned 0x13935f8 [0118.446] GetLastError () returned 0x0 [0118.446] GetAdaptersInfo (in: AdapterInfo=0x13935f8, SizePointer=0x118e838 | out: AdapterInfo=0x13935f8, SizePointer=0x118e838) returned 0x0 [0118.449] inet_addr (cp="192.168.0.96") returned 0x6000a8c0 [0118.449] GetLastError () returned 0x0 [0118.449] inet_addr (cp="255.255.255.0") returned 0xffffff [0118.449] GetLastError () returned 0x0 [0118.483] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0118.483] GetLastError () returned 0x0 [0118.484] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0118.484] GetLastError () returned 0x0 [0118.485] GetIfEntry (in: pIfRow=0x136fd10 | out: pIfRow=0x136fd10) returned 0x0 [0118.486] GetPerAdapterInfo (in: IfIndex=0x5, pPerAdapterInfo=0x0, pOutBufLen=0x118e5ac | out: pPerAdapterInfo=0x0, pOutBufLen=0x118e5ac) returned 0x6f [0118.492] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1342c20 [0118.492] GetLastError () returned 0x0 [0118.492] GetPerAdapterInfo (in: IfIndex=0x5, pPerAdapterInfo=0x1342c20, pOutBufLen=0x118e5ac | out: pPerAdapterInfo=0x1342c20, pOutBufLen=0x118e5ac) returned 0x0 [0118.499] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0118.499] GetLastError () returned 0x0 [0118.499] LocalFree (hMem=0x1342c20) returned 0x0 [0118.499] GetLastError () returned 0x0 [0118.499] LocalFree (hMem=0x13935f8) returned 0x0 [0118.499] GetLastError () returned 0x0 [0118.904] CreateBindCtx (in: reserved=0x0, ppbc=0x118e88c | out: ppbc=0x118e88c*=0x135fc90) returned 0x0 [0118.906] CBindCtx::QueryInterface () returned 0x0 [0118.906] CBindCtx::QueryInterface () returned 0x80004002 [0118.906] CBindCtx::QueryInterface () returned 0x80004002 [0118.906] CBindCtx::AddRef () returned 0x3 [0118.906] CoGetContextToken (in: pToken=0x118df7c | out: pToken=0x118df7c) returned 0x0 [0118.906] CoGetContextToken (in: pToken=0x118df40 | out: pToken=0x118df40) returned 0x0 [0118.906] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df74 | out: ppvObject=0x118df74*=0x1332d0c) returned 0x0 [0118.906] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118dfa4 | out: pAptType=0x118dfa4*=3) returned 0x0 [0118.906] IUnknown:Release (This=0x1332d0c) returned 0x1 [0118.907] CBindCtx::QueryInterface () returned 0x80004002 [0118.907] CoGetContextToken (in: pToken=0x118df74 | out: pToken=0x118df74) returned 0x0 [0118.907] CBindCtx::AddRef () returned 0x4 [0118.907] CBindCtx::QueryInterface () returned 0x80004002 [0118.907] CBindCtx::Release () returned 0x3 [0118.907] CBindCtx::Release () returned 0x2 [0118.907] CoGetContextToken (in: pToken=0x118e3e8 | out: pToken=0x118e3e8) returned 0x0 [0118.907] CoGetContextToken (in: pToken=0x118e3a8 | out: pToken=0x118e3a8) returned 0x0 [0118.907] CBindCtx::AddRef () returned 0x3 [0118.907] CBindCtx::QueryInterface () returned 0x0 [0118.907] CBindCtx::Release () returned 0x3 [0118.908] CBindCtx::Release () returned 0x2 [0118.908] CBindCtx::Release () returned 0x1 [0118.909] CoGetContextToken (in: pToken=0x118e44c | out: pToken=0x118e44c) returned 0x0 [0118.909] CoGetContextToken (in: pToken=0x118e40c | out: pToken=0x118e40c) returned 0x0 [0118.909] CBindCtx::AddRef () returned 0x2 [0118.909] CBindCtx::QueryInterface () returned 0x0 [0118.909] CBindCtx::Release () returned 0x2 [0118.909] CBindCtx::AddRef () returned 0x3 [0118.909] MkParseDisplayName (in: pbc=0x135fc90, szUserName="winmgmts:", pchEaten=0x118e918, ppmk=0x118e85c | out: pchEaten=0x118e918, ppmk=0x118e85c*=0x13a6238) returned 0x0 [0119.141] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1391720 [0119.141] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.141] DllGetClassObject (in: rclsid=0x13826f8*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x770ac3c4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x118e640 | out: ppv=0x118e640*=0x1391588) returned 0x0 [0119.141] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1391588 [0119.142] WinMGMTS:IClassFactory:CreateInstance (in: This=0x1391588, pUnkOuter=0x0, riid=0x774372dc*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e5e8 | out: ppvObject=0x118e5e8*=0x136ee50) returned 0x0 [0119.142] GetVersionExW (in: lpVersionInformation=0x118e3a8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x118e408, dwMinorVersion=0x7768254f, dwBuildNumber=0xc0150008, dwPlatformId=0x770ab734, szCSDVersion="ᥠ眓") | out: lpVersionInformation=0x118e3a8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0119.142] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x118e3a0 | out: phkResult=0x118e3a0*=0x3c8) returned 0x0 [0119.142] RegQueryValueExW (in: hKey=0x3c8, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x118e398, lpcbData=0x118e3a4*=0x4 | out: lpType=0x0, lpData=0x118e398*=0x3, lpcbData=0x118e3a4*=0x4) returned 0x0 [0119.142] RegCloseKey (hKey=0x3c8) returned 0x0 [0119.142] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13935f8 [0119.142] GetSystemDirectoryW (in: lpBuffer=0x13935f8, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0119.142] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x77990000 [0119.142] GetProcAddress (hModule=0x77990000, lpProcName="DuplicateTokenEx") returned 0x779b0c20 [0119.142] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.142] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13a5ec8 [0119.143] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x136ee50 [0119.143] WinMGMTS:IUnknown:Release (This=0x1391588) returned 0x0 [0119.143] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.143] IParseDisplayName:ParseDisplayName (in: This=0x136ee50, pbc=0x135fc90, pszDisplayName="winmgmts:", pchEaten=0x118e800, ppmkOut=0x118e7fc | out: pchEaten=0x118e800*=0x9, ppmkOut=0x118e7fc*=0x13a6238) returned 0x0 [0119.143] ApiSetQueryApiSetPresence () returned 0x0 [0119.143] _wcsnicmp (_String1="winmgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0119.143] IBindCtx:GetObjectParam (in: This=0x135fc90, pszKey=0x71663e74, ppunk=0x118e6a0 | out: ppunk=0x118e6a0*=0x0) returned 0x80004005 [0119.143] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387d98 [0119.143] _wcsnicmp (_String1="", _String2="{", _MaxCount=0x1) returned -123 [0119.143] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1343168 [0119.143] ResolveDelayLoadedAPI () returned 0x77138200 [0119.144] CoCreateInstance (in: rclsid=0x71661c98*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661c88*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1343180 | out: ppv=0x1343180*=0x136ef80) returned 0x0 [0119.144] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1342c20 [0119.144] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1396d50 [0119.144] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387a18 [0119.144] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.144] GetCurrentThreadId () returned 0xecc [0119.144] _wcsnicmp (_String1="", _String2="[", _MaxCount=0x1) returned -91 [0119.144] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.144] GetCurrentThreadId () returned 0xecc [0119.145] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x118e508 | out: phkResult=0x118e508*=0x3c8) returned 0x0 [0119.145] RegQueryValueExW (in: hKey=0x3c8, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x118e50c*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x118e50c*=0x16) returned 0x0 [0119.145] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387a38 [0119.145] RegQueryValueExW (in: hKey=0x3c8, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x1387a38, lpcbData=0x118e50c*=0x16 | out: lpType=0x0, lpData=0x1387a38*=0x72, lpcbData=0x118e50c*=0x16) returned 0x0 [0119.145] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387a78 [0119.146] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.146] RegCloseKey (hKey=0x3c8) returned 0x0 [0119.146] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e544 | out: ppv=0x118e544*=0x1374c30) returned 0x0 [0119.146] SysStringLen (param_1=".") returned 0x1 [0119.146] IWbemPath:SetServer (This=0x1374c30, Name=".") returned 0x0 [0119.146] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e4ec | out: ppv=0x118e4ec*=0x1374ca0) returned 0x0 [0119.146] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e4b4 | out: ppv=0x118e4b4*=0x1374df0) returned 0x0 [0119.147] IWbemPath:SetText (This=0x1374df0, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0119.147] IUnknown:Release (This=0x1374df0) returned 0x0 [0119.147] SysStringLen (param_1="root\\cimv2") returned 0xa [0119.147] IWbemPath:SetText (This=0x1374ca0, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0119.147] IWbemPath:GetNamespaceCount (in: This=0x1374ca0, puCount=0x118e504 | out: puCount=0x118e504*=0x2) returned 0x0 [0119.147] IWbemPath:RemoveAllNamespaces (This=0x1374c30) returned 0x0 [0119.147] IWbemPath:GetNamespaceAt (in: This=0x1374ca0, uIndex=0x0, puNameBufLength=0x118e4c0*=0x0, pName=0x0 | out: puNameBufLength=0x118e4c0*=0x5, pName=0x0) returned 0x0 [0119.147] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13918e8 [0119.147] IWbemPath:GetNamespaceAt (in: This=0x1374ca0, uIndex=0x0, puNameBufLength=0x118e4c0*=0x5, pName="䐀扥杵଀" | out: puNameBufLength=0x118e4c0*=0x5, pName="root") returned 0x0 [0119.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.147] IWbemPath:SetNamespaceAt (This=0x1374c30, uIndex=0x0, pszName="root") returned 0x0 [0119.147] IWbemPath:GetNamespaceAt (in: This=0x1374ca0, uIndex=0x1, puNameBufLength=0x118e4c0*=0x0, pName=0x0 | out: puNameBufLength=0x118e4c0*=0x6, pName=0x0) returned 0x0 [0119.147] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13918e8 [0119.147] IWbemPath:GetNamespaceAt (in: This=0x1374ca0, uIndex=0x1, puNameBufLength=0x118e4c0*=0x6, pName="root" | out: puNameBufLength=0x118e4c0*=0x6, pName="cimv2") returned 0x0 [0119.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.147] IWbemPath:SetNamespaceAt (This=0x1374c30, uIndex=0x1, pszName="cimv2") returned 0x0 [0119.147] IUnknown:Release (This=0x1374ca0) returned 0x0 [0119.147] IWbemPath:GetText (in: This=0x1374c30, lFlags=4, puBuffLength=0x118e508*=0x0, pszText=0x0 | out: puBuffLength=0x118e508*=0xf, pszText=0x0) returned 0x0 [0119.147] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13a5ea0 [0119.147] IWbemPath:GetText (in: This=0x1374c30, lFlags=4, puBuffLength=0x118e508*=0xf, pszText="" | out: puBuffLength=0x118e508*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0119.147] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.147] IUnknown:Release (This=0x1374c30) returned 0x0 [0119.147] IWbemLocator:ConnectServer (in: This=0x136ef80, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x118e5e4 | out: ppNamespace=0x118e5e4*=0x1384750) returned 0x0 [0119.157] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13751e0 [0119.157] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1396e10 [0119.157] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1379e88 [0119.157] IUnknown:QueryInterface (in: This=0x1384750, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e5d4 | out: ppvObject=0x118e5d4*=0x138cae4) returned 0x0 [0119.157] IClientSecurity:QueryBlanket (in: This=0x138cae4, pProxy=0x1384750, pAuthnSvc=0x118e5b4, pAuthzSvc=0x118e5b8, pServerPrincName=0x0, pAuthnLevel=0x118e5f8, pImpLevel=0x118e5e8, pAuthInfo=0x0, pCapabilites=0x118e5b0 | out: pAuthnSvc=0x118e5b4*=0xa, pAuthzSvc=0x118e5b8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118e5f8*=0x6, pImpLevel=0x118e5e8*=0x2, pAuthInfo=0x0, pCapabilites=0x118e5b0*=0x1) returned 0x0 [0119.157] IUnknown:Release (This=0x138cae4) returned 0x1 [0119.157] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.157] GetCurrentThreadId () returned 0xecc [0119.157] IUnknown:QueryInterface (in: This=0x1384750, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e61c | out: ppvObject=0x118e61c*=0x138cae4) returned 0x0 [0119.158] IClientSecurity:CopyProxy (in: This=0x138cae4, pProxy=0x1384750, ppCopy=0x118e634 | out: ppCopy=0x118e634*=0x13842f0) returned 0x0 [0119.158] IUnknown:QueryInterface (in: This=0x13842f0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e500 | out: ppvObject=0x118e500*=0x138cae4) returned 0x0 [0119.158] IClientSecurity:QueryBlanket (in: This=0x138cae4, pProxy=0x13842f0, pAuthnSvc=0x118e530, pAuthzSvc=0x118e52c, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x118e530*=0xa, pAuthzSvc=0x118e52c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0119.158] IUnknown:Release (This=0x138cae4) returned 0x3 [0119.158] IUnknown:QueryInterface (in: This=0x13842f0, riid=0x71661f78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4e4 | out: ppvObject=0x118e4e4*=0x138cb08) returned 0x0 [0119.158] IUnknown:QueryInterface (in: This=0x13842f0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4e8 | out: ppvObject=0x118e4e8*=0x138cae4) returned 0x0 [0119.158] IClientSecurity:SetBlanket (This=0x138cae4, pProxy=0x13842f0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0119.158] IUnknown:Release (This=0x138cae4) returned 0x4 [0119.158] IUnknown:Release (This=0x138cb08) returned 0x3 [0119.158] IUnknown:Release (This=0x138cae4) returned 0x2 [0119.158] IUnknown:AddRef (This=0x13842f0) returned 0x3 [0119.158] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13970b0 [0119.158] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387a38 [0119.158] IUnknown:Release (This=0x1384750) returned 0x2 [0119.159] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.159] GetCurrentThreadId () returned 0xecc [0119.159] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.159] GetCurrentThreadId () returned 0xecc [0119.159] IUnknown:QueryInterface (in: This=0x13842f0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e634 | out: ppvObject=0x118e634*=0x138cae4) returned 0x0 [0119.159] IClientSecurity:QueryBlanket (in: This=0x138cae4, pProxy=0x13842f0, pAuthnSvc=0x118e620, pAuthzSvc=0x118e624, pServerPrincName=0x0, pAuthnLevel=0x118e630, pImpLevel=0x118e62c, pAuthInfo=0x0, pCapabilites=0x118e628 | out: pAuthnSvc=0x118e620*=0xa, pAuthzSvc=0x118e624*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118e630*=0x6, pImpLevel=0x118e62c*=0x3, pAuthInfo=0x0, pCapabilites=0x118e628*=0x20) returned 0x0 [0119.159] IUnknown:Release (This=0x138cae4) returned 0x2 [0119.159] ResolveDelayLoadedAPI () returned 0x77454b10 [0119.159] CreatePointerMoniker (in: punk=0x13751e0, ppmk=0x118e7fc | out: ppmk=0x118e7fc*=0x13a6238) returned 0x0 [0119.159] IUnknown:AddRef (This=0x13751e0) returned 0x2 [0119.159] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.160] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.160] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.160] IUnknown:Release (This=0x136ef80) returned 0x0 [0119.160] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.160] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.160] IUnknown:Release (This=0x136ee50) returned 0x0 [0119.160] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.160] IUnknown:QueryInterface (in: This=0x13a6238, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e10c | out: ppvObject=0x118e10c*=0x13a6238) returned 0x0 [0119.160] IUnknown:QueryInterface (in: This=0x13a6238, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118e0c8 | out: ppvObject=0x118e0c8*=0x0) returned 0x80004002 [0119.160] IUnknown:QueryInterface (in: This=0x13a6238, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118dfbc | out: ppvObject=0x118dfbc*=0x0) returned 0x80004002 [0119.161] IUnknown:AddRef (This=0x13a6238) returned 0x3 [0119.161] CoGetContextToken (in: pToken=0x118df54 | out: pToken=0x118df54) returned 0x0 [0119.161] CoGetContextToken (in: pToken=0x118df18 | out: pToken=0x118df18) returned 0x0 [0119.161] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df4c | out: ppvObject=0x118df4c*=0x1332d0c) returned 0x0 [0119.161] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118df7c | out: pAptType=0x118df7c*=3) returned 0x0 [0119.161] IUnknown:Release (This=0x1332d0c) returned 0x1 [0119.161] IUnknown:QueryInterface (in: This=0x13a6238, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df3c | out: ppvObject=0x118df3c*=0x13a624c) returned 0x0 [0119.161] IMarshal:GetUnmarshalClass (in: This=0x13a624c, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118df44 | out: pCid=0x118df44*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0119.161] IUnknown:Release (This=0x13a624c) returned 0x3 [0119.161] CoGetContextToken (in: pToken=0x118df4c | out: pToken=0x118df4c) returned 0x0 [0119.161] IUnknown:AddRef (This=0x13a6238) returned 0x4 [0119.161] IUnknown:QueryInterface (in: This=0x13a6238, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dfc0 | out: ppvObject=0x118dfc0*=0x0) returned 0x80004002 [0119.162] IUnknown:Release (This=0x13a6238) returned 0x3 [0119.162] IUnknown:Release (This=0x13a6238) returned 0x2 [0119.162] CoGetContextToken (in: pToken=0x118e3c0 | out: pToken=0x118e3c0) returned 0x0 [0119.162] CoGetContextToken (in: pToken=0x118e380 | out: pToken=0x118e380) returned 0x0 [0119.162] IUnknown:AddRef (This=0x13a6238) returned 0x3 [0119.162] IUnknown:QueryInterface (in: This=0x13a6238, riid=0x118e3fc*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e3f8 | out: ppvObject=0x118e3f8*=0x13a6238) returned 0x0 [0119.162] IUnknown:Release (This=0x13a6238) returned 0x3 [0119.162] IUnknown:Release (This=0x13a6238) returned 0x2 [0119.162] IUnknown:Release (This=0x13a6238) returned 0x1 [0119.162] IUnknown:Release (This=0x135fc90) returned 0x2 [0119.163] CoGetContextToken (in: pToken=0x118e44c | out: pToken=0x118e44c) returned 0x0 [0119.163] CoGetContextToken (in: pToken=0x118e40c | out: pToken=0x118e40c) returned 0x0 [0119.163] IUnknown:AddRef (This=0x13a6238) returned 0x2 [0119.163] IUnknown:QueryInterface (in: This=0x13a6238, riid=0x118e488*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e484 | out: ppvObject=0x118e484*=0x13a6238) returned 0x0 [0119.164] IUnknown:Release (This=0x13a6238) returned 0x2 [0119.164] IUnknown:AddRef (This=0x13a6238) returned 0x3 [0119.164] BindMoniker (in: pmk=0x13a6238, grfOpt=0x0, iidResult=0x335494c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x118e85c | out: ppvResult=0x118e85c*=0x13751e0) returned 0x0 [0119.164] IUnknown:QueryInterface (in: This=0x13751e0, riid=0x335494c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e85c | out: ppvObject=0x118e85c*=0x13751e0) returned 0x0 [0119.165] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x118df78*=0x0 | out: pptlib=0x118df78*=0x13983f8) returned 0x0 [0119.313] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x1375224*(Data1=0x62e522dc, Data2=0x8cf3, Data3=0x40a8, Data4=([0]=0x8b, [1]=0x2e, [2]=0x37, [3]=0xd5, [4]=0x95, [5]=0x65, [6]=0x1e, [7]=0x40)), ppTInfo=0x137520c | out: ppTInfo=0x137520c*=0x13acc7c) returned 0x0 [0119.313] IUnknown:Release (This=0x13983f8) returned 0x1 [0119.332] CoGetContextToken (in: pToken=0x118df54 | out: pToken=0x118df54) returned 0x0 [0119.332] CoGetContextToken (in: pToken=0x118df18 | out: pToken=0x118df18) returned 0x0 [0119.332] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df4c | out: ppvObject=0x118df4c*=0x1332d0c) returned 0x0 [0119.332] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118df7c | out: pAptType=0x118df7c*=3) returned 0x0 [0119.332] IUnknown:Release (This=0x1332d0c) returned 0x1 [0119.332] CoGetContextToken (in: pToken=0x118df4c | out: pToken=0x118df4c) returned 0x0 [0119.332] IUnknown:Release (This=0x13a6238) returned 0x2 [0119.358] CoGetContextToken (in: pToken=0x118e4a8 | out: pToken=0x118e4a8) returned 0x0 [0119.358] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x118e478*=0x0 | out: pptlib=0x118e478*=0x13983f8) returned 0x0 [0119.359] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x1375214*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x1375208 | out: ppTInfo=0x1375208*=0x13acca8) returned 0x0 [0119.359] IUnknown:Release (This=0x13983f8) returned 0x2 [0119.359] IUnknown:AddRef (This=0x13acca8) returned 0x2 [0119.360] DispGetIDsOfNames (in: ptinfo=0x13acca8, rgszNames=0x118e500*="InstancesOf", cNames=0x1, rgdispid=0x118e4f0 | out: rgdispid=0x118e4f0*=5) returned 0x0 [0119.360] IUnknown:Release (This=0x13acca8) returned 0x1 [0119.361] IUnknown:AddRef (This=0x13acca8) returned 0x2 [0119.361] ITypeInfo:LocalInvoke (This=0x13acca8) returned 0x0 [0119.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.361] GetCurrentThreadId () returned 0xecc [0119.361] IUnknown:AddRef (This=0x13842f0) returned 0x3 [0119.361] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.361] GetCurrentThreadId () returned 0xecc [0119.361] IWbemServices:CreateInstanceEnum (in: This=0x13842f0, strFilter="Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x118dcec | out: ppEnum=0x118dcec*=0x13aaa58) returned 0x0 [0119.363] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1396bd0 [0119.363] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1397410 [0119.363] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1396990 [0119.363] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387d98 [0119.363] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1379810 [0119.363] IUnknown:QueryInterface (in: This=0x13aaa58, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118db94 | out: ppvObject=0x118db94*=0x13aaa5c) returned 0x0 [0119.363] IClientSecurity:QueryBlanket (in: This=0x13aaa5c, pProxy=0x13aaa58, pAuthnSvc=0x118db80, pAuthzSvc=0x118db88, pServerPrincName=0x0, pAuthnLevel=0x118dbbc, pImpLevel=0x118dbc0, pAuthInfo=0x0, pCapabilites=0x118db84 | out: pAuthnSvc=0x118db80*=0xa, pAuthzSvc=0x118db88*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118dbbc*=0x6, pImpLevel=0x118dbc0*=0x2, pAuthInfo=0x0, pCapabilites=0x118db84*=0x1) returned 0x0 [0119.363] IUnknown:Release (This=0x13aaa5c) returned 0x1 [0119.363] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.363] GetCurrentThreadId () returned 0xecc [0119.363] IUnknown:QueryInterface (in: This=0x13842f0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118db84 | out: ppvObject=0x118db84*=0x138cae4) returned 0x0 [0119.363] IClientSecurity:QueryBlanket (in: This=0x138cae4, pProxy=0x13842f0, pAuthnSvc=0x118db6c, pAuthzSvc=0x118db70, pServerPrincName=0x0, pAuthnLevel=0x118db7c, pImpLevel=0x118db80, pAuthInfo=0x0, pCapabilites=0x118db74 | out: pAuthnSvc=0x118db6c*=0xa, pAuthzSvc=0x118db70*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118db7c*=0x6, pImpLevel=0x118db80*=0x3, pAuthInfo=0x0, pCapabilites=0x118db74*=0x20) returned 0x0 [0119.363] IUnknown:Release (This=0x138cae4) returned 0x3 [0119.363] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.364] GetCurrentThreadId () returned 0xecc [0119.364] IUnknown:QueryInterface (in: This=0x13842f0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118db84 | out: ppvObject=0x118db84*=0x138cae4) returned 0x0 [0119.364] IClientSecurity:QueryBlanket (in: This=0x138cae4, pProxy=0x13842f0, pAuthnSvc=0x118db6c, pAuthzSvc=0x118db70, pServerPrincName=0x0, pAuthnLevel=0x118db80, pImpLevel=0x118db7c, pAuthInfo=0x0, pCapabilites=0x118db74 | out: pAuthnSvc=0x118db6c*=0xa, pAuthzSvc=0x118db70*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118db80*=0x6, pImpLevel=0x118db7c*=0x3, pAuthInfo=0x0, pCapabilites=0x118db74*=0x20) returned 0x0 [0119.364] IUnknown:Release (This=0x138cae4) returned 0x3 [0119.364] IUnknown:QueryInterface (in: This=0x13aaa58, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dbb4 | out: ppvObject=0x118dbb4*=0x13aaa5c) returned 0x0 [0119.364] IClientSecurity:CopyProxy (in: This=0x13aaa5c, pProxy=0x13aaa58, ppCopy=0x118dbb8 | out: ppCopy=0x118dbb8*=0x13aab20) returned 0x0 [0119.364] IUnknown:QueryInterface (in: This=0x13aab20, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118db0c | out: ppvObject=0x118db0c*=0x13aab24) returned 0x0 [0119.364] IClientSecurity:QueryBlanket (in: This=0x13aab24, pProxy=0x13aab20, pAuthnSvc=0x118db3c, pAuthzSvc=0x118db38, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x118db3c*=0xa, pAuthzSvc=0x118db38*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0119.364] IUnknown:Release (This=0x13aab24) returned 0x3 [0119.364] IUnknown:QueryInterface (in: This=0x13aab20, riid=0x71661f78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118daf0 | out: ppvObject=0x118daf0*=0x138ca08) returned 0x0 [0119.364] IUnknown:QueryInterface (in: This=0x13aab20, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118daf4 | out: ppvObject=0x118daf4*=0x13aab24) returned 0x0 [0119.365] IClientSecurity:SetBlanket (This=0x13aab24, pProxy=0x13aab20, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0119.365] IUnknown:Release (This=0x13aab24) returned 0x4 [0119.366] IUnknown:Release (This=0x138ca08) returned 0x3 [0119.366] IUnknown:Release (This=0x13aaa5c) returned 0x2 [0119.366] IUnknown:AddRef (This=0x13aab20) returned 0x3 [0119.366] IUnknown:Release (This=0x13aaa58) returned 0x2 [0119.366] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x118dca8 | out: pperrinfo=0x118dca8*=0x0) returned 0x1 [0119.366] IUnknown:Release (This=0x13842f0) returned 0x2 [0119.366] IUnknown:Release (This=0x13acca8) returned 0x1 [0119.367] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x118dd94*=0x0 | out: pptlib=0x118dd94*=0x13983f8) returned 0x0 [0119.368] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x1396c08*(Data1=0x4b83d61, Data2=0x21ae, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x33, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x1396bf0 | out: ppTInfo=0x1396bf0*=0x13acdb0) returned 0x0 [0119.368] IUnknown:Release (This=0x13983f8) returned 0x3 [0119.368] IUnknown:AddRef (This=0x13acdb0) returned 0x2 [0119.368] ITypeInfo:RemoteGetTypeAttr (in: This=0x13acdb0, ppTypeAttr=0x118dde4, pDummy=0x42e92609 | out: ppTypeAttr=0x118dde4, pDummy=0x42e92609) returned 0x0 [0119.368] ITypeInfo:LocalReleaseTypeAttr (This=0x13acdb0) returned 0x0 [0119.368] IUnknown:Release (This=0x13acdb0) returned 0x1 [0119.368] CoGetContextToken (in: pToken=0x118dd70 | out: pToken=0x118dd70) returned 0x0 [0119.368] CoGetContextToken (in: pToken=0x118dd34 | out: pToken=0x118dd34) returned 0x0 [0119.368] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dd68 | out: ppvObject=0x118dd68*=0x1332d0c) returned 0x0 [0119.368] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118dd98 | out: pAptType=0x118dd98*=3) returned 0x0 [0119.369] IUnknown:Release (This=0x1332d0c) returned 0x1 [0119.369] CoGetContextToken (in: pToken=0x118dd68 | out: pToken=0x118dd68) returned 0x0 [0119.369] CoGetContextToken (in: pToken=0x118e714 | out: pToken=0x118e714) returned 0x0 [0119.369] CoGetContextToken (in: pToken=0x118e6d4 | out: pToken=0x118e6d4) returned 0x0 [0119.370] CoGetContextToken (in: pToken=0x118e75c | out: pToken=0x118e75c) returned 0x0 [0119.370] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x118e730*=0x0 | out: pptlib=0x118e730*=0x13983f8) returned 0x0 [0119.371] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x1396bf8*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x1396bec | out: ppTInfo=0x1396bec*=0x13acd58) returned 0x0 [0119.371] IUnknown:Release (This=0x13983f8) returned 0x4 [0119.371] IUnknown:AddRef (This=0x13acd58) returned 0x2 [0119.371] ITypeInfo:LocalInvoke (This=0x13acd58) returned 0x0 [0119.371] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.371] GetCurrentThreadId () returned 0xecc [0119.371] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13916f0 [0119.371] IUnknown:Release (This=0x13acd58) returned 0x1 [0119.371] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0119.784] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x1356a60 [0119.785] GetLastError () returned 0x0 [0119.785] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x1356f28 [0119.785] GetLastError () returned 0x0 [0119.797] CoGetContextToken (in: pToken=0x118e61c | out: pToken=0x118e61c) returned 0x0 [0119.802] CoGetContextToken (in: pToken=0x118e248 | out: pToken=0x118e248) returned 0x0 [0119.802] IUnknown:AddRef (This=0x13acd58) returned 0x2 [0119.802] ITypeInfo:LocalInvoke (This=0x13acd58) returned 0x0 [0119.802] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.803] GetCurrentThreadId () returned 0xecc [0119.803] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.803] GetCurrentThreadId () returned 0xecc [0119.803] IUnknown:AddRef (This=0x13aab20) returned 0x3 [0119.803] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.803] GetCurrentThreadId () returned 0xecc [0119.803] IEnumWbemClassObject:Clone (in: This=0x13aab20, ppEnum=0x118dff4 | out: ppEnum=0x118dff4*=0x13aabe8) returned 0x0 [0119.803] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1396f30 [0119.803] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1396d50 [0119.804] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1397050 [0119.804] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13880d8 [0119.804] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1379250 [0119.804] IUnknown:QueryInterface (in: This=0x13aabe8, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dea0 | out: ppvObject=0x118dea0*=0x13aabec) returned 0x0 [0119.804] IClientSecurity:QueryBlanket (in: This=0x13aabec, pProxy=0x13aabe8, pAuthnSvc=0x118de8c, pAuthzSvc=0x118de94, pServerPrincName=0x0, pAuthnLevel=0x118dec8, pImpLevel=0x118decc, pAuthInfo=0x0, pCapabilites=0x118de90 | out: pAuthnSvc=0x118de8c*=0xa, pAuthzSvc=0x118de94*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118dec8*=0x6, pImpLevel=0x118decc*=0x2, pAuthInfo=0x0, pCapabilites=0x118de90*=0x1) returned 0x0 [0119.804] IUnknown:Release (This=0x13aabec) returned 0x1 [0119.804] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.804] GetCurrentThreadId () returned 0xecc [0119.804] IUnknown:QueryInterface (in: This=0x13aab20, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de90 | out: ppvObject=0x118de90*=0x13aab24) returned 0x0 [0119.804] IClientSecurity:QueryBlanket (in: This=0x13aab24, pProxy=0x13aab20, pAuthnSvc=0x118de78, pAuthzSvc=0x118de7c, pServerPrincName=0x0, pAuthnLevel=0x118de88, pImpLevel=0x118de8c, pAuthInfo=0x0, pCapabilites=0x118de80 | out: pAuthnSvc=0x118de78*=0xa, pAuthzSvc=0x118de7c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118de88*=0x6, pImpLevel=0x118de8c*=0x3, pAuthInfo=0x0, pCapabilites=0x118de80*=0x20) returned 0x0 [0119.804] IUnknown:Release (This=0x13aab24) returned 0x3 [0119.804] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.804] GetCurrentThreadId () returned 0xecc [0119.804] IUnknown:QueryInterface (in: This=0x13aab20, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de90 | out: ppvObject=0x118de90*=0x13aab24) returned 0x0 [0119.804] IClientSecurity:QueryBlanket (in: This=0x13aab24, pProxy=0x13aab20, pAuthnSvc=0x118de78, pAuthzSvc=0x118de7c, pServerPrincName=0x0, pAuthnLevel=0x118de8c, pImpLevel=0x118de88, pAuthInfo=0x0, pCapabilites=0x118de80 | out: pAuthnSvc=0x118de78*=0xa, pAuthzSvc=0x118de7c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118de8c*=0x6, pImpLevel=0x118de88*=0x3, pAuthInfo=0x0, pCapabilites=0x118de80*=0x20) returned 0x0 [0119.804] IUnknown:Release (This=0x13aab24) returned 0x3 [0119.804] IUnknown:QueryInterface (in: This=0x13aabe8, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dec0 | out: ppvObject=0x118dec0*=0x13aabec) returned 0x0 [0119.804] IClientSecurity:CopyProxy (in: This=0x13aabec, pProxy=0x13aabe8, ppCopy=0x118dec4 | out: ppCopy=0x118dec4*=0x13aae40) returned 0x0 [0119.804] IUnknown:QueryInterface (in: This=0x13aae40, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de18 | out: ppvObject=0x118de18*=0x13aae44) returned 0x0 [0119.804] IClientSecurity:QueryBlanket (in: This=0x13aae44, pProxy=0x13aae40, pAuthnSvc=0x118de48, pAuthzSvc=0x118de44, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x118de48*=0xa, pAuthzSvc=0x118de44*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0119.804] IUnknown:Release (This=0x13aae44) returned 0x3 [0119.804] IUnknown:QueryInterface (in: This=0x13aae40, riid=0x71661f78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118ddfc | out: ppvObject=0x118ddfc*=0x138cc08) returned 0x0 [0119.804] IUnknown:QueryInterface (in: This=0x13aae40, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de00 | out: ppvObject=0x118de00*=0x13aae44) returned 0x0 [0119.804] IClientSecurity:SetBlanket (This=0x13aae44, pProxy=0x13aae40, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0119.805] IUnknown:Release (This=0x13aae44) returned 0x4 [0119.805] IUnknown:Release (This=0x138cc08) returned 0x3 [0119.805] IUnknown:Release (This=0x13aabec) returned 0x2 [0119.806] IUnknown:AddRef (This=0x13aae40) returned 0x3 [0119.806] IUnknown:Release (This=0x13aabe8) returned 0x2 [0119.806] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x118dfb4 | out: pperrinfo=0x118dfb4*=0x0) returned 0x1 [0119.806] IUnknown:Release (This=0x13aab20) returned 0x2 [0119.806] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.806] GetCurrentThreadId () returned 0xecc [0119.806] IUnknown:AddRef (This=0x13aae40) returned 0x3 [0119.806] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.806] GetCurrentThreadId () returned 0xecc [0119.806] IEnumWbemClassObject:Reset (This=0x13aae40) returned 0x0 [0119.806] IUnknown:Release (This=0x13aae40) returned 0x2 [0119.806] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1391a20 [0119.806] IUnknown:Release (This=0x13acd58) returned 0x1 [0119.807] CoGetContextToken (in: pToken=0x118dcb0 | out: pToken=0x118dcb0) returned 0x0 [0119.807] CoGetContextToken (in: pToken=0x118dc74 | out: pToken=0x118dc74) returned 0x0 [0119.807] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dca8 | out: ppvObject=0x118dca8*=0x1332d0c) returned 0x0 [0119.807] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118dcd8 | out: pAptType=0x118dcd8*=3) returned 0x0 [0119.807] IUnknown:Release (This=0x1332d0c) returned 0x1 [0119.808] CoGetContextToken (in: pToken=0x118dca8 | out: pToken=0x118dca8) returned 0x0 [0119.810] CoGetContextToken (in: pToken=0x118e75c | out: pToken=0x118e75c) returned 0x0 [0119.810] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.810] GetCurrentThreadId () returned 0xecc [0119.810] IUnknown:AddRef (This=0x13aae40) returned 0x3 [0119.810] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0119.810] GetCurrentThreadId () returned 0xecc [0119.810] IEnumWbemClassObject:Next (in: This=0x13aae40, lTimeout=-1, uCount=0x1, apObjects=0x118e874, puReturned=0x118e854 | out: apObjects=0x118e874*=0x136fb10, puReturned=0x118e854*=0x1) returned 0x0 [0122.551] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x138f828 [0122.551] IUnknown:AddRef (This=0x136fb10) returned 0x2 [0122.551] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13aea58 [0122.552] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13974d0 [0122.552] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1396c90 [0122.552] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1388078 [0122.552] IUnknown:AddRef (This=0x13842f0) returned 0x3 [0122.552] IUnknown:AddRef (This=0x13aae40) returned 0x4 [0122.552] IUnknown:QueryInterface (in: This=0x13aae40, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e8a0 | out: ppvObject=0x118e8a0*=0x13aae44) returned 0x0 [0122.552] IClientSecurity:QueryBlanket (in: This=0x13aae44, pProxy=0x13aae40, pAuthnSvc=0x118e824, pAuthzSvc=0x118e82c, pServerPrincName=0x0, pAuthnLevel=0x118e850, pImpLevel=0x118e85c, pAuthInfo=0x0, pCapabilites=0x118e820 | out: pAuthnSvc=0x118e824*=0xa, pAuthzSvc=0x118e82c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118e850*=0x6, pImpLevel=0x118e85c*=0x3, pAuthInfo=0x0, pCapabilites=0x118e820*=0x20) returned 0x0 [0122.552] IUnknown:Release (This=0x13aae44) returned 0x4 [0122.552] IUnknown:Release (This=0x13842f0) returned 0x2 [0122.552] IUnknown:AddRef (This=0x13842f0) returned 0x3 [0122.552] IUnknown:Release (This=0x13aae40) returned 0x3 [0122.552] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0122.552] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x137ad68 [0122.552] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1388058 [0122.552] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13a5f68 [0122.552] IUnknown:AddRef (This=0x136fb10) returned 0x3 [0122.553] IUnknown:Release (This=0x136fb10) returned 0x2 [0122.553] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x118e7ec | out: pperrinfo=0x118e7ec*=0x0) returned 0x1 [0122.553] IUnknown:Release (This=0x13aae40) returned 0x2 [0122.553] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x118e8a4 | out: pperrinfo=0x118e8a4*=0x0) returned 0x1 [0122.554] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x118e100*=0x0 | out: pptlib=0x118e100*=0x13983f8) returned 0x0 [0122.555] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x71664c10*(Data1=0xd6bdafb2, Data2=0x9435, Data3=0x491f, Data4=([0]=0xbb, [1]=0x87, [2]=0x6a, [3]=0xa0, [4]=0xf0, [5]=0xbc, [6]=0x31, [7]=0xa2)), ppTInfo=0x137ad84 | out: ppTInfo=0x137ad84*=0x13acddc) returned 0x0 [0122.555] IUnknown:Release (This=0x13983f8) returned 0x5 [0122.555] IUnknown:AddRef (This=0x13acddc) returned 0x2 [0122.555] ITypeInfo:RemoteGetTypeAttr (in: This=0x13acddc, ppTypeAttr=0x118e150, pDummy=0x42e91a9d | out: ppTypeAttr=0x118e150, pDummy=0x42e91a9d) returned 0x0 [0122.555] ITypeInfo:LocalReleaseTypeAttr (This=0x13acddc) returned 0x0 [0122.555] IUnknown:Release (This=0x13acddc) returned 0x1 [0122.556] CoGetContextToken (in: pToken=0x118e0dc | out: pToken=0x118e0dc) returned 0x0 [0122.556] CoGetContextToken (in: pToken=0x118e0a0 | out: pToken=0x118e0a0) returned 0x0 [0122.556] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e0d4 | out: ppvObject=0x118e0d4*=0x1332d0c) returned 0x0 [0122.556] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118e104 | out: pAptType=0x118e104*=3) returned 0x0 [0122.556] IUnknown:Release (This=0x1332d0c) returned 0x1 [0122.556] CoGetContextToken (in: pToken=0x118e0d4 | out: pToken=0x118e0d4) returned 0x0 [0122.558] CoGetContextToken (in: pToken=0x118e4b8 | out: pToken=0x118e4b8) returned 0x0 [0122.558] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x118e488*=0x0 | out: pptlib=0x118e488*=0x13983f8) returned 0x0 [0122.567] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x71661f38*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x137ad80 | out: ppTInfo=0x137ad80*=0x13ace08) returned 0x0 [0122.567] IUnknown:Release (This=0x13983f8) returned 0x6 [0122.567] IUnknown:AddRef (This=0x13ace08) returned 0x2 [0122.567] DispGetIDsOfNames (in: ptinfo=0x13ace08, rgszNames=0x118e510*="Name", cNames=0x1, rgdispid=0x118e500 | out: rgdispid=0x118e500*=-1) returned 0x80020006 [0122.621] IUnknown:AddRef (This=0x136fb10) returned 0x3 [0122.621] IWbemClassObject:Get (in: This=0x136fb10, wszName="Name", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x118e458*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x118e458*=0) returned 0x0 [0122.621] IUnknown:Release (This=0x136fb10) returned 0x2 [0122.621] SysStringLen (param_1="Name") returned 0x4 [0122.621] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13a6198 [0122.621] SysStringLen (param_1="Name") returned 0x4 [0122.621] IUnknown:Release (This=0x13ace08) returned 0x1 [0122.621] IUnknown:AddRef (This=0x13ace08) returned 0x2 [0122.621] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.621] GetCurrentThreadId () returned 0xecc [0122.621] SysStringLen (param_1="Name") returned 0x4 [0122.621] IWbemClassObject:Get (in: This=0x136fb10, wszName="Name", lFlags=0, pVal=0x118e298*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x118e290*=0, plFlavor=0x0 | out: pVal=0x118e298*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz", varVal2=0x0), pType=0x118e290*=8, plFlavor=0x0) returned 0x0 [0122.621] IUnknown:Release (This=0x13ace08) returned 0x1 [0122.621] SysStringLen (param_1="Intel(R) Xeon(R) CPU E3-1270 v5 @ 3.60GHz") returned 0x29 [0122.643] GlobalMemoryStatusEx (in: lpBuffer=0x3370674 | out: lpBuffer=0x3370674) returned 1 [0122.643] GetLastError () returned 0x0 [0122.706] VarDecCmp (pdecLeft=0x118e864, pdecRight=0x118e854) returned 0x2 [0122.721] VarDecRound (in: pdecIn=0x118e864, cDecimals=2, pdecResult=0x118e8dc | out: pdecResult=0x118e8dc) returned 0x0 [0122.721] VarDecCmp (pdecLeft=0x118e864, pdecRight=0x118e854) returned 0x2 [0122.721] VarDecRound (in: pdecIn=0x118e864, cDecimals=2, pdecResult=0x118e8dc | out: pdecResult=0x118e8dc) returned 0x0 [0122.721] VarDecCmp (pdecLeft=0x118e864, pdecRight=0x118e854) returned 0x2 [0122.721] VarDecRound (in: pdecIn=0x118e864, cDecimals=2, pdecResult=0x118e8dc | out: pdecResult=0x118e8dc) returned 0x0 [0122.722] GetComputerNameW (in: lpBuffer=0x136fd10, nSize=0x118e980 | out: lpBuffer="LHNIWSJ", nSize=0x118e980) returned 1 [0122.760] GetLocaleInfoA (in: Locale=0x400, LCType=0x1002, lpLCData=0x13381c0, cchData=256 | out: lpLCData="United States") returned 14 [0122.783] CreateBindCtx (in: reserved=0x0, ppbc=0x118e878 | out: ppbc=0x118e878*=0x1360110) returned 0x0 [0122.783] IUnknown:QueryInterface (in: This=0x1360110, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e120 | out: ppvObject=0x118e120*=0x1360110) returned 0x0 [0122.783] IUnknown:QueryInterface (in: This=0x1360110, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118e0dc | out: ppvObject=0x118e0dc*=0x0) returned 0x80004002 [0122.783] IUnknown:QueryInterface (in: This=0x1360110, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118dfd0 | out: ppvObject=0x118dfd0*=0x0) returned 0x80004002 [0122.784] IUnknown:AddRef (This=0x1360110) returned 0x3 [0122.784] CoGetContextToken (in: pToken=0x118df68 | out: pToken=0x118df68) returned 0x0 [0122.784] CoGetContextToken (in: pToken=0x118df2c | out: pToken=0x118df2c) returned 0x0 [0122.784] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df60 | out: ppvObject=0x118df60*=0x1332d0c) returned 0x0 [0122.784] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118df90 | out: pAptType=0x118df90*=3) returned 0x0 [0122.784] IUnknown:Release (This=0x1332d0c) returned 0x1 [0122.784] IUnknown:QueryInterface (in: This=0x1360110, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df50 | out: ppvObject=0x118df50*=0x0) returned 0x80004002 [0122.784] CoGetContextToken (in: pToken=0x118df60 | out: pToken=0x118df60) returned 0x0 [0122.784] IUnknown:AddRef (This=0x1360110) returned 0x4 [0122.784] IUnknown:QueryInterface (in: This=0x1360110, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dfd4 | out: ppvObject=0x118dfd4*=0x0) returned 0x80004002 [0122.784] IUnknown:Release (This=0x1360110) returned 0x3 [0122.785] IUnknown:Release (This=0x1360110) returned 0x2 [0122.785] CoGetContextToken (in: pToken=0x118e3d4 | out: pToken=0x118e3d4) returned 0x0 [0122.785] CoGetContextToken (in: pToken=0x118e394 | out: pToken=0x118e394) returned 0x0 [0122.785] IUnknown:AddRef (This=0x1360110) returned 0x3 [0122.785] IUnknown:QueryInterface (in: This=0x1360110, riid=0x118e410*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e40c | out: ppvObject=0x118e40c*=0x1360110) returned 0x0 [0122.785] IUnknown:Release (This=0x1360110) returned 0x3 [0122.785] IUnknown:Release (This=0x1360110) returned 0x2 [0122.785] IUnknown:Release (This=0x1360110) returned 0x1 [0122.785] CoGetContextToken (in: pToken=0x118e438 | out: pToken=0x118e438) returned 0x0 [0122.785] CoGetContextToken (in: pToken=0x118e3f8 | out: pToken=0x118e3f8) returned 0x0 [0122.785] IUnknown:AddRef (This=0x1360110) returned 0x2 [0122.785] IUnknown:QueryInterface (in: This=0x1360110, riid=0x118e474*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e470 | out: ppvObject=0x118e470*=0x1360110) returned 0x0 [0122.786] IUnknown:Release (This=0x1360110) returned 0x2 [0122.786] IUnknown:AddRef (This=0x1360110) returned 0x3 [0122.786] MkParseDisplayName (in: pbc=0x1360110, szUserName="winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\SecurityCenter2", pchEaten=0x118e904, ppmk=0x118e848 | out: pchEaten=0x118e904, ppmk=0x118e848*=0x13a6490) returned 0x0 [0122.786] DllGetClassObject (in: rclsid=0x13826f8*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x774372dc*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x118e7b8 | out: ppv=0x118e7b8*=0x0) returned 0x80004002 [0122.787] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1391a38 [0122.787] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.787] DllGetClassObject (in: rclsid=0x13826f8*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x770ac3c4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x118e630 | out: ppv=0x118e630*=0x1391a38) returned 0x0 [0122.787] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1391a38 [0122.787] WinMGMTS:IClassFactory:CreateInstance (in: This=0x1391a38, pUnkOuter=0x0, riid=0x774372dc*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e5d8 | out: ppvObject=0x118e5d8*=0x136ef50) returned 0x0 [0122.787] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x136ef50 [0122.788] WinMGMTS:IUnknown:Release (This=0x1391a38) returned 0x0 [0122.788] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.788] IParseDisplayName:ParseDisplayName (in: This=0x136ef50, pbc=0x1360110, pszDisplayName="winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\SecurityCenter2", pchEaten=0x118e7f0, ppmkOut=0x118e7ec | out: pchEaten=0x118e7f0*=0x42, ppmkOut=0x118e7ec*=0x13a6490) returned 0x0 [0122.788] _wcsnicmp (_String1="winmgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0122.788] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387f38 [0122.788] _wcsnicmp (_String1="{", _String2="{", _MaxCount=0x1) returned 0 [0122.788] _wcsnicmp (_String1="impersonationLevel=", _String2="authenticationLevel", _MaxCount=0x13) returned 8 [0122.788] _wcsnicmp (_String1="impersonationLevel", _String2="impersonationLevel", _MaxCount=0x12) returned 0 [0122.788] _wcsnicmp (_String1="=", _String2="=", _MaxCount=0x1) returned 0 [0122.788] _wcsnicmp (_String1="impersona", _String2="anonymous", _MaxCount=0x9) returned 8 [0122.788] _wcsnicmp (_String1="imperson", _String2="identify", _MaxCount=0x8) returned 9 [0122.788] _wcsnicmp (_String1="impersonate", _String2="impersonate", _MaxCount=0xb) returned 0 [0122.788] _wcsnicmp (_String1="}", _String2="}", _MaxCount=0x1) returned 0 [0122.788] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1343168 [0122.788] CoCreateInstance (in: rclsid=0x71661c98*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661c88*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1343180 | out: ppv=0x1343180*=0x136eff0) returned 0x0 [0122.789] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1342c20 [0122.789] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1397110 [0122.789] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1388158 [0122.789] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.789] GetCurrentThreadId () returned 0xecc [0122.789] _wcsnicmp (_String1="!", _String2="[", _MaxCount=0x1) returned -58 [0122.789] _wcsnicmp (_String1="!", _String2="!", _MaxCount=0x1) returned 0 [0122.789] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e6c8 | out: ppv=0x118e6c8*=0x13ae9e8) returned 0x0 [0122.789] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e688 | out: ppv=0x118e688*=0x13af388) returned 0x0 [0122.789] IWbemPath:SetText (This=0x13af388, uMode=0x4, pszPath="\\\\.\\root\\SecurityCenter2") returned 0x0 [0122.789] IUnknown:Release (This=0x13af388) returned 0x0 [0122.789] SysStringLen (param_1="\\\\.\\root\\SecurityCenter2") returned 0x18 [0122.789] IWbemPath:SetText (This=0x13ae9e8, uMode=0x4, pszPath="\\\\.\\root\\SecurityCenter2") returned 0x0 [0122.789] IWbemPath:GetNamespaceCount (in: This=0x13ae9e8, puCount=0x118e688 | out: puCount=0x118e688*=0x2) returned 0x0 [0122.789] IWbemPath:GetText (in: This=0x13ae9e8, lFlags=16, puBuffLength=0x118e684*=0x0, pszText=0x0 | out: puBuffLength=0x118e684*=0x15, pszText=0x0) returned 0x0 [0122.789] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13ada30 [0122.789] IWbemPath:GetText (in: This=0x13ae9e8, lFlags=16, puBuffLength=0x118e684*=0x15, pszText="祓瑳浥刮湵楴敭䤮瑮牥灯敓癲捩獥䌮獵潴䵭牡桳" | out: puBuffLength=0x118e684*=0x15, pszText="root\\SecurityCenter2") returned 0x0 [0122.789] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.789] IWbemPath:GetInfo (in: This=0x13ae9e8, uRequestedInfo=0x0, puResponse=0x118e6a8 | out: puResponse=0x118e6a8*=0x24e01) returned 0x0 [0122.789] IWbemPath:GetInfo (in: This=0x13ae9e8, uRequestedInfo=0x0, puResponse=0x118e6a0 | out: puResponse=0x118e6a0*=0x24e01) returned 0x0 [0122.789] IWbemPath:GetServer (in: This=0x13ae9e8, puNameBufLength=0x118e684*=0x0, pName=0x0 | out: puNameBufLength=0x118e684*=0x2, pName=0x0) returned 0x0 [0122.789] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x132f768 [0122.789] IWbemPath:GetServer (in: This=0x13ae9e8, puNameBufLength=0x118e684*=0x2, pName="㾰罟" | out: puNameBufLength=0x118e684*=0x2, pName=".") returned 0x0 [0122.789] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.789] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.790] GetCurrentThreadId () returned 0xecc [0122.790] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e548 | out: ppv=0x118e548*=0x13aeac8) returned 0x0 [0122.790] SysStringLen (param_1=".") returned 0x1 [0122.790] IWbemPath:SetServer (This=0x13aeac8, Name=".") returned 0x0 [0122.790] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e534 | out: ppv=0x118e534*=0x13aef98) returned 0x0 [0122.790] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e4f4 | out: ppv=0x118e4f4*=0x13aeba8) returned 0x0 [0122.790] IWbemPath:SetText (This=0x13aeba8, uMode=0x4, pszPath="root\\SecurityCenter2") returned 0x0 [0122.790] IUnknown:Release (This=0x13aeba8) returned 0x0 [0122.790] SysStringLen (param_1="root\\SecurityCenter2") returned 0x14 [0122.790] IWbemPath:SetText (This=0x13aef98, uMode=0xc, pszPath="root\\SecurityCenter2") returned 0x0 [0122.790] IWbemPath:GetNamespaceCount (in: This=0x13aef98, puCount=0x118e52c | out: puCount=0x118e52c*=0x2) returned 0x0 [0122.790] IWbemPath:RemoveAllNamespaces (This=0x13aeac8) returned 0x0 [0122.790] IWbemPath:GetNamespaceAt (in: This=0x13aef98, uIndex=0x0, puNameBufLength=0x118e56c*=0x0, pName=0x0 | out: puNameBufLength=0x118e56c*=0x5, pName=0x0) returned 0x0 [0122.790] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1390d78 [0122.790] IWbemPath:GetNamespaceAt (in: This=0x13aef98, uIndex=0x0, puNameBufLength=0x118e56c*=0x5, pName="root" | out: puNameBufLength=0x118e56c*=0x5, pName="root") returned 0x0 [0122.790] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.790] IWbemPath:SetNamespaceAt (This=0x13aeac8, uIndex=0x0, pszName="root") returned 0x0 [0122.790] IWbemPath:GetNamespaceAt (in: This=0x13aef98, uIndex=0x1, puNameBufLength=0x118e56c*=0x0, pName=0x0 | out: puNameBufLength=0x118e56c*=0x10, pName=0x0) returned 0x0 [0122.790] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x137b008 [0122.790] IWbemPath:GetNamespaceAt (in: This=0x13aef98, uIndex=0x1, puNameBufLength=0x118e56c*=0x10, pName="" | out: puNameBufLength=0x118e56c*=0x10, pName="SecurityCenter2") returned 0x0 [0122.790] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.790] IWbemPath:SetNamespaceAt (This=0x13aeac8, uIndex=0x1, pszName="SecurityCenter2") returned 0x0 [0122.790] IUnknown:Release (This=0x13aef98) returned 0x0 [0122.790] IWbemPath:GetText (in: This=0x13aeac8, lFlags=4, puBuffLength=0x118e56c*=0x0, pszText=0x0 | out: puBuffLength=0x118e56c*=0x19, pszText=0x0) returned 0x0 [0122.790] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1360290 [0122.790] IWbemPath:GetText (in: This=0x13aeac8, lFlags=4, puBuffLength=0x118e56c*=0x19, pszText="" | out: puBuffLength=0x118e56c*=0x19, pszText="\\\\.\\root\\SecurityCenter2") returned 0x0 [0122.790] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.790] IUnknown:Release (This=0x13aeac8) returned 0x0 [0122.790] IWbemLocator:ConnectServer (in: This=0x136eff0, strNetworkResource="\\\\.\\root\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x118e5d4 | out: ppNamespace=0x118e5d4*=0x1384070) returned 0x0 [0122.798] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13aeeb8 [0122.798] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1396ff0 [0122.799] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1379530 [0122.799] IUnknown:QueryInterface (in: This=0x1384070, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e5c4 | out: ppvObject=0x118e5c4*=0x138cfe4) returned 0x0 [0122.799] IClientSecurity:QueryBlanket (in: This=0x138cfe4, pProxy=0x1384070, pAuthnSvc=0x118e5a4, pAuthzSvc=0x118e5a8, pServerPrincName=0x0, pAuthnLevel=0x118e5e8, pImpLevel=0x118e5d8, pAuthInfo=0x0, pCapabilites=0x118e5a0 | out: pAuthnSvc=0x118e5a4*=0xa, pAuthzSvc=0x118e5a8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118e5e8*=0x6, pImpLevel=0x118e5d8*=0x2, pAuthInfo=0x0, pCapabilites=0x118e5a0*=0x1) returned 0x0 [0122.799] IUnknown:Release (This=0x138cfe4) returned 0x1 [0122.799] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.799] GetCurrentThreadId () returned 0xecc [0122.799] IUnknown:QueryInterface (in: This=0x1384070, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e60c | out: ppvObject=0x118e60c*=0x138cfe4) returned 0x0 [0122.799] IClientSecurity:CopyProxy (in: This=0x138cfe4, pProxy=0x1384070, ppCopy=0x118e624 | out: ppCopy=0x118e624*=0x1384480) returned 0x0 [0122.799] IUnknown:QueryInterface (in: This=0x1384480, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4f0 | out: ppvObject=0x118e4f0*=0x138cfe4) returned 0x0 [0122.799] IClientSecurity:QueryBlanket (in: This=0x138cfe4, pProxy=0x1384480, pAuthnSvc=0x118e520, pAuthzSvc=0x118e51c, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x118e520*=0xa, pAuthzSvc=0x118e51c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0122.799] IUnknown:Release (This=0x138cfe4) returned 0x3 [0122.799] IUnknown:QueryInterface (in: This=0x1384480, riid=0x71661f78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4d4 | out: ppvObject=0x118e4d4*=0x138d008) returned 0x0 [0122.800] IUnknown:QueryInterface (in: This=0x1384480, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4d8 | out: ppvObject=0x118e4d8*=0x138cfe4) returned 0x0 [0122.800] IClientSecurity:SetBlanket (This=0x138cfe4, pProxy=0x1384480, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0122.800] IUnknown:Release (This=0x138cfe4) returned 0x4 [0122.800] IUnknown:Release (This=0x138d008) returned 0x3 [0122.800] IUnknown:Release (This=0x138cfe4) returned 0x2 [0122.800] IUnknown:AddRef (This=0x1384480) returned 0x3 [0122.800] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1397230 [0122.800] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387f78 [0122.800] IUnknown:Release (This=0x1384070) returned 0x2 [0122.800] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.800] GetCurrentThreadId () returned 0xecc [0122.801] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.801] GetCurrentThreadId () returned 0xecc [0122.801] IUnknown:QueryInterface (in: This=0x1384480, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e65c | out: ppvObject=0x118e65c*=0x138cfe4) returned 0x0 [0122.801] IClientSecurity:QueryBlanket (in: This=0x138cfe4, pProxy=0x1384480, pAuthnSvc=0x118e648, pAuthzSvc=0x118e64c, pServerPrincName=0x0, pAuthnLevel=0x118e658, pImpLevel=0x118e654, pAuthInfo=0x0, pCapabilites=0x118e650 | out: pAuthnSvc=0x118e648*=0xa, pAuthzSvc=0x118e64c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118e658*=0x6, pImpLevel=0x118e654*=0x3, pAuthInfo=0x0, pCapabilites=0x118e650*=0x20) returned 0x0 [0122.801] IUnknown:Release (This=0x138cfe4) returned 0x2 [0122.801] IWbemPath:GetInfo (in: This=0x13ae9e8, uRequestedInfo=0x0, puResponse=0x118e6a8 | out: puResponse=0x118e6a8*=0x24e01) returned 0x0 [0122.801] IWbemPath:GetInfo (in: This=0x13ae9e8, uRequestedInfo=0x0, puResponse=0x118e6d8 | out: puResponse=0x118e6d8*=0x24e01) returned 0x0 [0122.801] CreatePointerMoniker (in: punk=0x13aeeb8, ppmk=0x118e7ec | out: ppmk=0x118e7ec*=0x13a6490) returned 0x0 [0122.801] IUnknown:AddRef (This=0x13aeeb8) returned 0x2 [0122.801] IUnknown:Release (This=0x13ae9e8) returned 0x0 [0122.801] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.802] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.802] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.802] IUnknown:Release (This=0x136eff0) returned 0x0 [0122.802] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.802] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.802] IUnknown:Release (This=0x136ef50) returned 0x0 [0122.802] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.802] IUnknown:QueryInterface (in: This=0x13a6490, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e0f8 | out: ppvObject=0x118e0f8*=0x13a6490) returned 0x0 [0122.803] IUnknown:QueryInterface (in: This=0x13a6490, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118e0b4 | out: ppvObject=0x118e0b4*=0x0) returned 0x80004002 [0122.803] IUnknown:QueryInterface (in: This=0x13a6490, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118dfa8 | out: ppvObject=0x118dfa8*=0x0) returned 0x80004002 [0122.803] IUnknown:AddRef (This=0x13a6490) returned 0x3 [0122.803] CoGetContextToken (in: pToken=0x118df40 | out: pToken=0x118df40) returned 0x0 [0122.803] CoGetContextToken (in: pToken=0x118df04 | out: pToken=0x118df04) returned 0x0 [0122.803] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df38 | out: ppvObject=0x118df38*=0x1332d0c) returned 0x0 [0122.803] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118df68 | out: pAptType=0x118df68*=3) returned 0x0 [0122.804] IUnknown:Release (This=0x1332d0c) returned 0x1 [0122.804] IUnknown:QueryInterface (in: This=0x13a6490, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df28 | out: ppvObject=0x118df28*=0x13a64a4) returned 0x0 [0122.804] IMarshal:GetUnmarshalClass (in: This=0x13a64a4, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118df30 | out: pCid=0x118df30*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.804] IUnknown:Release (This=0x13a64a4) returned 0x3 [0122.804] CoGetContextToken (in: pToken=0x118df38 | out: pToken=0x118df38) returned 0x0 [0122.804] IUnknown:AddRef (This=0x13a6490) returned 0x4 [0122.804] IUnknown:QueryInterface (in: This=0x13a6490, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dfac | out: ppvObject=0x118dfac*=0x0) returned 0x80004002 [0122.804] IUnknown:Release (This=0x13a6490) returned 0x3 [0122.804] IUnknown:Release (This=0x13a6490) returned 0x2 [0122.805] CoGetContextToken (in: pToken=0x118e3ac | out: pToken=0x118e3ac) returned 0x0 [0122.805] CoGetContextToken (in: pToken=0x118e36c | out: pToken=0x118e36c) returned 0x0 [0122.805] IUnknown:AddRef (This=0x13a6490) returned 0x3 [0122.805] IUnknown:QueryInterface (in: This=0x13a6490, riid=0x118e3e8*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e3e4 | out: ppvObject=0x118e3e4*=0x13a6490) returned 0x0 [0122.805] IUnknown:Release (This=0x13a6490) returned 0x3 [0122.805] IUnknown:Release (This=0x13a6490) returned 0x2 [0122.805] IUnknown:Release (This=0x13a6490) returned 0x1 [0122.805] IUnknown:Release (This=0x1360110) returned 0x2 [0122.805] CoGetContextToken (in: pToken=0x118e438 | out: pToken=0x118e438) returned 0x0 [0122.805] CoGetContextToken (in: pToken=0x118e3f8 | out: pToken=0x118e3f8) returned 0x0 [0122.805] IUnknown:AddRef (This=0x13a6490) returned 0x2 [0122.806] IUnknown:QueryInterface (in: This=0x13a6490, riid=0x118e474*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e470 | out: ppvObject=0x118e470*=0x13a6490) returned 0x0 [0122.806] IUnknown:Release (This=0x13a6490) returned 0x2 [0122.806] IUnknown:AddRef (This=0x13a6490) returned 0x3 [0122.806] BindMoniker (in: pmk=0x13a6490, grfOpt=0x0, iidResult=0x335494c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x118e848 | out: ppvResult=0x118e848*=0x13aeeb8) returned 0x0 [0122.806] IUnknown:QueryInterface (in: This=0x13aeeb8, riid=0x335494c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e848 | out: ppvObject=0x118e848*=0x13aeeb8) returned 0x0 [0122.807] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x118df64*=0x0 | out: pptlib=0x118df64*=0x13983f8) returned 0x0 [0122.808] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x13aeefc*(Data1=0x62e522dc, Data2=0x8cf3, Data3=0x40a8, Data4=([0]=0x8b, [1]=0x2e, [2]=0x37, [3]=0xd5, [4]=0x95, [5]=0x65, [6]=0x1e, [7]=0x40)), ppTInfo=0x13aeee4 | out: ppTInfo=0x13aeee4*=0x13acc7c) returned 0x0 [0122.808] IUnknown:Release (This=0x13983f8) returned 0x6 [0122.808] IUnknown:AddRef (This=0x13acc7c) returned 0x3 [0122.808] ITypeInfo:RemoteGetTypeAttr (in: This=0x13acc7c, ppTypeAttr=0x118dfb4, pDummy=0x42e92439 | out: ppTypeAttr=0x118dfb4, pDummy=0x42e92439) returned 0x0 [0122.809] ITypeInfo:LocalReleaseTypeAttr (This=0x13acc7c) returned 0x0 [0122.809] IUnknown:Release (This=0x13acc7c) returned 0x2 [0122.809] CoGetContextToken (in: pToken=0x118df40 | out: pToken=0x118df40) returned 0x0 [0122.809] CoGetContextToken (in: pToken=0x118df04 | out: pToken=0x118df04) returned 0x0 [0122.809] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df38 | out: ppvObject=0x118df38*=0x1332d0c) returned 0x0 [0122.809] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118df68 | out: pAptType=0x118df68*=3) returned 0x0 [0122.809] IUnknown:Release (This=0x1332d0c) returned 0x1 [0122.810] CoGetContextToken (in: pToken=0x118df38 | out: pToken=0x118df38) returned 0x0 [0122.810] IUnknown:Release (This=0x13a6490) returned 0x2 [0122.810] CoGetContextToken (in: pToken=0x118e488 | out: pToken=0x118e488) returned 0x0 [0122.811] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x118e458*=0x0 | out: pptlib=0x118e458*=0x13983f8) returned 0x0 [0122.812] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x13aeeec*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x13aeee0 | out: ppTInfo=0x13aeee0*=0x13acca8) returned 0x0 [0122.812] IUnknown:Release (This=0x13983f8) returned 0x6 [0122.812] IUnknown:AddRef (This=0x13acca8) returned 0x3 [0122.812] DispGetIDsOfNames (in: ptinfo=0x13acca8, rgszNames=0x118e4e0*="ExecQuery", cNames=0x1, rgdispid=0x118e4d0 | out: rgdispid=0x118e4d0*=9) returned 0x0 [0122.812] IUnknown:Release (This=0x13acca8) returned 0x2 [0122.813] IUnknown:AddRef (This=0x13acca8) returned 0x3 [0122.813] ITypeInfo:LocalInvoke (This=0x13acca8) returned 0x0 [0122.813] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.813] GetCurrentThreadId () returned 0xecc [0122.813] IUnknown:AddRef (This=0x1384480) returned 0x3 [0122.813] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.813] GetCurrentThreadId () returned 0xecc [0122.813] IWbemServices:ExecQuery (in: This=0x1384480, strQueryLanguage="WQL", strQuery="Select * from AntiVirusProduct", lFlags=272, pCtx=0x0, ppEnum=0x118dc6c | out: ppEnum=0x118dc6c*=0x13aaf08) returned 0x0 [0122.826] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1396c30 [0122.826] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1396cf0 [0122.826] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1397110 [0122.826] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13880b8 [0122.826] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1379ba8 [0122.826] IUnknown:QueryInterface (in: This=0x13aaf08, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc60 | out: ppvObject=0x118dc60*=0x13aaf0c) returned 0x0 [0122.826] IClientSecurity:QueryBlanket (in: This=0x13aaf0c, pProxy=0x13aaf08, pAuthnSvc=0x118dc54, pAuthzSvc=0x118dc4c, pServerPrincName=0x0, pAuthnLevel=0x118dc68, pImpLevel=0x118dc78, pAuthInfo=0x0, pCapabilites=0x118dc44 | out: pAuthnSvc=0x118dc54*=0xa, pAuthzSvc=0x118dc4c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118dc68*=0x6, pImpLevel=0x118dc78*=0x2, pAuthInfo=0x0, pCapabilites=0x118dc44*=0x1) returned 0x0 [0122.826] IUnknown:Release (This=0x13aaf0c) returned 0x1 [0122.826] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.826] GetCurrentThreadId () returned 0xecc [0122.826] IUnknown:QueryInterface (in: This=0x1384480, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc0c | out: ppvObject=0x118dc0c*=0x138cfe4) returned 0x0 [0122.827] IClientSecurity:QueryBlanket (in: This=0x138cfe4, pProxy=0x1384480, pAuthnSvc=0x118dbf4, pAuthzSvc=0x118dbf8, pServerPrincName=0x0, pAuthnLevel=0x118dc04, pImpLevel=0x118dc08, pAuthInfo=0x0, pCapabilites=0x118dbfc | out: pAuthnSvc=0x118dbf4*=0xa, pAuthzSvc=0x118dbf8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118dc04*=0x6, pImpLevel=0x118dc08*=0x3, pAuthInfo=0x0, pCapabilites=0x118dbfc*=0x20) returned 0x0 [0122.827] IUnknown:Release (This=0x138cfe4) returned 0x3 [0122.827] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.827] GetCurrentThreadId () returned 0xecc [0122.827] IUnknown:QueryInterface (in: This=0x1384480, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc0c | out: ppvObject=0x118dc0c*=0x138cfe4) returned 0x0 [0122.827] IClientSecurity:QueryBlanket (in: This=0x138cfe4, pProxy=0x1384480, pAuthnSvc=0x118dbf4, pAuthzSvc=0x118dbf8, pServerPrincName=0x0, pAuthnLevel=0x118dc08, pImpLevel=0x118dc04, pAuthInfo=0x0, pCapabilites=0x118dbfc | out: pAuthnSvc=0x118dbf4*=0xa, pAuthzSvc=0x118dbf8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118dc08*=0x6, pImpLevel=0x118dc04*=0x3, pAuthInfo=0x0, pCapabilites=0x118dbfc*=0x20) returned 0x0 [0122.827] IUnknown:Release (This=0x138cfe4) returned 0x3 [0122.827] IUnknown:QueryInterface (in: This=0x13aaf08, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dcac | out: ppvObject=0x118dcac*=0x13aaf0c) returned 0x0 [0122.827] IClientSecurity:CopyProxy (in: This=0x13aaf0c, pProxy=0x13aaf08, ppCopy=0x118dcc4 | out: ppCopy=0x118dcc4*=0x13aafd0) returned 0x0 [0122.827] IUnknown:QueryInterface (in: This=0x13aafd0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118db94 | out: ppvObject=0x118db94*=0x13aafd4) returned 0x0 [0122.827] IClientSecurity:QueryBlanket (in: This=0x13aafd4, pProxy=0x13aafd0, pAuthnSvc=0x118dbc4, pAuthzSvc=0x118dbc0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x118dbc4*=0xa, pAuthzSvc=0x118dbc0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0122.827] IUnknown:Release (This=0x13aafd4) returned 0x3 [0122.827] IUnknown:QueryInterface (in: This=0x13aafd0, riid=0x71661f78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118db78 | out: ppvObject=0x118db78*=0x138d108) returned 0x0 [0122.828] IUnknown:QueryInterface (in: This=0x13aafd0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118db7c | out: ppvObject=0x118db7c*=0x13aafd4) returned 0x0 [0122.828] IClientSecurity:SetBlanket (This=0x13aafd4, pProxy=0x13aafd0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0122.829] IUnknown:Release (This=0x13aafd4) returned 0x4 [0122.829] IUnknown:Release (This=0x138d108) returned 0x3 [0122.829] IUnknown:Release (This=0x13aaf0c) returned 0x2 [0122.829] IUnknown:AddRef (This=0x13aafd0) returned 0x3 [0122.829] IUnknown:Release (This=0x13aaf08) returned 0x2 [0122.829] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x118dc10 | out: pperrinfo=0x118dc10*=0x0) returned 0x1 [0122.830] IUnknown:Release (This=0x1384480) returned 0x2 [0122.830] IUnknown:Release (This=0x13acca8) returned 0x2 [0122.830] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x118dd74*=0x0 | out: pptlib=0x118dd74*=0x13983f8) returned 0x0 [0122.831] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x1396c68*(Data1=0x4b83d61, Data2=0x21ae, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x33, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x1396c50 | out: ppTInfo=0x1396c50*=0x13acdb0) returned 0x0 [0122.831] IUnknown:Release (This=0x13983f8) returned 0x6 [0122.831] IUnknown:AddRef (This=0x13acdb0) returned 0x3 [0122.831] ITypeInfo:RemoteGetTypeAttr (in: This=0x13acdb0, ppTypeAttr=0x118ddc4, pDummy=0x42e92629 | out: ppTypeAttr=0x118ddc4, pDummy=0x42e92629) returned 0x0 [0122.832] ITypeInfo:LocalReleaseTypeAttr (This=0x13acdb0) returned 0x0 [0122.832] IUnknown:Release (This=0x13acdb0) returned 0x2 [0122.832] CoGetContextToken (in: pToken=0x118dd50 | out: pToken=0x118dd50) returned 0x0 [0122.832] CoGetContextToken (in: pToken=0x118dd14 | out: pToken=0x118dd14) returned 0x0 [0122.832] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dd48 | out: ppvObject=0x118dd48*=0x1332d0c) returned 0x0 [0122.832] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118dd78 | out: pAptType=0x118dd78*=3) returned 0x0 [0122.832] IUnknown:Release (This=0x1332d0c) returned 0x1 [0122.833] CoGetContextToken (in: pToken=0x118dd48 | out: pToken=0x118dd48) returned 0x0 [0122.833] CoGetContextToken (in: pToken=0x118e700 | out: pToken=0x118e700) returned 0x0 [0122.833] CoGetContextToken (in: pToken=0x118e6c0 | out: pToken=0x118e6c0) returned 0x0 [0122.834] CoGetContextToken (in: pToken=0x118e748 | out: pToken=0x118e748) returned 0x0 [0122.834] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x118e71c*=0x0 | out: pptlib=0x118e71c*=0x13983f8) returned 0x0 [0122.835] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x1396c58*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x1396c4c | out: ppTInfo=0x1396c4c*=0x13acd58) returned 0x0 [0122.835] IUnknown:Release (This=0x13983f8) returned 0x6 [0122.835] IUnknown:AddRef (This=0x13acd58) returned 0x3 [0122.835] ITypeInfo:LocalInvoke (This=0x13acd58) returned 0x0 [0122.835] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.836] GetCurrentThreadId () returned 0xecc [0122.836] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1391a38 [0122.836] IUnknown:Release (This=0x13acd58) returned 0x2 [0122.836] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.836] CoGetContextToken (in: pToken=0x118e608 | out: pToken=0x118e608) returned 0x0 [0122.837] CoGetContextToken (in: pToken=0x118e238 | out: pToken=0x118e238) returned 0x0 [0122.837] IUnknown:AddRef (This=0x13acd58) returned 0x3 [0122.837] ITypeInfo:LocalInvoke (This=0x13acd58) returned 0x0 [0122.837] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.837] GetCurrentThreadId () returned 0xecc [0122.837] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.837] GetCurrentThreadId () returned 0xecc [0122.837] IUnknown:AddRef (This=0x13aafd0) returned 0x3 [0122.837] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.837] GetCurrentThreadId () returned 0xecc [0122.837] IEnumWbemClassObject:Clone (in: This=0x13aafd0, ppEnum=0x118dfe4 | out: ppEnum=0x118dfe4*=0x13ab228) returned 0x0 [0122.838] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1397350 [0122.838] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13973b0 [0122.838] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1396ab0 [0122.839] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1388118 [0122.839] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1379dd0 [0122.839] IUnknown:QueryInterface (in: This=0x13ab228, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de90 | out: ppvObject=0x118de90*=0x13ab22c) returned 0x0 [0122.839] IClientSecurity:QueryBlanket (in: This=0x13ab22c, pProxy=0x13ab228, pAuthnSvc=0x118de7c, pAuthzSvc=0x118de84, pServerPrincName=0x0, pAuthnLevel=0x118deb8, pImpLevel=0x118debc, pAuthInfo=0x0, pCapabilites=0x118de80 | out: pAuthnSvc=0x118de7c*=0xa, pAuthzSvc=0x118de84*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118deb8*=0x6, pImpLevel=0x118debc*=0x2, pAuthInfo=0x0, pCapabilites=0x118de80*=0x1) returned 0x0 [0122.839] IUnknown:Release (This=0x13ab22c) returned 0x1 [0122.839] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.839] GetCurrentThreadId () returned 0xecc [0122.839] IUnknown:QueryInterface (in: This=0x13aafd0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de80 | out: ppvObject=0x118de80*=0x13aafd4) returned 0x0 [0122.839] IClientSecurity:QueryBlanket (in: This=0x13aafd4, pProxy=0x13aafd0, pAuthnSvc=0x118de68, pAuthzSvc=0x118de6c, pServerPrincName=0x0, pAuthnLevel=0x118de78, pImpLevel=0x118de7c, pAuthInfo=0x0, pCapabilites=0x118de70 | out: pAuthnSvc=0x118de68*=0xa, pAuthzSvc=0x118de6c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118de78*=0x6, pImpLevel=0x118de7c*=0x3, pAuthInfo=0x0, pCapabilites=0x118de70*=0x20) returned 0x0 [0122.839] IUnknown:Release (This=0x13aafd4) returned 0x3 [0122.839] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.839] GetCurrentThreadId () returned 0xecc [0122.839] IUnknown:QueryInterface (in: This=0x13aafd0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de80 | out: ppvObject=0x118de80*=0x13aafd4) returned 0x0 [0122.840] IClientSecurity:QueryBlanket (in: This=0x13aafd4, pProxy=0x13aafd0, pAuthnSvc=0x118de68, pAuthzSvc=0x118de6c, pServerPrincName=0x0, pAuthnLevel=0x118de7c, pImpLevel=0x118de78, pAuthInfo=0x0, pCapabilites=0x118de70 | out: pAuthnSvc=0x118de68*=0xa, pAuthzSvc=0x118de6c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118de7c*=0x6, pImpLevel=0x118de78*=0x3, pAuthInfo=0x0, pCapabilites=0x118de70*=0x20) returned 0x0 [0122.840] IUnknown:Release (This=0x13aafd4) returned 0x3 [0122.840] IUnknown:QueryInterface (in: This=0x13ab228, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118deb0 | out: ppvObject=0x118deb0*=0x13ab22c) returned 0x0 [0122.840] IClientSecurity:CopyProxy (in: This=0x13ab22c, pProxy=0x13ab228, ppCopy=0x118deb4 | out: ppCopy=0x118deb4*=0x13ab098) returned 0x0 [0122.840] IUnknown:QueryInterface (in: This=0x13ab098, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de08 | out: ppvObject=0x118de08*=0x13ab09c) returned 0x0 [0122.840] IClientSecurity:QueryBlanket (in: This=0x13ab09c, pProxy=0x13ab098, pAuthnSvc=0x118de38, pAuthzSvc=0x118de34, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x118de38*=0xa, pAuthzSvc=0x118de34*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0122.840] IUnknown:Release (This=0x13ab09c) returned 0x3 [0122.840] IUnknown:QueryInterface (in: This=0x13ab098, riid=0x71661f78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118ddec | out: ppvObject=0x118ddec*=0x138cf08) returned 0x0 [0122.840] IUnknown:QueryInterface (in: This=0x13ab098, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118ddf0 | out: ppvObject=0x118ddf0*=0x13ab09c) returned 0x0 [0122.840] IClientSecurity:SetBlanket (This=0x13ab09c, pProxy=0x13ab098, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0122.842] IUnknown:Release (This=0x13ab09c) returned 0x4 [0122.842] IUnknown:Release (This=0x138cf08) returned 0x3 [0122.842] IUnknown:Release (This=0x13ab22c) returned 0x2 [0122.843] IUnknown:AddRef (This=0x13ab098) returned 0x3 [0122.843] IUnknown:Release (This=0x13ab228) returned 0x2 [0122.843] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x118dfa4 | out: pperrinfo=0x118dfa4*=0x0) returned 0x1 [0122.843] IUnknown:Release (This=0x13aafd0) returned 0x2 [0122.843] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.843] GetCurrentThreadId () returned 0xecc [0122.843] IUnknown:AddRef (This=0x13ab098) returned 0x3 [0122.843] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.843] GetCurrentThreadId () returned 0xecc [0122.843] IEnumWbemClassObject:Reset (This=0x13ab098) returned 0x0 [0122.844] IUnknown:Release (This=0x13ab098) returned 0x2 [0122.844] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1391b70 [0122.844] IUnknown:Release (This=0x13acd58) returned 0x2 [0122.845] CoGetContextToken (in: pToken=0x118dca0 | out: pToken=0x118dca0) returned 0x0 [0122.845] CoGetContextToken (in: pToken=0x118dc64 | out: pToken=0x118dc64) returned 0x0 [0122.845] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc98 | out: ppvObject=0x118dc98*=0x1332d0c) returned 0x0 [0122.845] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118dcc8 | out: pAptType=0x118dcc8*=3) returned 0x0 [0122.845] IUnknown:Release (This=0x1332d0c) returned 0x1 [0122.845] CoGetContextToken (in: pToken=0x118dc98 | out: pToken=0x118dc98) returned 0x0 [0122.846] CoGetContextToken (in: pToken=0x118e748 | out: pToken=0x118e748) returned 0x0 [0122.846] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.846] GetCurrentThreadId () returned 0xecc [0122.846] IUnknown:AddRef (This=0x13ab098) returned 0x3 [0122.846] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.847] GetCurrentThreadId () returned 0xecc [0122.847] IEnumWbemClassObject:Next (in: This=0x13ab098, lTimeout=-1, uCount=0x1, apObjects=0x118e860, puReturned=0x118e840 | out: apObjects=0x118e860*=0x13b3538, puReturned=0x118e840*=0x1) returned 0x0 [0122.848] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x138f360 [0122.848] IUnknown:AddRef (This=0x13b3538) returned 0x2 [0122.848] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13ae898 [0122.848] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13975f0 [0122.848] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1397530 [0122.848] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1388038 [0122.848] IUnknown:AddRef (This=0x1384480) returned 0x3 [0122.848] IUnknown:AddRef (This=0x13ab098) returned 0x4 [0122.848] IUnknown:QueryInterface (in: This=0x13ab098, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e88c | out: ppvObject=0x118e88c*=0x13ab09c) returned 0x0 [0122.848] IClientSecurity:QueryBlanket (in: This=0x13ab09c, pProxy=0x13ab098, pAuthnSvc=0x118e810, pAuthzSvc=0x118e818, pServerPrincName=0x0, pAuthnLevel=0x118e83c, pImpLevel=0x118e848, pAuthInfo=0x0, pCapabilites=0x118e80c | out: pAuthnSvc=0x118e810*=0xa, pAuthzSvc=0x118e818*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118e83c*=0x6, pImpLevel=0x118e848*=0x3, pAuthInfo=0x0, pCapabilites=0x118e80c*=0x20) returned 0x0 [0122.848] IUnknown:Release (This=0x13ab09c) returned 0x4 [0122.848] IUnknown:Release (This=0x1384480) returned 0x2 [0122.848] IUnknown:AddRef (This=0x1384480) returned 0x3 [0122.848] IUnknown:Release (This=0x13ab098) returned 0x3 [0122.849] SysStringLen (param_1="\\\\.\\root\\SecurityCenter2") returned 0x18 [0122.849] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13af9f0 [0122.849] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387db8 [0122.849] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13a65a8 [0122.849] IUnknown:AddRef (This=0x13b3538) returned 0x3 [0122.849] IUnknown:Release (This=0x13b3538) returned 0x2 [0122.849] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x118e7d8 | out: pperrinfo=0x118e7d8*=0x0) returned 0x1 [0122.849] IUnknown:Release (This=0x13ab098) returned 0x2 [0122.849] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x118e890 | out: pperrinfo=0x118e890*=0x0) returned 0x1 [0122.851] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x118e0ec*=0x0 | out: pptlib=0x118e0ec*=0x13983f8) returned 0x0 [0122.852] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x71664c10*(Data1=0xd6bdafb2, Data2=0x9435, Data3=0x491f, Data4=([0]=0xbb, [1]=0x87, [2]=0x6a, [3]=0xa0, [4]=0xf0, [5]=0xbc, [6]=0x31, [7]=0xa2)), ppTInfo=0x13afa0c | out: ppTInfo=0x13afa0c*=0x13acddc) returned 0x0 [0122.852] IUnknown:Release (This=0x13983f8) returned 0x6 [0122.852] IUnknown:AddRef (This=0x13acddc) returned 0x3 [0122.852] ITypeInfo:RemoteGetTypeAttr (in: This=0x13acddc, ppTypeAttr=0x118e13c, pDummy=0x42e91ab1 | out: ppTypeAttr=0x118e13c, pDummy=0x42e91ab1) returned 0x0 [0122.852] ITypeInfo:LocalReleaseTypeAttr (This=0x13acddc) returned 0x0 [0122.852] IUnknown:Release (This=0x13acddc) returned 0x2 [0122.853] CoGetContextToken (in: pToken=0x118e0c8 | out: pToken=0x118e0c8) returned 0x0 [0122.853] CoGetContextToken (in: pToken=0x118e08c | out: pToken=0x118e08c) returned 0x0 [0122.853] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e0c0 | out: ppvObject=0x118e0c0*=0x1332d0c) returned 0x0 [0122.853] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118e0f0 | out: pAptType=0x118e0f0*=3) returned 0x0 [0122.853] IUnknown:Release (This=0x1332d0c) returned 0x1 [0122.853] CoGetContextToken (in: pToken=0x118e0c0 | out: pToken=0x118e0c0) returned 0x0 [0122.854] CoGetContextToken (in: pToken=0x118e4a4 | out: pToken=0x118e4a4) returned 0x0 [0122.854] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x118e478*=0x0 | out: pptlib=0x118e478*=0x13983f8) returned 0x0 [0122.856] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x71661f38*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x13afa08 | out: ppTInfo=0x13afa08*=0x13ace08) returned 0x0 [0122.856] IUnknown:Release (This=0x13983f8) returned 0x6 [0122.856] IUnknown:AddRef (This=0x13ace08) returned 0x3 [0122.856] DispGetIDsOfNames (in: ptinfo=0x13ace08, rgszNames=0x118e500*="displayname", cNames=0x1, rgdispid=0x118e4f0 | out: rgdispid=0x118e4f0*=-1) returned 0x80020006 [0122.856] IUnknown:AddRef (This=0x13b3538) returned 0x3 [0122.856] IWbemClassObject:Get (in: This=0x13b3538, wszName="displayname", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x118e448*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x118e448*=0) returned 0x0 [0122.856] IUnknown:Release (This=0x13b3538) returned 0x2 [0122.856] SysStringLen (param_1="displayname") returned 0xb [0122.856] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13a6300 [0122.856] SysStringLen (param_1="displayname") returned 0xb [0122.856] IUnknown:Release (This=0x13ace08) returned 0x2 [0122.857] IUnknown:AddRef (This=0x13ace08) returned 0x3 [0122.857] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.857] GetCurrentThreadId () returned 0xecc [0122.857] SysStringLen (param_1="displayname") returned 0xb [0122.857] IWbemClassObject:Get (in: This=0x13b3538, wszName="displayname", lFlags=0, pVal=0x118e288*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x118e280*=0, plFlavor=0x0 | out: pVal=0x118e288*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x118e280*=8, plFlavor=0x0) returned 0x0 [0122.857] IUnknown:Release (This=0x13ace08) returned 0x2 [0122.857] SysStringLen (param_1="Windows Defender") returned 0x10 [0122.879] CreateBindCtx (in: reserved=0x0, ppbc=0x118e884 | out: ppbc=0x118e884*=0x135fdd0) returned 0x0 [0122.880] IUnknown:QueryInterface (in: This=0x135fdd0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e12c | out: ppvObject=0x118e12c*=0x135fdd0) returned 0x0 [0122.880] IUnknown:QueryInterface (in: This=0x135fdd0, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118e0e8 | out: ppvObject=0x118e0e8*=0x0) returned 0x80004002 [0122.880] IUnknown:QueryInterface (in: This=0x135fdd0, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118dfdc | out: ppvObject=0x118dfdc*=0x0) returned 0x80004002 [0122.880] IUnknown:AddRef (This=0x135fdd0) returned 0x3 [0122.881] CoGetContextToken (in: pToken=0x118df74 | out: pToken=0x118df74) returned 0x0 [0122.881] CoGetContextToken (in: pToken=0x118df38 | out: pToken=0x118df38) returned 0x0 [0122.881] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df6c | out: ppvObject=0x118df6c*=0x1332d0c) returned 0x0 [0122.881] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118df9c | out: pAptType=0x118df9c*=3) returned 0x0 [0122.881] IUnknown:Release (This=0x1332d0c) returned 0x1 [0122.881] IUnknown:QueryInterface (in: This=0x135fdd0, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df5c | out: ppvObject=0x118df5c*=0x0) returned 0x80004002 [0122.881] CoGetContextToken (in: pToken=0x118df6c | out: pToken=0x118df6c) returned 0x0 [0122.881] IUnknown:AddRef (This=0x135fdd0) returned 0x4 [0122.882] IUnknown:QueryInterface (in: This=0x135fdd0, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dfe0 | out: ppvObject=0x118dfe0*=0x0) returned 0x80004002 [0122.882] IUnknown:Release (This=0x135fdd0) returned 0x3 [0122.882] IUnknown:Release (This=0x135fdd0) returned 0x2 [0122.882] CoGetContextToken (in: pToken=0x118e3e0 | out: pToken=0x118e3e0) returned 0x0 [0122.882] CoGetContextToken (in: pToken=0x118e3a0 | out: pToken=0x118e3a0) returned 0x0 [0122.882] IUnknown:AddRef (This=0x135fdd0) returned 0x3 [0122.882] IUnknown:QueryInterface (in: This=0x135fdd0, riid=0x118e41c*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e418 | out: ppvObject=0x118e418*=0x135fdd0) returned 0x0 [0122.882] IUnknown:Release (This=0x135fdd0) returned 0x3 [0122.883] IUnknown:Release (This=0x135fdd0) returned 0x2 [0122.883] IUnknown:Release (This=0x135fdd0) returned 0x1 [0122.883] CoGetContextToken (in: pToken=0x118e444 | out: pToken=0x118e444) returned 0x0 [0122.883] CoGetContextToken (in: pToken=0x118e404 | out: pToken=0x118e404) returned 0x0 [0122.883] IUnknown:AddRef (This=0x135fdd0) returned 0x2 [0122.883] IUnknown:QueryInterface (in: This=0x135fdd0, riid=0x118e480*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e47c | out: ppvObject=0x118e47c*=0x135fdd0) returned 0x0 [0122.883] IUnknown:Release (This=0x135fdd0) returned 0x2 [0122.883] IUnknown:AddRef (This=0x135fdd0) returned 0x3 [0122.884] MkParseDisplayName (in: pbc=0x135fdd0, szUserName="winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\SecurityCenter", pchEaten=0x118e910, ppmk=0x118e854 | out: pchEaten=0x118e910, ppmk=0x118e854*=0x13a6558) returned 0x0 [0122.884] DllGetClassObject (in: rclsid=0x13826f8*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x774372dc*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x118e7c0 | out: ppv=0x118e7c0*=0x0) returned 0x80004002 [0122.884] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1391ba0 [0122.884] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.884] DllGetClassObject (in: rclsid=0x13826f8*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x770ac3c4*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x118e638 | out: ppv=0x118e638*=0x1391bd0) returned 0x0 [0122.884] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1391bd0 [0122.885] WinMGMTS:IClassFactory:CreateInstance (in: This=0x1391bd0, pUnkOuter=0x0, riid=0x774372dc*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e5e0 | out: ppvObject=0x118e5e0*=0x13b30e8) returned 0x0 [0122.885] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13b30e8 [0122.885] WinMGMTS:IUnknown:Release (This=0x1391bd0) returned 0x0 [0122.885] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.885] IParseDisplayName:ParseDisplayName (in: This=0x13b30e8, pbc=0x135fdd0, pszDisplayName="winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\SecurityCenter", pchEaten=0x118e7f8, ppmkOut=0x118e7f4 | out: pchEaten=0x118e7f8*=0x41, ppmkOut=0x118e7f4*=0x13a6558) returned 0x0 [0122.885] _wcsnicmp (_String1="winmgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0122.885] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387df8 [0122.885] _wcsnicmp (_String1="{", _String2="{", _MaxCount=0x1) returned 0 [0122.885] _wcsnicmp (_String1="impersonationLevel=", _String2="authenticationLevel", _MaxCount=0x13) returned 8 [0122.885] _wcsnicmp (_String1="impersonationLevel", _String2="impersonationLevel", _MaxCount=0x12) returned 0 [0122.885] _wcsnicmp (_String1="=", _String2="=", _MaxCount=0x1) returned 0 [0122.885] _wcsnicmp (_String1="impersona", _String2="anonymous", _MaxCount=0x9) returned 8 [0122.885] _wcsnicmp (_String1="imperson", _String2="identify", _MaxCount=0x8) returned 9 [0122.885] _wcsnicmp (_String1="impersonate", _String2="impersonate", _MaxCount=0xb) returned 0 [0122.885] _wcsnicmp (_String1="}", _String2="}", _MaxCount=0x1) returned 0 [0122.885] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1342c20 [0122.886] CoCreateInstance (in: rclsid=0x71661c98*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661c88*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x1342c38 | out: ppv=0x1342c38*=0x13b3118) returned 0x0 [0122.886] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1342cf0 [0122.886] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1397650 [0122.886] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387e38 [0122.886] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.886] GetCurrentThreadId () returned 0xecc [0122.886] _wcsnicmp (_String1="!", _String2="[", _MaxCount=0x1) returned -58 [0122.886] _wcsnicmp (_String1="!", _String2="!", _MaxCount=0x1) returned 0 [0122.886] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e6d0 | out: ppv=0x118e6d0*=0x13af238) returned 0x0 [0122.886] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e690 | out: ppv=0x118e690*=0x13aeba8) returned 0x0 [0122.886] IWbemPath:SetText (This=0x13aeba8, uMode=0x4, pszPath="\\\\.\\root\\SecurityCenter") returned 0x0 [0122.886] IUnknown:Release (This=0x13aeba8) returned 0x0 [0122.886] SysStringLen (param_1="\\\\.\\root\\SecurityCenter") returned 0x17 [0122.886] IWbemPath:SetText (This=0x13af238, uMode=0x4, pszPath="\\\\.\\root\\SecurityCenter") returned 0x0 [0122.886] IWbemPath:GetNamespaceCount (in: This=0x13af238, puCount=0x118e690 | out: puCount=0x118e690*=0x2) returned 0x0 [0122.887] IWbemPath:GetText (in: This=0x13af238, lFlags=16, puBuffLength=0x118e68c*=0x0, pszText=0x0 | out: puBuffLength=0x118e68c*=0x14, pszText=0x0) returned 0x0 [0122.887] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13adc28 [0122.887] IWbemPath:GetText (in: This=0x13af238, lFlags=16, puBuffLength=0x118e68c*=0x14, pszText="" | out: puBuffLength=0x118e68c*=0x14, pszText="root\\SecurityCenter") returned 0x0 [0122.887] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.887] IWbemPath:GetInfo (in: This=0x13af238, uRequestedInfo=0x0, puResponse=0x118e6b0 | out: puResponse=0x118e6b0*=0x24e01) returned 0x0 [0122.887] IWbemPath:GetInfo (in: This=0x13af238, uRequestedInfo=0x0, puResponse=0x118e6a8 | out: puResponse=0x118e6a8*=0x24e01) returned 0x0 [0122.887] IWbemPath:GetServer (in: This=0x13af238, puNameBufLength=0x118e68c*=0x0, pName=0x0 | out: puNameBufLength=0x118e68c*=0x2, pName=0x0) returned 0x0 [0122.887] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13b3068 [0122.887] IWbemPath:GetServer (in: This=0x13af238, puNameBufLength=0x118e68c*=0x2, pName="\n☀" | out: puNameBufLength=0x118e68c*=0x2, pName=".") returned 0x0 [0122.887] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.888] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.888] GetCurrentThreadId () returned 0xecc [0122.888] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e550 | out: ppv=0x118e550*=0x13ae908) returned 0x0 [0122.888] SysStringLen (param_1=".") returned 0x1 [0122.888] IWbemPath:SetServer (This=0x13ae908, Name=".") returned 0x0 [0122.888] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e53c | out: ppv=0x118e53c*=0x13af318) returned 0x0 [0122.888] CoCreateInstance (in: rclsid=0x71661d94*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x71661da4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x118e4fc | out: ppv=0x118e4fc*=0x13aeac8) returned 0x0 [0122.888] IWbemPath:SetText (This=0x13aeac8, uMode=0x4, pszPath="root\\SecurityCenter") returned 0x0 [0122.888] IUnknown:Release (This=0x13aeac8) returned 0x0 [0122.888] SysStringLen (param_1="root\\SecurityCenter") returned 0x13 [0122.888] IWbemPath:SetText (This=0x13af318, uMode=0xc, pszPath="root\\SecurityCenter") returned 0x0 [0122.888] IWbemPath:GetNamespaceCount (in: This=0x13af318, puCount=0x118e534 | out: puCount=0x118e534*=0x2) returned 0x0 [0122.888] IWbemPath:RemoveAllNamespaces (This=0x13ae908) returned 0x0 [0122.888] IWbemPath:GetNamespaceAt (in: This=0x13af318, uIndex=0x0, puNameBufLength=0x118e574*=0x0, pName=0x0 | out: puNameBufLength=0x118e574*=0x5, pName=0x0) returned 0x0 [0122.889] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1390c70 [0122.889] IWbemPath:GetNamespaceAt (in: This=0x13af318, uIndex=0x0, puNameBufLength=0x118e574*=0x5, pName="訬眊" | out: puNameBufLength=0x118e574*=0x5, pName="root") returned 0x0 [0122.889] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.889] IWbemPath:SetNamespaceAt (This=0x13ae908, uIndex=0x0, pszName="root") returned 0x0 [0122.889] IWbemPath:GetNamespaceAt (in: This=0x13af318, uIndex=0x1, puNameBufLength=0x118e574*=0x0, pName=0x0 | out: puNameBufLength=0x118e574*=0xf, pName=0x0) returned 0x0 [0122.889] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13a6648 [0122.889] IWbemPath:GetNamespaceAt (in: This=0x13af318, uIndex=0x1, puNameBufLength=0x118e574*=0xf, pName="" | out: puNameBufLength=0x118e574*=0xf, pName="SecurityCenter") returned 0x0 [0122.889] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.889] IWbemPath:SetNamespaceAt (This=0x13ae908, uIndex=0x1, pszName="SecurityCenter") returned 0x0 [0122.889] IUnknown:Release (This=0x13af318) returned 0x0 [0122.889] IWbemPath:GetText (in: This=0x13ae908, lFlags=4, puBuffLength=0x118e574*=0x0, pszText=0x0 | out: puBuffLength=0x118e574*=0x18, pszText=0x0) returned 0x0 [0122.889] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x135ff90 [0122.889] IWbemPath:GetText (in: This=0x13ae908, lFlags=4, puBuffLength=0x118e574*=0x18, pszText="" | out: puBuffLength=0x118e574*=0x18, pszText="\\\\.\\root\\SecurityCenter") returned 0x0 [0122.889] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.889] IUnknown:Release (This=0x13ae908) returned 0x0 [0122.889] IWbemLocator:ConnectServer (in: This=0x13b3118, strNetworkResource="\\\\.\\root\\SecurityCenter", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x118e5dc | out: ppNamespace=0x118e5dc*=0x13843e0) returned 0x0 [0122.898] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13af008 [0122.898] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13977d0 [0122.898] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1379478 [0122.898] IUnknown:QueryInterface (in: This=0x13843e0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e5cc | out: ppvObject=0x118e5cc*=0x138bae4) returned 0x0 [0122.898] IClientSecurity:QueryBlanket (in: This=0x138bae4, pProxy=0x13843e0, pAuthnSvc=0x118e5ac, pAuthzSvc=0x118e5b0, pServerPrincName=0x0, pAuthnLevel=0x118e5f0, pImpLevel=0x118e5e0, pAuthInfo=0x0, pCapabilites=0x118e5a8 | out: pAuthnSvc=0x118e5ac*=0xa, pAuthzSvc=0x118e5b0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118e5f0*=0x6, pImpLevel=0x118e5e0*=0x2, pAuthInfo=0x0, pCapabilites=0x118e5a8*=0x1) returned 0x0 [0122.898] IUnknown:Release (This=0x138bae4) returned 0x1 [0122.898] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.898] GetCurrentThreadId () returned 0xecc [0122.898] IUnknown:QueryInterface (in: This=0x13843e0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e614 | out: ppvObject=0x118e614*=0x138bae4) returned 0x0 [0122.899] IClientSecurity:CopyProxy (in: This=0x138bae4, pProxy=0x13843e0, ppCopy=0x118e62c | out: ppCopy=0x118e62c*=0x1383ee0) returned 0x0 [0122.899] IUnknown:QueryInterface (in: This=0x1383ee0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4f8 | out: ppvObject=0x118e4f8*=0x138bae4) returned 0x0 [0122.899] IClientSecurity:QueryBlanket (in: This=0x138bae4, pProxy=0x1383ee0, pAuthnSvc=0x118e528, pAuthzSvc=0x118e524, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x118e528*=0xa, pAuthzSvc=0x118e524*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0122.899] IUnknown:Release (This=0x138bae4) returned 0x3 [0122.899] IUnknown:QueryInterface (in: This=0x1383ee0, riid=0x71661f78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4dc | out: ppvObject=0x118e4dc*=0x138bb08) returned 0x0 [0122.899] IUnknown:QueryInterface (in: This=0x1383ee0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e4e0 | out: ppvObject=0x118e4e0*=0x138bae4) returned 0x0 [0122.899] IClientSecurity:SetBlanket (This=0x138bae4, pProxy=0x1383ee0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0122.899] IUnknown:Release (This=0x138bae4) returned 0x4 [0122.899] IUnknown:Release (This=0x138bb08) returned 0x3 [0122.899] IUnknown:Release (This=0x138bae4) returned 0x2 [0122.899] IUnknown:AddRef (This=0x1383ee0) returned 0x3 [0122.899] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x13976b0 [0122.899] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387e98 [0122.900] IUnknown:Release (This=0x13843e0) returned 0x2 [0122.900] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.900] GetCurrentThreadId () returned 0xecc [0122.900] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.900] GetCurrentThreadId () returned 0xecc [0122.900] IUnknown:QueryInterface (in: This=0x1383ee0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e664 | out: ppvObject=0x118e664*=0x138bae4) returned 0x0 [0122.900] IClientSecurity:QueryBlanket (in: This=0x138bae4, pProxy=0x1383ee0, pAuthnSvc=0x118e650, pAuthzSvc=0x118e654, pServerPrincName=0x0, pAuthnLevel=0x118e660, pImpLevel=0x118e65c, pAuthInfo=0x0, pCapabilites=0x118e658 | out: pAuthnSvc=0x118e650*=0xa, pAuthzSvc=0x118e654*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118e660*=0x6, pImpLevel=0x118e65c*=0x3, pAuthInfo=0x0, pCapabilites=0x118e658*=0x20) returned 0x0 [0122.900] IUnknown:Release (This=0x138bae4) returned 0x2 [0122.900] IWbemPath:GetInfo (in: This=0x13af238, uRequestedInfo=0x0, puResponse=0x118e6b0 | out: puResponse=0x118e6b0*=0x24e01) returned 0x0 [0122.900] IWbemPath:GetInfo (in: This=0x13af238, uRequestedInfo=0x0, puResponse=0x118e6e0 | out: puResponse=0x118e6e0*=0x24e01) returned 0x0 [0122.900] CreatePointerMoniker (in: punk=0x13af008, ppmk=0x118e7f4 | out: ppmk=0x118e7f4*=0x13a6558) returned 0x0 [0122.900] IUnknown:AddRef (This=0x13af008) returned 0x2 [0122.900] IUnknown:Release (This=0x13af238) returned 0x0 [0122.901] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.901] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.901] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.901] IUnknown:Release (This=0x13b3118) returned 0x0 [0122.901] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.901] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.901] IUnknown:Release (This=0x13b30e8) returned 0x0 [0122.901] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.901] IUnknown:QueryInterface (in: This=0x13a6558, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e104 | out: ppvObject=0x118e104*=0x13a6558) returned 0x0 [0122.902] IUnknown:QueryInterface (in: This=0x13a6558, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118e0c0 | out: ppvObject=0x118e0c0*=0x0) returned 0x80004002 [0122.902] IUnknown:QueryInterface (in: This=0x13a6558, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118dfb4 | out: ppvObject=0x118dfb4*=0x0) returned 0x80004002 [0122.902] IUnknown:AddRef (This=0x13a6558) returned 0x3 [0122.902] CoGetContextToken (in: pToken=0x118df4c | out: pToken=0x118df4c) returned 0x0 [0122.902] CoGetContextToken (in: pToken=0x118df10 | out: pToken=0x118df10) returned 0x0 [0122.902] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df44 | out: ppvObject=0x118df44*=0x1332d0c) returned 0x0 [0122.902] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118df74 | out: pAptType=0x118df74*=3) returned 0x0 [0122.902] IUnknown:Release (This=0x1332d0c) returned 0x1 [0122.902] IUnknown:QueryInterface (in: This=0x13a6558, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df34 | out: ppvObject=0x118df34*=0x13a656c) returned 0x0 [0122.903] IMarshal:GetUnmarshalClass (in: This=0x13a656c, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118df3c | out: pCid=0x118df3c*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0122.903] IUnknown:Release (This=0x13a656c) returned 0x3 [0122.903] CoGetContextToken (in: pToken=0x118df44 | out: pToken=0x118df44) returned 0x0 [0122.903] IUnknown:AddRef (This=0x13a6558) returned 0x4 [0122.903] IUnknown:QueryInterface (in: This=0x13a6558, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dfb8 | out: ppvObject=0x118dfb8*=0x0) returned 0x80004002 [0122.903] IUnknown:Release (This=0x13a6558) returned 0x3 [0122.903] IUnknown:Release (This=0x13a6558) returned 0x2 [0122.903] CoGetContextToken (in: pToken=0x118e3b8 | out: pToken=0x118e3b8) returned 0x0 [0122.903] CoGetContextToken (in: pToken=0x118e378 | out: pToken=0x118e378) returned 0x0 [0122.903] IUnknown:AddRef (This=0x13a6558) returned 0x3 [0122.903] IUnknown:QueryInterface (in: This=0x13a6558, riid=0x118e3f4*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e3f0 | out: ppvObject=0x118e3f0*=0x13a6558) returned 0x0 [0122.904] IUnknown:Release (This=0x13a6558) returned 0x3 [0122.904] IUnknown:Release (This=0x13a6558) returned 0x2 [0122.904] IUnknown:Release (This=0x13a6558) returned 0x1 [0122.904] IUnknown:Release (This=0x135fdd0) returned 0x2 [0122.904] CoGetContextToken (in: pToken=0x118e444 | out: pToken=0x118e444) returned 0x0 [0122.904] CoGetContextToken (in: pToken=0x118e404 | out: pToken=0x118e404) returned 0x0 [0122.904] IUnknown:AddRef (This=0x13a6558) returned 0x2 [0122.904] IUnknown:QueryInterface (in: This=0x13a6558, riid=0x118e480*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e47c | out: ppvObject=0x118e47c*=0x13a6558) returned 0x0 [0122.905] IUnknown:Release (This=0x13a6558) returned 0x2 [0122.905] IUnknown:AddRef (This=0x13a6558) returned 0x3 [0122.905] BindMoniker (in: pmk=0x13a6558, grfOpt=0x0, iidResult=0x335494c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x118e854 | out: ppvResult=0x118e854*=0x13af008) returned 0x0 [0122.905] IUnknown:QueryInterface (in: This=0x13af008, riid=0x335494c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e854 | out: ppvObject=0x118e854*=0x13af008) returned 0x0 [0122.905] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x118df70*=0x0 | out: pptlib=0x118df70*=0x13983f8) returned 0x0 [0122.907] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x13af04c*(Data1=0x62e522dc, Data2=0x8cf3, Data3=0x40a8, Data4=([0]=0x8b, [1]=0x2e, [2]=0x37, [3]=0xd5, [4]=0x95, [5]=0x65, [6]=0x1e, [7]=0x40)), ppTInfo=0x13af034 | out: ppTInfo=0x13af034*=0x13acc7c) returned 0x0 [0122.907] IUnknown:Release (This=0x13983f8) returned 0x6 [0122.907] IUnknown:AddRef (This=0x13acc7c) returned 0x4 [0122.907] ITypeInfo:RemoteGetTypeAttr (in: This=0x13acc7c, ppTypeAttr=0x118dfc0, pDummy=0x42e9242d | out: ppTypeAttr=0x118dfc0, pDummy=0x42e9242d) returned 0x0 [0122.907] ITypeInfo:LocalReleaseTypeAttr (This=0x13acc7c) returned 0x0 [0122.907] IUnknown:Release (This=0x13acc7c) returned 0x3 [0122.908] CoGetContextToken (in: pToken=0x118df4c | out: pToken=0x118df4c) returned 0x0 [0122.908] CoGetContextToken (in: pToken=0x118df10 | out: pToken=0x118df10) returned 0x0 [0122.908] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118df44 | out: ppvObject=0x118df44*=0x1332d0c) returned 0x0 [0122.908] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118df74 | out: pAptType=0x118df74*=3) returned 0x0 [0122.908] IUnknown:Release (This=0x1332d0c) returned 0x1 [0122.908] CoGetContextToken (in: pToken=0x118df44 | out: pToken=0x118df44) returned 0x0 [0122.909] IUnknown:Release (This=0x13a6558) returned 0x2 [0122.909] CoGetContextToken (in: pToken=0x118e498 | out: pToken=0x118e498) returned 0x0 [0122.909] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x118e468*=0x0 | out: pptlib=0x118e468*=0x13983f8) returned 0x0 [0122.911] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x13af03c*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x13af030 | out: ppTInfo=0x13af030*=0x13acca8) returned 0x0 [0122.911] IUnknown:Release (This=0x13983f8) returned 0x6 [0122.911] IUnknown:AddRef (This=0x13acca8) returned 0x4 [0122.911] DispGetIDsOfNames (in: ptinfo=0x13acca8, rgszNames=0x118e4f0*="ExecQuery", cNames=0x1, rgdispid=0x118e4e0 | out: rgdispid=0x118e4e0*=9) returned 0x0 [0122.911] IUnknown:Release (This=0x13acca8) returned 0x3 [0122.911] IUnknown:AddRef (This=0x13acca8) returned 0x4 [0122.911] ITypeInfo:LocalInvoke (This=0x13acca8) returned 0x0 [0122.911] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.912] GetCurrentThreadId () returned 0xecc [0122.912] IUnknown:AddRef (This=0x1383ee0) returned 0x3 [0122.912] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.912] GetCurrentThreadId () returned 0xecc [0122.912] IWbemServices:ExecQuery (in: This=0x1383ee0, strQueryLanguage="WQL", strQuery="SELECT * FROM FirewallProduct", lFlags=272, pCtx=0x0, ppEnum=0x118dc7c | out: ppEnum=0x118dc7c*=0x13aa738) returned 0x0 [0122.928] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1397590 [0122.928] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1397650 [0122.928] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1397710 [0122.929] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387df8 [0122.929] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1379308 [0122.929] IUnknown:QueryInterface (in: This=0x13aa738, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc70 | out: ppvObject=0x118dc70*=0x13aa73c) returned 0x0 [0122.929] IClientSecurity:QueryBlanket (in: This=0x13aa73c, pProxy=0x13aa738, pAuthnSvc=0x118dc64, pAuthzSvc=0x118dc5c, pServerPrincName=0x0, pAuthnLevel=0x118dc78, pImpLevel=0x118dc88, pAuthInfo=0x0, pCapabilites=0x118dc54 | out: pAuthnSvc=0x118dc64*=0xa, pAuthzSvc=0x118dc5c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118dc78*=0x6, pImpLevel=0x118dc88*=0x2, pAuthInfo=0x0, pCapabilites=0x118dc54*=0x1) returned 0x0 [0122.929] IUnknown:Release (This=0x13aa73c) returned 0x1 [0122.929] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.929] GetCurrentThreadId () returned 0xecc [0122.929] IUnknown:QueryInterface (in: This=0x1383ee0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc1c | out: ppvObject=0x118dc1c*=0x138bae4) returned 0x0 [0122.929] IClientSecurity:QueryBlanket (in: This=0x138bae4, pProxy=0x1383ee0, pAuthnSvc=0x118dc04, pAuthzSvc=0x118dc08, pServerPrincName=0x0, pAuthnLevel=0x118dc14, pImpLevel=0x118dc18, pAuthInfo=0x0, pCapabilites=0x118dc0c | out: pAuthnSvc=0x118dc04*=0xa, pAuthzSvc=0x118dc08*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118dc14*=0x6, pImpLevel=0x118dc18*=0x3, pAuthInfo=0x0, pCapabilites=0x118dc0c*=0x20) returned 0x0 [0122.929] IUnknown:Release (This=0x138bae4) returned 0x3 [0122.929] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.929] GetCurrentThreadId () returned 0xecc [0122.929] IUnknown:QueryInterface (in: This=0x1383ee0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc1c | out: ppvObject=0x118dc1c*=0x138bae4) returned 0x0 [0122.929] IClientSecurity:QueryBlanket (in: This=0x138bae4, pProxy=0x1383ee0, pAuthnSvc=0x118dc04, pAuthzSvc=0x118dc08, pServerPrincName=0x0, pAuthnLevel=0x118dc18, pImpLevel=0x118dc14, pAuthInfo=0x0, pCapabilites=0x118dc0c | out: pAuthnSvc=0x118dc04*=0xa, pAuthzSvc=0x118dc08*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118dc18*=0x6, pImpLevel=0x118dc14*=0x3, pAuthInfo=0x0, pCapabilites=0x118dc0c*=0x20) returned 0x0 [0122.930] IUnknown:Release (This=0x138bae4) returned 0x3 [0122.930] IUnknown:QueryInterface (in: This=0x13aa738, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dcbc | out: ppvObject=0x118dcbc*=0x13aa73c) returned 0x0 [0122.930] IClientSecurity:CopyProxy (in: This=0x13aa73c, pProxy=0x13aa738, ppCopy=0x118dcd4 | out: ppCopy=0x118dcd4*=0x13ab160) returned 0x0 [0122.930] IUnknown:QueryInterface (in: This=0x13ab160, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dba4 | out: ppvObject=0x118dba4*=0x13ab164) returned 0x0 [0122.930] IClientSecurity:QueryBlanket (in: This=0x13ab164, pProxy=0x13ab160, pAuthnSvc=0x118dbd4, pAuthzSvc=0x118dbd0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x118dbd4*=0xa, pAuthzSvc=0x118dbd0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0122.930] IUnknown:Release (This=0x13ab164) returned 0x3 [0122.930] IUnknown:QueryInterface (in: This=0x13ab160, riid=0x71661f78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118db88 | out: ppvObject=0x118db88*=0x138c808) returned 0x0 [0122.930] IUnknown:QueryInterface (in: This=0x13ab160, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118db8c | out: ppvObject=0x118db8c*=0x13ab164) returned 0x0 [0122.930] IClientSecurity:SetBlanket (This=0x13ab164, pProxy=0x13ab160, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0122.932] IUnknown:Release (This=0x13ab164) returned 0x4 [0122.932] IUnknown:Release (This=0x138c808) returned 0x3 [0122.932] IUnknown:Release (This=0x13aa73c) returned 0x2 [0122.932] IUnknown:AddRef (This=0x13ab160) returned 0x3 [0122.932] IUnknown:Release (This=0x13aa738) returned 0x2 [0122.932] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x118dc20 | out: pperrinfo=0x118dc20*=0x0) returned 0x1 [0122.932] IUnknown:Release (This=0x1383ee0) returned 0x2 [0122.933] IUnknown:Release (This=0x13acca8) returned 0x3 [0122.933] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x118dd84*=0x0 | out: pptlib=0x118dd84*=0x13983f8) returned 0x0 [0122.935] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x13975c8*(Data1=0x4b83d61, Data2=0x21ae, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x33, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x13975b0 | out: ppTInfo=0x13975b0*=0x13acdb0) returned 0x0 [0122.935] IUnknown:Release (This=0x13983f8) returned 0x6 [0122.935] IUnknown:AddRef (This=0x13acdb0) returned 0x4 [0122.936] ITypeInfo:RemoteGetTypeAttr (in: This=0x13acdb0, ppTypeAttr=0x118ddd4, pDummy=0x42e92619 | out: ppTypeAttr=0x118ddd4, pDummy=0x42e92619) returned 0x0 [0122.936] ITypeInfo:LocalReleaseTypeAttr (This=0x13acdb0) returned 0x0 [0122.936] IUnknown:Release (This=0x13acdb0) returned 0x3 [0122.936] CoGetContextToken (in: pToken=0x118dd60 | out: pToken=0x118dd60) returned 0x0 [0122.936] CoGetContextToken (in: pToken=0x118dd24 | out: pToken=0x118dd24) returned 0x0 [0122.936] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dd58 | out: ppvObject=0x118dd58*=0x1332d0c) returned 0x0 [0122.937] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118dd88 | out: pAptType=0x118dd88*=3) returned 0x0 [0122.937] IUnknown:Release (This=0x1332d0c) returned 0x1 [0122.937] CoGetContextToken (in: pToken=0x118dd58 | out: pToken=0x118dd58) returned 0x0 [0122.938] CoGetContextToken (in: pToken=0x118e70c | out: pToken=0x118e70c) returned 0x0 [0122.938] CoGetContextToken (in: pToken=0x118e6cc | out: pToken=0x118e6cc) returned 0x0 [0122.938] CoGetContextToken (in: pToken=0x118e754 | out: pToken=0x118e754) returned 0x0 [0122.939] LoadRegTypeLib (in: rguid=0x716620fc*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x118e728*=0x0 | out: pptlib=0x118e728*=0x13983f8) returned 0x0 [0122.940] ITypeLib:GetTypeInfoOfGuid (in: This=0x13983f8, GUID=0x13975b8*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x13975ac | out: ppTInfo=0x13975ac*=0x13acd58) returned 0x0 [0122.940] IUnknown:Release (This=0x13983f8) returned 0x6 [0122.940] IUnknown:AddRef (This=0x13acd58) returned 0x4 [0122.941] ITypeInfo:LocalInvoke (This=0x13acd58) returned 0x0 [0122.941] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.941] GetCurrentThreadId () returned 0xecc [0122.941] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1391ba0 [0122.941] IUnknown:Release (This=0x13acd58) returned 0x3 [0122.941] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0122.941] CoGetContextToken (in: pToken=0x118e614 | out: pToken=0x118e614) returned 0x0 [0122.942] CoGetContextToken (in: pToken=0x118e238 | out: pToken=0x118e238) returned 0x0 [0122.942] IUnknown:AddRef (This=0x13acd58) returned 0x4 [0122.942] ITypeInfo:LocalInvoke (This=0x13acd58) returned 0x0 [0122.942] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.942] GetCurrentThreadId () returned 0xecc [0122.942] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.942] GetCurrentThreadId () returned 0xecc [0122.942] IUnknown:AddRef (This=0x13ab160) returned 0x3 [0122.942] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.943] GetCurrentThreadId () returned 0xecc [0122.943] IEnumWbemClassObject:Clone (in: This=0x13ab160, ppEnum=0x118dfe4 | out: ppEnum=0x118dfe4*=0x13ab2f0) returned 0x0 [0122.945] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x138e1a8 [0122.945] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x138e4a8 [0122.945] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x138df68 [0122.945] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1387ed8 [0122.945] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1379980 [0122.946] IUnknown:QueryInterface (in: This=0x13ab2f0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de90 | out: ppvObject=0x118de90*=0x13ab2f4) returned 0x0 [0122.946] IClientSecurity:QueryBlanket (in: This=0x13ab2f4, pProxy=0x13ab2f0, pAuthnSvc=0x118de7c, pAuthzSvc=0x118de84, pServerPrincName=0x0, pAuthnLevel=0x118deb8, pImpLevel=0x118debc, pAuthInfo=0x0, pCapabilites=0x118de80 | out: pAuthnSvc=0x118de7c*=0xa, pAuthzSvc=0x118de84*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118deb8*=0x6, pImpLevel=0x118debc*=0x2, pAuthInfo=0x0, pCapabilites=0x118de80*=0x1) returned 0x0 [0122.946] IUnknown:Release (This=0x13ab2f4) returned 0x1 [0122.946] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.946] GetCurrentThreadId () returned 0xecc [0122.946] IUnknown:QueryInterface (in: This=0x13ab160, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de80 | out: ppvObject=0x118de80*=0x13ab164) returned 0x0 [0122.946] IClientSecurity:QueryBlanket (in: This=0x13ab164, pProxy=0x13ab160, pAuthnSvc=0x118de68, pAuthzSvc=0x118de6c, pServerPrincName=0x0, pAuthnLevel=0x118de78, pImpLevel=0x118de7c, pAuthInfo=0x0, pCapabilites=0x118de70 | out: pAuthnSvc=0x118de68*=0xa, pAuthzSvc=0x118de6c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118de78*=0x6, pImpLevel=0x118de7c*=0x3, pAuthInfo=0x0, pCapabilites=0x118de70*=0x20) returned 0x0 [0122.946] IUnknown:Release (This=0x13ab164) returned 0x3 [0122.946] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.946] GetCurrentThreadId () returned 0xecc [0122.946] IUnknown:QueryInterface (in: This=0x13ab160, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de80 | out: ppvObject=0x118de80*=0x13ab164) returned 0x0 [0122.947] IClientSecurity:QueryBlanket (in: This=0x13ab164, pProxy=0x13ab160, pAuthnSvc=0x118de68, pAuthzSvc=0x118de6c, pServerPrincName=0x0, pAuthnLevel=0x118de7c, pImpLevel=0x118de78, pAuthInfo=0x0, pCapabilites=0x118de70 | out: pAuthnSvc=0x118de68*=0xa, pAuthzSvc=0x118de6c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x118de7c*=0x6, pImpLevel=0x118de78*=0x3, pAuthInfo=0x0, pCapabilites=0x118de70*=0x20) returned 0x0 [0122.947] IUnknown:Release (This=0x13ab164) returned 0x3 [0122.947] IUnknown:QueryInterface (in: This=0x13ab2f0, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118deb0 | out: ppvObject=0x118deb0*=0x13ab2f4) returned 0x0 [0122.947] IClientSecurity:CopyProxy (in: This=0x13ab2f4, pProxy=0x13ab2f0, ppCopy=0x118deb4 | out: ppCopy=0x118deb4*=0x13ab3b8) returned 0x0 [0122.947] IUnknown:QueryInterface (in: This=0x13ab3b8, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118de08 | out: ppvObject=0x118de08*=0x13ab3bc) returned 0x0 [0122.947] IClientSecurity:QueryBlanket (in: This=0x13ab3bc, pProxy=0x13ab3b8, pAuthnSvc=0x118de38, pAuthzSvc=0x118de34, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x118de38*=0xa, pAuthzSvc=0x118de34*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0122.947] IUnknown:Release (This=0x13ab3bc) returned 0x3 [0122.947] IUnknown:QueryInterface (in: This=0x13ab3b8, riid=0x71661f78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118ddec | out: ppvObject=0x118ddec*=0x138c308) returned 0x0 [0122.947] IUnknown:QueryInterface (in: This=0x13ab3b8, riid=0x71661fb8*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118ddf0 | out: ppvObject=0x118ddf0*=0x13ab3bc) returned 0x0 [0122.947] IClientSecurity:SetBlanket (This=0x13ab3bc, pProxy=0x13ab3b8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0122.949] IUnknown:Release (This=0x13ab3bc) returned 0x4 [0122.949] IUnknown:Release (This=0x138c308) returned 0x3 [0122.949] IUnknown:Release (This=0x13ab2f4) returned 0x2 [0122.949] IUnknown:AddRef (This=0x13ab3b8) returned 0x3 [0122.949] IUnknown:Release (This=0x13ab2f0) returned 0x2 [0122.949] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x118dfa4 | out: pperrinfo=0x118dfa4*=0x0) returned 0x1 [0122.949] IUnknown:Release (This=0x13ab160) returned 0x2 [0122.950] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.950] GetCurrentThreadId () returned 0xecc [0122.950] IUnknown:AddRef (This=0x13ab3b8) returned 0x3 [0122.950] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.950] GetCurrentThreadId () returned 0xecc [0122.950] IEnumWbemClassObject:Reset (This=0x13ab3b8) returned 0x0 [0122.950] IUnknown:Release (This=0x13ab3b8) returned 0x2 [0122.950] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x1390d78 [0122.950] IUnknown:Release (This=0x13acd58) returned 0x3 [0122.951] CoGetContextToken (in: pToken=0x118dca0 | out: pToken=0x118dca0) returned 0x0 [0122.951] CoGetContextToken (in: pToken=0x118dc64 | out: pToken=0x118dc64) returned 0x0 [0122.951] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc98 | out: ppvObject=0x118dc98*=0x1332d0c) returned 0x0 [0122.951] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118dcc8 | out: pAptType=0x118dcc8*=3) returned 0x0 [0122.951] IUnknown:Release (This=0x1332d0c) returned 0x1 [0122.952] CoGetContextToken (in: pToken=0x118dc98 | out: pToken=0x118dc98) returned 0x0 [0122.952] CoGetContextToken (in: pToken=0x118e754 | out: pToken=0x118e754) returned 0x0 [0122.952] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.952] GetCurrentThreadId () returned 0xecc [0122.953] IUnknown:AddRef (This=0x13ab3b8) returned 0x3 [0122.953] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0122.953] GetCurrentThreadId () returned 0xecc [0122.953] IEnumWbemClassObject:Next (in: This=0x13ab3b8, lTimeout=-1, uCount=0x1, apObjects=0x118e86c, puReturned=0x118e84c | out: apObjects=0x118e86c*=0x0, puReturned=0x118e84c*=0x0) returned 0x1 [0122.954] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x118e7e4 | out: pperrinfo=0x118e7e4*=0x0) returned 0x1 [0122.954] IUnknown:Release (This=0x13ab3b8) returned 0x2 [0122.954] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x118e89c | out: pperrinfo=0x118e89c*=0x0) returned 0x1 [0122.972] GetCurrentProcess () returned 0xffffffff [0122.972] GetLastError () returned 0x3f0 [0122.973] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x118e8cc | out: TokenHandle=0x118e8cc*=0x514) returned 1 [0122.973] GetLastError () returned 0x3f0 [0122.974] GetTokenInformation (in: TokenHandle=0x514, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x118e924 | out: TokenInformation=0x0, ReturnLength=0x118e924) returned 0 [0122.974] GetLastError () returned 0x7a [0122.975] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x13b30c8 [0122.976] GetLastError () returned 0x7a [0122.976] GetTokenInformation (in: TokenHandle=0x514, TokenInformationClass=0x8, TokenInformation=0x13b30c8, TokenInformationLength=0x4, ReturnLength=0x118e924 | out: TokenInformation=0x13b30c8, ReturnLength=0x118e924) returned 1 [0122.976] GetLastError () returned 0x7a [0122.977] DuplicateTokenEx (in: hExistingToken=0x514, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x118e8dc | out: phNewToken=0x118e8dc*=0x520) returned 1 [0122.977] GetLastError () returned 0x7a [0122.977] GetTokenInformation (in: TokenHandle=0x514, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x118e924 | out: TokenInformation=0x0, ReturnLength=0x118e924) returned 0 [0122.977] GetLastError () returned 0x7a [0122.977] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x13b3138 [0122.977] GetLastError () returned 0x7a [0122.977] GetTokenInformation (in: TokenHandle=0x514, TokenInformationClass=0x8, TokenInformation=0x13b3138, TokenInformationLength=0x4, ReturnLength=0x118e924 | out: TokenInformation=0x13b3138, ReturnLength=0x118e924) returned 1 [0122.977] GetLastError () returned 0x7a [0122.978] CheckTokenMembership (in: TokenHandle=0x520, SidToCheck=0x33717f4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x118e8b8 | out: IsMember=0x118e8b8) returned 1 [0122.978] GetLastError () returned 0x7a [0122.978] CloseHandle (hObject=0x520) returned 1 [0122.978] GetLastError () returned 0x7a [0122.978] GetTokenInformation (in: TokenHandle=0x514, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x118e924 | out: TokenInformation=0x0, ReturnLength=0x118e924) returned 0 [0122.978] GetLastError () returned 0x7a [0122.978] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x13b3158 [0122.979] GetLastError () returned 0x7a [0122.979] GetTokenInformation (in: TokenHandle=0x514, TokenInformationClass=0x8, TokenInformation=0x13b3158, TokenInformationLength=0x4, ReturnLength=0x118e924 | out: TokenInformation=0x13b3158, ReturnLength=0x118e924) returned 1 [0122.979] GetLastError () returned 0x7a [0122.979] DuplicateTokenEx (in: hExistingToken=0x514, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x118e8dc | out: phNewToken=0x118e8dc*=0x520) returned 1 [0122.979] GetLastError () returned 0x7a [0122.979] GetTokenInformation (in: TokenHandle=0x514, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x118e924 | out: TokenInformation=0x0, ReturnLength=0x118e924) returned 0 [0122.979] GetLastError () returned 0x7a [0122.979] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x13b2fb8 [0122.979] GetLastError () returned 0x7a [0122.979] GetTokenInformation (in: TokenHandle=0x514, TokenInformationClass=0x8, TokenInformation=0x13b2fb8, TokenInformationLength=0x4, ReturnLength=0x118e924 | out: TokenInformation=0x13b2fb8, ReturnLength=0x118e924) returned 1 [0122.979] GetLastError () returned 0x7a [0122.979] CheckTokenMembership (in: TokenHandle=0x520, SidToCheck=0x33718e4*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x118e8b8 | out: IsMember=0x118e8b8) returned 1 [0122.979] GetLastError () returned 0x7a [0122.979] CloseHandle (hObject=0x520) returned 1 [0122.980] GetLastError () returned 0x7a [0122.983] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x118e778 | out: pFixedInfo=0x0, pOutBufLen=0x118e778) returned 0x6f [0123.002] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x13a5550 [0123.002] GetLastError () returned 0x0 [0123.002] GetNetworkParams (in: pFixedInfo=0x13a5550, pOutBufLen=0x118e778 | out: pFixedInfo=0x13a5550, pOutBufLen=0x118e778) returned 0x0 [0123.009] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0123.009] GetLastError () returned 0x0 [0123.009] LocalFree (hMem=0x13a5550) returned 0x0 [0123.009] GetLastError () returned 0x0 [0123.009] GetAdaptersAddresses () returned 0x6f [0123.013] LocalAlloc (uFlags=0x0, uBytes=0xea4) returned 0x13be7e0 [0123.013] GetLastError () returned 0x0 [0123.013] GetAdaptersAddresses () returned 0x0 [0123.019] LocalFree (hMem=0x13be7e0) returned 0x0 [0123.019] GetLastError () returned 0x0 [0123.019] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x118e838 | out: AdapterInfo=0x0, SizePointer=0x118e838) returned 0x6f [0123.020] LocalAlloc (uFlags=0x0, uBytes=0x280) returned 0x13b4900 [0123.020] GetLastError () returned 0x0 [0123.020] GetAdaptersInfo (in: AdapterInfo=0x13b4900, SizePointer=0x118e838 | out: AdapterInfo=0x13b4900, SizePointer=0x118e838) returned 0x0 [0123.022] inet_addr (cp="192.168.0.96") returned 0x6000a8c0 [0123.022] GetLastError () returned 0x0 [0123.022] inet_addr (cp="255.255.255.0") returned 0xffffff [0123.022] GetLastError () returned 0x0 [0123.023] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0123.023] GetLastError () returned 0x0 [0123.023] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0123.023] GetLastError () returned 0x0 [0123.023] GetIfEntry (in: pIfRow=0x136fd10 | out: pIfRow=0x136fd10) returned 0x0 [0123.023] GetPerAdapterInfo (in: IfIndex=0x5, pPerAdapterInfo=0x0, pOutBufLen=0x118e5ac | out: pPerAdapterInfo=0x0, pOutBufLen=0x118e5ac) returned 0x6f [0123.028] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1343100 [0123.028] GetLastError () returned 0x0 [0123.028] GetPerAdapterInfo (in: IfIndex=0x5, pPerAdapterInfo=0x1343100, pOutBufLen=0x118e5ac | out: pPerAdapterInfo=0x1343100, pOutBufLen=0x118e5ac) returned 0x0 [0123.034] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0123.034] GetLastError () returned 0x0 [0123.034] LocalFree (hMem=0x1343100) returned 0x0 [0123.034] GetLastError () returned 0x0 [0123.034] LocalFree (hMem=0x13b4900) returned 0x0 [0123.034] GetLastError () returned 0x0 [0123.086] CoGetContextToken (in: pToken=0x118e71c | out: pToken=0x118e71c) returned 0x0 [0123.086] CoGetContextToken (in: pToken=0x118e6dc | out: pToken=0x118e6dc) returned 0x0 [0123.086] IUnknown:AddRef (This=0x1375100) returned 0x3 [0123.086] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e758*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e754 | out: ppvObject=0x118e754*=0x1375100) returned 0x0 [0123.086] IUnknown:Release (This=0x1375100) returned 0x3 [0123.086] IWbemPath:GetNamespaceCount (in: This=0x1375100, puCount=0x118e8d0 | out: puCount=0x118e8d0*=0x2) returned 0x0 [0123.086] IUnknown:Release (This=0x1375100) returned 0x2 [0123.086] CoGetContextToken (in: pToken=0x118e70c | out: pToken=0x118e70c) returned 0x0 [0123.086] CoGetContextToken (in: pToken=0x118e6cc | out: pToken=0x118e6cc) returned 0x0 [0123.086] IUnknown:AddRef (This=0x1375100) returned 0x3 [0123.086] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e748*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e744 | out: ppvObject=0x118e744*=0x1375100) returned 0x0 [0123.086] IUnknown:Release (This=0x1375100) returned 0x3 [0123.086] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e8cc*=0x0, pszText=0x0 | out: puBuffLength=0x118e8cc*=0xf, pszText=0x0) returned 0x0 [0123.087] IUnknown:Release (This=0x1375100) returned 0x2 [0123.087] CoGetContextToken (in: pToken=0x118e70c | out: pToken=0x118e70c) returned 0x0 [0123.087] CoGetContextToken (in: pToken=0x118e6cc | out: pToken=0x118e6cc) returned 0x0 [0123.087] IUnknown:AddRef (This=0x1375100) returned 0x3 [0123.087] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e748*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e744 | out: ppvObject=0x118e744*=0x1375100) returned 0x0 [0123.087] IUnknown:Release (This=0x1375100) returned 0x3 [0123.087] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e8cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x118e8cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.087] IUnknown:Release (This=0x1375100) returned 0x2 [0123.095] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x118e760*=0x53c, lpdwindex=0x118e5bc | out: lpdwindex=0x118e5bc) returned 0x0 [0123.110] CoGetContextToken (in: pToken=0x118e7ac | out: pToken=0x118e7ac) returned 0x0 [0123.110] CoGetContextToken (in: pToken=0x118e758 | out: pToken=0x118e758) returned 0x0 [0123.110] IUnknown:QueryInterface (in: This=0x1332db8, riid=0x73b4db1c*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e72c | out: ppvObject=0x118e72c*=0x1332dc8) returned 0x0 [0123.110] CObjectContext::ContextCallback () returned 0x0 [0123.111] IUnknown:Release (This=0x1332dc8) returned 0x1 [0123.111] CoUnmarshalInterface (in: pStm=0x13a6710, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x118e7b0 | out: ppv=0x118e7b0*=0x138bf08) returned 0x0 [0123.112] CoMarshalInterface (pStm=0x13a6710, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x138bf08, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0123.112] IUnknown:QueryInterface (in: This=0x138bf08, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e3d0 | out: ppvObject=0x118e3d0*=0x138bf08) returned 0x0 [0123.112] IUnknown:QueryInterface (in: This=0x138bf08, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118e38c | out: ppvObject=0x118e38c*=0x0) returned 0x80004002 [0123.112] IUnknown:QueryInterface (in: This=0x138bf08, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118e280 | out: ppvObject=0x118e280*=0x0) returned 0x80004002 [0123.113] IUnknown:AddRef (This=0x138bf08) returned 0x3 [0123.113] CoGetContextToken (in: pToken=0x118e218 | out: pToken=0x118e218) returned 0x0 [0123.113] CoGetContextToken (in: pToken=0x118e1dc | out: pToken=0x118e1dc) returned 0x0 [0123.113] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e210 | out: ppvObject=0x118e210*=0x1332d0c) returned 0x0 [0123.113] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118e240 | out: pAptType=0x118e240*=3) returned 0x0 [0123.113] IUnknown:Release (This=0x1332d0c) returned 0x1 [0123.113] IUnknown:QueryInterface (in: This=0x138bf08, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e200 | out: ppvObject=0x118e200*=0x138be64) returned 0x0 [0123.113] IMarshal:GetUnmarshalClass (in: This=0x138be64, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118e208 | out: pCid=0x118e208*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.113] IUnknown:Release (This=0x138be64) returned 0x3 [0123.114] CoGetContextToken (in: pToken=0x118e210 | out: pToken=0x118e210) returned 0x0 [0123.114] IUnknown:AddRef (This=0x138bf08) returned 0x4 [0123.114] IUnknown:QueryInterface (in: This=0x138bf08, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e284 | out: ppvObject=0x118e284*=0x138beec) returned 0x0 [0123.114] IUnknown:Release (This=0x138bf08) returned 0x4 [0123.114] IRpcOptions:Query (in: This=0x138beec, pPrx=0x138bf08, dwProperty=2, pdwValue=0x118e2a8 | out: pdwValue=0x118e2a8) returned 0x0 [0123.114] IUnknown:Release (This=0x138beec) returned 0x3 [0123.114] IUnknown:Release (This=0x138bf08) returned 0x2 [0123.114] IUnknown:Release (This=0x138bf08) returned 0x1 [0123.114] CoGetContextToken (in: pToken=0x118e26c | out: pToken=0x118e26c) returned 0x0 [0123.114] IUnknown:AddRef (This=0x138bf08) returned 0x2 [0123.114] IUnknown:QueryInterface (in: This=0x138bf08, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e510 | out: ppvObject=0x118e510*=0x138bee4) returned 0x0 [0123.114] IClientSecurity:QueryBlanket (in: This=0x138bee4, pProxy=0x138bf08, pAuthnSvc=0x118e558, pAuthzSvc=0x118e554, pServerPrincName=0x118e564, pAuthnLevel=0x118e55c, pImpLevel=0x118e548, pAuthInfo=0x118e54c, pCapabilites=0x118e550 | out: pAuthnSvc=0x118e558*=0xa, pAuthzSvc=0x118e554*=0x0, pServerPrincName=0x118e564, pAuthnLevel=0x118e55c*=0x6, pImpLevel=0x118e548*=0x2, pAuthInfo=0x118e54c, pCapabilites=0x118e550*=0x1) returned 0x0 [0123.115] IUnknown:Release (This=0x138bee4) returned 0x2 [0123.115] IUnknown:QueryInterface (in: This=0x138bf08, riid=0x74811250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e504 | out: ppvObject=0x118e504*=0x138bf08) returned 0x0 [0123.115] IUnknown:QueryInterface (in: This=0x138bf08, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e500 | out: ppvObject=0x118e500*=0x138bee4) returned 0x0 [0123.115] IClientSecurity:SetBlanket (This=0x138bee4, pProxy=0x138bf08, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0123.115] IUnknown:Release (This=0x138bee4) returned 0x3 [0123.115] IUnknown:Release (This=0x138bf08) returned 0x2 [0123.115] CoTaskMemFree (pv=0x13afc30) [0123.115] IUnknown:Release (This=0x138bf08) returned 0x1 [0123.115] SysStringLen (param_1=0x0) returned 0x0 [0123.115] GetLastError () returned 0x0 [0123.115] CoGetContextToken (in: pToken=0x118e68c | out: pToken=0x118e68c) returned 0x0 [0123.115] CoGetContextToken (in: pToken=0x118e64c | out: pToken=0x118e64c) returned 0x0 [0123.115] IUnknown:AddRef (This=0x138bf08) returned 0x2 [0123.116] IUnknown:QueryInterface (in: This=0x138bf08, riid=0x118e6c8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x118e6c4 | out: ppvObject=0x118e6c4*=0x1384660) returned 0x0 [0123.116] IUnknown:Release (This=0x138bf08) returned 0x2 [0123.116] IUnknown:Release (This=0x1384660) returned 0x1 [0123.116] CoGetContextToken (in: pToken=0x118e220 | out: pToken=0x118e220) returned 0x0 [0123.116] CoGetContextToken (in: pToken=0x118e1e0 | out: pToken=0x118e1e0) returned 0x0 [0123.116] IUnknown:AddRef (This=0x138bf08) returned 0x2 [0123.116] IUnknown:QueryInterface (in: This=0x138bf08, riid=0x118e25c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x118e258 | out: ppvObject=0x118e258*=0x1384660) returned 0x0 [0123.117] IUnknown:Release (This=0x138bf08) returned 0x2 [0123.117] IUnknown:AddRef (This=0x1384660) returned 0x3 [0123.117] IUnknown:QueryInterface (in: This=0x1384660, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e510 | out: ppvObject=0x118e510*=0x138bee4) returned 0x0 [0123.117] IClientSecurity:QueryBlanket (in: This=0x138bee4, pProxy=0x1384660, pAuthnSvc=0x118e558, pAuthzSvc=0x118e554, pServerPrincName=0x118e564, pAuthnLevel=0x118e55c, pImpLevel=0x118e548, pAuthInfo=0x118e54c, pCapabilites=0x118e550 | out: pAuthnSvc=0x118e558*=0xa, pAuthzSvc=0x118e554*=0x0, pServerPrincName=0x118e564, pAuthnLevel=0x118e55c*=0x6, pImpLevel=0x118e548*=0x2, pAuthInfo=0x118e54c, pCapabilites=0x118e550*=0x1) returned 0x0 [0123.117] IUnknown:Release (This=0x138bee4) returned 0x3 [0123.117] IUnknown:QueryInterface (in: This=0x1384660, riid=0x74811250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e504 | out: ppvObject=0x118e504*=0x138bf08) returned 0x0 [0123.117] IUnknown:QueryInterface (in: This=0x1384660, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e500 | out: ppvObject=0x118e500*=0x138bee4) returned 0x0 [0123.117] IClientSecurity:SetBlanket (This=0x138bee4, pProxy=0x1384660, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0123.117] IUnknown:Release (This=0x138bee4) returned 0x4 [0123.117] IUnknown:Release (This=0x138bf08) returned 0x3 [0123.117] CoTaskMemFree (pv=0x13afae0) [0123.117] IUnknown:Release (This=0x1384660) returned 0x2 [0123.118] SysStringLen (param_1=0x0) returned 0x0 [0123.118] GetLastError () returned 0x0 [0123.118] CoGetContextToken (in: pToken=0x118dfb0 | out: pToken=0x118dfb0) returned 0x0 [0123.118] IUnknown:AddRef (This=0x1384660) returned 0x3 [0123.118] IWbemServices:ExecQuery (in: This=0x1384660, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_VideoController", lFlags=16, pCtx=0x0, ppEnum=0x118e5f4 | out: ppEnum=0x118e5f4*=0x13aacb0) returned 0x0 [0123.121] IUnknown:QueryInterface (in: This=0x13aacb0, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e2a0 | out: ppvObject=0x118e2a0*=0x13aacb4) returned 0x0 [0123.121] IClientSecurity:QueryBlanket (in: This=0x13aacb4, pProxy=0x13aacb0, pAuthnSvc=0x118e2e8, pAuthzSvc=0x118e2e4, pServerPrincName=0x118e2f4, pAuthnLevel=0x118e2ec, pImpLevel=0x118e2d8, pAuthInfo=0x118e2dc, pCapabilites=0x118e2e0 | out: pAuthnSvc=0x118e2e8*=0xa, pAuthzSvc=0x118e2e4*=0x0, pServerPrincName=0x118e2f4, pAuthnLevel=0x118e2ec*=0x6, pImpLevel=0x118e2d8*=0x2, pAuthInfo=0x118e2dc, pCapabilites=0x118e2e0*=0x1) returned 0x0 [0123.121] IUnknown:Release (This=0x13aacb4) returned 0x1 [0123.121] IUnknown:QueryInterface (in: This=0x13aacb0, riid=0x74811250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e294 | out: ppvObject=0x118e294*=0x138c508) returned 0x0 [0123.121] IUnknown:QueryInterface (in: This=0x13aacb0, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e290 | out: ppvObject=0x118e290*=0x13aacb4) returned 0x0 [0123.121] IClientSecurity:SetBlanket (This=0x13aacb4, pProxy=0x13aacb0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0123.122] IUnknown:Release (This=0x13aacb4) returned 0x2 [0123.122] IUnknown:Release (This=0x138c508) returned 0x1 [0123.122] CoTaskMemFree (pv=0x13af9c0) [0123.123] IUnknown:Release (This=0x1384660) returned 0x2 [0123.123] IUnknown:QueryInterface (in: This=0x13aacb0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc4c | out: ppvObject=0x118dc4c*=0x138c508) returned 0x0 [0123.123] IUnknown:QueryInterface (in: This=0x138c508, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118dc08 | out: ppvObject=0x118dc08*=0x0) returned 0x80004002 [0123.123] IUnknown:QueryInterface (in: This=0x138c508, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118dafc | out: ppvObject=0x118dafc*=0x0) returned 0x80004002 [0123.124] IUnknown:AddRef (This=0x138c508) returned 0x3 [0123.124] CoGetContextToken (in: pToken=0x118da94 | out: pToken=0x118da94) returned 0x0 [0123.124] CoGetContextToken (in: pToken=0x118da58 | out: pToken=0x118da58) returned 0x0 [0123.124] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118da8c | out: ppvObject=0x118da8c*=0x1332d0c) returned 0x0 [0123.124] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118dabc | out: pAptType=0x118dabc*=3) returned 0x0 [0123.124] IUnknown:Release (This=0x1332d0c) returned 0x1 [0123.124] IUnknown:QueryInterface (in: This=0x138c508, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118da7c | out: ppvObject=0x118da7c*=0x138c464) returned 0x0 [0123.124] IMarshal:GetUnmarshalClass (in: This=0x138c464, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118da84 | out: pCid=0x118da84*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.124] IUnknown:Release (This=0x138c464) returned 0x3 [0123.124] CoGetContextToken (in: pToken=0x118da8c | out: pToken=0x118da8c) returned 0x0 [0123.124] IUnknown:AddRef (This=0x138c508) returned 0x4 [0123.125] IUnknown:QueryInterface (in: This=0x138c508, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118db00 | out: ppvObject=0x118db00*=0x138c4ec) returned 0x0 [0123.125] IUnknown:Release (This=0x138c508) returned 0x4 [0123.125] IRpcOptions:Query (in: This=0x138c4ec, pPrx=0x138c508, dwProperty=2, pdwValue=0x118db24 | out: pdwValue=0x118db24) returned 0x80004002 [0123.125] IUnknown:Release (This=0x138c4ec) returned 0x3 [0123.125] IUnknown:Release (This=0x138c508) returned 0x2 [0123.125] CoGetContextToken (in: pToken=0x118df00 | out: pToken=0x118df00) returned 0x0 [0123.125] CoGetContextToken (in: pToken=0x118dec0 | out: pToken=0x118dec0) returned 0x0 [0123.125] IUnknown:AddRef (This=0x138c508) returned 0x3 [0123.125] IUnknown:QueryInterface (in: This=0x138c508, riid=0x118df3c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x118df38 | out: ppvObject=0x118df38*=0x13aacb0) returned 0x0 [0123.125] IUnknown:Release (This=0x138c508) returned 0x3 [0123.125] IUnknown:Release (This=0x13aacb0) returned 0x2 [0123.125] IUnknown:Release (This=0x13aacb0) returned 0x1 [0123.125] SysStringLen (param_1=0x0) returned 0x0 [0123.125] GetLastError () returned 0x0 [0123.126] CoGetContextToken (in: pToken=0x118e6d8 | out: pToken=0x118e6d8) returned 0x0 [0123.126] CoGetContextToken (in: pToken=0x118e698 | out: pToken=0x118e698) returned 0x0 [0123.126] IUnknown:AddRef (This=0x1375100) returned 0x3 [0123.126] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e714*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e710 | out: ppvObject=0x118e710*=0x1375100) returned 0x0 [0123.126] IUnknown:Release (This=0x1375100) returned 0x3 [0123.126] IWbemPath:GetNamespaceCount (in: This=0x1375100, puCount=0x118e88c | out: puCount=0x118e88c*=0x2) returned 0x0 [0123.126] IUnknown:Release (This=0x1375100) returned 0x2 [0123.126] CoGetContextToken (in: pToken=0x118e6c8 | out: pToken=0x118e6c8) returned 0x0 [0123.126] CoGetContextToken (in: pToken=0x118e688 | out: pToken=0x118e688) returned 0x0 [0123.126] IUnknown:AddRef (This=0x1375100) returned 0x3 [0123.126] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e704*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e700 | out: ppvObject=0x118e700*=0x1375100) returned 0x0 [0123.126] IUnknown:Release (This=0x1375100) returned 0x3 [0123.126] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e888*=0x0, pszText=0x0 | out: puBuffLength=0x118e888*=0xf, pszText=0x0) returned 0x0 [0123.126] IUnknown:Release (This=0x1375100) returned 0x2 [0123.126] CoGetContextToken (in: pToken=0x118e6c8 | out: pToken=0x118e6c8) returned 0x0 [0123.126] CoGetContextToken (in: pToken=0x118e688 | out: pToken=0x118e688) returned 0x0 [0123.126] IUnknown:AddRef (This=0x1375100) returned 0x3 [0123.126] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e704*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e700 | out: ppvObject=0x118e700*=0x1375100) returned 0x0 [0123.127] IUnknown:Release (This=0x1375100) returned 0x3 [0123.127] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e888*=0xf, pszText="00000000000000" | out: puBuffLength=0x118e888*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.127] IUnknown:Release (This=0x1375100) returned 0x2 [0123.127] CoGetContextToken (in: pToken=0x118e228 | out: pToken=0x118e228) returned 0x0 [0123.127] CoGetContextToken (in: pToken=0x118e1e8 | out: pToken=0x118e1e8) returned 0x0 [0123.127] IUnknown:AddRef (This=0x138c508) returned 0x2 [0123.127] IUnknown:QueryInterface (in: This=0x138c508, riid=0x118e264*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x118e260 | out: ppvObject=0x118e260*=0x13aacb0) returned 0x0 [0123.127] IUnknown:Release (This=0x138c508) returned 0x2 [0123.127] IUnknown:AddRef (This=0x13aacb0) returned 0x3 [0123.127] IEnumWbemClassObject:Clone (in: This=0x13aacb0, ppEnum=0x118e85c | out: ppEnum=0x118e85c*=0x13aa4e0) returned 0x0 [0123.128] IUnknown:QueryInterface (in: This=0x13aa4e0, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e518 | out: ppvObject=0x118e518*=0x13aa4e4) returned 0x0 [0123.128] IClientSecurity:QueryBlanket (in: This=0x13aa4e4, pProxy=0x13aa4e0, pAuthnSvc=0x118e560, pAuthzSvc=0x118e55c, pServerPrincName=0x118e56c, pAuthnLevel=0x118e564, pImpLevel=0x118e550, pAuthInfo=0x118e554, pCapabilites=0x118e558 | out: pAuthnSvc=0x118e560*=0xa, pAuthzSvc=0x118e55c*=0x0, pServerPrincName=0x118e56c, pAuthnLevel=0x118e564*=0x6, pImpLevel=0x118e550*=0x2, pAuthInfo=0x118e554, pCapabilites=0x118e558*=0x1) returned 0x0 [0123.128] IUnknown:Release (This=0x13aa4e4) returned 0x1 [0123.128] IUnknown:QueryInterface (in: This=0x13aa4e0, riid=0x74811250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e50c | out: ppvObject=0x118e50c*=0x138c708) returned 0x0 [0123.128] IUnknown:QueryInterface (in: This=0x13aa4e0, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e508 | out: ppvObject=0x118e508*=0x13aa4e4) returned 0x0 [0123.128] IClientSecurity:SetBlanket (This=0x13aa4e4, pProxy=0x13aa4e0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0123.129] IUnknown:Release (This=0x13aa4e4) returned 0x2 [0123.129] IUnknown:Release (This=0x138c708) returned 0x1 [0123.129] CoTaskMemFree (pv=0x13afdb0) [0123.129] IUnknown:Release (This=0x13aacb0) returned 0x2 [0123.130] IUnknown:QueryInterface (in: This=0x13aa4e0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118deb4 | out: ppvObject=0x118deb4*=0x138c708) returned 0x0 [0123.130] IUnknown:QueryInterface (in: This=0x138c708, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118de70 | out: ppvObject=0x118de70*=0x0) returned 0x80004002 [0123.130] IUnknown:QueryInterface (in: This=0x138c708, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118dd64 | out: ppvObject=0x118dd64*=0x0) returned 0x80004002 [0123.130] IUnknown:AddRef (This=0x138c708) returned 0x3 [0123.130] CoGetContextToken (in: pToken=0x118dcfc | out: pToken=0x118dcfc) returned 0x0 [0123.131] CoGetContextToken (in: pToken=0x118dcc0 | out: pToken=0x118dcc0) returned 0x0 [0123.131] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dcf4 | out: ppvObject=0x118dcf4*=0x1332d0c) returned 0x0 [0123.136] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118dd24 | out: pAptType=0x118dd24*=3) returned 0x0 [0123.136] IUnknown:Release (This=0x1332d0c) returned 0x1 [0123.136] IUnknown:QueryInterface (in: This=0x138c708, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dce4 | out: ppvObject=0x118dce4*=0x138c664) returned 0x0 [0123.136] IMarshal:GetUnmarshalClass (in: This=0x138c664, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118dcec | out: pCid=0x118dcec*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.136] IUnknown:Release (This=0x138c664) returned 0x3 [0123.136] CoGetContextToken (in: pToken=0x118dcf4 | out: pToken=0x118dcf4) returned 0x0 [0123.136] IUnknown:AddRef (This=0x138c708) returned 0x4 [0123.136] IUnknown:QueryInterface (in: This=0x138c708, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dd68 | out: ppvObject=0x118dd68*=0x138c6ec) returned 0x0 [0123.136] IUnknown:Release (This=0x138c708) returned 0x4 [0123.137] IRpcOptions:Query (in: This=0x138c6ec, pPrx=0x138c708, dwProperty=2, pdwValue=0x118dd8c | out: pdwValue=0x118dd8c) returned 0x80004002 [0123.137] IUnknown:Release (This=0x138c6ec) returned 0x3 [0123.137] IUnknown:Release (This=0x138c708) returned 0x2 [0123.137] CoGetContextToken (in: pToken=0x118e168 | out: pToken=0x118e168) returned 0x0 [0123.137] CoGetContextToken (in: pToken=0x118e128 | out: pToken=0x118e128) returned 0x0 [0123.137] IUnknown:AddRef (This=0x138c708) returned 0x3 [0123.137] IUnknown:QueryInterface (in: This=0x138c708, riid=0x118e1a4*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x118e1a0 | out: ppvObject=0x118e1a0*=0x13aa4e0) returned 0x0 [0123.137] IUnknown:Release (This=0x138c708) returned 0x3 [0123.137] IUnknown:Release (This=0x13aa4e0) returned 0x2 [0123.137] IUnknown:Release (This=0x13aa4e0) returned 0x1 [0123.137] SysStringLen (param_1=0x0) returned 0x0 [0123.137] GetLastError () returned 0x0 [0123.137] CoGetContextToken (in: pToken=0x118e75c | out: pToken=0x118e75c) returned 0x0 [0123.137] CoGetContextToken (in: pToken=0x118e71c | out: pToken=0x118e71c) returned 0x0 [0123.137] IUnknown:AddRef (This=0x138c708) returned 0x2 [0123.137] IUnknown:QueryInterface (in: This=0x138c708, riid=0x118e798*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x118e794 | out: ppvObject=0x118e794*=0x13aa4e0) returned 0x0 [0123.138] IUnknown:Release (This=0x138c708) returned 0x2 [0123.138] IUnknown:AddRef (This=0x13aa4e0) returned 0x3 [0123.138] IEnumWbemClassObject:Reset (This=0x13aa4e0) returned 0x0 [0123.138] IUnknown:Release (This=0x13aa4e0) returned 0x2 [0123.138] CoGetContextToken (in: pToken=0x118e64c | out: pToken=0x118e64c) returned 0x0 [0123.138] IUnknown:AddRef (This=0x13aa4e0) returned 0x3 [0123.138] IEnumWbemClassObject:Next (in: This=0x13aa4e0, lTimeout=-1, uCount=0x1, apObjects=0x13381c0, puReturned=0x3375eac | out: apObjects=0x13381c0*=0x13c78c8, puReturned=0x3375eac*=0x1) returned 0x0 [0123.284] IUnknown:QueryInterface (in: This=0x13c78c8, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118dc58 | out: ppvObject=0x118dc58*=0x13c78c8) returned 0x0 [0123.285] IUnknown:QueryInterface (in: This=0x13c78c8, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118dc14 | out: ppvObject=0x118dc14*=0x0) returned 0x80004002 [0123.285] IUnknown:QueryInterface (in: This=0x13c78c8, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118db08 | out: ppvObject=0x118db08*=0x0) returned 0x80004002 [0123.285] IUnknown:AddRef (This=0x13c78c8) returned 0x3 [0123.285] CoGetContextToken (in: pToken=0x118daa0 | out: pToken=0x118daa0) returned 0x0 [0123.285] CoGetContextToken (in: pToken=0x118da64 | out: pToken=0x118da64) returned 0x0 [0123.285] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118da98 | out: ppvObject=0x118da98*=0x1332d0c) returned 0x0 [0123.285] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118dac8 | out: pAptType=0x118dac8*=3) returned 0x0 [0123.285] IUnknown:Release (This=0x1332d0c) returned 0x1 [0123.285] IUnknown:QueryInterface (in: This=0x13c78c8, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118da88 | out: ppvObject=0x118da88*=0x13c78cc) returned 0x0 [0123.285] IMarshal:GetUnmarshalClass (in: This=0x13c78cc, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x118da90 | out: pCid=0x118da90*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0123.285] IUnknown:Release (This=0x13c78cc) returned 0x3 [0123.286] CoGetContextToken (in: pToken=0x118da98 | out: pToken=0x118da98) returned 0x0 [0123.286] IUnknown:AddRef (This=0x13c78c8) returned 0x4 [0123.286] IUnknown:QueryInterface (in: This=0x13c78c8, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118db0c | out: ppvObject=0x118db0c*=0x0) returned 0x80004002 [0123.286] IUnknown:Release (This=0x13c78c8) returned 0x3 [0123.286] IUnknown:Release (This=0x13c78c8) returned 0x2 [0123.286] CoGetContextToken (in: pToken=0x118def8 | out: pToken=0x118def8) returned 0x0 [0123.286] CoGetContextToken (in: pToken=0x118deb8 | out: pToken=0x118deb8) returned 0x0 [0123.286] IUnknown:AddRef (This=0x13c78c8) returned 0x3 [0123.286] IUnknown:QueryInterface (in: This=0x13c78c8, riid=0x118df34*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x118df30 | out: ppvObject=0x118df30*=0x13c78c8) returned 0x0 [0123.286] IUnknown:Release (This=0x13c78c8) returned 0x3 [0123.286] IUnknown:Release (This=0x13c78c8) returned 0x2 [0123.286] IUnknown:Release (This=0x13c78c8) returned 0x1 [0123.287] IUnknown:Release (This=0x13aa4e0) returned 0x2 [0123.287] CoGetContextToken (in: pToken=0x118e7e0 | out: pToken=0x118e7e0) returned 0x0 [0123.287] IUnknown:AddRef (This=0x13c78c8) returned 0x2 [0123.287] IWbemClassObject:Get (in: This=0x13c78c8, wszName="__GENUS", lFlags=0, pVal=0x118e85c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x118e910*=0, plFlavor=0x118e90c*=0 | out: pVal=0x118e85c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x118e910*=3, plFlavor=0x118e90c*=64) returned 0x0 [0123.287] IWbemClassObject:Get (in: This=0x13c78c8, wszName="__PATH", lFlags=0, pVal=0x118e83c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x118e8f4*=0, plFlavor=0x118e8f0*=0 | out: pVal=0x118e83c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\LHNIWSJ\\root\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"", varVal2=0x0), pType=0x118e8f4*=8, plFlavor=0x118e8f0*=64) returned 0x0 [0123.287] SysStringLen (param_1="\\\\LHNIWSJ\\root\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x46 [0123.287] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x540 [0123.287] GetLastError () returned 0x0 [0123.287] SetEvent (hEvent=0x3cc) returned 1 [0123.288] GetLastError () returned 0x0 [0123.288] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x118e858*=0x540, lpdwindex=0x118e610 | out: lpdwindex=0x118e610) returned 0x0 [0123.290] CoGetContextToken (in: pToken=0x118e6a8 | out: pToken=0x118e6a8) returned 0x0 [0123.290] CoGetContextToken (in: pToken=0x118e668 | out: pToken=0x118e668) returned 0x0 [0123.290] IUnknown:AddRef (This=0x13aec18) returned 0x2 [0123.290] IUnknown:QueryInterface (in: This=0x13aec18, riid=0x118e6e4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e6e0 | out: ppvObject=0x118e6e0*=0x13aec18) returned 0x0 [0123.290] IUnknown:Release (This=0x13aec18) returned 0x2 [0123.290] IUnknown:Release (This=0x13aec18) returned 0x1 [0123.291] CoGetContextToken (in: pToken=0x118e728 | out: pToken=0x118e728) returned 0x0 [0123.291] CoGetContextToken (in: pToken=0x118e6e8 | out: pToken=0x118e6e8) returned 0x0 [0123.291] IUnknown:AddRef (This=0x13aec18) returned 0x2 [0123.291] IUnknown:QueryInterface (in: This=0x13aec18, riid=0x118e764*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e760 | out: ppvObject=0x118e760*=0x13aec18) returned 0x0 [0123.291] IUnknown:Release (This=0x13aec18) returned 0x2 [0123.291] IWbemPath:SetText (This=0x13aec18, uMode=0x4, pszPath="\\\\LHNIWSJ\\root\\cimv2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x0 [0123.291] IUnknown:Release (This=0x13aec18) returned 0x1 [0123.291] CoGetContextToken (in: pToken=0x118e714 | out: pToken=0x118e714) returned 0x0 [0123.291] CoGetContextToken (in: pToken=0x118e6d4 | out: pToken=0x118e6d4) returned 0x0 [0123.291] IUnknown:AddRef (This=0x1375100) returned 0x3 [0123.291] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e750*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e74c | out: ppvObject=0x118e74c*=0x1375100) returned 0x0 [0123.291] IUnknown:Release (This=0x1375100) returned 0x3 [0123.292] IWbemPath:GetNamespaceCount (in: This=0x1375100, puCount=0x118e8c8 | out: puCount=0x118e8c8*=0x2) returned 0x0 [0123.292] IUnknown:Release (This=0x1375100) returned 0x2 [0123.292] CoGetContextToken (in: pToken=0x118e704 | out: pToken=0x118e704) returned 0x0 [0123.292] CoGetContextToken (in: pToken=0x118e6c4 | out: pToken=0x118e6c4) returned 0x0 [0123.292] IUnknown:AddRef (This=0x1375100) returned 0x3 [0123.292] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e740*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e73c | out: ppvObject=0x118e73c*=0x1375100) returned 0x0 [0123.292] IUnknown:Release (This=0x1375100) returned 0x3 [0123.292] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e8c4*=0x0, pszText=0x0 | out: puBuffLength=0x118e8c4*=0xf, pszText=0x0) returned 0x0 [0123.292] IUnknown:Release (This=0x1375100) returned 0x2 [0123.292] CoGetContextToken (in: pToken=0x118e704 | out: pToken=0x118e704) returned 0x0 [0123.292] CoGetContextToken (in: pToken=0x118e6c4 | out: pToken=0x118e6c4) returned 0x0 [0123.292] IUnknown:AddRef (This=0x1375100) returned 0x3 [0123.292] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e740*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e73c | out: ppvObject=0x118e73c*=0x1375100) returned 0x0 [0123.292] IUnknown:Release (This=0x1375100) returned 0x3 [0123.292] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e8c4*=0xf, pszText="00000000000000" | out: puBuffLength=0x118e8c4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.293] IUnknown:Release (This=0x1375100) returned 0x2 [0123.293] CoGetContextToken (in: pToken=0x118e6ec | out: pToken=0x118e6ec) returned 0x0 [0123.293] CoGetContextToken (in: pToken=0x118e6ac | out: pToken=0x118e6ac) returned 0x0 [0123.293] IUnknown:AddRef (This=0x1375100) returned 0x3 [0123.293] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e728*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e724 | out: ppvObject=0x118e724*=0x1375100) returned 0x0 [0123.293] IUnknown:Release (This=0x1375100) returned 0x3 [0123.293] IWbemPath:GetNamespaceCount (in: This=0x1375100, puCount=0x118e8a0 | out: puCount=0x118e8a0*=0x2) returned 0x0 [0123.293] IUnknown:Release (This=0x1375100) returned 0x2 [0123.294] CoGetContextToken (in: pToken=0x118e6dc | out: pToken=0x118e6dc) returned 0x0 [0123.294] CoGetContextToken (in: pToken=0x118e69c | out: pToken=0x118e69c) returned 0x0 [0123.294] IUnknown:AddRef (This=0x1375100) returned 0x3 [0123.294] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e718*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e714 | out: ppvObject=0x118e714*=0x1375100) returned 0x0 [0123.294] IUnknown:Release (This=0x1375100) returned 0x3 [0123.294] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e89c*=0x0, pszText=0x0 | out: puBuffLength=0x118e89c*=0xf, pszText=0x0) returned 0x0 [0123.294] IUnknown:Release (This=0x1375100) returned 0x2 [0123.294] CoGetContextToken (in: pToken=0x118e6dc | out: pToken=0x118e6dc) returned 0x0 [0123.294] CoGetContextToken (in: pToken=0x118e69c | out: pToken=0x118e69c) returned 0x0 [0123.294] IUnknown:AddRef (This=0x1375100) returned 0x3 [0123.294] IUnknown:QueryInterface (in: This=0x1375100, riid=0x118e718*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e714 | out: ppvObject=0x118e714*=0x1375100) returned 0x0 [0123.294] IUnknown:Release (This=0x1375100) returned 0x3 [0123.294] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x118e89c*=0xf, pszText="00000000000000" | out: puBuffLength=0x118e89c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.294] IUnknown:Release (This=0x1375100) returned 0x2 [0123.294] IWbemClassObject:Get (in: This=0x13c78c8, wszName="Name", lFlags=0, pVal=0x118e85c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x3376800*=0, plFlavor=0x3376804*=0 | out: pVal=0x118e85c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Basic Display Adapter", varVal2=0x0), pType=0x3376800*=8, plFlavor=0x3376804*=0) returned 0x0 [0123.295] SysStringLen (param_1="Microsoft Basic Display Adapter") returned 0x1f [0123.295] IWbemClassObject:Get (in: This=0x13c78c8, wszName="Name", lFlags=0, pVal=0x118e860*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x3376800*=8, plFlavor=0x3376804*=0 | out: pVal=0x118e860*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Microsoft Basic Display Adapter", varVal2=0x0), pType=0x3376800*=8, plFlavor=0x3376804*=0) returned 0x0 [0123.295] SysStringLen (param_1="Microsoft Basic Display Adapter") returned 0x1f [0123.295] CoGetContextToken (in: pToken=0x118e64c | out: pToken=0x118e64c) returned 0x0 [0123.295] IUnknown:AddRef (This=0x13aa4e0) returned 0x3 [0123.295] IEnumWbemClassObject:Next (in: This=0x13aa4e0, lTimeout=-1, uCount=0x1, apObjects=0x13381c0, puReturned=0x3375eac | out: apObjects=0x13381c0*=0x0, puReturned=0x3375eac*=0x0) returned 0x1 [0123.297] IUnknown:Release (This=0x13aa4e0) returned 0x2 [0123.297] CoGetContextToken (in: pToken=0x118e798 | out: pToken=0x118e798) returned 0x0 [0123.297] IUnknown:Release (This=0x138c708) returned 0x1 [0123.298] IUnknown:Release (This=0x13aa4e0) returned 0x0 [0123.317] GetSystemPowerStatus (in: lpSystemPowerStatus=0x118e930 | out: lpSystemPowerStatus=0x118e930) returned 1 [0123.317] GetLastError () returned 0x0 [0123.340] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x118e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0123.340] GetLastError () returned 0x0 [0123.341] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x118e480, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0123.341] GetLastError () returned 0x0 [0123.342] DeleteFileA (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe:Zone.Identifier" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe:zone.identifier")) returned 0 [0123.343] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="d6255d76-fd1b-49c2-b1bf-bb2df53c6c67") returned 0x544 [0123.344] GetLastError () returned 0xb7 [0123.344] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x0, cHandles=0x1, pHandles=0x118e94c*=0x544, lpdwindex=0x118e704 | out: lpdwindex=0x118e704) returned 0x0 [0123.429] GetEnvironmentVariableW (in: lpName="AppData", lpBuffer=0x13381a8, nSize=0x80 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x25 [0123.429] GetLastError () returned 0x0 [0123.455] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x118e38c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0123.455] GetLastError () returned 0x0 [0123.455] SetErrorMode (uMode=0x1) returned 0x0 [0123.455] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x118e80c | out: lpFileInformation=0x118e80c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0123.455] GetLastError () returned 0x2 [0123.455] SetErrorMode (uMode=0x0) returned 0x1 [0123.456] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x118e398, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0123.456] GetLastError () returned 0x2 [0123.456] SetErrorMode (uMode=0x1) returned 0x0 [0123.456] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x118e7b4 | out: lpFileInformation=0x118e7b4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0123.456] GetLastError () returned 0x2 [0123.456] SetErrorMode (uMode=0x0) returned 0x1 [0123.456] SetErrorMode (uMode=0x1) returned 0x0 [0123.456] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x118e7b4 | out: lpFileInformation=0x118e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa832513c, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0x53812b5d, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x53812b5d, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0123.456] GetLastError () returned 0x2 [0123.456] SetErrorMode (uMode=0x0) returned 0x1 [0123.456] SetErrorMode (uMode=0x1) returned 0x0 [0123.456] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata"), fInfoLevelId=0x0, lpFileInformation=0x118e7b4 | out: lpFileInformation=0x118e7b4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xa832513c, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0xa86b89c3, ftLastAccessTime.dwHighDateTime=0x1d2d079, ftLastWriteTime.dwLowDateTime=0xa86b89c3, ftLastWriteTime.dwHighDateTime=0x1d2d079, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0123.456] GetLastError () returned 0x2 [0123.456] SetErrorMode (uMode=0x0) returned 0x1 [0123.456] SetErrorMode (uMode=0x1) returned 0x0 [0123.456] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps"), fInfoLevelId=0x0, lpFileInformation=0x118e7b4 | out: lpFileInformation=0x118e7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa82b2a28, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0xde27753, ftLastAccessTime.dwHighDateTime=0x1d2d411, ftLastWriteTime.dwLowDateTime=0xde27753, ftLastWriteTime.dwHighDateTime=0x1d2d411, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0123.457] GetLastError () returned 0x2 [0123.457] SetErrorMode (uMode=0x0) returned 0x1 [0123.457] SetErrorMode (uMode=0x1) returned 0x0 [0123.457] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x118e7b4 | out: lpFileInformation=0x118e7b4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0xa82b2a28, ftLastAccessTime.dwHighDateTime=0x1d2d079, ftLastWriteTime.dwLowDateTime=0xa82b2a28, ftLastWriteTime.dwHighDateTime=0x1d2d079, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0123.457] GetLastError () returned 0x2 [0123.457] SetErrorMode (uMode=0x0) returned 0x1 [0123.457] CreateDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), lpSecurityAttributes=0x0) returned 1 [0123.475] GetLastError () returned 0x2 [0123.475] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x118e38c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0123.475] GetLastError () returned 0x2 [0123.475] SetErrorMode (uMode=0x1) returned 0x0 [0123.475] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x118e80c | out: lpFileInformation=0x118e80c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0123.475] GetLastError () returned 0x2 [0123.475] SetErrorMode (uMode=0x0) returned 0x1 [0123.476] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x118e32c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0123.476] GetLastError () returned 0x2 [0123.476] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x118e26c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0123.476] GetLastError () returned 0x2 [0123.476] SetErrorMode (uMode=0x1) returned 0x0 [0123.476] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x568 [0123.476] GetLastError () returned 0x0 [0123.476] GetFileType (hFile=0x568) returned 0x1 [0123.476] SetErrorMode (uMode=0x0) returned 0x1 [0123.476] GetFileType (hFile=0x568) returned 0x1 [0123.476] GetFileSize (in: hFile=0x568, lpFileSizeHigh=0x118e820 | out: lpFileSizeHigh=0x118e820*=0x0) returned 0xe8a00 [0123.476] GetLastError () returned 0x0 [0123.478] ReadFile (in: hFile=0x568, lpBuffer=0x6f6d5e0, nNumberOfBytesToRead=0xe8a00, lpNumberOfBytesRead=0x118e7c8, lpOverlapped=0x0 | out: lpBuffer=0x6f6d5e0*, lpNumberOfBytesRead=0x118e7c8*=0xe8a00, lpOverlapped=0x0) returned 1 [0123.485] GetLastError () returned 0x0 [0123.485] CloseHandle (hObject=0x568) returned 1 [0123.486] GetLastError () returned 0x0 [0123.486] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x118e274, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0123.486] GetLastError () returned 0x0 [0123.486] SetErrorMode (uMode=0x1) returned 0x0 [0123.486] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x568 [0123.506] GetLastError () returned 0x0 [0123.506] GetFileType (hFile=0x568) returned 0x1 [0123.506] SetErrorMode (uMode=0x0) returned 0x1 [0123.506] GetFileType (hFile=0x568) returned 0x1 [0123.506] WriteFile (in: hFile=0x568, lpBuffer=0x6f6d5e0*, nNumberOfBytesToWrite=0xe8a00, lpNumberOfBytesWritten=0x118e7d4, lpOverlapped=0x0 | out: lpBuffer=0x6f6d5e0*, lpNumberOfBytesWritten=0x118e7d4*=0xe8a00, lpOverlapped=0x0) returned 1 [0123.515] GetLastError () returned 0x0 [0123.515] CloseHandle (hObject=0x568) returned 1 [0123.526] GetLastError () returned 0x0 [0123.526] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x118e7f4 | out: phkResult=0x118e7f4*=0x568) returned 0x0 [0123.526] RegQueryValueExW (in: hKey=0x568, lpValueName="ghh", lpReserved=0x0, lpType=0x118e7f4, lpData=0x0, lpcbData=0x118e7f0*=0x0 | out: lpType=0x118e7f4*=0x1, lpData=0x0, lpcbData=0x118e7f0*=0x22) returned 0x0 [0123.527] RegSetValueExW (in: hKey=0x568, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0123.553] RegCloseKey (hKey=0x568) returned 0x0 [0123.553] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x136fd10 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0123.553] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x118e314, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0123.553] GetLastError () returned 0x3f0 [0123.563] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x118e24c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0123.563] GetLastError () returned 0x3f0 [0123.563] SetErrorMode (uMode=0x1) returned 0x1 [0123.563] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0123.564] GetLastError () returned 0x3 [0123.594] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x134eed0*=0x568, lpdwindex=0x118da28 | out: lpdwindex=0x118da28) returned 0x0 [0123.597] SetErrorMode (uMode=0x1) returned 0x1 [0123.654] QueryPerformanceFrequency (in: lpFrequency=0x1284350 | out: lpFrequency=0x1284350) returned 1 [0123.969] CAddrControl::AddRef () returned 0x1 [0124.123] CoGetClassObject (in: rclsid=0x13a67dc*(Data1=0x62be5d10, Data2=0x60eb, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), dwClsContext=0x15, pvReserved=0x0, riid=0x739d9630*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x118e5e8 | out: ppv=0x118e5e8*=0x16a0528) returned 0x0 [0124.910] SystemDeviceEnum:IUnknown:QueryInterface (in: This=0x16a0528, riid=0x73b097d4*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118e418 | out: ppvObject=0x118e418*=0x0) returned 0x80004002 [0124.910] SystemDeviceEnum:IClassFactory:CreateInstance (in: This=0x16a0528, pUnkOuter=0x0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e450 | out: ppvObject=0x118e450*=0x16a0558) returned 0x0 [0125.235] IUnknown:QueryInterface (in: This=0x16a0558, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e1f4 | out: ppvObject=0x118e1f4*=0x16a0558) returned 0x0 [0125.235] IUnknown:QueryInterface (in: This=0x16a0558, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x118e1b0 | out: ppvObject=0x118e1b0*=0x0) returned 0x80004002 [0125.235] IUnknown:QueryInterface (in: This=0x16a0558, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x118e0a4 | out: ppvObject=0x118e0a4*=0x0) returned 0x80004002 [0125.235] IUnknown:AddRef (This=0x16a0558) returned 0x3 [0125.235] CoGetContextToken (in: pToken=0x118e03c | out: pToken=0x118e03c) returned 0x0 [0125.235] CoGetContextToken (in: pToken=0x118e000 | out: pToken=0x118e000) returned 0x0 [0125.235] IUnknown:QueryInterface (in: This=0x1332d00, riid=0x73a84a28*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e034 | out: ppvObject=0x118e034*=0x1332d0c) returned 0x0 [0125.235] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332d0c, pAptType=0x118e064 | out: pAptType=0x118e064*=3) returned 0x0 [0125.236] IUnknown:Release (This=0x1332d0c) returned 0x1 [0125.236] IUnknown:QueryInterface (in: This=0x16a0558, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e024 | out: ppvObject=0x118e024*=0x0) returned 0x80004002 [0125.236] CoGetContextToken (in: pToken=0x118e034 | out: pToken=0x118e034) returned 0x0 [0125.236] IUnknown:AddRef (This=0x16a0558) returned 0x4 [0125.236] IUnknown:QueryInterface (in: This=0x16a0558, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x118e0a8 | out: ppvObject=0x118e0a8*=0x0) returned 0x80004002 [0125.236] IUnknown:Release (This=0x16a0558) returned 0x3 [0125.236] IUnknown:Release (This=0x16a0558) returned 0x2 [0125.236] SystemDeviceEnum:IUnknown:Release (This=0x16a0528) returned 0x1 [0125.236] IUnknown:Release (This=0x16a0558) returned 0x1 [0125.236] CoGetContextToken (in: pToken=0x118e6bc | out: pToken=0x118e6bc) returned 0x0 [0125.236] IIDFromString (in: lpsz="{29840822-5B84-11D0-BD3B-00A0C911CE86}", lpiid=0x118e6f8 | out: lpiid=0x118e6f8) returned 0x0 [0125.236] CoGetContextToken (in: pToken=0x118e67c | out: pToken=0x118e67c) returned 0x0 [0125.236] IUnknown:AddRef (This=0x16a0558) returned 0x2 [0125.237] IUnknown:QueryInterface (in: This=0x16a0558, riid=0x118e6f8*(Data1=0x29840822, Data2=0x5b84, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), ppvObject=0x118e6f4 | out: ppvObject=0x118e6f4*=0x16a0558) returned 0x0 [0125.237] IUnknown:Release (This=0x16a0558) returned 0x2 [0125.237] IUnknown:Release (This=0x16a0558) returned 0x1 [0125.237] CoGetContextToken (in: pToken=0x118e68c | out: pToken=0x118e68c) returned 0x0 [0125.237] CoGetContextToken (in: pToken=0x118e64c | out: pToken=0x118e64c) returned 0x0 [0125.237] IUnknown:AddRef (This=0x16a0558) returned 0x2 [0125.238] IUnknown:QueryInterface (in: This=0x16a0558, riid=0x118e6c8*(Data1=0x29840822, Data2=0x5b84, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), ppvObject=0x118e6c4 | out: ppvObject=0x118e6c4*=0x16a0558) returned 0x0 [0125.238] IUnknown:Release (This=0x16a0558) returned 0x2 [0125.238] IUnknown:AddRef (This=0x16a0558) returned 0x3 [0125.238] ICreateDevEnum:CreateClassEnumerator (in: This=0x16a0558, clsidDeviceClass=0x118e948*(Data1=0x860bb310, Data2=0x5d01, Data3=0x11d0, Data4=([0]=0xbd, [1]=0x3b, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0x11, [6]=0xce, [7]=0x86)), ppenumMoniker=0x118e7f8, dwFlags=0x0 | out: ppenumMoniker=0x118e7f8*=0x0) returned 0x1 [0126.546] IUnknown:Release (This=0x16a0558) returned 0x2 [0126.548] CoGetContextToken (in: pToken=0x118e768 | out: pToken=0x118e768) returned 0x0 [0126.548] IUnknown:Release (This=0x16a0558) returned 0x1 [0126.548] IUnknown:Release (This=0x16a0558) returned 0x0 [0126.703] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc16b [0126.703] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc16c [0126.704] GetSystemMetrics (nIndex=75) returned 1 [0126.705] AdjustWindowRectEx (in: lpRect=0x118e934, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x118e934) returned 1 [0126.707] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74d70000 [0126.708] GetProcAddress (hModule=0x74d70000, lpProcName="DefWindowProcW") returned 0x77cbcaa0 [0126.708] GetStockObject (i=5) returned 0x1900015 [0126.708] GetLastError () returned 0x583 [0126.709] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0126.710] CoTaskMemAlloc (cb=0x4c) returned 0x1391f68 [0126.710] RegisterClassW (lpWndClass=0x13381c0) returned 0xc174 [0126.710] GetLastError () returned 0x583 [0126.710] CoTaskMemFree (pv=0x1391f68) [0126.711] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0126.711] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x400ec [0126.713] SetWindowLongW (hWnd=0x400ec, nIndex=-4, dwNewLong=2009844384) returned 23400842 [0126.715] GetWindowLongW (hWnd=0x400ec, nIndex=-4) returned 2009844384 [0126.717] SetWindowLongW (hWnd=0x400ec, nIndex=-4, dwNewLong=23400890) returned 2009844384 [0126.717] GetWindowLongW (hWnd=0x400ec, nIndex=-4) returned 23400890 [0126.717] GetWindowLongW (hWnd=0x400ec, nIndex=-16) returned 113311744 [0126.718] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc167 [0126.720] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x400ec, Msg=0x24, wParam=0x0, lParam=0x118e1c4) returned 0x0 [0126.720] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc0e6 [0126.720] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x400ec, Msg=0x81, wParam=0x0, lParam=0x118e1b8) returned 0x1 [0126.721] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x400ec, Msg=0x83, wParam=0x0, lParam=0x118e1a4) returned 0x0 [0126.724] CallWindowProcW (lpPrevWndFunc=0x77cbcaa0, hWnd=0x400ec, Msg=0x1, wParam=0x0, lParam=0x118e1b8) returned 0x0 [0126.725] GetClientRect (in: hWnd=0x400ec, lpRect=0x118def8 | out: lpRect=0x118def8) returned 1 [0126.726] GetWindowRect (in: hWnd=0x400ec, lpRect=0x118def8 | out: lpRect=0x118def8) returned 1 [0126.726] GetLastError () returned 0x6 [0126.727] GetParent (hWnd=0x400ec) returned 0x0 [0126.751] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x136fd10 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0126.752] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x118e458, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0126.752] GetLastError () returned 0x3f0 [0126.754] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x136fd10 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0126.754] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x118e458, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0126.754] GetLastError () returned 0x3f0 [0126.761] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x136fd10 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0126.761] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x118e458, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0126.761] GetLastError () returned 0x3f0 [0126.775] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x136fd10 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0126.775] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x118e454, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0126.775] GetLastError () returned 0x3f0 [0126.784] GetModuleHandleW (lpModuleName="0") returned 0x0 [0126.784] GetLastError () returned 0x7e [0126.785] SetWindowsHookExA (idHook=13, lpfn=0x16511ea, hmod=0x0, dwThreadId=0x0) returned 0x40101 [0126.838] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x136fd10 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0126.838] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x118e450, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0126.838] GetLastError () returned 0x3f0 [0126.875] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x118e764 | out: pFixedInfo=0x0, pOutBufLen=0x118e764) returned 0x6f [0126.884] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x13e12e8 [0126.884] GetLastError () returned 0x0 [0126.884] GetNetworkParams (in: pFixedInfo=0x13e12e8, pOutBufLen=0x118e764 | out: pFixedInfo=0x13e12e8, pOutBufLen=0x118e764) returned 0x0 [0126.891] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0126.891] GetLastError () returned 0x0 [0126.892] LocalFree (hMem=0x13e12e8) returned 0x0 [0126.892] GetLastError () returned 0x0 [0126.892] GetAdaptersAddresses () returned 0x6f [0126.897] LocalAlloc (uFlags=0x0, uBytes=0xea4) returned 0x13d1eb0 [0126.897] GetLastError () returned 0x0 [0126.897] GetAdaptersAddresses () returned 0x0 [0126.903] LocalFree (hMem=0x13d1eb0) returned 0x0 [0126.903] GetLastError () returned 0x0 [0126.903] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x118e824 | out: AdapterInfo=0x0, SizePointer=0x118e824) returned 0x6f [0126.905] LocalAlloc (uFlags=0x0, uBytes=0x280) returned 0x13dfd38 [0126.905] GetLastError () returned 0x0 [0126.905] GetAdaptersInfo (in: AdapterInfo=0x13dfd38, SizePointer=0x118e824 | out: AdapterInfo=0x13dfd38, SizePointer=0x118e824) returned 0x0 [0126.910] inet_addr (cp="192.168.0.96") returned 0x6000a8c0 [0126.910] GetLastError () returned 0x0 [0126.910] inet_addr (cp="255.255.255.0") returned 0xffffff [0126.910] GetLastError () returned 0x0 [0126.910] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0126.910] GetLastError () returned 0x0 [0126.910] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0126.910] GetLastError () returned 0x0 [0126.910] GetIfEntry (in: pIfRow=0x136fd10 | out: pIfRow=0x136fd10) returned 0x0 [0126.911] GetPerAdapterInfo (in: IfIndex=0x5, pPerAdapterInfo=0x0, pOutBufLen=0x118e598 | out: pPerAdapterInfo=0x0, pOutBufLen=0x118e598) returned 0x6f [0126.918] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1342c20 [0126.918] GetLastError () returned 0x0 [0126.918] GetPerAdapterInfo (in: IfIndex=0x5, pPerAdapterInfo=0x1342c20, pOutBufLen=0x118e598 | out: pPerAdapterInfo=0x1342c20, pOutBufLen=0x118e598) returned 0x0 [0126.925] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0126.925] GetLastError () returned 0x0 [0126.925] LocalFree (hMem=0x1342c20) returned 0x0 [0126.925] GetLastError () returned 0x0 [0126.926] LocalFree (hMem=0x13dfd38) returned 0x0 [0126.926] GetLastError () returned 0x0 [0126.926] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x118e76c | out: pFixedInfo=0x0, pOutBufLen=0x118e76c) returned 0x6f [0126.933] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x13d5490 [0126.933] GetLastError () returned 0x0 [0126.933] GetNetworkParams (in: pFixedInfo=0x13d5490, pOutBufLen=0x118e76c | out: pFixedInfo=0x13d5490, pOutBufLen=0x118e76c) returned 0x0 [0126.940] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0126.940] GetLastError () returned 0x0 [0126.940] LocalFree (hMem=0x13d5490) returned 0x0 [0126.940] GetLastError () returned 0x0 [0126.940] GetAdaptersAddresses () returned 0x6f [0126.945] LocalAlloc (uFlags=0x0, uBytes=0xea4) returned 0x13a3848 [0126.945] GetLastError () returned 0x0 [0126.945] GetAdaptersAddresses () returned 0x0 [0126.952] LocalFree (hMem=0x13a3848) returned 0x0 [0126.952] GetLastError () returned 0x0 [0126.952] GetAdaptersInfo (in: AdapterInfo=0x0, SizePointer=0x118e82c | out: AdapterInfo=0x0, SizePointer=0x118e82c) returned 0x6f [0126.954] LocalAlloc (uFlags=0x0, uBytes=0x280) returned 0x13d1eb0 [0126.954] GetLastError () returned 0x0 [0126.954] GetAdaptersInfo (in: AdapterInfo=0x13d1eb0, SizePointer=0x118e82c | out: AdapterInfo=0x13d1eb0, SizePointer=0x118e82c) returned 0x0 [0126.956] inet_addr (cp="192.168.0.96") returned 0x6000a8c0 [0126.956] GetLastError () returned 0x0 [0126.956] inet_addr (cp="255.255.255.0") returned 0xffffff [0126.956] GetLastError () returned 0x0 [0126.956] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0126.956] GetLastError () returned 0x0 [0126.956] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0126.956] GetLastError () returned 0x0 [0126.956] GetIfEntry (in: pIfRow=0x136fd10 | out: pIfRow=0x136fd10) returned 0x0 [0126.957] GetPerAdapterInfo (in: IfIndex=0x5, pPerAdapterInfo=0x0, pOutBufLen=0x118e5a0 | out: pPerAdapterInfo=0x0, pOutBufLen=0x118e5a0) returned 0x6f [0126.964] LocalAlloc (uFlags=0x0, uBytes=0x5c) returned 0x1343168 [0126.964] GetLastError () returned 0x0 [0126.964] GetPerAdapterInfo (in: IfIndex=0x5, pPerAdapterInfo=0x1343168, pOutBufLen=0x118e5a0 | out: pPerAdapterInfo=0x1343168, pOutBufLen=0x118e5a0) returned 0x0 [0126.970] inet_addr (cp="192.168.0.1") returned 0x100a8c0 [0126.970] GetLastError () returned 0x0 [0126.970] LocalFree (hMem=0x1343168) returned 0x0 [0126.970] GetLastError () returned 0x0 [0126.970] LocalFree (hMem=0x13d1eb0) returned 0x0 [0126.970] GetLastError () returned 0x0 [0126.980] GetIfEntry (in: pIfRow=0x136fd10 | out: pIfRow=0x136fd10) returned 0x0 [0126.988] GetIfEntry (in: pIfRow=0x136fd10 | out: pIfRow=0x136fd10) returned 0x0 [0126.988] GetIfEntry (in: pIfRow=0x136fd10 | out: pIfRow=0x136fd10) returned 0x0 [0126.988] GetIfEntry (in: pIfRow=0x136fd10 | out: pIfRow=0x136fd10) returned 0x0 [0126.988] GetIfEntry (in: pIfRow=0x136fd10 | out: pIfRow=0x136fd10) returned 0x0 [0126.989] GetIfEntry (in: pIfRow=0x136fd10 | out: pIfRow=0x136fd10) returned 0x0 [0126.989] GetIfEntry (in: pIfRow=0x136fd10 | out: pIfRow=0x136fd10) returned 0x0 [0126.989] GetIfEntry (in: pIfRow=0x136fd10 | out: pIfRow=0x136fd10) returned 0x0 [0127.052] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x63c [0127.052] GetLastError () returned 0x0 [0127.052] SetEvent (hEvent=0x3cc) returned 1 [0127.052] GetLastError () returned 0x0 [0127.052] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x118e8b8*=0x63c, lpdwindex=0x118e670 | out: lpdwindex=0x118e670) returned 0x0 [0127.068] CoGetContextToken (in: pToken=0x118e708 | out: pToken=0x118e708) returned 0x0 [0127.068] CoGetContextToken (in: pToken=0x118e6c8 | out: pToken=0x118e6c8) returned 0x0 [0127.068] IUnknown:AddRef (This=0x13aed68) returned 0x2 [0127.068] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x118e744*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e740 | out: ppvObject=0x118e740*=0x13aed68) returned 0x0 [0127.068] IUnknown:Release (This=0x13aed68) returned 0x2 [0127.068] IUnknown:Release (This=0x13aed68) returned 0x1 [0127.069] CoGetContextToken (in: pToken=0x118e788 | out: pToken=0x118e788) returned 0x0 [0127.069] CoGetContextToken (in: pToken=0x118e748 | out: pToken=0x118e748) returned 0x0 [0127.069] IUnknown:AddRef (This=0x13aed68) returned 0x2 [0127.069] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x118e7c4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e7c0 | out: ppvObject=0x118e7c0*=0x13aed68) returned 0x0 [0127.069] IUnknown:Release (This=0x13aed68) returned 0x2 [0127.069] IWbemPath:SetText (This=0x13aed68, uMode=0x4, pszPath="Win32_PerfFormattedData_PerfOS_Processor.Name='_Total'") returned 0x0 [0127.069] IUnknown:Release (This=0x13aed68) returned 0x1 [0127.069] CoGetContextToken (in: pToken=0x118e774 | out: pToken=0x118e774) returned 0x0 [0127.069] CoGetContextToken (in: pToken=0x118e734 | out: pToken=0x118e734) returned 0x0 [0127.069] IUnknown:AddRef (This=0x13aed68) returned 0x2 [0127.069] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x118e7b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e7ac | out: ppvObject=0x118e7ac*=0x13aed68) returned 0x0 [0127.069] IUnknown:Release (This=0x13aed68) returned 0x2 [0127.069] IWbemPath:GetNamespaceCount (in: This=0x13aed68, puCount=0x118e928 | out: puCount=0x118e928*=0x0) returned 0x0 [0127.070] IUnknown:Release (This=0x13aed68) returned 0x1 [0127.070] CoGetContextToken (in: pToken=0x118e764 | out: pToken=0x118e764) returned 0x0 [0127.070] CoGetContextToken (in: pToken=0x118e724 | out: pToken=0x118e724) returned 0x0 [0127.070] IUnknown:AddRef (This=0x13aed68) returned 0x2 [0127.070] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x118e7a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e79c | out: ppvObject=0x118e79c*=0x13aed68) returned 0x0 [0127.070] IUnknown:Release (This=0x13aed68) returned 0x2 [0127.070] IWbemPath:GetText (in: This=0x13aed68, lFlags=2, puBuffLength=0x118e924*=0x0, pszText=0x0 | out: puBuffLength=0x118e924*=0x37, pszText=0x0) returned 0x0 [0127.070] IUnknown:Release (This=0x13aed68) returned 0x1 [0127.070] CoGetContextToken (in: pToken=0x118e764 | out: pToken=0x118e764) returned 0x0 [0127.070] CoGetContextToken (in: pToken=0x118e724 | out: pToken=0x118e724) returned 0x0 [0127.084] IUnknown:AddRef (This=0x13aed68) returned 0x2 [0127.084] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x118e7a0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e79c | out: ppvObject=0x118e79c*=0x13aed68) returned 0x0 [0127.086] IUnknown:Release (This=0x13aed68) returned 0x2 [0127.086] IWbemPath:GetText (in: This=0x13aed68, lFlags=2, puBuffLength=0x118e924*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x118e924*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0127.086] IUnknown:Release (This=0x13aed68) returned 0x1 [0127.086] CoGetContextToken (in: pToken=0x118e778 | out: pToken=0x118e778) returned 0x0 [0127.086] CoGetContextToken (in: pToken=0x118e738 | out: pToken=0x118e738) returned 0x0 [0127.086] IUnknown:AddRef (This=0x13aed68) returned 0x2 [0127.086] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x118e7b4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e7b0 | out: ppvObject=0x118e7b0*=0x13aed68) returned 0x0 [0127.086] IUnknown:Release (This=0x13aed68) returned 0x2 [0127.086] IWbemPath:GetInfo (in: This=0x13aed68, uRequestedInfo=0x0, puResponse=0x118e92c | out: puResponse=0x118e92c*=0xc19) returned 0x0 [0127.087] IUnknown:Release (This=0x13aed68) returned 0x1 [0127.087] CoGetContextToken (in: pToken=0x118e774 | out: pToken=0x118e774) returned 0x0 [0127.087] CoGetContextToken (in: pToken=0x118e734 | out: pToken=0x118e734) returned 0x0 [0127.087] IUnknown:AddRef (This=0x13aed68) returned 0x2 [0127.087] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x118e7b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e7ac | out: ppvObject=0x118e7ac*=0x13aed68) returned 0x0 [0127.087] IUnknown:Release (This=0x13aed68) returned 0x2 [0127.087] IWbemPath:GetNamespaceCount (in: This=0x13aed68, puCount=0x118e928 | out: puCount=0x118e928*=0x0) returned 0x0 [0127.087] IUnknown:Release (This=0x13aed68) returned 0x1 [0127.087] CoGetContextToken (in: pToken=0x118e778 | out: pToken=0x118e778) returned 0x0 [0127.087] CoGetContextToken (in: pToken=0x118e738 | out: pToken=0x118e738) returned 0x0 [0127.087] IUnknown:AddRef (This=0x13aed68) returned 0x2 [0127.087] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x118e7b4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e7b0 | out: ppvObject=0x118e7b0*=0x13aed68) returned 0x0 [0127.087] IUnknown:Release (This=0x13aed68) returned 0x2 [0127.088] IWbemPath:GetInfo (in: This=0x13aed68, uRequestedInfo=0x0, puResponse=0x118e92c | out: puResponse=0x118e92c*=0xc19) returned 0x0 [0127.088] IUnknown:Release (This=0x13aed68) returned 0x1 [0127.088] CoGetContextToken (in: pToken=0x118e778 | out: pToken=0x118e778) returned 0x0 [0127.088] CoGetContextToken (in: pToken=0x118e738 | out: pToken=0x118e738) returned 0x0 [0127.088] IUnknown:AddRef (This=0x13aed68) returned 0x2 [0127.088] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x118e7b4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x118e7b0 | out: ppvObject=0x118e7b0*=0x13aed68) returned 0x0 [0127.088] IUnknown:Release (This=0x13aed68) returned 0x2 [0127.088] IWbemPath:GetInfo (in: This=0x13aed68, uRequestedInfo=0x0, puResponse=0x118e92c | out: puResponse=0x118e92c*=0xc19) returned 0x0 [0127.088] IUnknown:Release (This=0x13aed68) returned 0x1 [0127.154] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat", nBufferLength=0x105, lpBuffer=0x118e49c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat", lpFilePart=0x0) returned 0x45 [0127.154] GetLastError () returned 0x0 [0127.154] SetErrorMode (uMode=0x1) returned 0x0 [0127.154] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\monitoring\\network.dat"), fInfoLevelId=0x0, lpFileInformation=0x118e91c | out: lpFileInformation=0x118e91c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.154] GetLastError () returned 0x3 [0127.154] SetErrorMode (uMode=0x0) returned 0x1 [0127.159] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat", nBufferLength=0x105, lpBuffer=0x118e4a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat", lpFilePart=0x0) returned 0x44 [0127.159] GetLastError () returned 0x3 [0127.159] SetErrorMode (uMode=0x1) returned 0x0 [0127.160] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\monitoring\\system.dat"), fInfoLevelId=0x0, lpFileInformation=0x118e920 | out: lpFileInformation=0x118e920*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0127.160] GetLastError () returned 0x3 [0127.160] SetErrorMode (uMode=0x0) returned 0x1 [0127.352] GetCurrentProcessId () returned 0xec8 [0127.354] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x118e198 | out: lpLuid=0x118e198*(LowPart=0x14, HighPart=0)) returned 1 [0127.355] GetLastError () returned 0x0 [0127.356] GetCurrentProcess () returned 0xffffffff [0127.356] GetLastError () returned 0x0 [0127.357] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x118e194 | out: TokenHandle=0x118e194*=0x504) returned 1 [0127.357] GetLastError () returned 0x0 [0127.358] AdjustTokenPrivileges (in: TokenHandle=0x504, DisableAllPrivileges=0, NewState=0x33bd778*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0127.358] GetLastError () returned 0x514 [0127.358] CloseHandle (hObject=0x504) returned 1 [0127.358] GetLastError () returned 0x514 [0127.359] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0xec8) returned 0x504 [0127.359] GetLastError () returned 0x514 [0127.360] GetExitCodeProcess (in: hProcess=0x504, lpExitCode=0x33bd714 | out: lpExitCode=0x33bd714*=0x103) returned 1 [0127.360] GetLastError () returned 0x514 [0127.362] SetProcessWorkingSetSize (hProcess=0x504, dwMinimumWorkingSetSize=0xffffffff, dwMaximumWorkingSetSize=0xffffffff) returned 1 [0128.608] GetLastError () returned 0x514 [0128.611] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\control.exe", ulOptions=0x0, samDesired=0x20019, phkResult=0x118e914 | out: phkResult=0x118e914*=0x0) returned 0x2 [0128.618] GetCurrentProcessId () returned 0xec8 [0128.619] OpenProcess (dwDesiredAccess=0x100000, bInheritHandle=0, dwProcessId=0xec8) returned 0x6c0 [0128.619] GetLastError () returned 0x514 [0128.619] GetCurrentProcess () returned 0xffffffff [0128.619] GetLastError () returned 0x514 [0128.619] GetCurrentProcess () returned 0xffffffff [0128.619] GetLastError () returned 0x514 [0128.622] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x6c0, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x118e928, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x118e928*=0x6f0) returned 1 [0128.622] GetLastError () returned 0x514 [0128.623] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0x7fffffff, cHandles=0x1, pHandles=0x118e950*=0x6f0, lpdwindex=0x118e708) Thread: id = 40 os_tid = 0xed0 Thread: id = 41 os_tid = 0xed4 Thread: id = 42 os_tid = 0xed8 [0104.374] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 43 os_tid = 0xedc [0107.193] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 44 os_tid = 0xee0 [0107.988] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 45 os_tid = 0xee4 Thread: id = 46 os_tid = 0xee8 Thread: id = 47 os_tid = 0xeec Thread: id = 48 os_tid = 0xf34 [0113.111] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0113.277] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x80eefa4 | out: lpiid=0x80eefa4) returned 0x0 [0113.278] CoGetClassObject (in: rclsid=0x137bdcc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x739d9630*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x80eef0c | out: ppv=0x80eef0c*=0x136f0d0) returned 0x0 [0113.658] WbemDefPath:IUnknown:QueryInterface (in: This=0x136f0d0, riid=0x73b097d4*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x80eed3c | out: ppvObject=0x80eed3c*=0x0) returned 0x80004002 [0113.658] WbemDefPath:IClassFactory:CreateInstance (in: This=0x136f0d0, pUnkOuter=0x0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80eed74 | out: ppvObject=0x80eed74*=0x1375330) returned 0x0 [0113.659] IUnknown:QueryInterface (in: This=0x1375330, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80eeb18 | out: ppvObject=0x80eeb18*=0x1375330) returned 0x0 [0113.659] IUnknown:QueryInterface (in: This=0x1375330, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x80eead4 | out: ppvObject=0x80eead4*=0x0) returned 0x80004002 [0113.660] IUnknown:AddRef (This=0x1375330) returned 0x3 [0113.662] CoGetContextToken (in: pToken=0x80ee960 | out: pToken=0x80ee960) returned 0x0 [0113.662] CoGetObjectContext (in: riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x137b194 | out: ppv=0x137b194*=0x1332db8) returned 0x0 [0113.663] IUnknown:QueryInterface (in: This=0x1375330, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80ee948 | out: ppvObject=0x80ee948*=0x137e420) returned 0x0 [0113.663] IMarshal:GetUnmarshalClass (in: This=0x137e420, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x80ee950 | out: pCid=0x80ee950*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.663] IUnknown:Release (This=0x137e420) returned 0x3 [0113.663] CoGetContextToken (in: pToken=0x80ee958 | out: pToken=0x80ee958) returned 0x0 [0113.663] IUnknown:AddRef (This=0x1375330) returned 0x4 [0113.663] IUnknown:QueryInterface (in: This=0x1375330, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80ee9cc | out: ppvObject=0x80ee9cc*=0x0) returned 0x80004002 [0113.664] IUnknown:Release (This=0x1375330) returned 0x3 [0113.664] IUnknown:Release (This=0x1375330) returned 0x2 [0113.664] WbemDefPath:IUnknown:Release (This=0x136f0d0) returned 0x0 [0113.664] IUnknown:Release (This=0x1375330) returned 0x1 [0113.664] SetEvent (hEvent=0x3c4) returned 1 [0113.664] GetLastError () returned 0x0 [0113.666] CoGetClassObject (in: rclsid=0x137bdcc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x739d9630*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x80eef0c | out: ppv=0x80eef0c*=0x136f020) returned 0x0 [0113.667] WbemDefPath:IUnknown:QueryInterface (in: This=0x136f020, riid=0x73b097d4*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x80eed3c | out: ppvObject=0x80eed3c*=0x0) returned 0x80004002 [0113.667] WbemDefPath:IClassFactory:CreateInstance (in: This=0x136f020, pUnkOuter=0x0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80eed74 | out: ppvObject=0x80eed74*=0x1375100) returned 0x0 [0113.667] IUnknown:QueryInterface (in: This=0x1375100, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80eeb18 | out: ppvObject=0x80eeb18*=0x1375100) returned 0x0 [0113.667] IUnknown:QueryInterface (in: This=0x1375100, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x80eead4 | out: ppvObject=0x80eead4*=0x0) returned 0x80004002 [0113.667] IUnknown:AddRef (This=0x1375100) returned 0x3 [0113.667] CoGetContextToken (in: pToken=0x80ee960 | out: pToken=0x80ee960) returned 0x0 [0113.668] IUnknown:QueryInterface (in: This=0x1375100, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80ee948 | out: ppvObject=0x80ee948*=0x137e810) returned 0x0 [0113.668] IMarshal:GetUnmarshalClass (in: This=0x137e810, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x80ee950 | out: pCid=0x80ee950*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0113.668] IUnknown:Release (This=0x137e810) returned 0x3 [0113.668] CoGetContextToken (in: pToken=0x80ee958 | out: pToken=0x80ee958) returned 0x0 [0113.668] IUnknown:AddRef (This=0x1375100) returned 0x4 [0113.668] IUnknown:QueryInterface (in: This=0x1375100, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80ee9cc | out: ppvObject=0x80ee9cc*=0x0) returned 0x80004002 [0113.668] IUnknown:Release (This=0x1375100) returned 0x3 [0113.668] IUnknown:Release (This=0x1375100) returned 0x2 [0113.668] WbemDefPath:IUnknown:Release (This=0x136f020) returned 0x0 [0113.668] IUnknown:Release (This=0x1375100) returned 0x1 [0113.669] SetEvent (hEvent=0x420) returned 1 [0113.669] GetLastError () returned 0x36b7 [0117.355] CoGetClassObject (in: rclsid=0x137bdcc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x739d9630*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x80eef0c | out: ppv=0x80eef0c*=0x136ee50) returned 0x0 [0117.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x136ee50, riid=0x73b097d4*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x80eed3c | out: ppvObject=0x80eed3c*=0x0) returned 0x80004002 [0117.356] WbemDefPath:IClassFactory:CreateInstance (in: This=0x136ee50, pUnkOuter=0x0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80eed74 | out: ppvObject=0x80eed74*=0x1375640) returned 0x0 [0117.356] IUnknown:QueryInterface (in: This=0x1375640, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80eeb18 | out: ppvObject=0x80eeb18*=0x1375640) returned 0x0 [0117.356] IUnknown:QueryInterface (in: This=0x1375640, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x80eead4 | out: ppvObject=0x80eead4*=0x0) returned 0x80004002 [0117.356] IUnknown:AddRef (This=0x1375640) returned 0x3 [0117.356] CoGetContextToken (in: pToken=0x80ee960 | out: pToken=0x80ee960) returned 0x0 [0117.356] IUnknown:QueryInterface (in: This=0x1375640, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80ee948 | out: ppvObject=0x80ee948*=0x13510f0) returned 0x0 [0117.356] IMarshal:GetUnmarshalClass (in: This=0x13510f0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x80ee950 | out: pCid=0x80ee950*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0117.356] IUnknown:Release (This=0x13510f0) returned 0x3 [0117.356] CoGetContextToken (in: pToken=0x80ee958 | out: pToken=0x80ee958) returned 0x0 [0117.356] IUnknown:AddRef (This=0x1375640) returned 0x4 [0117.356] IUnknown:QueryInterface (in: This=0x1375640, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80ee9cc | out: ppvObject=0x80ee9cc*=0x0) returned 0x80004002 [0117.356] IUnknown:Release (This=0x1375640) returned 0x3 [0117.357] IUnknown:Release (This=0x1375640) returned 0x2 [0117.357] WbemDefPath:IUnknown:Release (This=0x136ee50) returned 0x0 [0117.357] IUnknown:Release (This=0x1375640) returned 0x1 [0117.357] SetEvent (hEvent=0x48c) returned 1 [0117.360] GetLastError () returned 0x36b7 [0123.288] CoGetClassObject (in: rclsid=0x137bdcc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x739d9630*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x80eef0c | out: ppv=0x80eef0c*=0x13b3128) returned 0x0 [0123.288] WbemDefPath:IUnknown:QueryInterface (in: This=0x13b3128, riid=0x73b097d4*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x80eed3c | out: ppvObject=0x80eed3c*=0x0) returned 0x80004002 [0123.288] WbemDefPath:IClassFactory:CreateInstance (in: This=0x13b3128, pUnkOuter=0x0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80eed74 | out: ppvObject=0x80eed74*=0x13aec18) returned 0x0 [0123.289] IUnknown:QueryInterface (in: This=0x13aec18, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80eeb18 | out: ppvObject=0x80eeb18*=0x13aec18) returned 0x0 [0123.289] IUnknown:QueryInterface (in: This=0x13aec18, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x80eead4 | out: ppvObject=0x80eead4*=0x0) returned 0x80004002 [0123.289] IUnknown:AddRef (This=0x13aec18) returned 0x3 [0123.289] CoGetContextToken (in: pToken=0x80ee960 | out: pToken=0x80ee960) returned 0x0 [0123.289] IUnknown:QueryInterface (in: This=0x13aec18, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80ee948 | out: ppvObject=0x80ee948*=0x1390e50) returned 0x0 [0123.289] IMarshal:GetUnmarshalClass (in: This=0x1390e50, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x80ee950 | out: pCid=0x80ee950*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.289] IUnknown:Release (This=0x1390e50) returned 0x3 [0123.289] CoGetContextToken (in: pToken=0x80ee958 | out: pToken=0x80ee958) returned 0x0 [0123.289] IUnknown:AddRef (This=0x13aec18) returned 0x4 [0123.289] IUnknown:QueryInterface (in: This=0x13aec18, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80ee9cc | out: ppvObject=0x80ee9cc*=0x0) returned 0x80004002 [0123.290] IUnknown:Release (This=0x13aec18) returned 0x3 [0123.290] IUnknown:Release (This=0x13aec18) returned 0x2 [0123.290] WbemDefPath:IUnknown:Release (This=0x13b3128) returned 0x0 [0123.290] IUnknown:Release (This=0x13aec18) returned 0x1 [0123.290] SetEvent (hEvent=0x540) returned 1 [0123.295] GetLastError () returned 0x36b7 [0127.066] CoGetClassObject (in: rclsid=0x137bdcc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x739d9630*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x80eef0c | out: ppv=0x80eef0c*=0x13b2f48) returned 0x0 [0127.066] WbemDefPath:IUnknown:QueryInterface (in: This=0x13b2f48, riid=0x73b097d4*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x80eed3c | out: ppvObject=0x80eed3c*=0x0) returned 0x80004002 [0127.066] WbemDefPath:IClassFactory:CreateInstance (in: This=0x13b2f48, pUnkOuter=0x0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80eed74 | out: ppvObject=0x80eed74*=0x13aed68) returned 0x0 [0127.066] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80eeb18 | out: ppvObject=0x80eeb18*=0x13aed68) returned 0x0 [0127.066] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x80eead4 | out: ppvObject=0x80eead4*=0x0) returned 0x80004002 [0127.066] IUnknown:AddRef (This=0x13aed68) returned 0x3 [0127.067] CoGetContextToken (in: pToken=0x80ee960 | out: pToken=0x80ee960) returned 0x0 [0127.067] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80ee948 | out: ppvObject=0x80ee948*=0x13a7a68) returned 0x0 [0127.067] IMarshal:GetUnmarshalClass (in: This=0x13a7a68, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x80ee950 | out: pCid=0x80ee950*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.067] IUnknown:Release (This=0x13a7a68) returned 0x3 [0127.067] CoGetContextToken (in: pToken=0x80ee958 | out: pToken=0x80ee958) returned 0x0 [0127.067] IUnknown:AddRef (This=0x13aed68) returned 0x4 [0127.067] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x80ee9cc | out: ppvObject=0x80ee9cc*=0x0) returned 0x80004002 [0127.067] IUnknown:Release (This=0x13aed68) returned 0x3 [0127.067] IUnknown:Release (This=0x13aed68) returned 0x2 [0127.067] WbemDefPath:IUnknown:Release (This=0x13b2f48) returned 0x0 [0127.067] IUnknown:Release (This=0x13aed68) returned 0x1 [0127.068] SetEvent (hEvent=0x63c) returned 1 [0127.090] GetLastError () returned 0x36b7 Thread: id = 49 os_tid = 0xf38 [0113.691] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0113.693] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x824f270 | out: lpiid=0x824f270) returned 0x0 [0113.693] CoGetClassObject (in: rclsid=0x137bd54*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x739d9630*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x824f1d8 | out: ppv=0x824f1d8*=0x137e708) returned 0x0 [0113.845] WbemLocator:IUnknown:QueryInterface (in: This=0x137e708, riid=0x73b097d4*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x824f008 | out: ppvObject=0x824f008*=0x0) returned 0x80004002 [0113.845] WbemLocator:IClassFactory:CreateInstance (in: This=0x137e708, pUnkOuter=0x0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x824f040 | out: ppvObject=0x824f040*=0x136f0f0) returned 0x0 [0113.845] IUnknown:QueryInterface (in: This=0x136f0f0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x824ede4 | out: ppvObject=0x824ede4*=0x136f0f0) returned 0x0 [0113.846] IUnknown:QueryInterface (in: This=0x136f0f0, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x824eda0 | out: ppvObject=0x824eda0*=0x0) returned 0x80004002 [0113.846] IUnknown:AddRef (This=0x136f0f0) returned 0x3 [0113.846] CoGetContextToken (in: pToken=0x824ec2c | out: pToken=0x824ec2c) returned 0x0 [0113.846] IUnknown:QueryInterface (in: This=0x136f0f0, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x824ec14 | out: ppvObject=0x824ec14*=0x0) returned 0x80004002 [0113.846] CoGetContextToken (in: pToken=0x824ec24 | out: pToken=0x824ec24) returned 0x0 [0113.846] IUnknown:AddRef (This=0x136f0f0) returned 0x4 [0113.846] IUnknown:QueryInterface (in: This=0x136f0f0, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x824ec98 | out: ppvObject=0x824ec98*=0x0) returned 0x80004002 [0113.847] IUnknown:Release (This=0x136f0f0) returned 0x3 [0113.847] IUnknown:Release (This=0x136f0f0) returned 0x2 [0113.847] WbemLocator:IUnknown:Release (This=0x137e708) returned 0x0 [0113.847] IUnknown:Release (This=0x136f0f0) returned 0x1 [0113.847] CoGetContextToken (in: pToken=0x824f130 | out: pToken=0x824f130) returned 0x0 [0113.847] CoGetContextToken (in: pToken=0x824f0f0 | out: pToken=0x824f0f0) returned 0x0 [0113.847] IUnknown:AddRef (This=0x136f0f0) returned 0x2 [0113.847] IUnknown:QueryInterface (in: This=0x136f0f0, riid=0x824f16c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x824f168 | out: ppvObject=0x824f168*=0x136f0f0) returned 0x0 [0113.847] IUnknown:Release (This=0x136f0f0) returned 0x2 [0113.847] IUnknown:Release (This=0x136f0f0) returned 0x1 [0114.133] CoGetContextToken (in: pToken=0x824f1ac | out: pToken=0x824f1ac) returned 0x0 [0114.133] CoGetContextToken (in: pToken=0x824f16c | out: pToken=0x824f16c) returned 0x0 [0114.133] IUnknown:AddRef (This=0x1375100) returned 0x2 [0114.133] IUnknown:QueryInterface (in: This=0x1375100, riid=0x824f1e8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x824f1e4 | out: ppvObject=0x824f1e4*=0x1375100) returned 0x0 [0114.133] IUnknown:Release (This=0x1375100) returned 0x2 [0114.133] IUnknown:AddRef (This=0x1375100) returned 0x3 [0114.133] IWbemPath:GetNamespaceCount (in: This=0x1375100, puCount=0x824f360 | out: puCount=0x824f360*=0x2) returned 0x0 [0114.133] IUnknown:Release (This=0x1375100) returned 0x2 [0114.134] IWbemPath:GetText (in: This=0x1375100, lFlags=8, puBuffLength=0x824f35c*=0x0, pszText=0x0 | out: puBuffLength=0x824f35c*=0xf, pszText=0x0) returned 0x0 [0114.134] IWbemPath:GetText (in: This=0x1375100, lFlags=8, puBuffLength=0x824f35c*=0xf, pszText="00000000000000" | out: puBuffLength=0x824f35c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0114.139] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x824e508, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0114.139] GetLastError () returned 0x0 [0114.141] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\\\wminet_utils.dll") returned 0x74810000 [0114.367] GetProcAddress (hModule=0x74810000, lpProcName="ResetSecurity") returned 0x74811944 [0114.386] GetProcAddress (hModule=0x74810000, lpProcName="SetSecurity") returned 0x74811986 [0114.389] GetProcAddress (hModule=0x74810000, lpProcName="BlessIWbemServices") returned 0x748119cc [0114.395] GetProcAddress (hModule=0x74810000, lpProcName="BlessIWbemServicesObject") returned 0x74811a1e [0114.411] GetProcAddress (hModule=0x74810000, lpProcName="GetPropertyHandle") returned 0x74811a70 [0114.414] GetProcAddress (hModule=0x74810000, lpProcName="WritePropertyValue") returned 0x74811a89 [0114.417] GetProcAddress (hModule=0x74810000, lpProcName="Clone") returned 0x74811aa2 [0114.420] GetProcAddress (hModule=0x74810000, lpProcName="VerifyClientKey") returned 0x74812270 [0114.423] GetProcAddress (hModule=0x74810000, lpProcName="GetQualifierSet") returned 0x74811d73 [0114.426] GetProcAddress (hModule=0x74810000, lpProcName="Get") returned 0x74811b96 [0114.429] GetProcAddress (hModule=0x74810000, lpProcName="Put") returned 0x74811b7a [0114.431] GetProcAddress (hModule=0x74810000, lpProcName="Delete") returned 0x74811bb5 [0114.435] GetProcAddress (hModule=0x74810000, lpProcName="GetNames") returned 0x74811bc8 [0114.438] GetProcAddress (hModule=0x74810000, lpProcName="BeginEnumeration") returned 0x74811be4 [0114.441] GetProcAddress (hModule=0x74810000, lpProcName="Next") returned 0x74811bf7 [0114.443] GetProcAddress (hModule=0x74810000, lpProcName="EndEnumeration") returned 0x74811c16 [0114.446] GetProcAddress (hModule=0x74810000, lpProcName="GetPropertyQualifierSet") returned 0x74811c26 [0114.450] GetProcAddress (hModule=0x74810000, lpProcName="Clone") returned 0x74811aa2 [0114.450] GetProcAddress (hModule=0x74810000, lpProcName="GetObjectText") returned 0x74811c3c [0114.453] GetProcAddress (hModule=0x74810000, lpProcName="SpawnDerivedClass") returned 0x74811c52 [0114.458] GetProcAddress (hModule=0x74810000, lpProcName="SpawnInstance") returned 0x74811c68 [0114.475] GetProcAddress (hModule=0x74810000, lpProcName="CompareTo") returned 0x74811c7e [0114.478] GetProcAddress (hModule=0x74810000, lpProcName="GetPropertyOrigin") returned 0x74811c94 [0114.481] GetProcAddress (hModule=0x74810000, lpProcName="InheritsFrom") returned 0x74811caa [0114.484] GetProcAddress (hModule=0x74810000, lpProcName="GetMethod") returned 0x74811cbd [0114.487] GetProcAddress (hModule=0x74810000, lpProcName="PutMethod") returned 0x74811cd9 [0114.490] GetProcAddress (hModule=0x74810000, lpProcName="DeleteMethod") returned 0x74811cf5 [0114.493] GetProcAddress (hModule=0x74810000, lpProcName="BeginMethodEnumeration") returned 0x74811d08 [0114.496] GetProcAddress (hModule=0x74810000, lpProcName="NextMethod") returned 0x74811d1b [0114.499] GetProcAddress (hModule=0x74810000, lpProcName="EndMethodEnumeration") returned 0x74811d37 [0114.502] GetProcAddress (hModule=0x74810000, lpProcName="GetMethodQualifierSet") returned 0x74811d47 [0114.504] GetProcAddress (hModule=0x74810000, lpProcName="GetMethodOrigin") returned 0x74811d5d [0114.507] GetProcAddress (hModule=0x74810000, lpProcName="QualifierSet_Get") returned 0x74811d86 [0114.510] GetProcAddress (hModule=0x74810000, lpProcName="QualifierSet_Put") returned 0x74811da2 [0114.513] GetProcAddress (hModule=0x74810000, lpProcName="QualifierSet_Delete") returned 0x74811dbb [0114.516] GetProcAddress (hModule=0x74810000, lpProcName="QualifierSet_GetNames") returned 0x74811dce [0114.522] GetProcAddress (hModule=0x74810000, lpProcName="QualifierSet_BeginEnumeration") returned 0x74811de4 [0114.525] GetProcAddress (hModule=0x74810000, lpProcName="QualifierSet_Next") returned 0x74811df7 [0114.528] GetProcAddress (hModule=0x74810000, lpProcName="QualifierSet_EndEnumeration") returned 0x74811e13 [0114.531] GetProcAddress (hModule=0x74810000, lpProcName="GetCurrentApartmentType") returned 0x74811d73 [0114.533] GetProcAddress (hModule=0x74810000, lpProcName="GetDemultiplexedStub") returned 0x748118fd [0114.535] GetProcAddress (hModule=0x74810000, lpProcName="CreateInstanceEnumWmi") returned 0x74811580 [0114.538] GetProcAddress (hModule=0x74810000, lpProcName="CreateClassEnumWmi") returned 0x748115f6 [0114.540] GetProcAddress (hModule=0x74810000, lpProcName="ExecQueryWmi") returned 0x7481169e [0114.543] GetProcAddress (hModule=0x74810000, lpProcName="ExecNotificationQueryWmi") returned 0x74811717 [0114.545] GetProcAddress (hModule=0x74810000, lpProcName="PutInstanceWmi") returned 0x74811790 [0114.547] GetProcAddress (hModule=0x74810000, lpProcName="PutClassWmi") returned 0x74811810 [0114.548] GetProcAddress (hModule=0x74810000, lpProcName="CloneEnumWbemClassObject") returned 0x74811890 [0114.550] GetProcAddress (hModule=0x74810000, lpProcName="ConnectServerWmi") returned 0x748124b7 [0114.551] CoCreateInstance (in: rclsid=0x748113a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x748112d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x824ee38 | out: ppv=0x824ee38*=0x136f110) returned 0x0 [0114.551] IWbemLocator:ConnectServer (in: This=0x136f110, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x824ee84 | out: ppNamespace=0x824ee84*=0x1384c50) returned 0x0 [0115.586] IUnknown:QueryInterface (in: This=0x1384c50, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x824ed54 | out: ppvObject=0x824ed54*=0x1386e2c) returned 0x0 [0115.586] IClientSecurity:QueryBlanket (in: This=0x1386e2c, pProxy=0x1384c50, pAuthnSvc=0x824ed9c, pAuthzSvc=0x824ed98, pServerPrincName=0x824eda8, pAuthnLevel=0x824eda0, pImpLevel=0x824ed8c, pAuthInfo=0x824ed90, pCapabilites=0x824ed94 | out: pAuthnSvc=0x824ed9c*=0xa, pAuthzSvc=0x824ed98*=0x0, pServerPrincName=0x824eda8, pAuthnLevel=0x824eda0*=0x6, pImpLevel=0x824ed8c*=0x2, pAuthInfo=0x824ed90, pCapabilites=0x824ed94*=0x1) returned 0x0 [0115.586] IUnknown:Release (This=0x1386e2c) returned 0x1 [0115.586] IUnknown:QueryInterface (in: This=0x1384c50, riid=0x74811250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x824ed48 | out: ppvObject=0x824ed48*=0x1386e50) returned 0x0 [0115.586] IUnknown:QueryInterface (in: This=0x1384c50, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x824ed44 | out: ppvObject=0x824ed44*=0x1386e2c) returned 0x0 [0115.587] IClientSecurity:SetBlanket (This=0x1386e2c, pProxy=0x1384c50, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0115.587] IUnknown:Release (This=0x1386e2c) returned 0x2 [0115.587] IUnknown:Release (This=0x1386e50) returned 0x1 [0115.587] CoTaskMemFree (pv=0x1388850) [0115.587] IUnknown:Release (This=0x136f110) returned 0x0 [0115.587] IUnknown:QueryInterface (in: This=0x1384c50, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x824e704 | out: ppvObject=0x824e704*=0x1386e50) returned 0x0 [0115.587] IUnknown:QueryInterface (in: This=0x1386e50, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x824e6c0 | out: ppvObject=0x824e6c0*=0x0) returned 0x80004002 [0115.588] IUnknown:QueryInterface (in: This=0x1386e50, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x824e5b4 | out: ppvObject=0x824e5b4*=0x0) returned 0x80004002 [0115.588] IUnknown:AddRef (This=0x1386e50) returned 0x3 [0115.588] CoGetContextToken (in: pToken=0x824e54c | out: pToken=0x824e54c) returned 0x0 [0115.588] IUnknown:QueryInterface (in: This=0x1386e50, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x824e534 | out: ppvObject=0x824e534*=0x1386dac) returned 0x0 [0115.589] IMarshal:GetUnmarshalClass (in: This=0x1386dac, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x824e53c | out: pCid=0x824e53c*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0115.589] IUnknown:Release (This=0x1386dac) returned 0x3 [0115.589] CoGetContextToken (in: pToken=0x824e544 | out: pToken=0x824e544) returned 0x0 [0115.589] IUnknown:AddRef (This=0x1386e50) returned 0x4 [0115.590] IUnknown:QueryInterface (in: This=0x1386e50, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x824e5b8 | out: ppvObject=0x824e5b8*=0x1386e34) returned 0x0 [0115.590] IUnknown:Release (This=0x1386e50) returned 0x4 [0115.590] IRpcOptions:Query (in: This=0x1386e34, pPrx=0x1386e50, dwProperty=2, pdwValue=0x824e5dc | out: pdwValue=0x824e5dc) returned 0x80004002 [0115.590] IUnknown:Release (This=0x1386e34) returned 0x3 [0115.590] IUnknown:Release (This=0x1386e50) returned 0x2 [0115.590] CoGetContextToken (in: pToken=0x824e9b8 | out: pToken=0x824e9b8) returned 0x0 [0115.590] CoGetContextToken (in: pToken=0x824e978 | out: pToken=0x824e978) returned 0x0 [0115.590] IUnknown:AddRef (This=0x1386e50) returned 0x3 [0115.590] IUnknown:QueryInterface (in: This=0x1386e50, riid=0x824e9f4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x824e9f0 | out: ppvObject=0x824e9f0*=0x1384c50) returned 0x0 [0115.590] IUnknown:Release (This=0x1386e50) returned 0x3 [0115.591] IUnknown:Release (This=0x1384c50) returned 0x2 [0115.591] IUnknown:Release (This=0x1384c50) returned 0x1 [0115.596] SysStringLen (param_1=0x0) returned 0x0 [0115.597] GetLastError () returned 0x7e [0115.598] CoUninitialize () Thread: id = 110 os_tid = 0xf4c [0115.640] CoGetContextToken (in: pToken=0x824ebcc | out: pToken=0x824ebcc) returned 0x0 [0115.640] CoGetContextToken (in: pToken=0x824ebbc | out: pToken=0x824ebbc) returned 0x0 [0115.641] CoGetMarshalSizeMax (in: pulSize=0x824eb88, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x1386e50, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x824eb88) returned 0x0 [0115.641] CoMarshalInterface (pStm=0x1387458, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x1386e50, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0123.110] CoGetContextToken (in: pToken=0x824ebcc | out: pToken=0x824ebcc) returned 0x0 [0123.110] CoGetContextToken (in: pToken=0x824ebbc | out: pToken=0x824ebbc) returned 0x0 [0123.110] CoGetMarshalSizeMax (in: pulSize=0x824eb88, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x138c408, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x824eb88) returned 0x0 [0123.111] CoMarshalInterface (pStm=0x13a6710, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x138c408, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 Thread: id = 125 os_tid = 0xfa4 [0123.090] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0123.092] CoGetClassObject (in: rclsid=0x137bd54*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x739d9630*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x841ee38 | out: ppv=0x841ee38*=0x1390eb0) returned 0x0 [0123.092] WbemLocator:IUnknown:QueryInterface (in: This=0x1390eb0, riid=0x73b097d4*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x841ec68 | out: ppvObject=0x841ec68*=0x0) returned 0x80004002 [0123.092] WbemLocator:IClassFactory:CreateInstance (in: This=0x1390eb0, pUnkOuter=0x0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x841eca0 | out: ppvObject=0x841eca0*=0x13b2fc8) returned 0x0 [0123.092] IUnknown:QueryInterface (in: This=0x13b2fc8, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x841ea44 | out: ppvObject=0x841ea44*=0x13b2fc8) returned 0x0 [0123.092] IUnknown:QueryInterface (in: This=0x13b2fc8, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x841ea00 | out: ppvObject=0x841ea00*=0x0) returned 0x80004002 [0123.093] IUnknown:AddRef (This=0x13b2fc8) returned 0x3 [0123.093] CoGetContextToken (in: pToken=0x841e88c | out: pToken=0x841e88c) returned 0x0 [0123.093] IUnknown:QueryInterface (in: This=0x13b2fc8, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x841e874 | out: ppvObject=0x841e874*=0x0) returned 0x80004002 [0123.093] CoGetContextToken (in: pToken=0x841e884 | out: pToken=0x841e884) returned 0x0 [0123.093] IUnknown:AddRef (This=0x13b2fc8) returned 0x4 [0123.093] IUnknown:QueryInterface (in: This=0x13b2fc8, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x841e8f8 | out: ppvObject=0x841e8f8*=0x0) returned 0x80004002 [0123.093] IUnknown:Release (This=0x13b2fc8) returned 0x3 [0123.093] IUnknown:Release (This=0x13b2fc8) returned 0x2 [0123.093] WbemLocator:IUnknown:Release (This=0x1390eb0) returned 0x0 [0123.093] IUnknown:Release (This=0x13b2fc8) returned 0x1 [0123.093] CoGetContextToken (in: pToken=0x841ed90 | out: pToken=0x841ed90) returned 0x0 [0123.094] CoGetContextToken (in: pToken=0x841ed50 | out: pToken=0x841ed50) returned 0x0 [0123.094] IUnknown:AddRef (This=0x13b2fc8) returned 0x2 [0123.094] IUnknown:QueryInterface (in: This=0x13b2fc8, riid=0x841edcc*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x841edc8 | out: ppvObject=0x841edc8*=0x13b2fc8) returned 0x0 [0123.094] IUnknown:Release (This=0x13b2fc8) returned 0x2 [0123.094] IUnknown:Release (This=0x13b2fc8) returned 0x1 [0123.094] IWbemPath:GetNamespaceCount (in: This=0x1375100, puCount=0x841efc0 | out: puCount=0x841efc0*=0x2) returned 0x0 [0123.094] IWbemPath:GetText (in: This=0x1375100, lFlags=8, puBuffLength=0x841efbc*=0x0, pszText=0x0 | out: puBuffLength=0x841efbc*=0xf, pszText=0x0) returned 0x0 [0123.094] IWbemPath:GetText (in: This=0x1375100, lFlags=8, puBuffLength=0x841efbc*=0xf, pszText="00000000000000" | out: puBuffLength=0x841efbc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0123.094] CoCreateInstance (in: rclsid=0x748113a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x748112d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x841ea98 | out: ppv=0x841ea98*=0x13b30d8) returned 0x0 [0123.094] IWbemLocator:ConnectServer (in: This=0x13b30d8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x841eae4 | out: ppNamespace=0x841eae4*=0x1383f30) returned 0x0 [0123.103] IUnknown:QueryInterface (in: This=0x1383f30, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x841e9b4 | out: ppvObject=0x841e9b4*=0x138c3e4) returned 0x0 [0123.103] IClientSecurity:QueryBlanket (in: This=0x138c3e4, pProxy=0x1383f30, pAuthnSvc=0x841e9fc, pAuthzSvc=0x841e9f8, pServerPrincName=0x841ea08, pAuthnLevel=0x841ea00, pImpLevel=0x841e9ec, pAuthInfo=0x841e9f0, pCapabilites=0x841e9f4 | out: pAuthnSvc=0x841e9fc*=0xa, pAuthzSvc=0x841e9f8*=0x0, pServerPrincName=0x841ea08, pAuthnLevel=0x841ea00*=0x6, pImpLevel=0x841e9ec*=0x2, pAuthInfo=0x841e9f0, pCapabilites=0x841e9f4*=0x1) returned 0x0 [0123.103] IUnknown:Release (This=0x138c3e4) returned 0x1 [0123.103] IUnknown:QueryInterface (in: This=0x1383f30, riid=0x74811250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x841e9a8 | out: ppvObject=0x841e9a8*=0x138c408) returned 0x0 [0123.103] IUnknown:QueryInterface (in: This=0x1383f30, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x841e9a4 | out: ppvObject=0x841e9a4*=0x138c3e4) returned 0x0 [0123.103] IClientSecurity:SetBlanket (This=0x138c3e4, pProxy=0x1383f30, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0123.103] IUnknown:Release (This=0x138c3e4) returned 0x2 [0123.103] IUnknown:Release (This=0x138c408) returned 0x1 [0123.103] CoTaskMemFree (pv=0x13af900) [0123.104] IUnknown:Release (This=0x13b30d8) returned 0x0 [0123.104] IUnknown:QueryInterface (in: This=0x1383f30, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x841e364 | out: ppvObject=0x841e364*=0x138c408) returned 0x0 [0123.104] IUnknown:QueryInterface (in: This=0x138c408, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x841e320 | out: ppvObject=0x841e320*=0x0) returned 0x80004002 [0123.104] IUnknown:QueryInterface (in: This=0x138c408, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x841e214 | out: ppvObject=0x841e214*=0x0) returned 0x80004002 [0123.105] IUnknown:AddRef (This=0x138c408) returned 0x3 [0123.105] CoGetContextToken (in: pToken=0x841e1ac | out: pToken=0x841e1ac) returned 0x0 [0123.105] IUnknown:QueryInterface (in: This=0x138c408, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x841e194 | out: ppvObject=0x841e194*=0x138c364) returned 0x0 [0123.105] IMarshal:GetUnmarshalClass (in: This=0x138c364, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x841e19c | out: pCid=0x841e19c*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0123.105] IUnknown:Release (This=0x138c364) returned 0x3 [0123.105] CoGetContextToken (in: pToken=0x841e1a4 | out: pToken=0x841e1a4) returned 0x0 [0123.105] IUnknown:AddRef (This=0x138c408) returned 0x4 [0123.105] IUnknown:QueryInterface (in: This=0x138c408, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x841e218 | out: ppvObject=0x841e218*=0x138c3ec) returned 0x0 [0123.105] IUnknown:Release (This=0x138c408) returned 0x4 [0123.105] IRpcOptions:Query (in: This=0x138c3ec, pPrx=0x138c408, dwProperty=2, pdwValue=0x841e23c | out: pdwValue=0x841e23c) returned 0x80004002 [0123.105] IUnknown:Release (This=0x138c3ec) returned 0x3 [0123.105] IUnknown:Release (This=0x138c408) returned 0x2 [0123.106] CoGetContextToken (in: pToken=0x841e618 | out: pToken=0x841e618) returned 0x0 [0123.106] CoGetContextToken (in: pToken=0x841e5d8 | out: pToken=0x841e5d8) returned 0x0 [0123.106] IUnknown:AddRef (This=0x138c408) returned 0x3 [0123.106] IUnknown:QueryInterface (in: This=0x138c408, riid=0x841e654*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x841e650 | out: ppvObject=0x841e650*=0x1383f30) returned 0x0 [0123.106] IUnknown:Release (This=0x138c408) returned 0x3 [0123.106] IUnknown:Release (This=0x1383f30) returned 0x2 [0123.106] IUnknown:Release (This=0x1383f30) returned 0x1 [0123.106] SysStringLen (param_1=0x0) returned 0x0 [0123.106] GetLastError () returned 0x0 [0123.106] CoUninitialize () Thread: id = 126 os_tid = 0xfa8 [0123.348] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0123.452] GetFullPathNameW (in: lpFileName="\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\temp", lpFilePart=0x0) returned 0x7 [0123.452] GetLastError () returned 0x0 [0123.452] SetErrorMode (uMode=0x1) returned 0x0 [0123.452] GetFileAttributesExW (in: lpFileName="C:\\temp" (normalized: "c:\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0123.452] GetLastError () returned 0x2 [0123.452] SetErrorMode (uMode=0x0) returned 0x1 [0123.452] GetFullPathNameW (in: lpFileName="\\temp", nBufferLength=0x105, lpBuffer=0x841ed1c, lpFilePart=0x0 | out: lpBuffer="C:\\temp", lpFilePart=0x0) returned 0x7 [0123.452] GetLastError () returned 0x2 [0123.452] SetErrorMode (uMode=0x1) returned 0x0 [0123.452] GetFileAttributesExW (in: lpFileName="C:\\temp" (normalized: "c:\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f138 | out: lpFileInformation=0x841f138*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0123.452] GetLastError () returned 0x2 [0123.452] SetErrorMode (uMode=0x0) returned 0x1 [0123.454] CreateDirectoryW (lpPathName="C:\\temp" (normalized: "c:\\temp"), lpSecurityAttributes=0x0) returned 1 [0123.458] GetLastError () returned 0x2 [0123.458] GetFullPathNameW (in: lpFileName="\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x12 [0123.458] GetLastError () returned 0x2 [0123.458] SetErrorMode (uMode=0x1) returned 0x0 [0123.458] GetFileAttributesExW (in: lpFileName="C:\\temp\\tempgh.exe" (normalized: "c:\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0123.458] GetLastError () returned 0x2 [0123.458] SetErrorMode (uMode=0x0) returned 0x1 [0123.458] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x841ecb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0123.458] GetLastError () returned 0x2 [0123.458] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", nBufferLength=0x105, lpBuffer=0x841ebf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe", lpFilePart=0x0) returned 0x31 [0123.458] GetLastError () returned 0x2 [0123.458] SetErrorMode (uMode=0x1) returned 0x0 [0123.458] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\vfggggg.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\vfggggg.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x564 [0123.458] GetLastError () returned 0x0 [0123.458] GetFileType (hFile=0x564) returned 0x1 [0123.458] SetErrorMode (uMode=0x0) returned 0x1 [0123.458] GetFileType (hFile=0x564) returned 0x1 [0123.459] GetFileSize (in: hFile=0x564, lpFileSizeHigh=0x841f1a4 | out: lpFileSizeHigh=0x841f1a4*=0x0) returned 0xe8a00 [0123.459] GetLastError () returned 0x0 [0123.460] ReadFile (in: hFile=0x564, lpBuffer=0x6e84bc0, nNumberOfBytesToRead=0xe8a00, lpNumberOfBytesRead=0x841f14c, lpOverlapped=0x0 | out: lpBuffer=0x6e84bc0*, lpNumberOfBytesRead=0x841f14c*=0xe8a00, lpOverlapped=0x0) returned 1 [0123.469] GetLastError () returned 0x0 [0123.470] CloseHandle (hObject=0x564) returned 1 [0123.470] GetLastError () returned 0x0 [0123.470] GetFullPathNameW (in: lpFileName="\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ebf8, lpFilePart=0x0 | out: lpBuffer="C:\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x12 [0123.470] GetLastError () returned 0x0 [0123.470] SetErrorMode (uMode=0x1) returned 0x0 [0123.470] CreateFileW (lpFileName="C:\\temp\\tempgh.exe" (normalized: "c:\\temp\\tempgh.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x564 [0123.470] GetLastError () returned 0x0 [0123.470] GetFileType (hFile=0x564) returned 0x1 [0123.471] SetErrorMode (uMode=0x0) returned 0x1 [0123.471] GetFileType (hFile=0x564) returned 0x1 [0123.471] WriteFile (in: hFile=0x564, lpBuffer=0x6e84bc0*, nNumberOfBytesToWrite=0xe8a00, lpNumberOfBytesWritten=0x841f158, lpOverlapped=0x0 | out: lpBuffer=0x6e84bc0*, lpNumberOfBytesWritten=0x841f158*=0xe8a00, lpOverlapped=0x0) returned 1 [0123.493] GetLastError () returned 0x0 [0123.493] CloseHandle (hObject=0x564) returned 1 [0123.503] GetLastError () returned 0x0 [0123.503] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x564) returned 0x0 [0123.504] RegQueryValueExW (in: hKey=0x564, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x0, lpData=0x0, lpcbData=0x841f174*=0x0) returned 0x2 [0123.505] RegSetValueExW (in: hKey=0x564, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="\\temp\\tempgh.exe", cbData=0x22 | out: lpData="\\temp\\tempgh.exe") returned 0x0 [0123.527] RegCloseKey (hKey=0x564) returned 0x0 [0123.536] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0123.536] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0123.536] GetLastError () returned 0x3f0 [0123.562] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0123.562] GetLastError () returned 0x3f0 [0123.562] SetErrorMode (uMode=0x1) returned 0x0 [0123.563] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0123.563] GetLastError () returned 0x3 [0123.611] SetErrorMode (uMode=0x0) returned 0x1 [0124.747] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0124.747] GetLastError () returned 0x3 [0124.747] SetErrorMode (uMode=0x1) returned 0x0 [0124.748] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0124.748] GetLastError () returned 0x3 [0124.748] SetErrorMode (uMode=0x0) returned 0x1 [0124.748] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0124.748] GetLastError () returned 0x3 [0124.748] SetErrorMode (uMode=0x1) returned 0x0 [0124.748] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0124.748] GetLastError () returned 0x3 [0124.748] SetErrorMode (uMode=0x0) returned 0x1 [0124.749] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x58c) returned 0x0 [0124.749] RegQueryValueExW (in: hKey=0x58c, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0124.749] RegSetValueExW (in: hKey=0x58c, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0124.749] RegCloseKey (hKey=0x58c) returned 0x0 [0124.749] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0124.749] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0124.749] GetLastError () returned 0x3f0 [0124.750] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0124.750] GetLastError () returned 0x3f0 [0124.750] SetErrorMode (uMode=0x1) returned 0x0 [0124.750] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0124.750] GetLastError () returned 0x3 [0124.752] SetErrorMode (uMode=0x0) returned 0x1 [0125.996] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0125.996] GetLastError () returned 0x3 [0125.996] SetErrorMode (uMode=0x1) returned 0x0 [0125.996] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0125.996] GetLastError () returned 0x3 [0125.996] SetErrorMode (uMode=0x0) returned 0x1 [0125.996] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0125.996] GetLastError () returned 0x3 [0125.996] SetErrorMode (uMode=0x1) returned 0x0 [0125.997] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0125.997] GetLastError () returned 0x3 [0125.997] SetErrorMode (uMode=0x0) returned 0x1 [0125.997] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x5e4) returned 0x0 [0125.997] RegQueryValueExW (in: hKey=0x5e4, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0125.997] RegSetValueExW (in: hKey=0x5e4, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0125.997] RegCloseKey (hKey=0x5e4) returned 0x0 [0125.998] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0125.998] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0125.998] GetLastError () returned 0x3f0 [0125.998] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0125.998] GetLastError () returned 0x3f0 [0125.998] SetErrorMode (uMode=0x1) returned 0x0 [0125.998] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffff [0125.998] GetLastError () returned 0x3 [0126.000] SetErrorMode (uMode=0x0) returned 0x1 [0127.053] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0127.053] GetLastError () returned 0x3 [0127.053] SetErrorMode (uMode=0x1) returned 0x0 [0127.053] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0127.053] GetLastError () returned 0x3 [0127.053] SetErrorMode (uMode=0x0) returned 0x1 [0127.053] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0127.053] GetLastError () returned 0x3 [0127.053] SetErrorMode (uMode=0x1) returned 0x0 [0127.053] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0127.054] GetLastError () returned 0x3 [0127.054] SetErrorMode (uMode=0x0) returned 0x1 [0127.054] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x640) returned 0x0 [0127.054] RegQueryValueExW (in: hKey=0x640, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0127.054] RegSetValueExW (in: hKey=0x640, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0127.054] RegCloseKey (hKey=0x640) returned 0x0 [0127.054] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0127.054] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0127.054] GetLastError () returned 0x3f0 [0127.055] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0127.055] GetLastError () returned 0x3f0 [0127.055] SetErrorMode (uMode=0x1) returned 0x0 [0127.055] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x640 [0127.056] GetLastError () returned 0x0 [0127.056] GetFileType (hFile=0x640) returned 0x1 [0127.056] SetErrorMode (uMode=0x0) returned 0x1 [0127.056] GetFileType (hFile=0x640) returned 0x1 [0127.056] WriteFile (in: hFile=0x640, lpBuffer=0x33b8630*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x33b8630*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0127.057] GetLastError () returned 0x0 [0127.057] CloseHandle (hObject=0x640) returned 1 [0127.057] GetLastError () returned 0x0 [0128.133] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0128.133] GetLastError () returned 0x0 [0128.133] SetErrorMode (uMode=0x1) returned 0x0 [0128.133] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0128.134] GetLastError () returned 0x0 [0128.134] SetErrorMode (uMode=0x0) returned 0x1 [0128.134] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0128.134] GetLastError () returned 0x0 [0128.134] SetErrorMode (uMode=0x1) returned 0x0 [0128.134] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0128.134] GetLastError () returned 0x0 [0128.134] SetErrorMode (uMode=0x0) returned 0x1 [0128.135] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x6bc) returned 0x0 [0128.136] RegQueryValueExW (in: hKey=0x6bc, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0128.136] RegSetValueExW (in: hKey=0x6bc, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0128.136] RegCloseKey (hKey=0x6bc) returned 0x0 [0128.137] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0128.137] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0128.137] GetLastError () returned 0x3f0 [0128.139] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0128.139] GetLastError () returned 0x3f0 [0128.139] SetErrorMode (uMode=0x1) returned 0x0 [0128.139] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x6bc [0128.140] GetLastError () returned 0xb7 [0128.140] GetFileType (hFile=0x6bc) returned 0x1 [0128.140] SetErrorMode (uMode=0x0) returned 0x1 [0128.140] GetFileType (hFile=0x6bc) returned 0x1 [0128.141] WriteFile (in: hFile=0x6bc, lpBuffer=0x33c1b1c*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x33c1b1c*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0128.141] GetLastError () returned 0xb7 [0128.141] CloseHandle (hObject=0x6bc) returned 1 [0128.142] GetLastError () returned 0xb7 [0129.159] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0129.159] GetLastError () returned 0xb7 [0129.160] SetErrorMode (uMode=0x1) returned 0x0 [0129.160] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0129.160] GetLastError () returned 0xb7 [0129.160] SetErrorMode (uMode=0x0) returned 0x1 [0129.160] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0129.160] GetLastError () returned 0xb7 [0129.160] SetErrorMode (uMode=0x1) returned 0x0 [0129.160] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0129.160] GetLastError () returned 0xb7 [0129.160] SetErrorMode (uMode=0x0) returned 0x1 [0129.161] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x70c) returned 0x0 [0129.161] RegQueryValueExW (in: hKey=0x70c, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0129.161] RegSetValueExW (in: hKey=0x70c, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0129.161] RegCloseKey (hKey=0x70c) returned 0x0 [0129.161] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0129.162] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0129.162] GetLastError () returned 0x3f0 [0129.163] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0129.163] GetLastError () returned 0x3f0 [0129.163] SetErrorMode (uMode=0x1) returned 0x0 [0129.163] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x70c [0129.164] GetLastError () returned 0xb7 [0129.164] GetFileType (hFile=0x70c) returned 0x1 [0129.164] SetErrorMode (uMode=0x0) returned 0x1 [0129.164] GetFileType (hFile=0x70c) returned 0x1 [0129.164] WriteFile (in: hFile=0x70c, lpBuffer=0x33cd490*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x33cd490*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0129.165] GetLastError () returned 0xb7 [0129.165] CloseHandle (hObject=0x70c) returned 1 [0129.165] GetLastError () returned 0xb7 [0130.199] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0130.199] GetLastError () returned 0xb7 [0130.199] SetErrorMode (uMode=0x1) returned 0x0 [0130.199] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.200] GetLastError () returned 0xb7 [0130.200] SetErrorMode (uMode=0x0) returned 0x1 [0130.200] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0130.200] GetLastError () returned 0xb7 [0130.200] SetErrorMode (uMode=0x1) returned 0x0 [0130.200] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0130.200] GetLastError () returned 0xb7 [0130.200] SetErrorMode (uMode=0x0) returned 0x1 [0130.200] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x71c) returned 0x0 [0130.200] RegQueryValueExW (in: hKey=0x71c, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0130.201] RegSetValueExW (in: hKey=0x71c, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0130.201] RegCloseKey (hKey=0x71c) returned 0x0 [0130.201] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0130.201] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0130.201] GetLastError () returned 0x3f0 [0130.202] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0130.202] GetLastError () returned 0x3f0 [0130.202] SetErrorMode (uMode=0x1) returned 0x0 [0130.202] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x71c [0130.203] GetLastError () returned 0xb7 [0130.203] GetFileType (hFile=0x71c) returned 0x1 [0130.203] SetErrorMode (uMode=0x0) returned 0x1 [0130.203] GetFileType (hFile=0x71c) returned 0x1 [0130.203] WriteFile (in: hFile=0x71c, lpBuffer=0x33d4278*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x33d4278*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0130.203] GetLastError () returned 0xb7 [0130.204] CloseHandle (hObject=0x71c) returned 1 [0130.204] GetLastError () returned 0xb7 [0131.265] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0131.265] GetLastError () returned 0xb7 [0131.265] SetErrorMode (uMode=0x1) returned 0x0 [0131.266] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0131.266] GetLastError () returned 0xb7 [0131.266] SetErrorMode (uMode=0x0) returned 0x1 [0131.266] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0131.266] GetLastError () returned 0xb7 [0131.266] SetErrorMode (uMode=0x1) returned 0x0 [0131.266] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0131.266] GetLastError () returned 0xb7 [0131.266] SetErrorMode (uMode=0x0) returned 0x1 [0131.266] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x760) returned 0x0 [0131.267] RegQueryValueExW (in: hKey=0x760, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0131.267] RegSetValueExW (in: hKey=0x760, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0131.267] RegCloseKey (hKey=0x760) returned 0x0 [0131.267] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0131.267] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0131.267] GetLastError () returned 0x3f0 [0131.267] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0131.267] GetLastError () returned 0x3f0 [0131.267] SetErrorMode (uMode=0x1) returned 0x0 [0131.268] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x760 [0131.268] GetLastError () returned 0xb7 [0131.269] GetFileType (hFile=0x760) returned 0x1 [0131.269] SetErrorMode (uMode=0x0) returned 0x1 [0131.269] GetFileType (hFile=0x760) returned 0x1 [0131.269] WriteFile (in: hFile=0x760, lpBuffer=0x33df7a4*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x33df7a4*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0131.269] GetLastError () returned 0xb7 [0131.270] CloseHandle (hObject=0x760) returned 1 [0131.270] GetLastError () returned 0xb7 [0132.330] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0132.330] GetLastError () returned 0xb7 [0132.330] SetErrorMode (uMode=0x1) returned 0x0 [0132.330] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0132.330] GetLastError () returned 0xb7 [0132.330] SetErrorMode (uMode=0x0) returned 0x1 [0132.331] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0132.331] GetLastError () returned 0xb7 [0132.331] SetErrorMode (uMode=0x1) returned 0x0 [0132.331] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0132.331] GetLastError () returned 0xb7 [0132.331] SetErrorMode (uMode=0x0) returned 0x1 [0132.331] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x77c) returned 0x0 [0132.331] RegQueryValueExW (in: hKey=0x77c, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0132.331] RegSetValueExW (in: hKey=0x77c, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0132.331] RegCloseKey (hKey=0x77c) returned 0x0 [0132.332] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0132.332] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0132.332] GetLastError () returned 0x3f0 [0132.332] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0132.332] GetLastError () returned 0x3f0 [0132.332] SetErrorMode (uMode=0x1) returned 0x0 [0132.332] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x77c [0132.333] GetLastError () returned 0xb7 [0132.333] GetFileType (hFile=0x77c) returned 0x1 [0132.333] SetErrorMode (uMode=0x0) returned 0x1 [0132.333] GetFileType (hFile=0x77c) returned 0x1 [0132.334] WriteFile (in: hFile=0x77c, lpBuffer=0x3401c9c*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x3401c9c*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0132.334] GetLastError () returned 0xb7 [0132.334] CloseHandle (hObject=0x77c) returned 1 [0132.335] GetLastError () returned 0xb7 [0133.353] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0133.354] GetLastError () returned 0xb7 [0133.354] SetErrorMode (uMode=0x1) returned 0x0 [0133.354] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0133.354] GetLastError () returned 0xb7 [0133.354] SetErrorMode (uMode=0x0) returned 0x1 [0133.354] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0133.354] GetLastError () returned 0xb7 [0133.354] SetErrorMode (uMode=0x1) returned 0x0 [0133.354] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0133.354] GetLastError () returned 0xb7 [0133.354] SetErrorMode (uMode=0x0) returned 0x1 [0133.355] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x85c) returned 0x0 [0133.355] RegQueryValueExW (in: hKey=0x85c, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0133.355] RegSetValueExW (in: hKey=0x85c, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0133.355] RegCloseKey (hKey=0x85c) returned 0x0 [0133.355] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0133.355] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0133.355] GetLastError () returned 0x3f0 [0133.356] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0133.356] GetLastError () returned 0x3f0 [0133.356] SetErrorMode (uMode=0x1) returned 0x0 [0133.356] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x85c [0133.357] GetLastError () returned 0xb7 [0133.357] GetFileType (hFile=0x85c) returned 0x1 [0133.357] SetErrorMode (uMode=0x0) returned 0x1 [0133.357] GetFileType (hFile=0x85c) returned 0x1 [0133.357] WriteFile (in: hFile=0x85c, lpBuffer=0x340f190*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x340f190*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0133.358] GetLastError () returned 0xb7 [0133.358] CloseHandle (hObject=0x85c) returned 1 [0133.358] GetLastError () returned 0xb7 [0134.411] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0134.411] GetLastError () returned 0xb7 [0134.411] SetErrorMode (uMode=0x1) returned 0x0 [0134.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0134.411] GetLastError () returned 0xb7 [0134.411] SetErrorMode (uMode=0x0) returned 0x1 [0134.411] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0134.411] GetLastError () returned 0xb7 [0134.411] SetErrorMode (uMode=0x1) returned 0x0 [0134.411] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0134.411] GetLastError () returned 0xb7 [0134.412] SetErrorMode (uMode=0x0) returned 0x1 [0134.412] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x8b4) returned 0x0 [0134.412] RegQueryValueExW (in: hKey=0x8b4, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0134.412] RegSetValueExW (in: hKey=0x8b4, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0134.412] RegCloseKey (hKey=0x8b4) returned 0x0 [0134.412] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0134.413] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0134.413] GetLastError () returned 0x3f0 [0134.413] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0134.413] GetLastError () returned 0x3f0 [0134.413] SetErrorMode (uMode=0x1) returned 0x0 [0134.413] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x8b4 [0134.414] GetLastError () returned 0xb7 [0134.414] GetFileType (hFile=0x8b4) returned 0x1 [0134.414] SetErrorMode (uMode=0x0) returned 0x1 [0134.414] GetFileType (hFile=0x8b4) returned 0x1 [0134.414] WriteFile (in: hFile=0x8b4, lpBuffer=0x3424f44*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x3424f44*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0134.415] GetLastError () returned 0xb7 [0134.415] CloseHandle (hObject=0x8b4) returned 1 [0134.415] GetLastError () returned 0xb7 [0135.489] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0135.489] GetLastError () returned 0xb7 [0135.489] SetErrorMode (uMode=0x1) returned 0x0 [0135.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0135.490] GetLastError () returned 0xb7 [0135.490] SetErrorMode (uMode=0x0) returned 0x1 [0135.490] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0135.491] GetLastError () returned 0xb7 [0135.491] SetErrorMode (uMode=0x1) returned 0x0 [0135.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0135.491] GetLastError () returned 0xb7 [0135.491] SetErrorMode (uMode=0x0) returned 0x1 [0135.491] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x924) returned 0x0 [0135.491] RegQueryValueExW (in: hKey=0x924, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0135.491] RegSetValueExW (in: hKey=0x924, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0135.492] RegCloseKey (hKey=0x924) returned 0x0 [0135.492] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0135.492] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0135.492] GetLastError () returned 0x3f0 [0135.495] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0135.495] GetLastError () returned 0x3f0 [0135.495] SetErrorMode (uMode=0x1) returned 0x0 [0135.495] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x924 [0135.496] GetLastError () returned 0xb7 [0135.496] GetFileType (hFile=0x924) returned 0x1 [0135.496] SetErrorMode (uMode=0x0) returned 0x1 [0135.496] GetFileType (hFile=0x924) returned 0x1 [0135.496] WriteFile (in: hFile=0x924, lpBuffer=0x342ec8c*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x342ec8c*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0135.499] GetLastError () returned 0xb7 [0135.500] CloseHandle (hObject=0x924) returned 1 [0135.500] GetLastError () returned 0xb7 [0136.547] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0136.548] GetLastError () returned 0xb7 [0136.548] SetErrorMode (uMode=0x1) returned 0x0 [0136.548] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0136.548] GetLastError () returned 0xb7 [0136.548] SetErrorMode (uMode=0x0) returned 0x1 [0136.548] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0136.548] GetLastError () returned 0xb7 [0136.548] SetErrorMode (uMode=0x1) returned 0x0 [0136.548] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0136.548] GetLastError () returned 0xb7 [0136.548] SetErrorMode (uMode=0x0) returned 0x1 [0136.549] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0xb08) returned 0x0 [0136.549] RegQueryValueExW (in: hKey=0xb08, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0136.549] RegSetValueExW (in: hKey=0xb08, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0136.549] RegCloseKey (hKey=0xb08) returned 0x0 [0136.549] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0136.549] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0136.549] GetLastError () returned 0x3f0 [0136.550] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0136.550] GetLastError () returned 0x3f0 [0136.550] SetErrorMode (uMode=0x1) returned 0x0 [0136.550] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xb08 [0136.551] GetLastError () returned 0xb7 [0136.551] GetFileType (hFile=0xb08) returned 0x1 [0136.551] SetErrorMode (uMode=0x0) returned 0x1 [0136.551] GetFileType (hFile=0xb08) returned 0x1 [0136.551] WriteFile (in: hFile=0xb08, lpBuffer=0x3435804*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x3435804*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0136.552] GetLastError () returned 0xb7 [0136.552] CloseHandle (hObject=0xb08) returned 1 [0136.552] GetLastError () returned 0xb7 [0137.564] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0137.564] GetLastError () returned 0xb7 [0137.564] SetErrorMode (uMode=0x1) returned 0x0 [0137.564] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0137.564] GetLastError () returned 0xb7 [0137.564] SetErrorMode (uMode=0x0) returned 0x1 [0137.564] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0137.564] GetLastError () returned 0xb7 [0137.564] SetErrorMode (uMode=0x1) returned 0x0 [0137.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0137.565] GetLastError () returned 0xb7 [0137.565] SetErrorMode (uMode=0x0) returned 0x1 [0137.565] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0xc0c) returned 0x0 [0137.565] RegQueryValueExW (in: hKey=0xc0c, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0137.565] RegSetValueExW (in: hKey=0xc0c, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0137.565] RegCloseKey (hKey=0xc0c) returned 0x0 [0137.565] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0137.566] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0137.566] GetLastError () returned 0x3f0 [0137.566] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0137.566] GetLastError () returned 0x3f0 [0137.566] SetErrorMode (uMode=0x1) returned 0x0 [0137.566] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xc0c [0137.567] GetLastError () returned 0xb7 [0137.568] GetFileType (hFile=0xc0c) returned 0x1 [0137.568] SetErrorMode (uMode=0x0) returned 0x1 [0137.568] GetFileType (hFile=0xc0c) returned 0x1 [0137.568] WriteFile (in: hFile=0xc0c, lpBuffer=0x344db44*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x344db44*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0137.583] GetLastError () returned 0xb7 [0137.583] CloseHandle (hObject=0xc0c) returned 1 [0137.583] GetLastError () returned 0xb7 [0139.304] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0139.304] GetLastError () returned 0xb7 [0139.304] SetErrorMode (uMode=0x1) returned 0x0 [0139.304] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0139.304] GetLastError () returned 0xb7 [0139.305] SetErrorMode (uMode=0x0) returned 0x1 [0139.305] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0139.305] GetLastError () returned 0xb7 [0139.305] SetErrorMode (uMode=0x1) returned 0x0 [0139.305] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0139.305] GetLastError () returned 0xb7 [0139.305] SetErrorMode (uMode=0x0) returned 0x1 [0139.305] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0xbdc) returned 0x0 [0139.305] RegQueryValueExW (in: hKey=0xbdc, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0139.306] RegSetValueExW (in: hKey=0xbdc, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0139.306] RegCloseKey (hKey=0xbdc) returned 0x0 [0139.306] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0139.306] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0139.306] GetLastError () returned 0x3f0 [0139.307] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0139.307] GetLastError () returned 0x3f0 [0139.307] SetErrorMode (uMode=0x1) returned 0x0 [0139.307] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xbdc [0139.308] GetLastError () returned 0xb7 [0139.308] GetFileType (hFile=0xbdc) returned 0x1 [0139.308] SetErrorMode (uMode=0x0) returned 0x1 [0139.308] GetFileType (hFile=0xbdc) returned 0x1 [0139.308] WriteFile (in: hFile=0xbdc, lpBuffer=0x34528d0*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x34528d0*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0139.309] GetLastError () returned 0xb7 [0139.309] CloseHandle (hObject=0xbdc) returned 1 [0139.309] GetLastError () returned 0xb7 [0140.354] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0140.354] GetLastError () returned 0xb7 [0140.354] SetErrorMode (uMode=0x1) returned 0x0 [0140.354] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0140.354] GetLastError () returned 0xb7 [0140.354] SetErrorMode (uMode=0x0) returned 0x1 [0140.355] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0140.355] GetLastError () returned 0xb7 [0140.355] SetErrorMode (uMode=0x1) returned 0x0 [0140.355] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0140.355] GetLastError () returned 0xb7 [0140.355] SetErrorMode (uMode=0x0) returned 0x1 [0140.355] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0xb34) returned 0x0 [0140.355] RegQueryValueExW (in: hKey=0xb34, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0140.355] RegSetValueExW (in: hKey=0xb34, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0140.355] RegCloseKey (hKey=0xb34) returned 0x0 [0140.356] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0140.356] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0140.356] GetLastError () returned 0x3f0 [0140.356] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0140.356] GetLastError () returned 0x3f0 [0140.356] SetErrorMode (uMode=0x1) returned 0x0 [0140.356] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xb34 [0140.357] GetLastError () returned 0xb7 [0140.357] GetFileType (hFile=0xb34) returned 0x1 [0140.357] SetErrorMode (uMode=0x0) returned 0x1 [0140.357] GetFileType (hFile=0xb34) returned 0x1 [0140.357] WriteFile (in: hFile=0xb34, lpBuffer=0x345b8bc*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x345b8bc*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0140.358] GetLastError () returned 0xb7 [0140.358] CloseHandle (hObject=0xb34) returned 1 [0140.358] GetLastError () returned 0xb7 [0141.371] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0141.371] GetLastError () returned 0xb7 [0141.371] SetErrorMode (uMode=0x1) returned 0x0 [0141.371] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0141.371] GetLastError () returned 0xb7 [0141.371] SetErrorMode (uMode=0x0) returned 0x1 [0141.371] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0141.372] GetLastError () returned 0xb7 [0141.372] SetErrorMode (uMode=0x1) returned 0x0 [0141.372] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0141.372] GetLastError () returned 0xb7 [0141.372] SetErrorMode (uMode=0x0) returned 0x1 [0141.372] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0xbe0) returned 0x0 [0141.372] RegQueryValueExW (in: hKey=0xbe0, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0141.372] RegSetValueExW (in: hKey=0xbe0, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0141.372] RegCloseKey (hKey=0xbe0) returned 0x0 [0141.373] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0141.373] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0141.373] GetLastError () returned 0x3f0 [0141.373] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0141.373] GetLastError () returned 0x3f0 [0141.373] SetErrorMode (uMode=0x1) returned 0x0 [0141.373] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xbe0 [0141.386] GetLastError () returned 0xb7 [0141.386] GetFileType (hFile=0xbe0) returned 0x1 [0141.386] SetErrorMode (uMode=0x0) returned 0x1 [0141.386] GetFileType (hFile=0xbe0) returned 0x1 [0141.386] WriteFile (in: hFile=0xbe0, lpBuffer=0x347825c*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x347825c*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0141.386] GetLastError () returned 0xb7 [0141.387] CloseHandle (hObject=0xbe0) returned 1 [0141.387] GetLastError () returned 0xb7 [0142.432] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp", lpFilePart=0x0) returned 0x2a [0142.432] GetLastError () returned 0xb7 [0142.432] SetErrorMode (uMode=0x1) returned 0x0 [0142.432] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b1501fc, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b19c69a, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0142.432] GetLastError () returned 0xb7 [0142.432] SetErrorMode (uMode=0x0) returned 0x1 [0142.432] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", nBufferLength=0x105, lpBuffer=0x841ed10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", lpFilePart=0x0) returned 0x35 [0142.433] GetLastError () returned 0xb7 [0142.433] SetErrorMode (uMode=0x1) returned 0x0 [0142.433] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\temp\\tempgh.exe"), fInfoLevelId=0x0, lpFileInformation=0x841f190 | out: lpFileInformation=0x841f190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b19c69a, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7b19c69a, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1c292e, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe8a00)) returned 1 [0142.433] GetLastError () returned 0xb7 [0142.433] SetErrorMode (uMode=0x0) returned 0x1 [0142.433] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x2001f, phkResult=0x841f178 | out: phkResult=0x841f178*=0x7c8) returned 0x0 [0142.433] RegQueryValueExW (in: hKey=0x7c8, lpValueName="ghh", lpReserved=0x0, lpType=0x841f178, lpData=0x0, lpcbData=0x841f174*=0x0 | out: lpType=0x841f178*=0x1, lpData=0x0, lpcbData=0x841f174*=0x6c) returned 0x0 [0142.433] RegSetValueExW (in: hKey=0x7c8, lpValueName="ghh", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe", cbData=0x6c | out: lpData="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\temp\\tempgh.exe") returned 0x0 [0142.433] RegCloseKey (hKey=0x7c8) returned 0x0 [0142.433] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13cd660 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0142.434] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x841ec98, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0142.434] GetLastError () returned 0x3f0 [0142.436] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", nBufferLength=0x105, lpBuffer=0x841ebd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat", lpFilePart=0x0) returned 0x37 [0142.436] GetLastError () returned 0x3f0 [0142.436] SetErrorMode (uMode=0x1) returned 0x0 [0142.436] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Path.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\path.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0142.437] GetLastError () returned 0xb7 [0142.437] GetFileType (hFile=0x7c8) returned 0x1 [0142.437] SetErrorMode (uMode=0x0) returned 0x1 [0142.437] GetFileType (hFile=0x7c8) returned 0x1 [0142.437] WriteFile (in: hFile=0x7c8, lpBuffer=0x34e0470*, nNumberOfBytesToWrite=0x35, lpNumberOfBytesWritten=0x841f0f8, lpOverlapped=0x0 | out: lpBuffer=0x34e0470*, lpNumberOfBytesWritten=0x841f0f8*=0x35, lpOverlapped=0x0) returned 1 [0142.438] GetLastError () returned 0xb7 [0142.438] CloseHandle (hObject=0x7c8) returned 1 [0142.439] GetLastError () returned 0xb7 Thread: id = 127 os_tid = 0xfdc [0126.793] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0127.183] GetForegroundWindow () returned 0x301fa [0127.183] GetLastError () returned 0x0 [0127.186] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0127.186] GetLastError () returned 0x0 [0127.189] GetForegroundWindow () returned 0x301fa [0127.189] GetLastError () returned 0x0 [0127.189] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0127.189] GetLastError () returned 0x0 [0127.600] GetForegroundWindow () returned 0x301fa [0127.600] GetLastError () returned 0x0 [0127.601] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0127.601] GetLastError () returned 0x0 [0127.990] GetForegroundWindow () returned 0x301fa [0127.990] GetLastError () returned 0x0 [0127.990] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0127.991] GetLastError () returned 0x0 [0128.525] GetForegroundWindow () returned 0x100ca [0128.525] GetLastError () returned 0x0 [0128.526] GetWindowTextA (in: hWnd=0x100ca, lpString=0x13d768c, nMaxCount=255 | out: lpString="FolderView") returned 10 [0128.526] GetLastError () returned 0x0 [0128.526] GetForegroundWindow () returned 0x301fa [0128.526] GetLastError () returned 0x0 [0128.526] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0128.526] GetLastError () returned 0x0 [0128.834] GetForegroundWindow () returned 0x301fa [0128.834] GetLastError () returned 0x0 [0128.834] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0128.834] GetLastError () returned 0x0 [0129.137] GetForegroundWindow () returned 0x301fa [0129.137] GetLastError () returned 0x0 [0129.137] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0129.137] GetLastError () returned 0x0 [0129.465] GetForegroundWindow () returned 0x301fa [0129.465] GetLastError () returned 0x0 [0129.465] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0129.465] GetLastError () returned 0x0 [0129.777] GetForegroundWindow () returned 0x100ca [0129.778] GetLastError () returned 0x0 [0129.778] GetWindowTextA (in: hWnd=0x100ca, lpString=0x13d768c, nMaxCount=255 | out: lpString="FolderView") returned 10 [0129.778] GetLastError () returned 0x0 [0129.778] GetForegroundWindow () returned 0x301fa [0129.778] GetLastError () returned 0x0 [0129.778] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0129.778] GetLastError () returned 0x0 [0130.106] GetForegroundWindow () returned 0x301fa [0130.106] GetLastError () returned 0x0 [0130.106] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0130.106] GetLastError () returned 0x0 [0130.528] GetForegroundWindow () returned 0x301fa [0130.528] GetLastError () returned 0x0 [0130.528] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0130.528] GetLastError () returned 0x0 [0130.981] GetForegroundWindow () returned 0x301fa [0130.982] GetLastError () returned 0x0 [0130.982] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0130.982] GetLastError () returned 0x0 [0131.360] GetForegroundWindow () returned 0x100ca [0131.360] GetLastError () returned 0x0 [0131.360] GetWindowTextA (in: hWnd=0x100ca, lpString=0x13d768c, nMaxCount=255 | out: lpString="FolderView") returned 10 [0131.360] GetLastError () returned 0x0 [0131.360] GetForegroundWindow () returned 0x301fa [0131.360] GetLastError () returned 0x0 [0131.360] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0131.361] GetLastError () returned 0x0 [0131.674] GetForegroundWindow () returned 0x301fa [0131.674] GetLastError () returned 0x0 [0131.674] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0131.674] GetLastError () returned 0x0 [0132.081] GetForegroundWindow () returned 0x301fa [0132.081] GetLastError () returned 0x0 [0132.081] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0132.081] GetLastError () returned 0x0 [0132.417] GetForegroundWindow () returned 0x301fa [0132.417] GetLastError () returned 0x0 [0132.417] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0132.417] GetLastError () returned 0x0 [0132.849] GetForegroundWindow () returned 0x100ca [0132.849] GetLastError () returned 0x0 [0132.849] GetWindowTextA (in: hWnd=0x100ca, lpString=0x13d768c, nMaxCount=255 | out: lpString="FolderView") returned 10 [0132.849] GetLastError () returned 0x0 [0132.849] GetForegroundWindow () returned 0x301fa [0132.849] GetLastError () returned 0x0 [0132.849] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0132.849] GetLastError () returned 0x0 [0133.302] GetForegroundWindow () returned 0x301fa [0133.302] GetLastError () returned 0x0 [0133.302] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0133.302] GetLastError () returned 0x0 [0133.617] GetForegroundWindow () returned 0x301fa [0133.617] GetLastError () returned 0x0 [0133.617] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0133.617] GetLastError () returned 0x0 [0133.941] GetForegroundWindow () returned 0x301fa [0133.941] GetLastError () returned 0x0 [0133.942] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0133.942] GetLastError () returned 0x0 [0134.419] GetForegroundWindow () returned 0x100ca [0134.419] GetLastError () returned 0x0 [0134.419] GetWindowTextA (in: hWnd=0x100ca, lpString=0x13d768c, nMaxCount=255 | out: lpString="FolderView") returned 10 [0134.419] GetLastError () returned 0x0 [0134.419] GetForegroundWindow () returned 0x301fa [0134.419] GetLastError () returned 0x0 [0134.419] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0134.419] GetLastError () returned 0x0 [0134.721] GetForegroundWindow () returned 0x301fa [0134.721] GetLastError () returned 0x0 [0134.721] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0134.722] GetLastError () returned 0x0 [0135.162] GetForegroundWindow () returned 0x301fa [0135.163] GetLastError () returned 0x0 [0135.163] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0135.163] GetLastError () returned 0x0 [0135.501] GetForegroundWindow () returned 0x301fa [0135.501] GetLastError () returned 0x0 [0135.501] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0135.501] GetLastError () returned 0x0 [0135.829] GetForegroundWindow () returned 0x100ca [0135.829] GetLastError () returned 0x0 [0135.829] GetWindowTextA (in: hWnd=0x100ca, lpString=0x13d768c, nMaxCount=255 | out: lpString="FolderView") returned 10 [0135.829] GetLastError () returned 0x0 [0135.830] GetForegroundWindow () returned 0x301fa [0135.830] GetLastError () returned 0x0 [0135.830] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0135.830] GetLastError () returned 0x0 [0136.148] GetForegroundWindow () returned 0x301fa [0136.148] GetLastError () returned 0x0 [0136.148] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0136.148] GetLastError () returned 0x0 [0136.556] GetForegroundWindow () returned 0x301fa [0136.556] GetLastError () returned 0x0 [0136.556] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0136.556] GetLastError () returned 0x0 [0136.867] GetForegroundWindow () returned 0x301fa [0136.867] GetLastError () returned 0x0 [0136.867] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0136.867] GetLastError () returned 0x0 [0137.221] GetForegroundWindow () returned 0x100ca [0137.221] GetLastError () returned 0x0 [0137.221] GetWindowTextA (in: hWnd=0x100ca, lpString=0x13d768c, nMaxCount=255 | out: lpString="FolderView") returned 10 [0137.221] GetLastError () returned 0x0 [0137.221] GetForegroundWindow () returned 0x301fa [0137.221] GetLastError () returned 0x0 [0137.221] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0137.221] GetLastError () returned 0x0 [0137.560] GetForegroundWindow () returned 0x301fa [0137.560] GetLastError () returned 0x0 [0137.560] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0137.560] GetLastError () returned 0x0 [0139.303] GetForegroundWindow () returned 0x301fa [0139.303] GetLastError () returned 0x0 [0139.304] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0139.304] GetLastError () returned 0x0 [0139.657] GetForegroundWindow () returned 0x301fa [0139.657] GetLastError () returned 0x0 [0139.657] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0139.657] GetLastError () returned 0x0 [0139.987] GetForegroundWindow () returned 0x100ca [0139.987] GetLastError () returned 0x0 [0139.987] GetWindowTextA (in: hWnd=0x100ca, lpString=0x13d768c, nMaxCount=255 | out: lpString="FolderView") returned 10 [0139.987] GetLastError () returned 0x0 [0139.987] GetForegroundWindow () returned 0x301fa [0139.987] GetLastError () returned 0x0 [0139.987] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0139.987] GetLastError () returned 0x0 [0140.308] GetForegroundWindow () returned 0x301fa [0140.308] GetLastError () returned 0x0 [0140.308] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0140.309] GetLastError () returned 0x0 [0140.618] GetForegroundWindow () returned 0x301fa [0140.618] GetLastError () returned 0x0 [0140.618] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0140.618] GetLastError () returned 0x0 [0140.986] GetForegroundWindow () returned 0x301fa [0140.986] GetLastError () returned 0x0 [0140.987] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0140.987] GetLastError () returned 0x0 [0141.291] GetForegroundWindow () returned 0x100ca [0141.291] GetLastError () returned 0x0 [0141.291] GetWindowTextA (in: hWnd=0x100ca, lpString=0x13d768c, nMaxCount=255 | out: lpString="FolderView") returned 10 [0141.291] GetLastError () returned 0x0 [0141.291] GetForegroundWindow () returned 0x301fa [0141.291] GetLastError () returned 0x0 [0141.291] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0141.291] GetLastError () returned 0x0 [0141.684] GetForegroundWindow () returned 0x301fa [0141.684] GetLastError () returned 0x0 [0141.684] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0141.684] GetLastError () returned 0x0 [0142.028] GetForegroundWindow () returned 0x301fa [0142.028] GetLastError () returned 0x0 [0142.028] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0142.028] GetLastError () returned 0x0 [0142.379] GetForegroundWindow () returned 0x301fa [0142.379] GetLastError () returned 0x0 [0142.379] GetWindowTextA (in: hWnd=0x301fa, lpString=0x13d768c, nMaxCount=255 | out: lpString="Cleanup") returned 7 [0142.379] GetLastError () returned 0x0 Thread: id = 128 os_tid = 0xfe0 [0126.806] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0126.814] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\", nBufferLength=0x105, lpBuffer=0x889ec20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\", lpFilePart=0x0) returned 0x34 [0126.814] GetLastError () returned 0x0 [0126.815] SetErrorMode (uMode=0x1) returned 0x0 [0126.815] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs"), fInfoLevelId=0x0, lpFileInformation=0x889f0a0 | out: lpFileInformation=0x889f0a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.815] GetLastError () returned 0x3 [0126.815] SetErrorMode (uMode=0x0) returned 0x1 [0126.815] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\", nBufferLength=0x105, lpBuffer=0x889ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\", lpFilePart=0x0) returned 0x34 [0126.815] GetLastError () returned 0x3 [0126.815] SetErrorMode (uMode=0x1) returned 0x0 [0126.815] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs"), fInfoLevelId=0x0, lpFileInformation=0x889f048 | out: lpFileInformation=0x889f048*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.815] GetLastError () returned 0x3 [0126.815] SetErrorMode (uMode=0x0) returned 0x1 [0126.815] SetErrorMode (uMode=0x1) returned 0x0 [0126.815] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent"), fInfoLevelId=0x0, lpFileInformation=0x889f048 | out: lpFileInformation=0x889f048*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.815] GetLastError () returned 0x2 [0126.818] SetErrorMode (uMode=0x0) returned 0x1 [0126.818] SetErrorMode (uMode=0x1) returned 0x0 [0126.819] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x889f048 | out: lpFileInformation=0x889f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa832513c, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0x7b1501fc, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7b1501fc, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0126.819] GetLastError () returned 0x2 [0126.819] SetErrorMode (uMode=0x0) returned 0x1 [0126.819] SetErrorMode (uMode=0x1) returned 0x0 [0126.819] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata"), fInfoLevelId=0x0, lpFileInformation=0x889f048 | out: lpFileInformation=0x889f048*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xa832513c, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0xa86b89c3, ftLastAccessTime.dwHighDateTime=0x1d2d079, ftLastWriteTime.dwLowDateTime=0xa86b89c3, ftLastWriteTime.dwHighDateTime=0x1d2d079, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0126.820] GetLastError () returned 0x2 [0126.820] SetErrorMode (uMode=0x0) returned 0x1 [0126.820] SetErrorMode (uMode=0x1) returned 0x0 [0126.820] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps"), fInfoLevelId=0x0, lpFileInformation=0x889f048 | out: lpFileInformation=0x889f048*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa82b2a28, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0xde27753, ftLastAccessTime.dwHighDateTime=0x1d2d411, ftLastWriteTime.dwLowDateTime=0xde27753, ftLastWriteTime.dwHighDateTime=0x1d2d411, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0126.820] GetLastError () returned 0x2 [0126.820] SetErrorMode (uMode=0x0) returned 0x1 [0126.820] SetErrorMode (uMode=0x1) returned 0x0 [0126.820] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x889f048 | out: lpFileInformation=0x889f048*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0xa82b2a28, ftLastAccessTime.dwHighDateTime=0x1d2d079, ftLastWriteTime.dwLowDateTime=0xa82b2a28, ftLastWriteTime.dwHighDateTime=0x1d2d079, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0126.820] GetLastError () returned 0x2 [0126.820] SetErrorMode (uMode=0x0) returned 0x1 [0126.820] CreateDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent"), lpSecurityAttributes=0x0) returned 1 [0126.849] GetLastError () returned 0x2 [0126.849] CreateDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs"), lpSecurityAttributes=0x0) returned 1 [0126.850] GetLastError () returned 0x2 [0126.869] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", nBufferLength=0x105, lpBuffer=0x889ec20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", lpFilePart=0x0) returned 0x3e [0126.869] GetLastError () returned 0x2 [0126.869] SetErrorMode (uMode=0x1) returned 0x0 [0126.869] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs\\04-04-2018"), fInfoLevelId=0x0, lpFileInformation=0x889f0a0 | out: lpFileInformation=0x889f0a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0126.870] GetLastError () returned 0x2 [0126.870] SetErrorMode (uMode=0x0) returned 0x1 [0126.870] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", nBufferLength=0x105, lpBuffer=0x889eae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", lpFilePart=0x0) returned 0x3e [0126.870] GetLastError () returned 0x2 [0126.870] SetErrorMode (uMode=0x1) returned 0x0 [0126.870] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs\\04-04-2018"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x628 [0126.871] GetLastError () returned 0x0 [0126.871] GetFileType (hFile=0x628) returned 0x1 [0126.871] SetErrorMode (uMode=0x0) returned 0x1 [0126.871] GetFileType (hFile=0x628) returned 0x1 [0126.871] WriteFile (in: hFile=0x628, lpBuffer=0x33abffc*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x889f008, lpOverlapped=0x0 | out: lpBuffer=0x33abffc*, lpNumberOfBytesWritten=0x889f008*=0x5, lpOverlapped=0x0) returned 1 [0126.872] GetLastError () returned 0x0 [0126.872] CloseHandle (hObject=0x628) returned 1 [0126.873] GetLastError () returned 0x0 [0131.976] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", nBufferLength=0x105, lpBuffer=0x889eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", lpFilePart=0x0) returned 0x3e [0131.976] GetLastError () returned 0x0 [0131.976] SetErrorMode (uMode=0x1) returned 0x0 [0131.976] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs\\04-04-2018"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x768 [0131.976] GetLastError () returned 0x0 [0131.976] GetFileType (hFile=0x768) returned 0x1 [0131.976] SetErrorMode (uMode=0x0) returned 0x1 [0131.976] GetFileType (hFile=0x768) returned 0x1 [0131.976] GetFileSize (in: hFile=0x768, lpFileSizeHigh=0x889f0a0 | out: lpFileSizeHigh=0x889f0a0*=0x0) returned 0x5 [0131.977] GetLastError () returned 0x0 [0131.977] ReadFile (in: hFile=0x768, lpBuffer=0x33ebd14, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x889f048, lpOverlapped=0x0 | out: lpBuffer=0x33ebd14*, lpNumberOfBytesRead=0x889f048*=0x5, lpOverlapped=0x0) returned 1 [0131.977] GetLastError () returned 0x0 [0131.977] CloseHandle (hObject=0x768) returned 1 [0131.977] GetLastError () returned 0x0 [0131.978] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", nBufferLength=0x105, lpBuffer=0x889eae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", lpFilePart=0x0) returned 0x3e [0131.978] GetLastError () returned 0x0 [0131.978] SetErrorMode (uMode=0x1) returned 0x0 [0131.978] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs\\04-04-2018"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x768 [0131.979] GetLastError () returned 0xb7 [0131.979] GetFileType (hFile=0x768) returned 0x1 [0131.979] SetErrorMode (uMode=0x0) returned 0x1 [0131.979] GetFileType (hFile=0x768) returned 0x1 [0131.979] WriteFile (in: hFile=0x768, lpBuffer=0x33f2380*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x889f008, lpOverlapped=0x0 | out: lpBuffer=0x33f2380*, lpNumberOfBytesWritten=0x889f008*=0x85, lpOverlapped=0x0) returned 1 [0131.980] GetLastError () returned 0xb7 [0131.980] CloseHandle (hObject=0x768) returned 1 [0131.985] GetLastError () returned 0xb7 [0131.985] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", nBufferLength=0x105, lpBuffer=0x889ec20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", lpFilePart=0x0) returned 0x3e [0131.985] GetLastError () returned 0xb7 [0131.985] SetErrorMode (uMode=0x1) returned 0x0 [0131.986] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs\\04-04-2018"), fInfoLevelId=0x0, lpFileInformation=0x889f0a0 | out: lpFileInformation=0x889f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d1a6191, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7d1a6191, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x802778ec, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x85)) returned 1 [0131.986] GetLastError () returned 0xb7 [0131.986] SetErrorMode (uMode=0x0) returned 0x1 [0136.996] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", nBufferLength=0x105, lpBuffer=0x889eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", lpFilePart=0x0) returned 0x3e [0136.996] GetLastError () returned 0xb7 [0136.996] SetErrorMode (uMode=0x1) returned 0x0 [0136.996] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs\\04-04-2018"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xbe4 [0136.997] GetLastError () returned 0x0 [0136.997] GetFileType (hFile=0xbe4) returned 0x1 [0136.997] SetErrorMode (uMode=0x0) returned 0x1 [0136.997] GetFileType (hFile=0xbe4) returned 0x1 [0136.997] GetFileSize (in: hFile=0xbe4, lpFileSizeHigh=0x889f0a0 | out: lpFileSizeHigh=0x889f0a0*=0x0) returned 0x85 [0136.997] GetLastError () returned 0x0 [0136.997] ReadFile (in: hFile=0xbe4, lpBuffer=0x3438730, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x889f048, lpOverlapped=0x0 | out: lpBuffer=0x3438730*, lpNumberOfBytesRead=0x889f048*=0x85, lpOverlapped=0x0) returned 1 [0136.997] GetLastError () returned 0x0 [0136.997] CloseHandle (hObject=0xbe4) returned 1 [0136.997] GetLastError () returned 0x0 [0136.998] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", nBufferLength=0x105, lpBuffer=0x889eae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", lpFilePart=0x0) returned 0x3e [0136.998] GetLastError () returned 0x0 [0136.998] SetErrorMode (uMode=0x1) returned 0x0 [0136.998] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs\\04-04-2018"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xbe4 [0136.999] GetLastError () returned 0xb7 [0136.999] GetFileType (hFile=0xbe4) returned 0x1 [0136.999] SetErrorMode (uMode=0x0) returned 0x1 [0136.999] GetFileType (hFile=0xbe4) returned 0x1 [0136.999] WriteFile (in: hFile=0xbe4, lpBuffer=0x3446e68*, nNumberOfBytesToWrite=0xe5, lpNumberOfBytesWritten=0x889f008, lpOverlapped=0x0 | out: lpBuffer=0x3446e68*, lpNumberOfBytesWritten=0x889f008*=0xe5, lpOverlapped=0x0) returned 1 [0137.000] GetLastError () returned 0xb7 [0137.000] CloseHandle (hObject=0xbe4) returned 1 [0137.007] GetLastError () returned 0xb7 [0137.007] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", nBufferLength=0x105, lpBuffer=0x889ec20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", lpFilePart=0x0) returned 0x3e [0137.007] GetLastError () returned 0xb7 [0137.007] SetErrorMode (uMode=0x1) returned 0x0 [0137.007] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs\\04-04-2018"), fInfoLevelId=0x0, lpFileInformation=0x889f0a0 | out: lpFileInformation=0x889f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d1a6191, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7d1a6191, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x8325d984, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0xe5)) returned 1 [0137.007] GetLastError () returned 0xb7 [0137.007] SetErrorMode (uMode=0x0) returned 0x1 [0142.009] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", nBufferLength=0x105, lpBuffer=0x889eaec, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", lpFilePart=0x0) returned 0x3e [0142.009] GetLastError () returned 0xb7 [0142.009] SetErrorMode (uMode=0x1) returned 0x0 [0142.009] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs\\04-04-2018"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0142.009] GetLastError () returned 0x0 [0142.009] GetFileType (hFile=0x7c8) returned 0x1 [0142.009] SetErrorMode (uMode=0x0) returned 0x1 [0142.009] GetFileType (hFile=0x7c8) returned 0x1 [0142.009] GetFileSize (in: hFile=0x7c8, lpFileSizeHigh=0x889f0a0 | out: lpFileSizeHigh=0x889f0a0*=0x0) returned 0xe5 [0142.009] GetLastError () returned 0x0 [0142.009] ReadFile (in: hFile=0x7c8, lpBuffer=0x34c47a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x889f048, lpOverlapped=0x0 | out: lpBuffer=0x34c47a0*, lpNumberOfBytesRead=0x889f048*=0xe5, lpOverlapped=0x0) returned 1 [0142.009] GetLastError () returned 0x0 [0142.010] CloseHandle (hObject=0x7c8) returned 1 [0142.010] GetLastError () returned 0x0 [0142.011] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", nBufferLength=0x105, lpBuffer=0x889eae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", lpFilePart=0x0) returned 0x3e [0142.011] GetLastError () returned 0x0 [0142.011] SetErrorMode (uMode=0x1) returned 0x0 [0142.011] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs\\04-04-2018"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7c8 [0142.012] GetLastError () returned 0xb7 [0142.012] GetFileType (hFile=0x7c8) returned 0x1 [0142.012] SetErrorMode (uMode=0x0) returned 0x1 [0142.012] GetFileType (hFile=0x7c8) returned 0x1 [0142.013] WriteFile (in: hFile=0x7c8, lpBuffer=0x34d9d68*, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x889f008, lpOverlapped=0x0 | out: lpBuffer=0x34d9d68*, lpNumberOfBytesWritten=0x889f008*=0x145, lpOverlapped=0x0) returned 1 [0142.013] GetLastError () returned 0xb7 [0142.013] CloseHandle (hObject=0x7c8) returned 1 [0142.014] GetLastError () returned 0xb7 [0142.014] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", nBufferLength=0x105, lpBuffer=0x889ec20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018", lpFilePart=0x0) returned 0x3e [0142.014] GetLastError () returned 0xb7 [0142.014] SetErrorMode (uMode=0x1) returned 0x0 [0142.014] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Logs\\04-04-2018" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\logs\\04-04-2018"), fInfoLevelId=0x0, lpFileInformation=0x889f0a0 | out: lpFileInformation=0x889f0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d1a6191, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7d1a6191, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x86210895, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x145)) returned 1 [0142.014] GetLastError () returned 0xb7 [0142.014] SetErrorMode (uMode=0x0) returned 0x1 Thread: id = 129 os_tid = 0xfe4 [0126.992] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0127.062] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0127.062] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0127.063] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0127.063] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0127.063] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0127.064] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0127.064] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0127.065] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0127.065] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0127.065] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0127.065] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0127.065] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0128.142] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0128.143] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0128.143] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0128.143] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0128.144] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0128.144] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0128.144] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0128.145] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0128.145] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0128.145] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0128.145] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0128.145] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0129.154] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0129.155] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0129.155] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0129.156] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0129.156] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0129.156] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0129.157] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0129.157] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0129.158] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0129.158] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0129.158] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0129.158] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0130.204] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0130.205] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0130.205] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0130.206] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0130.206] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0130.206] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0130.207] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0130.207] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0130.207] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0130.207] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0130.207] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0130.207] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0131.262] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0131.262] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0131.263] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0131.263] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0131.263] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0131.264] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0131.264] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0131.265] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0131.265] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0131.265] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0131.265] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0131.265] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0132.335] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0132.336] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0132.336] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0132.337] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0132.337] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0132.337] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0132.338] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0132.338] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0132.338] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0132.338] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0132.338] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0132.338] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0133.350] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0133.351] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0133.351] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0133.351] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0133.352] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0133.352] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0133.352] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0133.353] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0133.353] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0133.353] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0133.353] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0133.353] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0134.416] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0134.416] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0134.417] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0134.417] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0134.417] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0134.418] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0134.418] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0134.418] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0134.419] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0134.419] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0134.419] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0134.419] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0135.482] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0135.483] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0135.484] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0135.485] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0135.485] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0135.486] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0135.486] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0135.487] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0135.488] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0135.488] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0135.488] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0135.488] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0136.552] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0136.553] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0136.553] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0136.554] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0136.554] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0136.554] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0136.555] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0136.555] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0136.555] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0136.555] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0136.555] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0136.555] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0137.561] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0137.562] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0137.562] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0137.562] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0137.563] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0137.563] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0137.563] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0137.563] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0137.564] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0137.564] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0137.564] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0137.564] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0139.324] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0139.325] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0139.325] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0139.326] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0139.326] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0139.326] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0139.327] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0139.327] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0139.327] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0139.327] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0139.327] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0139.327] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0140.359] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0140.359] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0140.360] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0140.360] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0140.360] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0140.360] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0140.361] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0140.361] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0140.361] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0140.361] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0140.361] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0140.361] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0141.368] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0141.369] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0141.369] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0141.369] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0141.370] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0141.370] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0141.370] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0141.370] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0141.370] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0141.371] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0141.371] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0141.371] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0142.416] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0142.429] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0142.430] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0142.430] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0142.431] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0142.431] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0142.431] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0142.431] GetIfEntry (in: pIfRow=0x13a3850 | out: pIfRow=0x13a3850) returned 0x0 [0142.432] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89deb38 | out: pdecResult=0x89deb38) returned 0x0 [0142.432] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 [0142.432] VarDecMul (in: pdecLeft=0x89de9e8, pdecRight=0x89de9d8, pdecResult=0x89dea38 | out: pdecResult=0x89dea38) returned 0x0 [0142.432] VarR8FromDec (in: pdecIn=0x89de9e8, pdblOut=0x89de9d8 | out: pdblOut=0x89de9d8) returned 0x0 Thread: id = 130 os_tid = 0xfe8 [0127.091] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0127.133] CoGetContextToken (in: pToken=0x8b1ef6c | out: pToken=0x8b1ef6c) returned 0x0 [0127.133] CoGetContextToken (in: pToken=0x8b1ef2c | out: pToken=0x8b1ef2c) returned 0x0 [0127.133] IUnknown:AddRef (This=0x13aed68) returned 0x2 [0127.133] IUnknown:QueryInterface (in: This=0x13aed68, riid=0x8b1efa8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x8b1efa4 | out: ppvObject=0x8b1efa4*=0x13aed68) returned 0x0 [0127.133] IUnknown:Release (This=0x13aed68) returned 0x2 [0127.133] IUnknown:AddRef (This=0x13aed68) returned 0x3 [0127.133] IWbemPath:GetNamespaceCount (in: This=0x13aed68, puCount=0x8b1f120 | out: puCount=0x8b1f120*=0x0) returned 0x0 [0127.133] IUnknown:Release (This=0x13aed68) returned 0x2 [0127.134] IWbemPath:GetNamespaceCount (in: This=0x1375100, puCount=0x8b1f10c | out: puCount=0x8b1f10c*=0x2) returned 0x0 [0127.134] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x8b1f108*=0x0, pszText=0x0 | out: puBuffLength=0x8b1f108*=0xf, pszText=0x0) returned 0x0 [0127.134] IWbemPath:GetText (in: This=0x1375100, lFlags=4, puBuffLength=0x8b1f108*=0xf, pszText="00000000000000" | out: puBuffLength=0x8b1f108*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.135] CoGetObjectContext (in: riid=0x3361204*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x8b1f0ac | out: ppv=0x8b1f0ac*=0x1332dc4) returned 0x0 [0127.135] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332dc4, pAptType=0x8b1f0a4 | out: pAptType=0x8b1f0a4*=1) returned 0x0 [0127.135] IUnknown:QueryInterface (in: This=0x1332dc4, riid=0x33611ec*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x8b1f0a8 | out: ppvObject=0x8b1f0a8*=0x0) returned 0x80004002 [0127.135] IUnknown:Release (This=0x1332dc4) returned 0x1 [0127.136] CoGetClassObject (in: rclsid=0x137bdcc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x739d9630*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x8b1ebc4 | out: ppv=0x8b1ebc4*=0x13b2da8) returned 0x0 [0127.136] WbemDefPath:IUnknown:QueryInterface (in: This=0x13b2da8, riid=0x73b097d4*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x8b1e9f4 | out: ppvObject=0x8b1e9f4*=0x0) returned 0x80004002 [0127.136] WbemDefPath:IClassFactory:CreateInstance (in: This=0x13b2da8, pUnkOuter=0x0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1ea2c | out: ppvObject=0x8b1ea2c*=0x13af698) returned 0x0 [0127.136] IUnknown:QueryInterface (in: This=0x13af698, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1e7d0 | out: ppvObject=0x8b1e7d0*=0x13af698) returned 0x0 [0127.136] IUnknown:QueryInterface (in: This=0x13af698, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x8b1e78c | out: ppvObject=0x8b1e78c*=0x0) returned 0x80004002 [0127.137] IUnknown:AddRef (This=0x13af698) returned 0x3 [0127.137] CoGetContextToken (in: pToken=0x8b1e618 | out: pToken=0x8b1e618) returned 0x0 [0127.137] IUnknown:QueryInterface (in: This=0x13af698, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1e600 | out: ppvObject=0x8b1e600*=0x13a7a08) returned 0x0 [0127.137] IMarshal:GetUnmarshalClass (in: This=0x13a7a08, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x8b1e608 | out: pCid=0x8b1e608*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.137] IUnknown:Release (This=0x13a7a08) returned 0x3 [0127.137] CoGetContextToken (in: pToken=0x8b1e610 | out: pToken=0x8b1e610) returned 0x0 [0127.137] IUnknown:AddRef (This=0x13af698) returned 0x4 [0127.137] IUnknown:QueryInterface (in: This=0x13af698, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1e684 | out: ppvObject=0x8b1e684*=0x0) returned 0x80004002 [0127.137] IUnknown:Release (This=0x13af698) returned 0x3 [0127.138] IUnknown:Release (This=0x13af698) returned 0x2 [0127.138] WbemDefPath:IUnknown:Release (This=0x13b2da8) returned 0x0 [0127.138] IUnknown:Release (This=0x13af698) returned 0x1 [0127.138] CoGetContextToken (in: pToken=0x8b1eec0 | out: pToken=0x8b1eec0) returned 0x0 [0127.138] CoGetContextToken (in: pToken=0x8b1ee80 | out: pToken=0x8b1ee80) returned 0x0 [0127.138] IUnknown:AddRef (This=0x13af698) returned 0x2 [0127.138] IUnknown:QueryInterface (in: This=0x13af698, riid=0x8b1eefc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x8b1eef8 | out: ppvObject=0x8b1eef8*=0x13af698) returned 0x0 [0127.138] IUnknown:Release (This=0x13af698) returned 0x2 [0127.138] IUnknown:Release (This=0x13af698) returned 0x1 [0127.139] CoGetContextToken (in: pToken=0x8b1ef40 | out: pToken=0x8b1ef40) returned 0x0 [0127.139] CoGetContextToken (in: pToken=0x8b1ef00 | out: pToken=0x8b1ef00) returned 0x0 [0127.139] IUnknown:AddRef (This=0x13af698) returned 0x2 [0127.139] IUnknown:QueryInterface (in: This=0x13af698, riid=0x8b1ef7c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x8b1ef78 | out: ppvObject=0x8b1ef78*=0x13af698) returned 0x0 [0127.139] IUnknown:Release (This=0x13af698) returned 0x2 [0127.139] IUnknown:AddRef (This=0x13af698) returned 0x3 [0127.139] IWbemPath:SetText (This=0x13af698, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0127.139] IUnknown:Release (This=0x13af698) returned 0x2 [0127.139] IWbemPath:GetNamespaceCount (in: This=0x13af698, puCount=0x8b1f0e4 | out: puCount=0x8b1f0e4*=0x2) returned 0x0 [0127.139] IWbemPath:GetText (in: This=0x13af698, lFlags=4, puBuffLength=0x8b1f0e0*=0x0, pszText=0x0 | out: puBuffLength=0x8b1f0e0*=0xf, pszText=0x0) returned 0x0 [0127.139] IWbemPath:GetText (in: This=0x13af698, lFlags=4, puBuffLength=0x8b1f0e0*=0xf, pszText="00000000000000" | out: puBuffLength=0x8b1f0e0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.139] CoGetObjectContext (in: riid=0x3361204*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x8b1f0e0 | out: ppv=0x8b1f0e0*=0x1332dc4) returned 0x0 [0127.139] IComThreadingInfo:GetCurrentApartmentType (in: This=0x1332dc4, pAptType=0x8b1f0d8 | out: pAptType=0x8b1f0d8*=1) returned 0x0 [0127.139] IUnknown:QueryInterface (in: This=0x1332dc4, riid=0x33611ec*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x8b1f0dc | out: ppvObject=0x8b1f0dc*=0x0) returned 0x80004002 [0127.139] IUnknown:Release (This=0x1332dc4) returned 0x1 [0127.139] CoGetClassObject (in: rclsid=0x137bd54*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x739d9630*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x8b1ef30 | out: ppv=0x8b1ef30*=0x13a7ba0) returned 0x0 [0127.140] WbemLocator:IUnknown:QueryInterface (in: This=0x13a7ba0, riid=0x73b097d4*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x8b1ed60 | out: ppvObject=0x8b1ed60*=0x0) returned 0x80004002 [0127.140] WbemLocator:IClassFactory:CreateInstance (in: This=0x13a7ba0, pUnkOuter=0x0, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1ed98 | out: ppvObject=0x8b1ed98*=0x13b2e98) returned 0x0 [0127.140] IUnknown:QueryInterface (in: This=0x13b2e98, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1eb3c | out: ppvObject=0x8b1eb3c*=0x13b2e98) returned 0x0 [0127.140] IUnknown:QueryInterface (in: This=0x13b2e98, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x8b1eaf8 | out: ppvObject=0x8b1eaf8*=0x0) returned 0x80004002 [0127.140] IUnknown:AddRef (This=0x13b2e98) returned 0x3 [0127.140] CoGetContextToken (in: pToken=0x8b1e984 | out: pToken=0x8b1e984) returned 0x0 [0127.140] IUnknown:QueryInterface (in: This=0x13b2e98, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1e96c | out: ppvObject=0x8b1e96c*=0x0) returned 0x80004002 [0127.140] CoGetContextToken (in: pToken=0x8b1e97c | out: pToken=0x8b1e97c) returned 0x0 [0127.140] IUnknown:AddRef (This=0x13b2e98) returned 0x4 [0127.140] IUnknown:QueryInterface (in: This=0x13b2e98, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1e9f0 | out: ppvObject=0x8b1e9f0*=0x0) returned 0x80004002 [0127.141] IUnknown:Release (This=0x13b2e98) returned 0x3 [0127.141] IUnknown:Release (This=0x13b2e98) returned 0x2 [0127.141] WbemLocator:IUnknown:Release (This=0x13a7ba0) returned 0x0 [0127.141] IUnknown:Release (This=0x13b2e98) returned 0x1 [0127.141] CoGetContextToken (in: pToken=0x8b1ee88 | out: pToken=0x8b1ee88) returned 0x0 [0127.141] CoGetContextToken (in: pToken=0x8b1ee48 | out: pToken=0x8b1ee48) returned 0x0 [0127.141] IUnknown:AddRef (This=0x13b2e98) returned 0x2 [0127.141] IUnknown:QueryInterface (in: This=0x13b2e98, riid=0x8b1eec4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x8b1eec0 | out: ppvObject=0x8b1eec0*=0x13b2e98) returned 0x0 [0127.141] IUnknown:Release (This=0x13b2e98) returned 0x2 [0127.141] IUnknown:Release (This=0x13b2e98) returned 0x1 [0127.141] IWbemPath:GetNamespaceCount (in: This=0x13af698, puCount=0x8b1f0b8 | out: puCount=0x8b1f0b8*=0x2) returned 0x0 [0127.141] IWbemPath:GetText (in: This=0x13af698, lFlags=8, puBuffLength=0x8b1f0b4*=0x0, pszText=0x0 | out: puBuffLength=0x8b1f0b4*=0xf, pszText=0x0) returned 0x0 [0127.141] IWbemPath:GetText (in: This=0x13af698, lFlags=8, puBuffLength=0x8b1f0b4*=0xf, pszText="00000000000000" | out: puBuffLength=0x8b1f0b4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0127.141] CoCreateInstance (in: rclsid=0x748113a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x748112d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x8b1eb90 | out: ppv=0x8b1eb90*=0x13b2f48) returned 0x0 [0127.141] IWbemLocator:ConnectServer (in: This=0x13b2f48, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x8b1ebdc | out: ppNamespace=0x8b1ebdc*=0x13db808) returned 0x0 [0127.230] IUnknown:QueryInterface (in: This=0x13db808, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1eaac | out: ppvObject=0x8b1eaac*=0x13ce05c) returned 0x0 [0127.230] IClientSecurity:QueryBlanket (in: This=0x13ce05c, pProxy=0x13db808, pAuthnSvc=0x8b1eaf4, pAuthzSvc=0x8b1eaf0, pServerPrincName=0x8b1eb00, pAuthnLevel=0x8b1eaf8, pImpLevel=0x8b1eae4, pAuthInfo=0x8b1eae8, pCapabilites=0x8b1eaec | out: pAuthnSvc=0x8b1eaf4*=0xa, pAuthzSvc=0x8b1eaf0*=0x0, pServerPrincName=0x8b1eb00, pAuthnLevel=0x8b1eaf8*=0x6, pImpLevel=0x8b1eae4*=0x2, pAuthInfo=0x8b1eae8, pCapabilites=0x8b1eaec*=0x1) returned 0x0 [0127.231] IUnknown:Release (This=0x13ce05c) returned 0x1 [0127.231] IUnknown:QueryInterface (in: This=0x13db808, riid=0x74811250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1eaa0 | out: ppvObject=0x8b1eaa0*=0x13ce080) returned 0x0 [0127.231] IUnknown:QueryInterface (in: This=0x13db808, riid=0x74811260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1ea9c | out: ppvObject=0x8b1ea9c*=0x13ce05c) returned 0x0 [0127.231] IClientSecurity:SetBlanket (This=0x13ce05c, pProxy=0x13db808, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0127.231] IUnknown:Release (This=0x13ce05c) returned 0x2 [0127.231] IUnknown:Release (This=0x13ce080) returned 0x1 [0127.231] CoTaskMemFree (pv=0x13afea0) [0127.231] IUnknown:Release (This=0x13b2f48) returned 0x0 [0127.231] IUnknown:QueryInterface (in: This=0x13db808, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1e45c | out: ppvObject=0x8b1e45c*=0x13ce080) returned 0x0 [0127.231] IUnknown:QueryInterface (in: This=0x13ce080, riid=0x73a8a6d0*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x8b1e418 | out: ppvObject=0x8b1e418*=0x0) returned 0x80004002 [0127.232] IUnknown:QueryInterface (in: This=0x13ce080, riid=0x73a1e9fc*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x8b1e30c | out: ppvObject=0x8b1e30c*=0x0) returned 0x80004002 [0127.232] IUnknown:AddRef (This=0x13ce080) returned 0x3 [0127.232] CoGetContextToken (in: pToken=0x8b1e2a4 | out: pToken=0x8b1e2a4) returned 0x0 [0127.232] IUnknown:QueryInterface (in: This=0x13ce080, riid=0x7399b034*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1e28c | out: ppvObject=0x8b1e28c*=0x13cdfdc) returned 0x0 [0127.233] IMarshal:GetUnmarshalClass (in: This=0x13cdfdc, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x8b1e294 | out: pCid=0x8b1e294*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0127.233] IUnknown:Release (This=0x13cdfdc) returned 0x3 [0127.233] CoGetContextToken (in: pToken=0x8b1e29c | out: pToken=0x8b1e29c) returned 0x0 [0127.233] IUnknown:AddRef (This=0x13ce080) returned 0x4 [0127.233] IUnknown:QueryInterface (in: This=0x13ce080, riid=0x73a254dc*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1e310 | out: ppvObject=0x8b1e310*=0x13ce064) returned 0x0 [0127.233] IUnknown:Release (This=0x13ce080) returned 0x4 [0127.233] IRpcOptions:Query (in: This=0x13ce064, pPrx=0x13ce080, dwProperty=2, pdwValue=0x8b1e334 | out: pdwValue=0x8b1e334) returned 0x80004002 [0127.233] IUnknown:Release (This=0x13ce064) returned 0x3 [0127.233] IUnknown:Release (This=0x13ce080) returned 0x2 [0127.233] CoGetContextToken (in: pToken=0x8b1e710 | out: pToken=0x8b1e710) returned 0x0 [0127.233] CoGetContextToken (in: pToken=0x8b1e6d0 | out: pToken=0x8b1e6d0) returned 0x0 [0127.234] IUnknown:AddRef (This=0x13ce080) returned 0x3 [0127.234] IUnknown:QueryInterface (in: This=0x13ce080, riid=0x8b1e74c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x8b1e748 | out: ppvObject=0x8b1e748*=0x13db808) returned 0x0 [0127.234] IUnknown:Release (This=0x13ce080) returned 0x3 [0127.234] IUnknown:Release (This=0x13db808) returned 0x2 [0127.234] IUnknown:Release (This=0x13db808) returned 0x1 [0127.234] SysStringLen (param_1=0x0) returned 0x0 [0127.234] GetLastError () returned 0x0 [0127.234] IWbemPath:GetNamespaceCount (in: This=0x13aed68, puCount=0x8b1f18c | out: puCount=0x8b1f18c*=0x0) returned 0x0 [0127.234] IWbemPath:GetText (in: This=0x13aed68, lFlags=2, puBuffLength=0x8b1f188*=0x0, pszText=0x0 | out: puBuffLength=0x8b1f188*=0x37, pszText=0x0) returned 0x0 [0127.234] IWbemPath:GetText (in: This=0x13aed68, lFlags=2, puBuffLength=0x8b1f188*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x8b1f188*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0127.234] CoGetContextToken (in: pToken=0x8b1f064 | out: pToken=0x8b1f064) returned 0x0 [0127.234] IUnknown:AddRef (This=0x13ce080) returned 0x2 [0127.234] IUnknown:QueryInterface (in: This=0x13ce080, riid=0x73a703ec*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b1ec88 | out: ppvObject=0x8b1ec88*=0x13ce080) returned 0x0 [0127.234] IUnknown:Release (This=0x13ce080) returned 0x2 [0127.234] IUnknown:Release (This=0x13ce080) returned 0x1 [0127.235] IWbemPath:GetText (in: This=0x13aed68, lFlags=2, puBuffLength=0x8b1f190*=0x0, pszText=0x0 | out: puBuffLength=0x8b1f190*=0x37, pszText=0x0) returned 0x0 [0127.235] IWbemPath:GetText (in: This=0x13aed68, lFlags=2, puBuffLength=0x8b1f190*=0x37, pszText="000000000000000000000000000000000000000000000000000000" | out: puBuffLength=0x8b1f190*=0x37, pszText="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"") returned 0x0 [0127.262] CoGetContextToken (in: pToken=0x8b1edcc | out: pToken=0x8b1edcc) returned 0x0 [0127.262] CoGetContextToken (in: pToken=0x8b1ed8c | out: pToken=0x8b1ed8c) returned 0x0 [0127.262] IUnknown:AddRef (This=0x13ce080) returned 0x2 [0127.263] IUnknown:QueryInterface (in: This=0x13ce080, riid=0x8b1ee08*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x8b1ee04 | out: ppvObject=0x8b1ee04*=0x13db808) returned 0x0 [0127.263] IUnknown:Release (This=0x13ce080) returned 0x2 [0127.263] IUnknown:AddRef (This=0x13db808) returned 0x3 [0127.263] IWbemServices:GetObject (This=0x13db808, strObjectPath="Win32_PerfFormattedData_PerfOS_Processor.Name=\"_Total\"", lFlags=0, pCtx=0x0, ppObject=0x8b1ef40*=0x0, ppCallResult=0x0) Thread: id = 131 os_tid = 0xfec [0127.192] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0130.523] CoUninitialize () Thread: id = 132 os_tid = 0xff0 [0127.211] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0128.507] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x6c8 [0128.508] GetLastError () returned 0x0 [0128.594] GetSystemInfo (in: lpSystemInfo=0x8d9e280 | out: lpSystemInfo=0x8d9e280*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0x3, dwNumberOfProcessors=0x2, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0128.594] GetLastError () returned 0x0 [0128.665] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x708 [0128.665] GetLastError () returned 0x0 [0130.217] WSARecv (in: s=0x6c8, lpBuffers=0x33d65d0, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x8d9ea44, lpFlags=0x8d9ea78*=0x0, lpOverlapped=0x33cf0fc, lpCompletionRoutine=0x0 | out: lpBuffers=0x33d65d0*=((len=0x2000, buf=0x33c3cf0)), lpNumberOfBytesRecvd=0x8d9ea44*=0x0, lpFlags=0x8d9ea78*=0x0, lpOverlapped=0x33cf0fc) returned -1 [0130.217] GetLastError () returned 0x3e5 Thread: id = 133 os_tid = 0xff4 [0127.244] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 134 os_tid = 0xff8 [0127.305] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0133.569] send (in: s=0x6c8, buf=0x34157b8*, len=10, flags=0 | out: buf=0x34157b8*) returned 10 [0133.569] GetLastError () returned 0x0 [0139.310] send (in: s=0x6c8, buf=0x345422c*, len=10, flags=0 | out: buf=0x345422c*) returned 10 [0139.324] GetLastError () returned 0x0 Thread: id = 136 os_tid = 0x82c [0128.653] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0128.660] getaddrinfo (in: pNodeName="dankleo01.chickenkiller.com", pServiceName=0x0, pHints=0x917efd0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x917ed64 | out: ppResult=0x917ed64*=0x13c75b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="dankleo01.chickenkiller.com", ai_addr=0x13a7d98*(sa_family=2, sin_port=0x0, sin_addr="91.192.100.59"), ai_next=0x0)) returned 0 [0129.569] GetLastError () returned 0x0 [0129.569] FreeAddrInfoW (pAddrInfo=0x13c75b0*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="慤歮敬は⸱档捩敫歮汩敬⹲潣m", ai_addr=0x13a7d98*(sa_family=2, sin_port=0x0, sin_addr="91.192.100.59"), ai_next=0x0)) [0129.569] GetLastError () returned 0x0 [0129.573] bind (s=0x6c8, addr=0x33cefc4*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0 [0129.573] GetLastError () returned 0x0 [0129.608] WSAIoctl (in: s=0x6c8, dwIoControlCode=0xc8000006, lpvInBuffer=0x917ee8c, cbInBuffer=0x10, lpvOutBuffer=0x917eea0, cbOutBuffer=0x4, lpcbBytesReturned=0x917ee9c, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x917eea0, lpcbBytesReturned=0x917ee9c, lpOverlapped=0x0) returned 0 [0129.608] GetLastError () returned 0x0 Thread: id = 146 os_tid = 0x438 Thread: id = 147 os_tid = 0x428 [0129.587] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0130.212] setsockopt (s=0x6c8, level=65535, optname=28688, optval=0x0, optlen=0) returned 0 [0130.212] GetLastError () returned 0x0 [0130.214] SetEvent (hEvent=0x708) returned 1 [0130.214] GetLastError () returned 0x0 Thread: id = 148 os_tid = 0x2dc [0130.279] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0131.721] send (in: s=0x6c8, buf=0x33e5c54*, len=50, flags=0 | out: buf=0x33e5c54*) returned 50 [0131.764] GetLastError () returned 0x0 [0132.045] GetLastInputInfo (in: plii=0x953e7a4 | out: plii=0x953e7a4) returned 1 [0132.137] GlobalMemoryStatusEx (in: lpBuffer=0x33f3d18 | out: lpBuffer=0x33f3d18) returned 1 [0132.137] GetLastError () returned 0x0 [0132.137] GlobalMemoryStatusEx (in: lpBuffer=0x33f3d18 | out: lpBuffer=0x33f3d18) returned 1 [0132.137] GetLastError () returned 0x0 [0132.137] GlobalMemoryStatusEx (in: lpBuffer=0x33f3d18 | out: lpBuffer=0x33f3d18) returned 1 [0132.137] GetLastError () returned 0x0 [0132.167] send (in: s=0x6c8, buf=0x33fb11c*, len=198, flags=0 | out: buf=0x33fb11c*) returned 198 [0132.167] GetLastError () returned 0x0 [0132.191] send (in: s=0x6c8, buf=0x33fcc48*, len=10, flags=0 | out: buf=0x33fcc48*) returned 10 [0132.191] GetLastError () returned 0x0 [0132.231] WSARecv (in: s=0x6c8, lpBuffers=0x33fe4d8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x953e954, lpFlags=0x953e988*=0x0, lpOverlapped=0x33cf0fc, lpCompletionRoutine=0x0 | out: lpBuffers=0x33fe4d8*=((len=0x1fd0, buf=0x33c3d20)), lpNumberOfBytesRecvd=0x953e954*=0x0, lpFlags=0x953e988*=0x0, lpOverlapped=0x33cf0fc) returned -1 [0132.231] GetLastError () returned 0x3e5 [0134.397] send (in: s=0x6c8, buf=0x3420314*, len=10, flags=0 | out: buf=0x3420314*) returned 10 [0134.398] GetLastError () returned 0x0 [0134.398] WSARecv (in: s=0x6c8, lpBuffers=0x3421780, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x953e954, lpFlags=0x953e988*=0x0, lpOverlapped=0x33cf0fc, lpCompletionRoutine=0x0 | out: lpBuffers=0x3421780*=((len=0x1fc6, buf=0x33c3d2a)), lpNumberOfBytesRecvd=0x953e954*=0x0, lpFlags=0x953e988*=0x0, lpOverlapped=0x33cf0fc) returned -1 [0134.398] GetLastError () returned 0x3e5 [0134.613] WSARecv (in: s=0x6c8, lpBuffers=0x3428334, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x953e954, lpFlags=0x953e988*=0x0, lpOverlapped=0x33cf0fc, lpCompletionRoutine=0x0 | out: lpBuffers=0x3428334*=((len=0x1fbc, buf=0x33c3d34)), lpNumberOfBytesRecvd=0x953e954*=0x0, lpFlags=0x953e988*=0x0, lpOverlapped=0x33cf0fc) returned -1 [0134.613] GetLastError () returned 0x3e5 [0139.512] WSARecv (in: s=0x6c8, lpBuffers=0x34569f8, dwBufferCount=0x1, lpNumberOfBytesRecvd=0x953e954, lpFlags=0x953e988*=0x0, lpOverlapped=0x33cf0fc, lpCompletionRoutine=0x0 | out: lpBuffers=0x34569f8*=((len=0x1fb2, buf=0x33c3d3e)), lpNumberOfBytesRecvd=0x953e954*=0x0, lpFlags=0x953e988*=0x0, lpOverlapped=0x33cf0fc) returned -1 [0139.512] GetLastError () returned 0x3e5 Thread: id = 149 os_tid = 0x788 [0130.326] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0130.489] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\", nBufferLength=0x105, lpBuffer=0x967e510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\", lpFilePart=0x0) returned 0x3a [0130.489] GetLastError () returned 0x0 [0130.489] SetErrorMode (uMode=0x1) returned 0x0 [0130.489] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\monitoring"), fInfoLevelId=0x0, lpFileInformation=0x967e990 | out: lpFileInformation=0x967e990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.489] GetLastError () returned 0x2 [0130.489] SetErrorMode (uMode=0x0) returned 0x1 [0130.489] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\", nBufferLength=0x105, lpBuffer=0x967e51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\", lpFilePart=0x0) returned 0x3a [0130.490] GetLastError () returned 0x2 [0130.490] SetErrorMode (uMode=0x1) returned 0x0 [0130.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\monitoring"), fInfoLevelId=0x0, lpFileInformation=0x967e938 | out: lpFileInformation=0x967e938*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.490] GetLastError () returned 0x2 [0130.490] SetErrorMode (uMode=0x0) returned 0x1 [0130.490] SetErrorMode (uMode=0x1) returned 0x0 [0130.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent"), fInfoLevelId=0x0, lpFileInformation=0x967e938 | out: lpFileInformation=0x967e938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d159d8d, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7d36fe31, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7d36fe31, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.490] GetLastError () returned 0x2 [0130.490] SetErrorMode (uMode=0x0) returned 0x1 [0130.490] SetErrorMode (uMode=0x1) returned 0x0 [0130.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming"), fInfoLevelId=0x0, lpFileInformation=0x967e938 | out: lpFileInformation=0x967e938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa832513c, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0x7d159d8d, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7d159d8d, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0130.490] GetLastError () returned 0x2 [0130.490] SetErrorMode (uMode=0x0) returned 0x1 [0130.490] SetErrorMode (uMode=0x1) returned 0x0 [0130.490] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata"), fInfoLevelId=0x0, lpFileInformation=0x967e938 | out: lpFileInformation=0x967e938*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xa832513c, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0xa86b89c3, ftLastAccessTime.dwHighDateTime=0x1d2d079, ftLastWriteTime.dwLowDateTime=0xa86b89c3, ftLastWriteTime.dwHighDateTime=0x1d2d079, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.491] GetLastError () returned 0x2 [0130.491] SetErrorMode (uMode=0x0) returned 0x1 [0130.491] SetErrorMode (uMode=0x1) returned 0x0 [0130.491] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps" (normalized: "c:\\users\\ciihmnxmn6ps"), fInfoLevelId=0x0, lpFileInformation=0x967e938 | out: lpFileInformation=0x967e938*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa82b2a28, ftCreationTime.dwHighDateTime=0x1d2d079, ftLastAccessTime.dwLowDateTime=0xde27753, ftLastAccessTime.dwHighDateTime=0x1d2d411, ftLastWriteTime.dwLowDateTime=0xde27753, ftLastWriteTime.dwHighDateTime=0x1d2d411, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0130.491] GetLastError () returned 0x2 [0130.491] SetErrorMode (uMode=0x0) returned 0x1 [0130.491] SetErrorMode (uMode=0x1) returned 0x0 [0130.491] GetFileAttributesExW (in: lpFileName="C:\\Users" (normalized: "c:\\users"), fInfoLevelId=0x0, lpFileInformation=0x967e938 | out: lpFileInformation=0x967e938*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x90fee405, ftCreationTime.dwHighDateTime=0x1d0baef, ftLastAccessTime.dwLowDateTime=0xa82b2a28, ftLastAccessTime.dwHighDateTime=0x1d2d079, ftLastWriteTime.dwLowDateTime=0xa82b2a28, ftLastWriteTime.dwHighDateTime=0x1d2d079, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0130.491] GetLastError () returned 0x2 [0130.491] SetErrorMode (uMode=0x0) returned 0x1 [0130.491] CreateDirectoryW (lpPathName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\monitoring"), lpSecurityAttributes=0x0) returned 1 [0130.666] GetLastError () returned 0x2 [0131.219] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat", nBufferLength=0x105, lpBuffer=0x967e49c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat", lpFilePart=0x0) returned 0x45 [0131.219] GetLastError () returned 0x2 [0131.219] SetErrorMode (uMode=0x1) returned 0x0 [0131.219] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\monitoring\\network.dat"), fInfoLevelId=0x0, lpFileInformation=0x967e91c | out: lpFileInformation=0x967e91c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0131.219] GetLastError () returned 0x2 [0131.219] SetErrorMode (uMode=0x0) returned 0x1 [0131.309] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat", nBufferLength=0x105, lpBuffer=0x967e384, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat", lpFilePart=0x0) returned 0x45 [0131.309] GetLastError () returned 0x2 [0131.309] SetErrorMode (uMode=0x1) returned 0x0 [0131.309] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\network.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\monitoring\\network.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x760 [0131.310] GetLastError () returned 0x0 [0131.310] GetFileType (hFile=0x760) returned 0x1 [0131.310] SetErrorMode (uMode=0x0) returned 0x1 [0131.310] GetFileType (hFile=0x760) returned 0x1 [0131.310] WriteFile (in: hFile=0x760, lpBuffer=0x33e23c4*, nNumberOfBytesToWrite=0x1b, lpNumberOfBytesWritten=0x967e8ac, lpOverlapped=0x0 | out: lpBuffer=0x33e23c4*, lpNumberOfBytesWritten=0x967e8ac*=0x1b, lpOverlapped=0x0) returned 1 [0131.313] GetLastError () returned 0x0 [0131.313] CloseHandle (hObject=0x760) returned 1 [0131.317] GetLastError () returned 0x0 Thread: id = 150 os_tid = 0x1b4 [0130.493] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0130.523] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\", nBufferLength=0x105, lpBuffer=0x97be910, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\", lpFilePart=0x0) returned 0x3a [0130.523] GetLastError () returned 0x0 [0130.523] SetErrorMode (uMode=0x1) returned 0x0 [0130.523] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\monitoring"), fInfoLevelId=0x0, lpFileInformation=0x97bed90 | out: lpFileInformation=0x97bed90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f504eb6, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x7f504eb6, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x7f504eb6, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0130.699] GetLastError () returned 0x0 [0130.699] SetErrorMode (uMode=0x0) returned 0x1 [0130.931] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat", nBufferLength=0x105, lpBuffer=0x97be8ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat", lpFilePart=0x0) returned 0x44 [0130.931] GetLastError () returned 0x0 [0130.931] SetErrorMode (uMode=0x1) returned 0x0 [0130.931] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\monitoring\\system.dat"), fInfoLevelId=0x0, lpFileInformation=0x97bed2c | out: lpFileInformation=0x97bed2c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0130.931] GetLastError () returned 0x2 [0130.931] SetErrorMode (uMode=0x0) returned 0x1 [0131.096] GlobalMemoryStatusEx (in: lpBuffer=0x33d8a30 | out: lpBuffer=0x33d8a30) returned 1 [0131.096] GetLastError () returned 0x2 [0131.096] GlobalMemoryStatusEx (in: lpBuffer=0x33d8a30 | out: lpBuffer=0x33d8a30) returned 1 [0131.096] GetLastError () returned 0x2 [0131.096] GlobalMemoryStatusEx (in: lpBuffer=0x33d8a30 | out: lpBuffer=0x33d8a30) returned 1 [0131.096] GetLastError () returned 0x2 [0131.221] GlobalMemoryStatusEx (in: lpBuffer=0x33d8a30 | out: lpBuffer=0x33d8a30) returned 1 [0131.221] GetLastError () returned 0x2 [0131.221] GlobalMemoryStatusEx (in: lpBuffer=0x33d8a30 | out: lpBuffer=0x33d8a30) returned 1 [0131.221] GetLastError () returned 0x2 [0131.221] GlobalMemoryStatusEx (in: lpBuffer=0x33d8a30 | out: lpBuffer=0x33d8a30) returned 1 [0131.221] GetLastError () returned 0x2 [0131.318] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat", nBufferLength=0x105, lpBuffer=0x97be794, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat", lpFilePart=0x0) returned 0x44 [0131.318] GetLastError () returned 0x2 [0131.318] SetErrorMode (uMode=0x1) returned 0x0 [0131.321] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Monitoring\\system.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\monitoring\\system.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x760 [0131.321] GetLastError () returned 0x0 [0131.321] GetFileType (hFile=0x760) returned 0x1 [0131.321] SetErrorMode (uMode=0x0) returned 0x1 [0131.321] GetFileType (hFile=0x760) returned 0x1 [0131.321] WriteFile (in: hFile=0x760, lpBuffer=0x33e4bd8*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x97becbc, lpOverlapped=0x0 | out: lpBuffer=0x33e4bd8*, lpNumberOfBytesWritten=0x97becbc*=0x12, lpOverlapped=0x0) returned 1 [0131.322] GetLastError () returned 0x0 [0131.322] CloseHandle (hObject=0x760) returned 1 [0131.323] GetLastError () returned 0x0 Thread: id = 151 os_tid = 0xa14 [0132.197] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0132.403] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13f4e18 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0132.404] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x8c5e6a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0132.404] GetLastError () returned 0x3f0 [0132.404] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat", nBufferLength=0x105, lpBuffer=0x8c5e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat", lpFilePart=0x0) returned 0x36 [0132.404] GetLastError () returned 0x3f0 [0132.404] SetErrorMode (uMode=0x1) returned 0x0 [0132.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\geo.dat"), fInfoLevelId=0x0, lpFileInformation=0x8c5eb9c | out: lpFileInformation=0x8c5eb9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0132.404] GetLastError () returned 0x2 [0132.404] SetErrorMode (uMode=0x0) returned 0x1 [0132.461] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x77c [0132.461] GetLastError () returned 0x0 [0132.461] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x780 [0132.461] GetLastError () returned 0x0 [0132.517] GetCurrentProcess () returned 0xffffffff [0132.517] GetLastError () returned 0x3f0 [0132.517] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8c5e728 | out: TokenHandle=0x8c5e728*=0x784) returned 1 [0132.517] GetLastError () returned 0x3f0 [0132.521] GetCurrentProcess () returned 0xffffffff [0132.521] GetLastError () returned 0x3f0 [0132.521] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8c5e738 | out: TokenHandle=0x8c5e738*=0x788) returned 1 [0132.521] GetLastError () returned 0x3f0 [0132.529] GetCurrentProcess () returned 0xffffffff [0132.529] GetLastError () returned 0x3f0 [0132.529] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8c5e6fc | out: TokenHandle=0x8c5e6fc*=0x78c) returned 1 [0132.529] GetLastError () returned 0x3f0 [0132.532] GetCurrentProcess () returned 0xffffffff [0132.532] GetLastError () returned 0x3f0 [0132.533] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8c5e70c | out: TokenHandle=0x8c5e70c*=0x790) returned 1 [0132.533] GetLastError () returned 0x3f0 [0132.536] GetCurrentProcess () returned 0xffffffff [0132.536] GetLastError () returned 0x3f0 [0132.536] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8c5ea00 | out: TokenHandle=0x8c5ea00*=0x794) returned 1 [0132.536] GetLastError () returned 0x3f0 [0132.642] RasEnumConnectionsW (in: param_1=0x13f5e70, param_2=0x8c5ea5c, param_3=0x8c5ea60 | out: param_1=0x13f5e70, param_2=0x8c5ea5c, param_3=0x8c5ea60) returned 0x0 [0132.894] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x7d8 [0132.894] GetLastError () returned 0x0 [0132.894] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7dc [0132.894] GetLastError () returned 0x0 [0132.896] ioctlsocket (in: s=0x7d8, cmd=-2147195266, argp=0x8c5ea64 | out: argp=0x8c5ea64) returned 0 [0132.896] GetLastError () returned 0x0 [0132.896] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x7e0 [0132.896] GetLastError () returned 0x0 [0132.896] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7e4 [0132.896] GetLastError () returned 0x0 [0132.896] ioctlsocket (in: s=0x7e0, cmd=-2147195266, argp=0x8c5ea64 | out: argp=0x8c5ea64) returned 0 [0132.896] GetLastError () returned 0x0 [0132.898] WSAIoctl (in: s=0x7d8, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x8c5ea48, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x8c5ea48, lpOverlapped=0x0) returned -1 [0132.898] GetLastError () returned 0x2733 [0132.901] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x13f5e70, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0132.911] GetLastError () returned 0x2733 [0132.913] WSAEventSelect (s=0x7d8, hEventObject=0x7dc, lNetworkEvents=512) returned 0 [0132.913] GetLastError () returned 0x0 [0132.913] WSAIoctl (in: s=0x7e0, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x8c5ea48, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x8c5ea48, lpOverlapped=0x0) returned -1 [0132.913] GetLastError () returned 0x2733 [0132.913] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x13f5e70, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0132.913] GetLastError () returned 0x2733 [0132.922] WSAEventSelect (s=0x7e0, hEventObject=0x7e4, lNetworkEvents=512) returned 0 [0132.922] GetLastError () returned 0x0 [0132.922] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7e8 [0132.922] GetLastError () returned 0x0 [0132.923] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x7e8, param_3=0x3) returned 0x0 [0132.931] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x8c5ea4c | out: phkResult=0x8c5ea4c*=0x804) returned 0x0 [0132.931] GetLastError () returned 0x0 [0132.933] RegOpenKeyExW (in: hKey=0x804, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x8c5ea08 | out: phkResult=0x8c5ea08*=0x808) returned 0x0 [0132.933] GetLastError () returned 0x0 [0132.933] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x80c [0132.933] GetLastError () returned 0x0 [0132.934] RegNotifyChangeKeyValue (hKey=0x808, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x80c, fAsynchronous=1) returned 0x0 [0132.934] GetLastError () returned 0x0 [0132.936] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x8c5ea08 | out: phkResult=0x8c5ea08*=0x810) returned 0x0 [0132.936] GetLastError () returned 0x0 [0132.936] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x814 [0132.936] GetLastError () returned 0x0 [0132.936] RegNotifyChangeKeyValue (hKey=0x810, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x814, fAsynchronous=1) returned 0x0 [0132.936] GetLastError () returned 0x0 [0132.936] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x8c5ea08 | out: phkResult=0x8c5ea08*=0x818) returned 0x0 [0132.937] GetLastError () returned 0x0 [0132.937] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x81c [0132.937] GetLastError () returned 0x0 [0132.937] RegNotifyChangeKeyValue (hKey=0x818, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x81c, fAsynchronous=1) returned 0x0 [0132.937] GetLastError () returned 0x0 [0132.937] GetCurrentProcess () returned 0xffffffff [0132.937] GetLastError () returned 0x3f0 [0132.937] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8c5e9f0 | out: TokenHandle=0x8c5e9f0*=0x820) returned 1 [0132.937] GetLastError () returned 0x3f0 [0132.945] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x8c5e260 | out: phkResult=0x8c5e260*=0x824) returned 0x0 [0132.945] RegQueryValueExW (in: hKey=0x824, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x8c5e2c8, lpData=0x0, lpcbData=0x8c5e2c4*=0x0 | out: lpType=0x8c5e2c8*=0x0, lpData=0x0, lpcbData=0x8c5e2c4*=0x0) returned 0x2 [0132.958] RegCloseKey (hKey=0x824) returned 0x0 [0133.087] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x13de070 [0133.305] GetLastError () returned 0x0 [0133.308] WinHttpSetTimeouts (hInternet=0x13de070, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0133.308] GetLastError () returned 0x0 [0133.395] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x13c2d80 | out: pProxyConfig=0x13c2d80) returned 1 [0133.400] GetLastError () returned 0x0 [0133.409] GetCurrentProcess () returned 0xffffffff [0133.409] GetLastError () returned 0x3f0 [0133.409] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8c5e6c8 | out: TokenHandle=0x8c5e6c8*=0x864) returned 1 [0133.409] GetLastError () returned 0x3f0 [0133.459] GetCurrentProcess () returned 0xffffffff [0133.459] GetLastError () returned 0x3f0 [0133.460] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8c5e6d8 | out: TokenHandle=0x8c5e6d8*=0x85c) returned 1 [0133.460] GetLastError () returned 0x3f0 [0133.475] GetCurrentProcess () returned 0xffffffff [0133.475] GetLastError () returned 0x3f0 [0133.475] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8c5e680 | out: TokenHandle=0x8c5e680*=0x868) returned 1 [0133.475] GetLastError () returned 0x3f0 [0133.476] GetCurrentProcess () returned 0xffffffff [0133.476] GetLastError () returned 0x3f0 [0133.476] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8c5e690 | out: TokenHandle=0x8c5e690*=0x86c) returned 1 [0133.476] GetLastError () returned 0x3f0 [0133.477] SetEvent (hEvent=0x77c) returned 1 [0133.477] GetLastError () returned 0x3f0 [0133.526] SetEvent (hEvent=0x77c) returned 1 [0133.526] GetLastError () returned 0x0 [0133.528] GetACP () returned 0x4e4 [0133.684] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x890 [0133.684] GetLastError () returned 0x0 [0133.685] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x894 [0133.685] GetLastError () returned 0x0 [0133.685] getaddrinfo (in: pNodeName="www.iptrackeronline.com", pServiceName=0x0, pHints=0x8c5e8a0*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x8c5e634 | out: ppResult=0x8c5e634*=0x13c7308*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="iptrackeronline.com", ai_addr=0x13a7648*(sa_family=2, sin_port=0x0, sin_addr="45.55.57.244"), ai_next=0x0)) returned 0 [0133.893] GetLastError () returned 0x0 [0133.893] FreeAddrInfoW (pAddrInfo=0x13c7308*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="灩牴捡敫潲汮湩⹥潣mā\x01ꝏ൏蠀", ai_addr=0x13a7648*(sa_family=2, sin_port=0x0, sin_addr="45.55.57.244"), ai_next=0x0)) [0133.893] GetLastError () returned 0x0 [0133.894] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x89c [0133.894] GetLastError () returned 0x0 [0133.894] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8a0 [0133.894] GetLastError () returned 0x0 [0133.894] ioctlsocket (in: s=0x89c, cmd=-2147195266, argp=0x8c5e884 | out: argp=0x8c5e884) returned 0 [0133.894] GetLastError () returned 0x0 [0133.895] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x8a4 [0133.895] GetLastError () returned 0x0 [0133.895] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x8a8 [0133.895] GetLastError () returned 0x0 [0133.895] ioctlsocket (in: s=0x8a4, cmd=-2147195266, argp=0x8c5e884 | out: argp=0x8c5e884) returned 0 [0133.895] GetLastError () returned 0x0 [0133.895] WSAIoctl (in: s=0x89c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x8c5e868, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x8c5e868, lpOverlapped=0x0) returned -1 [0133.895] GetLastError () returned 0x2733 [0133.895] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x13f5e70, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0133.895] GetLastError () returned 0x2733 [0133.895] WSAEventSelect (s=0x89c, hEventObject=0x8a0, lNetworkEvents=512) returned 0 [0133.895] GetLastError () returned 0x0 [0133.895] WSAIoctl (in: s=0x8a4, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x8c5e868, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x8c5e868, lpOverlapped=0x0) returned -1 [0133.895] GetLastError () returned 0x2733 [0133.896] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x13f5e70, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0133.896] GetLastError () returned 0x2733 [0133.896] WSAEventSelect (s=0x8a4, hEventObject=0x8a8, lNetworkEvents=512) returned 0 [0133.896] GetLastError () returned 0x0 [0133.896] GetAdaptersAddresses () returned 0x6f [0133.900] LocalAlloc (uFlags=0x0, uBytes=0xa8c) returned 0x9a40048 [0133.900] GetLastError () returned 0x0 [0133.900] GetAdaptersAddresses () returned 0x0 [0133.904] LocalFree (hMem=0x9a40048) returned 0x0 [0133.904] GetLastError () returned 0x0 [0133.907] WSAConnect (in: s=0x890, name=0x341b1fc*(sa_family=2, sin_port=0x1bb, sin_addr="45.55.57.244"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0134.120] GetLastError () returned 0x0 [0134.121] closesocket (s=0x894) returned 0 [0134.121] GetLastError () returned 0x0 [0134.128] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v2.0.50727", ulOptions=0x0, samDesired=0x20019, phkResult=0x8c5e7f0 | out: phkResult=0x8c5e7f0*=0x894) returned 0x0 [0134.128] RegQueryValueExW (in: hKey=0x894, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x8c5e830, lpData=0x0, lpcbData=0x8c5e82c*=0x0 | out: lpType=0x8c5e830*=0x0, lpData=0x0, lpcbData=0x8c5e82c*=0x0) returned 0x2 [0134.129] RegCloseKey (hKey=0x894) returned 0x0 [0134.148] EnumerateSecurityPackagesW (in: pcPackages=0x8c5e80c, ppPackageInfo=0x8c5e77c | out: pcPackages=0x8c5e80c, ppPackageInfo=0x8c5e77c) returned 0x0 [0134.154] GetLastError () returned 0x0 [0134.157] lstrlenW (lpString="Negotiate") returned 9 [0134.158] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcbc8, Length=0x14 | out: Destination=0x13f5e70) [0134.158] lstrlenW (lpString="Microsoft Package Negotiator") returned 28 [0134.158] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcbdc, Length=0x3a | out: Destination=0x13f5e70) [0134.158] lstrlenW (lpString="NegoExtender") returned 12 [0134.158] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcc16, Length=0x1a | out: Destination=0x13f5e70) [0134.159] lstrlenW (lpString="NegoExtender Security Package") returned 29 [0134.159] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcc30, Length=0x3c | out: Destination=0x13f5e70) [0134.159] lstrlenW (lpString="Kerberos") returned 8 [0134.159] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcc6c, Length=0x12 | out: Destination=0x13f5e70) [0134.159] lstrlenW (lpString="Microsoft Kerberos V1.0") returned 23 [0134.159] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcc7e, Length=0x30 | out: Destination=0x13f5e70) [0134.159] lstrlenW (lpString="NTLM") returned 4 [0134.159] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dccae, Length=0xa | out: Destination=0x13f5e70) [0134.159] lstrlenW (lpString="NTLM Security Package") returned 21 [0134.159] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dccb8, Length=0x2c | out: Destination=0x13f5e70) [0134.159] lstrlenW (lpString="TSSSP") returned 5 [0134.159] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcce4, Length=0xc | out: Destination=0x13f5e70) [0134.160] lstrlenW (lpString="TS Service Security Package") returned 27 [0134.160] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dccf0, Length=0x38 | out: Destination=0x13f5e70) [0134.160] lstrlenW (lpString="pku2u") returned 5 [0134.160] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcd28, Length=0xc | out: Destination=0x13f5e70) [0134.160] lstrlenW (lpString="PKU2U Security Package") returned 22 [0134.160] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcd34, Length=0x2e | out: Destination=0x13f5e70) [0134.160] lstrlenW (lpString="WDigest") returned 7 [0134.160] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcd62, Length=0x10 | out: Destination=0x13f5e70) [0134.160] lstrlenW (lpString="Digest Authentication for Windows") returned 33 [0134.160] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcd72, Length=0x44 | out: Destination=0x13f5e70) [0134.161] lstrlenW (lpString="Schannel") returned 8 [0134.161] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcdb6, Length=0x12 | out: Destination=0x13f5e70) [0134.161] lstrlenW (lpString="Schannel Security Package") returned 25 [0134.161] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcdc8, Length=0x34 | out: Destination=0x13f5e70) [0134.161] lstrlenW (lpString="Microsoft Unified Security Protocol Provider") returned 44 [0134.161] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dcdfc, Length=0x5a | out: Destination=0x13f5e70) [0134.161] lstrlenW (lpString="Schannel Security Package") returned 25 [0134.161] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dce56, Length=0x34 | out: Destination=0x13f5e70) [0134.161] lstrlenW (lpString="CREDSSP") returned 7 [0134.161] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dce8a, Length=0x10 | out: Destination=0x13f5e70) [0134.161] lstrlenW (lpString="Microsoft CredSSP Security Provider") returned 35 [0134.161] RtlMoveMemory (in: Destination=0x13f5e70, Source=0x13dce9a, Length=0x48 | out: Destination=0x13f5e70) [0134.162] FreeContextBuffer (in: pvContextBuffer=0x13dcb00 | out: pvContextBuffer=0x13dcb00) returned 0x0 [0134.162] GetLastError () returned 0x7f [0134.167] GetCurrentProcess () returned 0xffffffff [0134.167] GetLastError () returned 0x3f0 [0134.167] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x8c5e5d4 | out: TokenHandle=0x8c5e5d4*=0x8ac) returned 1 [0134.167] GetLastError () returned 0x3f0 [0134.171] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x341df48, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x8c5e670, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x341f7b0, ptsExpiry=0x8c5e5dc | out: phCredential=0x341f7b0, ptsExpiry=0x8c5e5dc) returned 0x0 [0134.456] GetLastError () returned 0x0 [0134.461] InitializeSecurityContextW (in: phCredential=0x8c5e5d8, phContext=0x0, pTargetName=0x34138e8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x3427ec4, pOutput=0x3427e5c, pfContextAttr=0x341deac, ptsExpiry=0x8c5e5d0 | out: phNewContext=0x3427ec4, pOutput=0x3427e5c, pfContextAttr=0x341deac, ptsExpiry=0x8c5e5d0) returned 0x90312 [0134.462] GetLastError () returned 0x0 [0134.462] FreeContextBuffer (in: pvContextBuffer=0x13d3520 | out: pvContextBuffer=0x13d3520) returned 0x0 [0134.462] GetLastError () returned 0x0 [0134.485] send (in: s=0x890, buf=0x3427ed8*, len=135, flags=0 | out: buf=0x3427ed8*) returned 135 [0134.485] GetLastError () returned 0x0 [0134.486] recv (in: s=0x890, buf=0x3427ed8, len=5, flags=0 | out: buf=0x3427ed8*) returned 5 [0134.733] GetLastError () returned 0x0 [0134.733] recv (in: s=0x890, buf=0x3427edd, len=65, flags=0 | out: buf=0x3427edd*) returned 65 [0134.733] GetLastError () returned 0x0 [0134.734] InitializeSecurityContextW (in: phCredential=0x8c5e518, phContext=0x8c5e62c, pTargetName=0x34138e8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x34289c0, Reserved2=0x0, phNewContext=0x3427ec4, pOutput=0x34289d4, pfContextAttr=0x341deac, ptsExpiry=0x8c5e510 | out: phNewContext=0x3427ec4, pOutput=0x34289d4, pfContextAttr=0x341deac, ptsExpiry=0x8c5e510) returned 0x90312 [0134.735] GetLastError () returned 0x0 [0134.735] recv (in: s=0x890, buf=0x3428a64, len=5, flags=0 | out: buf=0x3428a64*) returned 5 [0134.735] GetLastError () returned 0x0 [0134.735] recv (in: s=0x890, buf=0x3428a7d, len=2529, flags=0 | out: buf=0x3428a7d*) returned 2529 [0134.735] GetLastError () returned 0x0 [0134.735] InitializeSecurityContextW (in: phCredential=0x8c5e460, phContext=0x8c5e574, pTargetName=0x34138e8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x34294d4, Reserved2=0x0, phNewContext=0x3427ec4, pOutput=0x34294e8, pfContextAttr=0x341deac, ptsExpiry=0x8c5e458 | out: phNewContext=0x3427ec4, pOutput=0x34294e8, pfContextAttr=0x341deac, ptsExpiry=0x8c5e458) returned 0x90312 [0134.736] GetLastError () returned 0x0 [0134.737] recv (in: s=0x890, buf=0x3429578, len=5, flags=0 | out: buf=0x3429578*) returned 5 [0134.737] GetLastError () returned 0x0 [0134.737] recv (in: s=0x890, buf=0x3429591, len=331, flags=0 | out: buf=0x3429591*) returned 331 [0134.737] GetLastError () returned 0x0 [0134.737] InitializeSecurityContextW (in: phCredential=0x8c5e3a8, phContext=0x8c5e4bc, pTargetName=0x34138e8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x3429750, Reserved2=0x0, phNewContext=0x3427ec4, pOutput=0x3429764, pfContextAttr=0x341deac, ptsExpiry=0x8c5e3a0 | out: phNewContext=0x3427ec4, pOutput=0x3429764, pfContextAttr=0x341deac, ptsExpiry=0x8c5e3a0) returned 0x90312 [0134.737] GetLastError () returned 0x0 [0134.737] recv (in: s=0x890, buf=0x34297f4, len=5, flags=0 | out: buf=0x34297f4*) returned 5 [0134.737] GetLastError () returned 0x0 [0134.737] recv (in: s=0x890, buf=0x342980d, len=4, flags=0 | out: buf=0x342980d*) returned 4 [0134.737] GetLastError () returned 0x0 [0134.737] InitializeSecurityContextW (in: phCredential=0x8c5e2f0, phContext=0x8c5e404, pTargetName=0x34138e8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x3429888, Reserved2=0x0, phNewContext=0x3427ec4, pOutput=0x342989c, pfContextAttr=0x341deac, ptsExpiry=0x8c5e2e8 | out: phNewContext=0x3427ec4, pOutput=0x342989c, pfContextAttr=0x341deac, ptsExpiry=0x8c5e2e8) returned 0x90312 [0134.740] GetLastError () returned 0x0 [0134.740] FreeContextBuffer (in: pvContextBuffer=0x13d3200 | out: pvContextBuffer=0x13d3200) returned 0x0 [0134.740] GetLastError () returned 0x0 [0134.740] send (in: s=0x890, buf=0x3429918*, len=134, flags=0 | out: buf=0x3429918*) returned 134 [0134.741] GetLastError () returned 0x0 [0134.741] recv (in: s=0x890, buf=0x3429918, len=5, flags=0 | out: buf=0x3429918*) returned 5 [0134.868] GetLastError () returned 0x0 [0134.869] recv (in: s=0x890, buf=0x34299c5, len=218, flags=0 | out: buf=0x34299c5*) returned 218 [0134.869] GetLastError () returned 0x0 [0134.869] InitializeSecurityContextW (in: phCredential=0x8c5e238, phContext=0x8c5e34c, pTargetName=0x34138e8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x3429b14, Reserved2=0x0, phNewContext=0x3427ec4, pOutput=0x3429b28, pfContextAttr=0x341deac, ptsExpiry=0x8c5e230 | out: phNewContext=0x3427ec4, pOutput=0x3429b28, pfContextAttr=0x341deac, ptsExpiry=0x8c5e230) returned 0x90312 [0134.869] GetLastError () returned 0x0 [0134.869] recv (in: s=0x890, buf=0x3429bb8, len=5, flags=0 | out: buf=0x3429bb8*) returned 5 [0134.869] GetLastError () returned 0x0 [0134.869] recv (in: s=0x890, buf=0x3429bd1, len=1, flags=0 | out: buf=0x3429bd1*) returned 1 [0134.869] GetLastError () returned 0x0 [0134.869] InitializeSecurityContextW (in: phCredential=0x8c5e180, phContext=0x8c5e294, pTargetName=0x34138e8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x3429c48, Reserved2=0x0, phNewContext=0x3427ec4, pOutput=0x3429c5c, pfContextAttr=0x341deac, ptsExpiry=0x8c5e178 | out: phNewContext=0x3427ec4, pOutput=0x3429c5c, pfContextAttr=0x341deac, ptsExpiry=0x8c5e178) returned 0x90312 [0134.870] GetLastError () returned 0x0 [0134.870] recv (in: s=0x890, buf=0x3429cec, len=5, flags=0 | out: buf=0x3429cec*) returned 5 [0134.870] GetLastError () returned 0x0 [0134.870] recv (in: s=0x890, buf=0x3429d05, len=48, flags=0 | out: buf=0x3429d05*) returned 48 [0134.870] GetLastError () returned 0x0 [0134.870] InitializeSecurityContextW (in: phCredential=0x8c5e0c8, phContext=0x8c5e1dc, pTargetName=0x34138e8, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x3429dac, Reserved2=0x0, phNewContext=0x3427ec4, pOutput=0x3429dc0, pfContextAttr=0x341deac, ptsExpiry=0x8c5e0c0 | out: phNewContext=0x3427ec4, pOutput=0x3429dc0, pfContextAttr=0x341deac, ptsExpiry=0x8c5e0c0) returned 0x0 [0135.538] GetLastError () returned 0x0 [0135.587] QueryContextAttributesW (in: phContext=0x3427ec4, ulAttribute=0x4, pBuffer=0x3430284 | out: pBuffer=0x3430284) returned 0x0 [0135.588] GetLastError () returned 0x0 [0135.588] QueryContextAttributesW (in: phContext=0x3427ec4, ulAttribute=0x5a, pBuffer=0x34302d4 | out: pBuffer=0x34302d4) returned 0x0 [0135.588] GetLastError () returned 0x0 [0135.608] QueryContextAttributesW (in: phContext=0x3427ec4, ulAttribute=0x53, pBuffer=0x34305a0 | out: pBuffer=0x34305a0) returned 0x0 [0135.610] GetLastError () returned 0x80092004 [0135.673] CertDuplicateCertificateContext (pCertContext=0x13dbf78) returned 0x13dbf78 [0135.673] GetLastError () returned 0x80092004 [0135.677] CertDuplicateStore (hCertStore=0x137ef00) returned 0x137ef00 [0135.677] GetLastError () returned 0x80092004 [0135.678] CertEnumCertificatesInStore (hCertStore=0x137ef00, pPrevCertContext=0x0) returned 0x13dbfc8 [0135.678] GetLastError () returned 0x80092004 [0135.678] CertDuplicateCertificateContext (pCertContext=0x13dbfc8) returned 0x13dbfc8 [0135.678] GetLastError () returned 0x80092004 [0135.678] CertEnumCertificatesInStore (hCertStore=0x137ef00, pPrevCertContext=0x13dbfc8) returned 0x13dbf78 [0135.678] GetLastError () returned 0x80092004 [0135.679] CertDuplicateCertificateContext (pCertContext=0x13dbf78) returned 0x13dbf78 [0135.679] GetLastError () returned 0x80092004 [0135.679] CertEnumCertificatesInStore (hCertStore=0x137ef00, pPrevCertContext=0x13dbf78) returned 0x0 [0135.679] GetLastError () returned 0x80092004 [0135.679] CertCloseStore (hCertStore=0x137ef00, dwFlags=0x0) returned 1 [0135.679] GetLastError () returned 0x80092004 [0135.679] CertFreeCertificateContext (pCertContext=0x13dbf78) returned 1 [0135.679] GetLastError () returned 0x80092004 [0135.692] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x137ef78 [0135.692] GetLastError () returned 0x80092004 [0135.700] CertAddCRLLinkToStore (in: hCertStore=0x137ef78, pCrlContext=0x13dbfc8, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0135.700] GetLastError () returned 0x80092004 [0135.700] CertAddCRLLinkToStore (in: hCertStore=0x137ef78, pCrlContext=0x13dbf78, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0135.700] GetLastError () returned 0x80092004 [0135.702] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x13dbf78, pTime=0x8c5e154, hAdditionalStore=0x137ef78, pChainPara=0x13f5e70, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x8c5e094 | out: ppChainContext=0x8c5e094) returned 1 [0141.171] GetLastError () returned 0x80092004 [0141.173] CertDuplicateCertificateChain (pChainContext=0x13f0878) returned 0x13f0878 [0141.173] GetLastError () returned 0x80092004 [0141.175] CertDuplicateCertificateContext (pCertContext=0x13dbf78) returned 0x13dbf78 [0141.175] GetLastError () returned 0x80092004 [0141.176] CertDuplicateCertificateContext (pCertContext=0x9b23fe8) returned 0x9b23fe8 [0141.176] GetLastError () returned 0x80092004 [0141.176] CertDuplicateCertificateContext (pCertContext=0x9b241c8) returned 0x9b241c8 [0141.176] GetLastError () returned 0x80092004 [0141.176] CertFreeCertificateChain (pChainContext=0x13f0878) [0141.176] GetLastError () returned 0x80092004 [0141.178] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x13f0878, pPolicyPara=0x8c5e23c, pPolicyStatus=0x8c5e228 | out: pPolicyStatus=0x8c5e228) returned 1 [0141.178] GetLastError () returned 0x0 [0141.179] SetLastError (dwErrCode=0x0) [0141.179] GetLastError () returned 0x0 [0141.183] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x13f0878, pPolicyPara=0x8c5e2b8, pPolicyStatus=0x8c5e24c | out: pPolicyStatus=0x8c5e24c) returned 1 [0141.186] GetLastError () returned 0x80092004 [0141.187] CertFreeCertificateChain (pChainContext=0x13f0878) [0141.187] GetLastError () returned 0x80092004 [0141.187] CertFreeCertificateContext (pCertContext=0x13dbf78) returned 1 [0141.187] GetLastError () returned 0x80092004 [0141.190] EncryptMessage (in: phContext=0x3427ec4, fQOP=0x0, pMessage=0x345f7d4, MessageSeqNo=0x0 | out: pMessage=0x345f7d4) returned 0x0 [0141.191] GetLastError () returned 0x80092004 [0141.191] send (in: s=0x890, buf=0x345f5b8*, len=229, flags=0 | out: buf=0x345f5b8*) returned 229 [0141.191] GetLastError () returned 0x0 [0141.195] setsockopt (s=0x890, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0141.195] GetLastError () returned 0x0 [0141.195] recv (in: s=0x890, buf=0x345f90c, len=5, flags=0 | out: buf=0x345f90c*) returned 5 [0141.353] GetLastError () returned 0x0 [0141.353] recv (in: s=0x890, buf=0x3460559, len=400, flags=0 | out: buf=0x3460559*) returned 400 [0141.354] GetLastError () returned 0x0 [0141.356] DecryptMessage (in: phContext=0x3427ec4, pMessage=0x3460784, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3460784, pfQOP=0x0) returned 0x0 [0141.356] GetLastError () returned 0x0 [0141.380] setsockopt (s=0x890, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0141.380] GetLastError () returned 0x0 [0141.381] recv (in: s=0x890, buf=0x3460554, len=5, flags=0 | out: buf=0x3460554*) returned 5 [0141.381] GetLastError () returned 0x0 [0141.381] recv (in: s=0x890, buf=0x3460559, len=32, flags=0 | out: buf=0x3460559*) returned 32 [0141.381] GetLastError () returned 0x0 [0141.381] DecryptMessage (in: phContext=0x3427ec4, pMessage=0x3466ff0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3466ff0, pfQOP=0x0) returned 0x0 [0141.381] GetLastError () returned 0x0 [0141.382] recv (in: s=0x890, buf=0x3460554, len=5, flags=0 | out: buf=0x3460554*) returned 5 [0141.382] GetLastError () returned 0x0 [0141.382] recv (in: s=0x890, buf=0x3467085, len=5056, flags=0 | out: buf=0x3467085*) returned 5056 [0141.382] GetLastError () returned 0x0 [0141.382] DecryptMessage (in: phContext=0x3427ec4, pMessage=0x34684e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x34684e0, pfQOP=0x0) returned 0x0 [0141.382] GetLastError () returned 0x0 [0141.383] recv (in: s=0x890, buf=0x3467080, len=5, flags=0 | out: buf=0x3467080*) returned 5 [0141.383] GetLastError () returned 0x0 [0141.383] recv (in: s=0x890, buf=0x3467085, len=4192, flags=0 | out: buf=0x3467085*) returned 4192 [0141.383] GetLastError () returned 0x0 [0141.383] DecryptMessage (in: phContext=0x3427ec4, pMessage=0x346fe4c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x346fe4c, pfQOP=0x0) returned 0x0 [0141.383] GetLastError () returned 0x0 [0141.384] recv (in: s=0x890, buf=0x3467080, len=5, flags=0 | out: buf=0x3467080*) returned 5 [0141.384] GetLastError () returned 0x0 [0141.384] recv (in: s=0x890, buf=0x3467085, len=32, flags=0 | out: buf=0x3467085*) returned 32 [0141.384] GetLastError () returned 0x0 [0141.384] DecryptMessage (in: phContext=0x3427ec4, pMessage=0x3477f7c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x3477f7c, pfQOP=0x0) returned 0x0 [0141.384] GetLastError () returned 0x0 [0141.384] recv (in: s=0x890, buf=0x3467080, len=5, flags=0 | out: buf=0x3467080*) returned 5 [0141.384] GetLastError () returned 0x0 [0141.384] recv (in: s=0x890, buf=0x3467085, len=32, flags=0 | out: buf=0x3467085*) returned 32 [0141.384] GetLastError () returned 0x0 [0141.384] DecryptMessage (in: phContext=0x3427ec4, pMessage=0x34780b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x34780b0, pfQOP=0x0) returned 0x0 [0141.384] GetLastError () returned 0x0 [0141.384] recv (in: s=0x890, buf=0x3467080, len=5, flags=0 | out: buf=0x3467080*) returned 5 [0141.384] GetLastError () returned 0x0 [0141.384] recv (in: s=0x890, buf=0x3467085, len=4144, flags=0 | out: buf=0x3467085*) returned 4144 [0141.384] GetLastError () returned 0x0 [0141.385] DecryptMessage (in: phContext=0x3427ec4, pMessage=0x34781cc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x34781cc, pfQOP=0x0) returned 0x0 [0141.385] GetLastError () returned 0x0 [0141.385] recv (in: s=0x890, buf=0x3467080, len=5, flags=0 | out: buf=0x3467080*) returned 5 [0141.459] GetLastError () returned 0x0 [0141.459] recv (in: s=0x890, buf=0x347927d, len=5312, flags=0 | out: buf=0x347927d*) returned 5312 [0141.460] GetLastError () returned 0x0 [0141.460] DecryptMessage (in: phContext=0x3427ec4, pMessage=0x347a7d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x347a7d8, pfQOP=0x0) returned 0x0 [0141.460] GetLastError () returned 0x0 [0141.461] recv (in: s=0x890, buf=0x3479278, len=5, flags=0 | out: buf=0x3479278*) returned 5 [0141.461] GetLastError () returned 0x0 [0141.461] recv (in: s=0x890, buf=0x347927d, len=32, flags=0 | out: buf=0x347927d*) returned 32 [0141.461] GetLastError () returned 0x0 [0141.461] DecryptMessage (in: phContext=0x3427ec4, pMessage=0x348a908, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x348a908, pfQOP=0x0) returned 0x0 [0141.461] GetLastError () returned 0x0 [0141.461] recv (in: s=0x890, buf=0x3479278, len=5, flags=0 | out: buf=0x3479278*) returned 5 [0141.461] GetLastError () returned 0x0 [0141.461] recv (in: s=0x890, buf=0x347927d, len=48, flags=0 | out: buf=0x347927d*) returned 48 [0141.461] GetLastError () returned 0x0 [0141.461] DecryptMessage (in: phContext=0x3427ec4, pMessage=0x348aa3c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x348aa3c, pfQOP=0x0) returned 0x0 [0141.461] GetLastError () returned 0x0 [0141.461] recv (in: s=0x890, buf=0x3479278, len=5, flags=0 | out: buf=0x3479278*) returned 5 [0141.461] GetLastError () returned 0x0 [0141.462] recv (in: s=0x890, buf=0x347927d, len=32, flags=0 | out: buf=0x347927d*) returned 32 [0141.462] GetLastError () returned 0x0 [0141.462] DecryptMessage (in: phContext=0x3427ec4, pMessage=0x348ab70, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x348ab70, pfQOP=0x0) returned 0x0 [0141.462] GetLastError () returned 0x0 [0141.462] SetEvent (hEvent=0x77c) returned 1 [0141.462] GetLastError () returned 0x0 [0141.627] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13f5e70 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0141.627] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x8c5e6a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0141.628] GetLastError () returned 0x3f0 [0141.628] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat", nBufferLength=0x105, lpBuffer=0x8c5e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat", lpFilePart=0x0) returned 0x36 [0141.628] GetLastError () returned 0x3f0 [0141.628] SetErrorMode (uMode=0x1) returned 0x0 [0141.628] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\geo.dat"), fInfoLevelId=0x0, lpFileInformation=0x8c5eb9c | out: lpFileInformation=0x8c5eb9c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0141.628] GetLastError () returned 0x2 [0141.628] SetErrorMode (uMode=0x0) returned 0x1 [0141.628] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13f5e70 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0141.628] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x8c5e6a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0141.628] GetLastError () returned 0x3f0 [0141.629] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat", nBufferLength=0x105, lpBuffer=0x8c5e5dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat", lpFilePart=0x0) returned 0x36 [0141.629] GetLastError () returned 0x3f0 [0141.629] SetErrorMode (uMode=0x1) returned 0x0 [0141.629] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\geo.dat"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xbe0 [0141.630] GetLastError () returned 0x0 [0141.630] GetFileType (hFile=0xbe0) returned 0x1 [0141.630] SetErrorMode (uMode=0x0) returned 0x1 [0141.630] GetFileType (hFile=0xbe0) returned 0x1 [0141.630] WriteFile (in: hFile=0xbe0, lpBuffer=0x34bc1a4*, nNumberOfBytesToWrite=0x21, lpNumberOfBytesWritten=0x8c5eb04, lpOverlapped=0x0 | out: lpBuffer=0x34bc1a4*, lpNumberOfBytesWritten=0x8c5eb04*=0x21, lpOverlapped=0x0) returned 1 [0141.631] GetLastError () returned 0x0 [0141.631] CloseHandle (hObject=0xbe0) returned 1 [0141.685] GetLastError () returned 0x0 [0141.685] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13f5e70 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0141.685] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x8c5e6a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0141.685] GetLastError () returned 0x3f0 [0141.685] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat", nBufferLength=0x105, lpBuffer=0x8c5e71c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat", lpFilePart=0x0) returned 0x36 [0141.685] GetLastError () returned 0x3f0 [0141.685] SetErrorMode (uMode=0x1) returned 0x0 [0141.685] GetFileAttributesExW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\geo.dat"), fInfoLevelId=0x0, lpFileInformation=0x8c5eb9c | out: lpFileInformation=0x8c5eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85e56e16, ftCreationTime.dwHighDateTime=0x1d3cb58, ftLastAccessTime.dwLowDateTime=0x85e56e16, ftLastAccessTime.dwHighDateTime=0x1d3cb58, ftLastWriteTime.dwLowDateTime=0x85eef6e6, ftLastWriteTime.dwHighDateTime=0x1d3cb58, nFileSizeHigh=0x0, nFileSizeLow=0x21)) returned 1 [0141.686] GetLastError () returned 0x3f0 [0141.686] SetErrorMode (uMode=0x0) returned 0x1 [0141.686] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x13f5e70 | out: pszPath="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming") returned 0x0 [0141.686] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x8c5e6a4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0141.686] GetLastError () returned 0x3f0 [0141.686] GetFullPathNameW (in: lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat", nBufferLength=0x105, lpBuffer=0x8c5e5e8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat", lpFilePart=0x0) returned 0x36 [0141.686] GetLastError () returned 0x3f0 [0141.686] SetErrorMode (uMode=0x1) returned 0x0 [0141.686] CreateFileW (lpFileName="C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Imminent\\Geo.dat" (normalized: "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\imminent\\geo.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xbe0 [0141.686] GetLastError () returned 0x0 [0141.686] GetFileType (hFile=0xbe0) returned 0x1 [0141.686] SetErrorMode (uMode=0x0) returned 0x1 [0141.687] GetFileType (hFile=0xbe0) returned 0x1 [0141.687] GetFileSize (in: hFile=0xbe0, lpFileSizeHigh=0x8c5eb9c | out: lpFileSizeHigh=0x8c5eb9c*=0x0) returned 0x21 [0141.687] GetLastError () returned 0x0 [0141.687] ReadFile (in: hFile=0xbe0, lpBuffer=0x34be638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x8c5eb44, lpOverlapped=0x0 | out: lpBuffer=0x34be638*, lpNumberOfBytesRead=0x8c5eb44*=0x21, lpOverlapped=0x0) returned 1 [0141.687] GetLastError () returned 0x0 [0141.687] CloseHandle (hObject=0xbe0) returned 1 [0141.687] GetLastError () returned 0x0 [0141.690] send (in: s=0x6c8, buf=0x34c30c0*, len=50, flags=0 | out: buf=0x34c30c0*) returned 50 [0141.690] GetLastError () returned 0x0 [0141.690] CoUninitialize () Thread: id = 152 os_tid = 0x8d4 Thread: id = 153 os_tid = 0xbc0 Thread: id = 154 os_tid = 0x594 [0133.521] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0133.524] ResetEvent (hEvent=0x77c) returned 1 [0133.524] GetLastError () returned 0x0 Thread: id = 158 os_tid = 0xbcc Thread: id = 160 os_tid = 0x778 Thread: id = 162 os_tid = 0xc0c Thread: id = 163 os_tid = 0x310 Thread: id = 164 os_tid = 0xc04 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x54043000" os_pid = "0x378" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xec8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e0e3" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1004 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1005 start_va = 0x51e5e10000 end_va = 0x51e5e1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e5e10000" filename = "" Region: id = 1006 start_va = 0x51e5e20000 end_va = 0x51e5e20fff entry_point = 0x51e5e20000 region_type = mapped_file name = "svchost.exe.mui" filename = "\\Windows\\System32\\en-US\\svchost.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\svchost.exe.mui") Region: id = 1007 start_va = 0x51e5e30000 end_va = 0x51e5e43fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e5e30000" filename = "" Region: id = 1008 start_va = 0x51e5e50000 end_va = 0x51e5ecffff entry_point = 0x0 region_type = private name = "private_0x00000051e5e50000" filename = "" Region: id = 1009 start_va = 0x51e5ed0000 end_va = 0x51e5ed3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e5ed0000" filename = "" Region: id = 1010 start_va = 0x51e5ee0000 end_va = 0x51e5ee0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e5ee0000" filename = "" Region: id = 1011 start_va = 0x51e5ef0000 end_va = 0x51e5ef1fff entry_point = 0x0 region_type = private name = "private_0x00000051e5ef0000" filename = "" Region: id = 1012 start_va = 0x51e5f00000 end_va = 0x51e5fbdfff entry_point = 0x51e5f00000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1013 start_va = 0x51e5fc0000 end_va = 0x51e5fc0fff entry_point = 0x0 region_type = private name = "private_0x00000051e5fc0000" filename = "" Region: id = 1014 start_va = 0x51e5fd0000 end_va = 0x51e5fd6fff entry_point = 0x0 region_type = private name = "private_0x00000051e5fd0000" filename = "" Region: id = 1015 start_va = 0x51e5fe0000 end_va = 0x51e5fe0fff entry_point = 0x0 region_type = private name = "private_0x00000051e5fe0000" filename = "" Region: id = 1016 start_va = 0x51e5ff0000 end_va = 0x51e5ff0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e5ff0000" filename = "" Region: id = 1017 start_va = 0x51e6000000 end_va = 0x51e60fffff entry_point = 0x0 region_type = private name = "private_0x00000051e6000000" filename = "" Region: id = 1018 start_va = 0x51e6100000 end_va = 0x51e617ffff entry_point = 0x0 region_type = private name = "private_0x00000051e6100000" filename = "" Region: id = 1019 start_va = 0x51e6180000 end_va = 0x51e6180fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e6180000" filename = "" Region: id = 1020 start_va = 0x51e6190000 end_va = 0x51e6190fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e6190000" filename = "" Region: id = 1021 start_va = 0x51e61a0000 end_va = 0x51e61a1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e61a0000" filename = "" Region: id = 1022 start_va = 0x51e61b0000 end_va = 0x51e61b6fff entry_point = 0x0 region_type = private name = "private_0x00000051e61b0000" filename = "" Region: id = 1023 start_va = 0x51e61c0000 end_va = 0x51e61c3fff entry_point = 0x51e61c0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1024 start_va = 0x51e61d0000 end_va = 0x51e61d3fff entry_point = 0x51e61d0000 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1025 start_va = 0x51e61e0000 end_va = 0x51e61e6fff entry_point = 0x0 region_type = private name = "private_0x00000051e61e0000" filename = "" Region: id = 1026 start_va = 0x51e61f0000 end_va = 0x51e61fcfff entry_point = 0x51e61f0000 region_type = mapped_file name = "iphlpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\iphlpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\iphlpsvc.dll.mui") Region: id = 1027 start_va = 0x51e6200000 end_va = 0x51e62fffff entry_point = 0x0 region_type = private name = "private_0x00000051e6200000" filename = "" Region: id = 1028 start_va = 0x51e6300000 end_va = 0x51e6487fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e6300000" filename = "" Region: id = 1029 start_va = 0x51e6490000 end_va = 0x51e6610fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e6490000" filename = "" Region: id = 1030 start_va = 0x51e6620000 end_va = 0x51e66dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e6620000" filename = "" Region: id = 1031 start_va = 0x51e66e0000 end_va = 0x51e675ffff entry_point = 0x0 region_type = private name = "private_0x00000051e66e0000" filename = "" Region: id = 1032 start_va = 0x51e6760000 end_va = 0x51e67dffff entry_point = 0x0 region_type = private name = "private_0x00000051e6760000" filename = "" Region: id = 1033 start_va = 0x51e67e0000 end_va = 0x51e68dffff entry_point = 0x0 region_type = private name = "private_0x00000051e67e0000" filename = "" Region: id = 1034 start_va = 0x51e68e0000 end_va = 0x51e69dffff entry_point = 0x0 region_type = private name = "private_0x00000051e68e0000" filename = "" Region: id = 1035 start_va = 0x51e69e0000 end_va = 0x51e6adffff entry_point = 0x0 region_type = private name = "private_0x00000051e69e0000" filename = "" Region: id = 1036 start_va = 0x51e6ae0000 end_va = 0x51e6b22fff entry_point = 0x51e6ae0000 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000b.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000b.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000b.db") Region: id = 1037 start_va = 0x51e6b30000 end_va = 0x51e6b40fff entry_point = 0x51e6b30000 region_type = mapped_file name = "propsys.dll.mui" filename = "\\Windows\\System32\\en-US\\propsys.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\propsys.dll.mui") Region: id = 1038 start_va = 0x51e6b50000 end_va = 0x51e6b56fff entry_point = 0x0 region_type = private name = "private_0x00000051e6b50000" filename = "" Region: id = 1039 start_va = 0x51e6b60000 end_va = 0x51e6b61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e6b60000" filename = "" Region: id = 1040 start_va = 0x51e6b70000 end_va = 0x51e6b71fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e6b70000" filename = "" Region: id = 1041 start_va = 0x51e6b80000 end_va = 0x51e6b84fff entry_point = 0x51e6b80000 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 1042 start_va = 0x51e6b90000 end_va = 0x51e6b96fff entry_point = 0x51e6b90000 region_type = mapped_file name = "newdev.dll.mui" filename = "\\Windows\\System32\\en-US\\newdev.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\newdev.dll.mui") Region: id = 1043 start_va = 0x51e6ba0000 end_va = 0x51e6ba6fff entry_point = 0x0 region_type = private name = "private_0x00000051e6ba0000" filename = "" Region: id = 1044 start_va = 0x51e6bb0000 end_va = 0x51e6bb0fff entry_point = 0x0 region_type = private name = "private_0x00000051e6bb0000" filename = "" Region: id = 1045 start_va = 0x51e6bc0000 end_va = 0x51e6bc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e6bc0000" filename = "" Region: id = 1046 start_va = 0x51e6bd0000 end_va = 0x51e6bdffff entry_point = 0x51e6bd0000 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 1047 start_va = 0x51e6be0000 end_va = 0x51e6be1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e6be0000" filename = "" Region: id = 1048 start_va = 0x51e6bf0000 end_va = 0x51e6bfcfff entry_point = 0x51e6bf0000 region_type = mapped_file name = "gpsvc.dll.mui" filename = "\\Windows\\System32\\en-US\\gpsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\gpsvc.dll.mui") Region: id = 1049 start_va = 0x51e6c00000 end_va = 0x51e6cfffff entry_point = 0x0 region_type = private name = "private_0x00000051e6c00000" filename = "" Region: id = 1050 start_va = 0x51e6d00000 end_va = 0x51e7036fff entry_point = 0x51e6d00000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1051 start_va = 0x51e7040000 end_va = 0x51e713ffff entry_point = 0x0 region_type = private name = "private_0x00000051e7040000" filename = "" Region: id = 1052 start_va = 0x51e7140000 end_va = 0x51e723ffff entry_point = 0x0 region_type = private name = "private_0x00000051e7140000" filename = "" Region: id = 1053 start_va = 0x51e7240000 end_va = 0x51e733ffff entry_point = 0x0 region_type = private name = "private_0x00000051e7240000" filename = "" Region: id = 1054 start_va = 0x51e7340000 end_va = 0x51e743ffff entry_point = 0x0 region_type = private name = "private_0x00000051e7340000" filename = "" Region: id = 1055 start_va = 0x51e7440000 end_va = 0x51e74bffff entry_point = 0x0 region_type = private name = "private_0x00000051e7440000" filename = "" Region: id = 1056 start_va = 0x51e74c0000 end_va = 0x51e74c8fff entry_point = 0x51e74c0000 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 1057 start_va = 0x51e74d0000 end_va = 0x51e74d6fff entry_point = 0x0 region_type = private name = "private_0x00000051e74d0000" filename = "" Region: id = 1058 start_va = 0x51e74e0000 end_va = 0x51e74e1fff entry_point = 0x51e74e0000 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 1059 start_va = 0x51e74f0000 end_va = 0x51e74f2fff entry_point = 0x51e74f0000 region_type = mapped_file name = "mswsock.dll.mui" filename = "\\Windows\\System32\\en-US\\mswsock.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\mswsock.dll.mui") Region: id = 1060 start_va = 0x51e7500000 end_va = 0x51e75fffff entry_point = 0x0 region_type = private name = "private_0x00000051e7500000" filename = "" Region: id = 1061 start_va = 0x51e7600000 end_va = 0x51e76fffff entry_point = 0x0 region_type = private name = "private_0x00000051e7600000" filename = "" Region: id = 1062 start_va = 0x51e7700000 end_va = 0x51e777ffff entry_point = 0x0 region_type = private name = "private_0x00000051e7700000" filename = "" Region: id = 1063 start_va = 0x51e7780000 end_va = 0x51e787ffff entry_point = 0x0 region_type = private name = "private_0x00000051e7780000" filename = "" Region: id = 1064 start_va = 0x51e7880000 end_va = 0x51e797ffff entry_point = 0x0 region_type = private name = "private_0x00000051e7880000" filename = "" Region: id = 1065 start_va = 0x51e7980000 end_va = 0x51e7a7ffff entry_point = 0x0 region_type = private name = "private_0x00000051e7980000" filename = "" Region: id = 1066 start_va = 0x51e7a80000 end_va = 0x51e7afffff entry_point = 0x0 region_type = private name = "private_0x00000051e7a80000" filename = "" Region: id = 1067 start_va = 0x51e7b00000 end_va = 0x51e7bfffff entry_point = 0x0 region_type = private name = "private_0x00000051e7b00000" filename = "" Region: id = 1068 start_va = 0x51e7c00000 end_va = 0x51e7c8afff entry_point = 0x51e7c00000 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 1069 start_va = 0x51e7c90000 end_va = 0x51e7d8ffff entry_point = 0x0 region_type = private name = "private_0x00000051e7c90000" filename = "" Region: id = 1070 start_va = 0x51e7d90000 end_va = 0x51e7e8ffff entry_point = 0x0 region_type = private name = "private_0x00000051e7d90000" filename = "" Region: id = 1071 start_va = 0x51e7e90000 end_va = 0x51e7f8ffff entry_point = 0x0 region_type = private name = "private_0x00000051e7e90000" filename = "" Region: id = 1072 start_va = 0x51e7f90000 end_va = 0x51e800ffff entry_point = 0x0 region_type = private name = "private_0x00000051e7f90000" filename = "" Region: id = 1073 start_va = 0x51e8010000 end_va = 0x51e8010fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8010000" filename = "" Region: id = 1074 start_va = 0x51e8020000 end_va = 0x51e8022fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8020000" filename = "" Region: id = 1075 start_va = 0x51e8030000 end_va = 0x51e8030fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8030000" filename = "" Region: id = 1076 start_va = 0x51e8040000 end_va = 0x51e8040fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8040000" filename = "" Region: id = 1077 start_va = 0x51e8050000 end_va = 0x51e805ffff entry_point = 0x51e8050000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1078 start_va = 0x51e8060000 end_va = 0x51e80a0fff entry_point = 0x0 region_type = private name = "private_0x00000051e8060000" filename = "" Region: id = 1079 start_va = 0x51e80b0000 end_va = 0x51e80b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e80b0000" filename = "" Region: id = 1080 start_va = 0x51e80c0000 end_va = 0x51e80c7fff entry_point = 0x0 region_type = private name = "private_0x00000051e80c0000" filename = "" Region: id = 1081 start_va = 0x51e80d0000 end_va = 0x51e80dffff entry_point = 0x0 region_type = private name = "private_0x00000051e80d0000" filename = "" Region: id = 1082 start_va = 0x51e80e0000 end_va = 0x51e80effff entry_point = 0x0 region_type = private name = "private_0x00000051e80e0000" filename = "" Region: id = 1083 start_va = 0x51e80f0000 end_va = 0x51e80f0fff entry_point = 0x0 region_type = private name = "private_0x00000051e80f0000" filename = "" Region: id = 1084 start_va = 0x51e8100000 end_va = 0x51e8106fff entry_point = 0x0 region_type = private name = "private_0x00000051e8100000" filename = "" Region: id = 1085 start_va = 0x51e8110000 end_va = 0x51e820ffff entry_point = 0x0 region_type = private name = "private_0x00000051e8110000" filename = "" Region: id = 1086 start_va = 0x51e8210000 end_va = 0x51e828ffff entry_point = 0x0 region_type = private name = "private_0x00000051e8210000" filename = "" Region: id = 1087 start_va = 0x51e8290000 end_va = 0x51e838ffff entry_point = 0x0 region_type = private name = "private_0x00000051e8290000" filename = "" Region: id = 1088 start_va = 0x51e8390000 end_va = 0x51e848ffff entry_point = 0x0 region_type = private name = "private_0x00000051e8390000" filename = "" Region: id = 1089 start_va = 0x51e8490000 end_va = 0x51e850ffff entry_point = 0x0 region_type = private name = "private_0x00000051e8490000" filename = "" Region: id = 1090 start_va = 0x51e8510000 end_va = 0x51e860ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8510000" filename = "" Region: id = 1091 start_va = 0x51e8610000 end_va = 0x51e8610fff entry_point = 0x0 region_type = private name = "private_0x00000051e8610000" filename = "" Region: id = 1092 start_va = 0x51e8620000 end_va = 0x51e8623fff entry_point = 0x0 region_type = private name = "private_0x00000051e8620000" filename = "" Region: id = 1093 start_va = 0x51e8630000 end_va = 0x51e8636fff entry_point = 0x0 region_type = private name = "private_0x00000051e8630000" filename = "" Region: id = 1094 start_va = 0x51e8640000 end_va = 0x51e864ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8640000" filename = "" Region: id = 1095 start_va = 0x51e8650000 end_va = 0x51e865ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8650000" filename = "" Region: id = 1096 start_va = 0x51e8660000 end_va = 0x51e866ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8660000" filename = "" Region: id = 1097 start_va = 0x51e8670000 end_va = 0x51e867ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8670000" filename = "" Region: id = 1098 start_va = 0x51e8680000 end_va = 0x51e868ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8680000" filename = "" Region: id = 1099 start_va = 0x51e8690000 end_va = 0x51e869ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8690000" filename = "" Region: id = 1100 start_va = 0x51e86a0000 end_va = 0x51e86ecfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e86a0000" filename = "" Region: id = 1101 start_va = 0x51e86f0000 end_va = 0x51e86f1fff entry_point = 0x0 region_type = private name = "private_0x00000051e86f0000" filename = "" Region: id = 1102 start_va = 0x51e8700000 end_va = 0x51e87fffff entry_point = 0x0 region_type = private name = "private_0x00000051e8700000" filename = "" Region: id = 1103 start_va = 0x51e8800000 end_va = 0x51e88fffff entry_point = 0x0 region_type = private name = "private_0x00000051e8800000" filename = "" Region: id = 1104 start_va = 0x51e8900000 end_va = 0x51e89fffff entry_point = 0x0 region_type = private name = "private_0x00000051e8900000" filename = "" Region: id = 1105 start_va = 0x51e8a00000 end_va = 0x51e8a7ffff entry_point = 0x0 region_type = private name = "private_0x00000051e8a00000" filename = "" Region: id = 1106 start_va = 0x51e8a80000 end_va = 0x51e8b7ffff entry_point = 0x0 region_type = private name = "private_0x00000051e8a80000" filename = "" Region: id = 1107 start_va = 0x51e8b80000 end_va = 0x51e8bccfff entry_point = 0x0 region_type = private name = "private_0x00000051e8b80000" filename = "" Region: id = 1108 start_va = 0x51e8bd0000 end_va = 0x51e8bd0fff entry_point = 0x0 region_type = private name = "private_0x00000051e8bd0000" filename = "" Region: id = 1109 start_va = 0x51e8be0000 end_va = 0x51e8beffff entry_point = 0x0 region_type = private name = "private_0x00000051e8be0000" filename = "" Region: id = 1110 start_va = 0x51e8bf0000 end_va = 0x51e8bf7fff entry_point = 0x0 region_type = private name = "private_0x00000051e8bf0000" filename = "" Region: id = 1111 start_va = 0x51e8c00000 end_va = 0x51e8c7ffff entry_point = 0x0 region_type = private name = "private_0x00000051e8c00000" filename = "" Region: id = 1112 start_va = 0x51e8c80000 end_va = 0x51e8d7ffff entry_point = 0x0 region_type = private name = "private_0x00000051e8c80000" filename = "" Region: id = 1113 start_va = 0x51e8d80000 end_va = 0x51e8d8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8d80000" filename = "" Region: id = 1114 start_va = 0x51e8d90000 end_va = 0x51e8d9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8d90000" filename = "" Region: id = 1115 start_va = 0x51e8da0000 end_va = 0x51e8daffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8da0000" filename = "" Region: id = 1116 start_va = 0x51e8db0000 end_va = 0x51e8dbffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8db0000" filename = "" Region: id = 1117 start_va = 0x51e8dc0000 end_va = 0x51e8dcffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8dc0000" filename = "" Region: id = 1118 start_va = 0x51e8dd0000 end_va = 0x51e8ddffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051e8dd0000" filename = "" Region: id = 1119 start_va = 0x51e8de0000 end_va = 0x51e8deffff entry_point = 0x51e8de0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1120 start_va = 0x51e8df0000 end_va = 0x51e8dfffff entry_point = 0x51e8df0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1121 start_va = 0x51e8e00000 end_va = 0x51e8e7ffff entry_point = 0x0 region_type = private name = "private_0x00000051e8e00000" filename = "" Region: id = 1122 start_va = 0x51e8e80000 end_va = 0x51e8eaffff entry_point = 0x0 region_type = private name = "private_0x00000051e8e80000" filename = "" Region: id = 1123 start_va = 0x51e8eb0000 end_va = 0x51e8ebffff entry_point = 0x51e8eb0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1124 start_va = 0x51e8ec0000 end_va = 0x51e8ecffff entry_point = 0x51e8ec0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1125 start_va = 0x51e8ed0000 end_va = 0x51e8edffff entry_point = 0x51e8ed0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1126 start_va = 0x51e8ee0000 end_va = 0x51e8eeffff entry_point = 0x51e8ee0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1127 start_va = 0x51e8ef0000 end_va = 0x51e8efffff entry_point = 0x51e8ef0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1128 start_va = 0x51e8f00000 end_va = 0x51e8ffffff entry_point = 0x0 region_type = private name = "private_0x00000051e8f00000" filename = "" Region: id = 1129 start_va = 0x51e9000000 end_va = 0x51e90fffff entry_point = 0x0 region_type = private name = "private_0x00000051e9000000" filename = "" Region: id = 1130 start_va = 0x51e9100000 end_va = 0x51e917ffff entry_point = 0x0 region_type = private name = "private_0x00000051e9100000" filename = "" Region: id = 1131 start_va = 0x51e9180000 end_va = 0x51e91fffff entry_point = 0x0 region_type = private name = "private_0x00000051e9180000" filename = "" Region: id = 1132 start_va = 0x51e9200000 end_va = 0x51e92fffff entry_point = 0x0 region_type = private name = "private_0x00000051e9200000" filename = "" Region: id = 1133 start_va = 0x51e9300000 end_va = 0x51e93fffff entry_point = 0x0 region_type = private name = "private_0x00000051e9300000" filename = "" Region: id = 1134 start_va = 0x51e9400000 end_va = 0x51e94fffff entry_point = 0x0 region_type = private name = "private_0x00000051e9400000" filename = "" Region: id = 1135 start_va = 0x51e9500000 end_va = 0x51e95fffff entry_point = 0x0 region_type = private name = "private_0x00000051e9500000" filename = "" Region: id = 1136 start_va = 0x51e9600000 end_va = 0x51e96fffff entry_point = 0x0 region_type = private name = "private_0x00000051e9600000" filename = "" Region: id = 1137 start_va = 0x51e9700000 end_va = 0x51e97fffff entry_point = 0x0 region_type = private name = "private_0x00000051e9700000" filename = "" Region: id = 1138 start_va = 0x51e9800000 end_va = 0x51e98fffff entry_point = 0x0 region_type = private name = "private_0x00000051e9800000" filename = "" Region: id = 1139 start_va = 0x51e9900000 end_va = 0x51e99fffff entry_point = 0x0 region_type = private name = "private_0x00000051e9900000" filename = "" Region: id = 1140 start_va = 0x51e9a00000 end_va = 0x51e9afffff entry_point = 0x0 region_type = private name = "private_0x00000051e9a00000" filename = "" Region: id = 1141 start_va = 0x51e9b00000 end_va = 0x51e9bfffff entry_point = 0x0 region_type = private name = "private_0x00000051e9b00000" filename = "" Region: id = 1142 start_va = 0x51e9c00000 end_va = 0x51e9cfffff entry_point = 0x0 region_type = private name = "private_0x00000051e9c00000" filename = "" Region: id = 1143 start_va = 0x51e9d00000 end_va = 0x51e9dfffff entry_point = 0x0 region_type = private name = "private_0x00000051e9d00000" filename = "" Region: id = 1144 start_va = 0x51e9e00000 end_va = 0x51e9efffff entry_point = 0x0 region_type = private name = "private_0x00000051e9e00000" filename = "" Region: id = 1145 start_va = 0x51e9f00000 end_va = 0x51e9fdefff entry_point = 0x51e9f00000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1146 start_va = 0x51e9fe0000 end_va = 0x51ea0dffff entry_point = 0x0 region_type = private name = "private_0x00000051e9fe0000" filename = "" Region: id = 1147 start_va = 0x51ea0e0000 end_va = 0x51ea15ffff entry_point = 0x0 region_type = private name = "private_0x00000051ea0e0000" filename = "" Region: id = 1148 start_va = 0x51ea160000 end_va = 0x51ea16ffff entry_point = 0x51ea160000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1149 start_va = 0x51ea170000 end_va = 0x51ea176fff entry_point = 0x0 region_type = private name = "private_0x00000051ea170000" filename = "" Region: id = 1150 start_va = 0x51ea180000 end_va = 0x51ea27ffff entry_point = 0x0 region_type = private name = "private_0x00000051ea180000" filename = "" Region: id = 1151 start_va = 0x51ea280000 end_va = 0x51ea28ffff entry_point = 0x51ea280000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1152 start_va = 0x51ea300000 end_va = 0x51ea3fffff entry_point = 0x0 region_type = private name = "private_0x00000051ea300000" filename = "" Region: id = 1153 start_va = 0x51ea400000 end_va = 0x51ea4fffff entry_point = 0x0 region_type = private name = "private_0x00000051ea400000" filename = "" Region: id = 1154 start_va = 0x51ea500000 end_va = 0x51ea5fffff entry_point = 0x0 region_type = private name = "private_0x00000051ea500000" filename = "" Region: id = 1155 start_va = 0x51ea600000 end_va = 0x51ea6fffff entry_point = 0x0 region_type = private name = "private_0x00000051ea600000" filename = "" Region: id = 1156 start_va = 0x51ea700000 end_va = 0x51ea7fffff entry_point = 0x0 region_type = private name = "private_0x00000051ea700000" filename = "" Region: id = 1157 start_va = 0x51ea800000 end_va = 0x51ea8fffff entry_point = 0x0 region_type = private name = "private_0x00000051ea800000" filename = "" Region: id = 1158 start_va = 0x51ea900000 end_va = 0x51ea9fffff entry_point = 0x0 region_type = private name = "private_0x00000051ea900000" filename = "" Region: id = 1159 start_va = 0x51eaa00000 end_va = 0x51eaafffff entry_point = 0x0 region_type = private name = "private_0x00000051eaa00000" filename = "" Region: id = 1160 start_va = 0x51eab00000 end_va = 0x51eabfffff entry_point = 0x0 region_type = private name = "private_0x00000051eab00000" filename = "" Region: id = 1161 start_va = 0x51eac00000 end_va = 0x51eacfffff entry_point = 0x0 region_type = private name = "private_0x00000051eac00000" filename = "" Region: id = 1162 start_va = 0x51ead00000 end_va = 0x51eadfffff entry_point = 0x0 region_type = private name = "private_0x00000051ead00000" filename = "" Region: id = 1163 start_va = 0x51eae00000 end_va = 0x51eaefffff entry_point = 0x0 region_type = private name = "private_0x00000051eae00000" filename = "" Region: id = 1164 start_va = 0x51eaf00000 end_va = 0x51eaffffff entry_point = 0x0 region_type = private name = "private_0x00000051eaf00000" filename = "" Region: id = 1165 start_va = 0x51eb000000 end_va = 0x51eb0fffff entry_point = 0x0 region_type = private name = "private_0x00000051eb000000" filename = "" Region: id = 1166 start_va = 0x51eb100000 end_va = 0x51eb17ffff entry_point = 0x0 region_type = private name = "private_0x00000051eb100000" filename = "" Region: id = 1167 start_va = 0x51eb180000 end_va = 0x51eb18ffff entry_point = 0x0 region_type = private name = "private_0x00000051eb180000" filename = "" Region: id = 1168 start_va = 0x51eb190000 end_va = 0x51eb19ffff entry_point = 0x0 region_type = private name = "private_0x00000051eb190000" filename = "" Region: id = 1169 start_va = 0x51eb1a0000 end_va = 0x51eb1affff entry_point = 0x0 region_type = private name = "private_0x00000051eb1a0000" filename = "" Region: id = 1170 start_va = 0x51eb1b0000 end_va = 0x51eb1bffff entry_point = 0x0 region_type = private name = "private_0x00000051eb1b0000" filename = "" Region: id = 1171 start_va = 0x51eb1c0000 end_va = 0x51eb1cffff entry_point = 0x0 region_type = private name = "private_0x00000051eb1c0000" filename = "" Region: id = 1172 start_va = 0x51eb1d0000 end_va = 0x51eb1d6fff entry_point = 0x0 region_type = private name = "private_0x00000051eb1d0000" filename = "" Region: id = 1173 start_va = 0x51eb1e0000 end_va = 0x51eb1e7fff entry_point = 0x0 region_type = private name = "private_0x00000051eb1e0000" filename = "" Region: id = 1174 start_va = 0x51eb1f0000 end_va = 0x51eb1fffff entry_point = 0x0 region_type = private name = "private_0x00000051eb1f0000" filename = "" Region: id = 1175 start_va = 0x51eb200000 end_va = 0x51eb2fffff entry_point = 0x0 region_type = private name = "private_0x00000051eb200000" filename = "" Region: id = 1176 start_va = 0x51eb300000 end_va = 0x51eb300fff entry_point = 0x51eb300000 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 1177 start_va = 0x51eb310000 end_va = 0x51eb313fff entry_point = 0x51eb310000 region_type = mapped_file name = "wuaueng.dll.mui" filename = "\\Windows\\System32\\en-US\\wuaueng.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\wuaueng.dll.mui") Region: id = 1178 start_va = 0x51eb320000 end_va = 0x51eb41ffff entry_point = 0x0 region_type = private name = "private_0x00000051eb320000" filename = "" Region: id = 1179 start_va = 0x51eb4f0000 end_va = 0x51eb4f6fff entry_point = 0x0 region_type = private name = "private_0x00000051eb4f0000" filename = "" Region: id = 1180 start_va = 0x51eb500000 end_va = 0x51eb5fffff entry_point = 0x0 region_type = private name = "private_0x00000051eb500000" filename = "" Region: id = 1181 start_va = 0x51eb800000 end_va = 0x51eb8fffff entry_point = 0x0 region_type = private name = "private_0x00000051eb800000" filename = "" Region: id = 1182 start_va = 0x51ec900000 end_va = 0x51ec9fffff entry_point = 0x0 region_type = private name = "private_0x00000051ec900000" filename = "" Region: id = 1183 start_va = 0x51eca00000 end_va = 0x51ed9fffff entry_point = 0x0 region_type = private name = "private_0x00000051eca00000" filename = "" Region: id = 1184 start_va = 0x51eda00000 end_va = 0x51f19fffff entry_point = 0x0 region_type = private name = "private_0x00000051eda00000" filename = "" Region: id = 1185 start_va = 0x51f1a00000 end_va = 0x51f59fffff entry_point = 0x0 region_type = private name = "private_0x00000051f1a00000" filename = "" Region: id = 1186 start_va = 0x7df5ffdb0000 end_va = 0x7ff5ffdaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffdb0000" filename = "" Region: id = 1187 start_va = 0x7ff7b3ab6000 end_va = 0x7ff7b3ab7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ab6000" filename = "" Region: id = 1188 start_va = 0x7ff7b3abe000 end_va = 0x7ff7b3abffff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3abe000" filename = "" Region: id = 1189 start_va = 0x7ff7b3ac0000 end_va = 0x7ff7b3ac1fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ac0000" filename = "" Region: id = 1190 start_va = 0x7ff7b3ac2000 end_va = 0x7ff7b3ac3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ac2000" filename = "" Region: id = 1191 start_va = 0x7ff7b3ac4000 end_va = 0x7ff7b3ac5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ac4000" filename = "" Region: id = 1192 start_va = 0x7ff7b3aca000 end_va = 0x7ff7b3acbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3aca000" filename = "" Region: id = 1193 start_va = 0x7ff7b3acc000 end_va = 0x7ff7b3acdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3acc000" filename = "" Region: id = 1194 start_va = 0x7ff7b3ace000 end_va = 0x7ff7b3acffff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ace000" filename = "" Region: id = 1195 start_va = 0x7ff7b3ad0000 end_va = 0x7ff7b3ad1fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ad0000" filename = "" Region: id = 1196 start_va = 0x7ff7b3ad2000 end_va = 0x7ff7b3ad3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ad2000" filename = "" Region: id = 1197 start_va = 0x7ff7b3ad4000 end_va = 0x7ff7b3ad5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ad4000" filename = "" Region: id = 1198 start_va = 0x7ff7b3ad6000 end_va = 0x7ff7b3ad7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ad6000" filename = "" Region: id = 1199 start_va = 0x7ff7b3ad8000 end_va = 0x7ff7b3ad9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ad8000" filename = "" Region: id = 1200 start_va = 0x7ff7b3ada000 end_va = 0x7ff7b3adbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ada000" filename = "" Region: id = 1201 start_va = 0x7ff7b3adc000 end_va = 0x7ff7b3addfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3adc000" filename = "" Region: id = 1202 start_va = 0x7ff7b3ade000 end_va = 0x7ff7b3adffff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ade000" filename = "" Region: id = 1203 start_va = 0x7ff7b3ae0000 end_va = 0x7ff7b3ae1fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ae0000" filename = "" Region: id = 1204 start_va = 0x7ff7b3ae2000 end_va = 0x7ff7b3ae3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ae2000" filename = "" Region: id = 1205 start_va = 0x7ff7b3ae4000 end_va = 0x7ff7b3ae5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ae4000" filename = "" Region: id = 1206 start_va = 0x7ff7b3ae6000 end_va = 0x7ff7b3ae7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ae6000" filename = "" Region: id = 1207 start_va = 0x7ff7b3ae8000 end_va = 0x7ff7b3ae9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ae8000" filename = "" Region: id = 1208 start_va = 0x7ff7b3aea000 end_va = 0x7ff7b3aebfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3aea000" filename = "" Region: id = 1209 start_va = 0x7ff7b3aec000 end_va = 0x7ff7b3aedfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3aec000" filename = "" Region: id = 1210 start_va = 0x7ff7b3af0000 end_va = 0x7ff7b3af1fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3af0000" filename = "" Region: id = 1211 start_va = 0x7ff7b3af4000 end_va = 0x7ff7b3af5fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3af4000" filename = "" Region: id = 1212 start_va = 0x7ff7b3af6000 end_va = 0x7ff7b3af7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3af6000" filename = "" Region: id = 1213 start_va = 0x7ff7b3af8000 end_va = 0x7ff7b3af9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3af8000" filename = "" Region: id = 1214 start_va = 0x7ff7b3afa000 end_va = 0x7ff7b3afbfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3afa000" filename = "" Region: id = 1215 start_va = 0x7ff7b3afc000 end_va = 0x7ff7b3afdfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3afc000" filename = "" Region: id = 1216 start_va = 0x7ff7b3afe000 end_va = 0x7ff7b3afffff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3afe000" filename = "" Region: id = 1217 start_va = 0x7ff7b3b00000 end_va = 0x7ff7b3b01fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b00000" filename = "" Region: id = 1218 start_va = 0x7ff7b3b02000 end_va = 0x7ff7b3b03fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b02000" filename = "" Region: id = 1219 start_va = 0x7ff7b3b04000 end_va = 0x7ff7b3b05fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b04000" filename = "" Region: id = 1220 start_va = 0x7ff7b3b06000 end_va = 0x7ff7b3b07fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b06000" filename = "" Region: id = 1221 start_va = 0x7ff7b3b08000 end_va = 0x7ff7b3b09fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b08000" filename = "" Region: id = 1222 start_va = 0x7ff7b3b0a000 end_va = 0x7ff7b3b0bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b0a000" filename = "" Region: id = 1223 start_va = 0x7ff7b3b0c000 end_va = 0x7ff7b3b0dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b0c000" filename = "" Region: id = 1224 start_va = 0x7ff7b3b0e000 end_va = 0x7ff7b3b0ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b0e000" filename = "" Region: id = 1225 start_va = 0x7ff7b3b10000 end_va = 0x7ff7b3b11fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b10000" filename = "" Region: id = 1226 start_va = 0x7ff7b3b12000 end_va = 0x7ff7b3b13fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b12000" filename = "" Region: id = 1227 start_va = 0x7ff7b3b14000 end_va = 0x7ff7b3b15fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b14000" filename = "" Region: id = 1228 start_va = 0x7ff7b3b16000 end_va = 0x7ff7b3b17fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b16000" filename = "" Region: id = 1229 start_va = 0x7ff7b3b18000 end_va = 0x7ff7b3b19fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b18000" filename = "" Region: id = 1230 start_va = 0x7ff7b3b1a000 end_va = 0x7ff7b3b1bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b1a000" filename = "" Region: id = 1231 start_va = 0x7ff7b3b1c000 end_va = 0x7ff7b3b1dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b1c000" filename = "" Region: id = 1232 start_va = 0x7ff7b3b1e000 end_va = 0x7ff7b3b1ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b1e000" filename = "" Region: id = 1233 start_va = 0x7ff7b3b20000 end_va = 0x7ff7b3b21fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b20000" filename = "" Region: id = 1234 start_va = 0x7ff7b3b22000 end_va = 0x7ff7b3b23fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b22000" filename = "" Region: id = 1235 start_va = 0x7ff7b3b24000 end_va = 0x7ff7b3b25fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b24000" filename = "" Region: id = 1236 start_va = 0x7ff7b3b26000 end_va = 0x7ff7b3b27fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b26000" filename = "" Region: id = 1237 start_va = 0x7ff7b3b28000 end_va = 0x7ff7b3b29fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b28000" filename = "" Region: id = 1238 start_va = 0x7ff7b3b2a000 end_va = 0x7ff7b3b2bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b2a000" filename = "" Region: id = 1239 start_va = 0x7ff7b3b2c000 end_va = 0x7ff7b3b2dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b2c000" filename = "" Region: id = 1240 start_va = 0x7ff7b3b2e000 end_va = 0x7ff7b3b2ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3b2e000" filename = "" Region: id = 1241 start_va = 0x7ff7b3b30000 end_va = 0x7ff7b3c2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7b3b30000" filename = "" Region: id = 1242 start_va = 0x7ff7b3c30000 end_va = 0x7ff7b3c52fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff7b3c30000" filename = "" Region: id = 1243 start_va = 0x7ff7b3c53000 end_va = 0x7ff7b3c54fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3c53000" filename = "" Region: id = 1244 start_va = 0x7ff7b3c55000 end_va = 0x7ff7b3c56fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3c55000" filename = "" Region: id = 1245 start_va = 0x7ff7b3c57000 end_va = 0x7ff7b3c58fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3c57000" filename = "" Region: id = 1246 start_va = 0x7ff7b3c59000 end_va = 0x7ff7b3c59fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3c59000" filename = "" Region: id = 1247 start_va = 0x7ff7b3c5a000 end_va = 0x7ff7b3c5bfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3c5a000" filename = "" Region: id = 1248 start_va = 0x7ff7b3c5c000 end_va = 0x7ff7b3c5dfff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3c5c000" filename = "" Region: id = 1249 start_va = 0x7ff7b3c5e000 end_va = 0x7ff7b3c5ffff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3c5e000" filename = "" Region: id = 1250 start_va = 0x7ff7b3dc0000 end_va = 0x7ff7b3dccfff entry_point = 0x7ff7b3dc0000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1251 start_va = 0x7ffbea930000 end_va = 0x7ffbea987fff entry_point = 0x7ffbea930000 region_type = mapped_file name = "newdev.dll" filename = "\\Windows\\System32\\newdev.dll" (normalized: "c:\\windows\\system32\\newdev.dll") Region: id = 1252 start_va = 0x7ffbea990000 end_va = 0x7ffbea9f0fff entry_point = 0x7ffbea990000 region_type = mapped_file name = "wuuhext.dll" filename = "\\Windows\\System32\\wuuhext.dll" (normalized: "c:\\windows\\system32\\wuuhext.dll") Region: id = 1253 start_va = 0x7ffbeaa00000 end_va = 0x7ffbeac29fff entry_point = 0x7ffbeaa00000 region_type = mapped_file name = "wuaueng.dll" filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll") Region: id = 1254 start_va = 0x7ffbeb7e0000 end_va = 0x7ffbeb7f2fff entry_point = 0x7ffbeb7e0000 region_type = mapped_file name = "devrtl.dll" filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll") Region: id = 1255 start_va = 0x7ffbed2e0000 end_va = 0x7ffbed31ffff entry_point = 0x7ffbed2e0000 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 1256 start_va = 0x7ffbed3a0000 end_va = 0x7ffbed3bcfff entry_point = 0x7ffbed3a0000 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 1257 start_va = 0x7ffbed450000 end_va = 0x7ffbed513fff entry_point = 0x7ffbed450000 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 1258 start_va = 0x7ffbed520000 end_va = 0x7ffbed538fff entry_point = 0x7ffbed520000 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 1259 start_va = 0x7ffbefdf0000 end_va = 0x7ffbefe73fff entry_point = 0x7ffbefdf0000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv") Region: id = 1260 start_va = 0x7ffbf2120000 end_va = 0x7ffbf2396fff entry_point = 0x7ffbf2120000 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 1261 start_va = 0x7ffbf2590000 end_va = 0x7ffbf25a1fff entry_point = 0x7ffbf2590000 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 1262 start_va = 0x7ffbf25b0000 end_va = 0x7ffbf262ffff entry_point = 0x7ffbf25b0000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1263 start_va = 0x7ffbf2cc0000 end_va = 0x7ffbf2d25fff entry_point = 0x7ffbf2cc0000 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1264 start_va = 0x7ffbf2d30000 end_va = 0x7ffbf2d42fff entry_point = 0x7ffbf2d30000 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1265 start_va = 0x7ffbf2d50000 end_va = 0x7ffbf2d5afff entry_point = 0x7ffbf2d50000 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1266 start_va = 0x7ffbf2d60000 end_va = 0x7ffbf2e80fff entry_point = 0x7ffbf2d60000 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1267 start_va = 0x7ffbf5460000 end_va = 0x7ffbf58c9fff entry_point = 0x7ffbf5460000 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1268 start_va = 0x7ffbf5c50000 end_va = 0x7ffbf5ef6fff entry_point = 0x7ffbf5c50000 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 1269 start_va = 0x7ffbf5f00000 end_va = 0x7ffbf5f10fff entry_point = 0x7ffbf5f00000 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 1270 start_va = 0x7ffbf5f20000 end_va = 0x7ffbf5fa2fff entry_point = 0x7ffbf5f20000 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1271 start_va = 0x7ffbf5fb0000 end_va = 0x7ffbf5fc5fff entry_point = 0x7ffbf5fb0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1272 start_va = 0x7ffbf5fd0000 end_va = 0x7ffbf60a7fff entry_point = 0x7ffbf5fd0000 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1273 start_va = 0x7ffbf60b0000 end_va = 0x7ffbf6112fff entry_point = 0x7ffbf60b0000 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1274 start_va = 0x7ffbf6120000 end_va = 0x7ffbf6144fff entry_point = 0x7ffbf6120000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1275 start_va = 0x7ffbf6150000 end_va = 0x7ffbf6163fff entry_point = 0x7ffbf6150000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1276 start_va = 0x7ffbf6170000 end_va = 0x7ffbf6267fff entry_point = 0x7ffbf6170000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1277 start_va = 0x7ffbf6270000 end_va = 0x7ffbf62e2fff entry_point = 0x7ffbf6270000 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1278 start_va = 0x7ffbf62f0000 end_va = 0x7ffbf6426fff entry_point = 0x7ffbf62f0000 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1279 start_va = 0x7ffbf6430000 end_va = 0x7ffbf64c6fff entry_point = 0x7ffbf6430000 region_type = mapped_file name = "settingsync.dll" filename = "\\Windows\\System32\\SettingSync.dll" (normalized: "c:\\windows\\system32\\settingsync.dll") Region: id = 1280 start_va = 0x7ffbf64d0000 end_va = 0x7ffbf64e0fff entry_point = 0x7ffbf64d0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1281 start_va = 0x7ffbf64f0000 end_va = 0x7ffbf6500fff entry_point = 0x7ffbf64f0000 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 1282 start_va = 0x7ffbf6510000 end_va = 0x7ffbf658ffff entry_point = 0x7ffbf6510000 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1283 start_va = 0x7ffbf6590000 end_va = 0x7ffbf65a4fff entry_point = 0x7ffbf6590000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 1284 start_va = 0x7ffbf65b0000 end_va = 0x7ffbf65c9fff entry_point = 0x7ffbf65b0000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 1285 start_va = 0x7ffbf69b0000 end_va = 0x7ffbf69b7fff entry_point = 0x7ffbf69b0000 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 1286 start_va = 0x7ffbf69c0000 end_va = 0x7ffbf69d6fff entry_point = 0x7ffbf69c0000 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 1287 start_va = 0x7ffbf6a70000 end_va = 0x7ffbf6a8cfff entry_point = 0x7ffbf6a70000 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1288 start_va = 0x7ffbf6f50000 end_va = 0x7ffbf6f61fff entry_point = 0x7ffbf6f50000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1289 start_va = 0x7ffbf6f70000 end_va = 0x7ffbf6fb5fff entry_point = 0x7ffbf6f70000 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 1290 start_va = 0x7ffbf7160000 end_va = 0x7ffbf7441fff entry_point = 0x7ffbf7160000 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 1291 start_va = 0x7ffbf74e0000 end_va = 0x7ffbf751ffff entry_point = 0x7ffbf74e0000 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 1292 start_va = 0x7ffbf7520000 end_va = 0x7ffbf7567fff entry_point = 0x7ffbf7520000 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 1293 start_va = 0x7ffbf7570000 end_va = 0x7ffbf7580fff entry_point = 0x7ffbf7570000 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1294 start_va = 0x7ffbf7590000 end_va = 0x7ffbf759cfff entry_point = 0x7ffbf7590000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 1295 start_va = 0x7ffbf7b30000 end_va = 0x7ffbf7b3dfff entry_point = 0x7ffbf7b30000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1296 start_va = 0x7ffbf9250000 end_va = 0x7ffbf9264fff entry_point = 0x7ffbf9250000 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 1297 start_va = 0x7ffbf9270000 end_va = 0x7ffbf92b0fff entry_point = 0x7ffbf9270000 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1298 start_va = 0x7ffbf9810000 end_va = 0x7ffbf982cfff entry_point = 0x7ffbf9810000 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 1299 start_va = 0x7ffbf9830000 end_va = 0x7ffbf9893fff entry_point = 0x7ffbf9830000 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 1300 start_va = 0x7ffbf99c0000 end_va = 0x7ffbf9a1efff entry_point = 0x7ffbf99c0000 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1301 start_va = 0x7ffbf9aa0000 end_va = 0x7ffbf9ab7fff entry_point = 0x7ffbf9aa0000 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 1302 start_va = 0x7ffbf9ac0000 end_va = 0x7ffbf9ae2fff entry_point = 0x7ffbf9ac0000 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 1303 start_va = 0x7ffbf9b00000 end_va = 0x7ffbf9b14fff entry_point = 0x7ffbf9b00000 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1304 start_va = 0x7ffbf9b20000 end_va = 0x7ffbf9b64fff entry_point = 0x7ffbf9b20000 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1305 start_va = 0x7ffbf9b70000 end_va = 0x7ffbf9b83fff entry_point = 0x7ffbf9b70000 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1306 start_va = 0x7ffbf9b90000 end_va = 0x7ffbf9c80fff entry_point = 0x7ffbf9b90000 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1307 start_va = 0x7ffbf9d80000 end_va = 0x7ffbf9d9bfff entry_point = 0x7ffbf9d80000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1308 start_va = 0x7ffbf9da0000 end_va = 0x7ffbf9db7fff entry_point = 0x7ffbf9da0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1309 start_va = 0x7ffbf9dc0000 end_va = 0x7ffbf9f42fff entry_point = 0x7ffbf9dc0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1310 start_va = 0x7ffbf9f50000 end_va = 0x7ffbf9f59fff entry_point = 0x7ffbf9f50000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1311 start_va = 0x7ffbf9f80000 end_va = 0x7ffbfa01efff entry_point = 0x7ffbf9f80000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1312 start_va = 0x7ffbfa020000 end_va = 0x7ffbfa07afff entry_point = 0x7ffbfa020000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1313 start_va = 0x7ffbfa080000 end_va = 0x7ffbfa0adfff entry_point = 0x7ffbfa080000 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 1314 start_va = 0x7ffbfa0b0000 end_va = 0x7ffbfa10cfff entry_point = 0x7ffbfa0b0000 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 1315 start_va = 0x7ffbfa110000 end_va = 0x7ffbfa12ffff entry_point = 0x7ffbfa110000 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 1316 start_va = 0x7ffbfa130000 end_va = 0x7ffbfa137fff entry_point = 0x7ffbfa130000 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 1317 start_va = 0x7ffbfa140000 end_va = 0x7ffbfa150fff entry_point = 0x7ffbfa140000 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1318 start_va = 0x7ffbfa160000 end_va = 0x7ffbfa1defff entry_point = 0x7ffbfa160000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1319 start_va = 0x7ffbfa1e0000 end_va = 0x7ffbfa21bfff entry_point = 0x7ffbfa1e0000 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1320 start_va = 0x7ffbfa220000 end_va = 0x7ffbfa25efff entry_point = 0x7ffbfa220000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1321 start_va = 0x7ffbfa410000 end_va = 0x7ffbfa45bfff entry_point = 0x7ffbfa410000 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1322 start_va = 0x7ffbfaa10000 end_va = 0x7ffbfaa26fff entry_point = 0x7ffbfaa10000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1323 start_va = 0x7ffbfb2b0000 end_va = 0x7ffbfb2bbfff entry_point = 0x7ffbfb2b0000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1324 start_va = 0x7ffbfb550000 end_va = 0x7ffbfb88cfff entry_point = 0x7ffbfb550000 region_type = mapped_file name = "msi.dll" filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll") Region: id = 1325 start_va = 0x7ffbfba10000 end_va = 0x7ffbfba36fff entry_point = 0x7ffbfba10000 region_type = mapped_file name = "cabinet.dll" filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll") Region: id = 1326 start_va = 0x7ffbfba50000 end_va = 0x7ffbfbae1fff entry_point = 0x7ffbfba50000 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1327 start_va = 0x7ffbfbaf0000 end_va = 0x7ffbfbb28fff entry_point = 0x7ffbfbaf0000 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 1328 start_va = 0x7ffbfbb30000 end_va = 0x7ffbfbb38fff entry_point = 0x7ffbfbb30000 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 1329 start_va = 0x7ffbfbb40000 end_va = 0x7ffbfbc15fff entry_point = 0x7ffbfbb40000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1330 start_va = 0x7ffbfbce0000 end_va = 0x7ffbfbd11fff entry_point = 0x7ffbfbce0000 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 1331 start_va = 0x7ffbfbd20000 end_va = 0x7ffbfbd54fff entry_point = 0x7ffbfbd20000 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 1332 start_va = 0x7ffbfbe40000 end_va = 0x7ffbfbe75fff entry_point = 0x7ffbfbe40000 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1333 start_va = 0x7ffbfc980000 end_va = 0x7ffbfc988fff entry_point = 0x7ffbfc980000 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 1334 start_va = 0x7ffbfc990000 end_va = 0x7ffbfc9bcfff entry_point = 0x7ffbfc990000 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 1335 start_va = 0x7ffbfc9c0000 end_va = 0x7ffbfc9cffff entry_point = 0x7ffbfc9c0000 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 1336 start_va = 0x7ffbfc9d0000 end_va = 0x7ffbfca20fff entry_point = 0x7ffbfc9d0000 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 1337 start_va = 0x7ffbfca30000 end_va = 0x7ffbfca3bfff entry_point = 0x7ffbfca30000 region_type = mapped_file name = "fvecerts.dll" filename = "\\Windows\\System32\\fvecerts.dll" (normalized: "c:\\windows\\system32\\fvecerts.dll") Region: id = 1338 start_va = 0x7ffbfca40000 end_va = 0x7ffbfcafdfff entry_point = 0x7ffbfca40000 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1339 start_va = 0x7ffbfcbc0000 end_va = 0x7ffbfccf0fff entry_point = 0x7ffbfcbc0000 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1340 start_va = 0x7ffbfcd00000 end_va = 0x7ffbfcd3dfff entry_point = 0x7ffbfcd00000 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 1341 start_va = 0x7ffbfcd40000 end_va = 0x7ffbfcdd5fff entry_point = 0x7ffbfcd40000 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1342 start_va = 0x7ffbfcde0000 end_va = 0x7ffbfcdf7fff entry_point = 0x7ffbfcde0000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1343 start_va = 0x7ffbfce00000 end_va = 0x7ffbfceb3fff entry_point = 0x7ffbfce00000 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 1344 start_va = 0x7ffbfced0000 end_va = 0x7ffbfcf37fff entry_point = 0x7ffbfced0000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1345 start_va = 0x7ffbfcfa0000 end_va = 0x7ffbfcfb9fff entry_point = 0x7ffbfcfa0000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1346 start_va = 0x7ffbfcfc0000 end_va = 0x7ffbfcfd5fff entry_point = 0x7ffbfcfc0000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1347 start_va = 0x7ffbfd180000 end_va = 0x7ffbfd18ffff entry_point = 0x7ffbfd180000 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 1348 start_va = 0x7ffbfd2d0000 end_va = 0x7ffbfd2dffff entry_point = 0x7ffbfd2d0000 region_type = mapped_file name = "timebrokerclient.dll" filename = "\\Windows\\System32\\TimeBrokerClient.dll" (normalized: "c:\\windows\\system32\\timebrokerclient.dll") Region: id = 1349 start_va = 0x7ffbfd2e0000 end_va = 0x7ffbfd30dfff entry_point = 0x7ffbfd2e0000 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 1350 start_va = 0x7ffbfd310000 end_va = 0x7ffbfd33cfff entry_point = 0x7ffbfd310000 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1351 start_va = 0x7ffbfd340000 end_va = 0x7ffbfd355fff entry_point = 0x7ffbfd340000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1352 start_va = 0x7ffbfd360000 end_va = 0x7ffbfd3cdfff entry_point = 0x7ffbfd360000 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1353 start_va = 0x7ffbfd5b0000 end_va = 0x7ffbfd732fff entry_point = 0x7ffbfd5b0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1354 start_va = 0x7ffbfd810000 end_va = 0x7ffbfd820fff entry_point = 0x7ffbfd810000 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1355 start_va = 0x7ffbfd830000 end_va = 0x7ffbfd83cfff entry_point = 0x7ffbfd830000 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 1356 start_va = 0x7ffbfd840000 end_va = 0x7ffbfd87ffff entry_point = 0x7ffbfd840000 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1357 start_va = 0x7ffbfd880000 end_va = 0x7ffbfd97bfff entry_point = 0x7ffbfd880000 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1358 start_va = 0x7ffbfd980000 end_va = 0x7ffbfd9c1fff entry_point = 0x7ffbfd980000 region_type = mapped_file name = "mstask.dll" filename = "\\Windows\\System32\\mstask.dll" (normalized: "c:\\windows\\system32\\mstask.dll") Region: id = 1359 start_va = 0x7ffbfd9d0000 end_va = 0x7ffbfd9e6fff entry_point = 0x7ffbfd9d0000 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1360 start_va = 0x7ffbfd9f0000 end_va = 0x7ffbfdaaffff entry_point = 0x7ffbfd9f0000 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1361 start_va = 0x7ffbfdab0000 end_va = 0x7ffbfdacdfff entry_point = 0x7ffbfdab0000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1362 start_va = 0x7ffbfdad0000 end_va = 0x7ffbfdaf6fff entry_point = 0x7ffbfdad0000 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 1363 start_va = 0x7ffbfdb00000 end_va = 0x7ffbfdb79fff entry_point = 0x7ffbfdb00000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1364 start_va = 0x7ffbfdb80000 end_va = 0x7ffbfdbd4fff entry_point = 0x7ffbfdb80000 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1365 start_va = 0x7ffbfdbf0000 end_va = 0x7ffbfdc02fff entry_point = 0x7ffbfdbf0000 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1366 start_va = 0x7ffbfdc10000 end_va = 0x7ffbfdc19fff entry_point = 0x7ffbfdc10000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1367 start_va = 0x7ffbfdc20000 end_va = 0x7ffbfdc37fff entry_point = 0x7ffbfdc20000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1368 start_va = 0x7ffbfdc40000 end_va = 0x7ffbfdd8cfff entry_point = 0x7ffbfdc40000 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1369 start_va = 0x7ffbfdeb0000 end_va = 0x7ffbfdf14fff entry_point = 0x7ffbfdeb0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1370 start_va = 0x7ffbfe0d0000 end_va = 0x7ffbfe0dafff entry_point = 0x7ffbfe0d0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1371 start_va = 0x7ffbfe0f0000 end_va = 0x7ffbfe127fff entry_point = 0x7ffbfe0f0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1372 start_va = 0x7ffbfe5c0000 end_va = 0x7ffbfe5d2fff entry_point = 0x7ffbfe5c0000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1373 start_va = 0x7ffbff0d0000 end_va = 0x7ffbff147fff entry_point = 0x7ffbff0d0000 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1374 start_va = 0x7ffbff170000 end_va = 0x7ffbff205fff entry_point = 0x7ffbff170000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1375 start_va = 0x7ffbff210000 end_va = 0x7ffbff236fff entry_point = 0x7ffbff210000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1376 start_va = 0x7ffbff3f0000 end_va = 0x7ffbff3fbfff entry_point = 0x7ffbff3f0000 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1377 start_va = 0x7ffbff5d0000 end_va = 0x7ffbff601fff entry_point = 0x7ffbff5d0000 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1378 start_va = 0x7ffbff610000 end_va = 0x7ffbff691fff entry_point = 0x7ffbff610000 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1379 start_va = 0x7ffbff7c0000 end_va = 0x7ffbff7e2fff entry_point = 0x7ffbff7c0000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1380 start_va = 0x7ffbff8f0000 end_va = 0x7ffbff8fbfff entry_point = 0x7ffbff8f0000 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 1381 start_va = 0x7ffbff9b0000 end_va = 0x7ffbff9f7fff entry_point = 0x7ffbff9b0000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1382 start_va = 0x7ffbffaf0000 end_va = 0x7ffbffafbfff entry_point = 0x7ffbffaf0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1383 start_va = 0x7ffbffb00000 end_va = 0x7ffbffb25fff entry_point = 0x7ffbffb00000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1384 start_va = 0x7ffbffbe0000 end_va = 0x7ffbffc11fff entry_point = 0x7ffbffbe0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1385 start_va = 0x7ffbffcc0000 end_va = 0x7ffbffcc9fff entry_point = 0x7ffbffcc0000 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 1386 start_va = 0x7ffbffd20000 end_va = 0x7ffbffd77fff entry_point = 0x7ffbffd20000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1387 start_va = 0x7ffbffdc0000 end_va = 0x7ffbffdf2fff entry_point = 0x7ffbffdc0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1388 start_va = 0x7ffbffeb0000 end_va = 0x7ffbffecefff entry_point = 0x7ffbffeb0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1389 start_va = 0x7ffbffed0000 end_va = 0x7ffbfff0dfff entry_point = 0x7ffbffed0000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1390 start_va = 0x7ffbfff10000 end_va = 0x7ffbfffb7fff entry_point = 0x7ffbfff10000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1391 start_va = 0x7ffc00110000 end_va = 0x7ffc0016cfff entry_point = 0x7ffc00110000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1392 start_va = 0x7ffc00170000 end_va = 0x7ffc00186fff entry_point = 0x7ffc00170000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1393 start_va = 0x7ffc002e0000 end_va = 0x7ffc002eafff entry_point = 0x7ffc002e0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1394 start_va = 0x7ffc00320000 end_va = 0x7ffc00340fff entry_point = 0x7ffc00320000 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 1395 start_va = 0x7ffc00370000 end_va = 0x7ffc003a5fff entry_point = 0x7ffc00370000 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 1396 start_va = 0x7ffc003b0000 end_va = 0x7ffc003d5fff entry_point = 0x7ffc003b0000 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1397 start_va = 0x7ffc004c0000 end_va = 0x7ffc004ebfff entry_point = 0x7ffc004c0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1398 start_va = 0x7ffc00690000 end_va = 0x7ffc006a9fff entry_point = 0x7ffc00690000 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 1399 start_va = 0x7ffc006b0000 end_va = 0x7ffc006b7fff entry_point = 0x7ffc006b0000 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 1400 start_va = 0x7ffc006c0000 end_va = 0x7ffc006e7fff entry_point = 0x7ffc006c0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1401 start_va = 0x7ffc006f0000 end_va = 0x7ffc0075afff entry_point = 0x7ffc006f0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1402 start_va = 0x7ffc00760000 end_va = 0x7ffc007f7fff entry_point = 0x7ffc00760000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1403 start_va = 0x7ffc008a0000 end_va = 0x7ffc008e9fff entry_point = 0x7ffc008a0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1404 start_va = 0x7ffc008f0000 end_va = 0x7ffc00902fff entry_point = 0x7ffc008f0000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1405 start_va = 0x7ffc00910000 end_va = 0x7ffc0091efff entry_point = 0x7ffc00910000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1406 start_va = 0x7ffc00920000 end_va = 0x7ffc00930fff entry_point = 0x7ffc00920000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1407 start_va = 0x7ffc00940000 end_va = 0x7ffc00f67fff entry_point = 0x7ffc00940000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1408 start_va = 0x7ffc00f70000 end_va = 0x7ffc00fb3fff entry_point = 0x7ffc00f70000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1409 start_va = 0x7ffc00fc0000 end_va = 0x7ffc01072fff entry_point = 0x7ffc00fc0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1410 start_va = 0x7ffc01080000 end_va = 0x7ffc010d3fff entry_point = 0x7ffc01080000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1411 start_va = 0x7ffc01190000 end_va = 0x7ffc01350fff entry_point = 0x7ffc01190000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1412 start_va = 0x7ffc01360000 end_va = 0x7ffc0153cfff entry_point = 0x7ffc01360000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1413 start_va = 0x7ffc01540000 end_va = 0x7ffc015e4fff entry_point = 0x7ffc01540000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1414 start_va = 0x7ffc01640000 end_va = 0x7ffc016e5fff entry_point = 0x7ffc01640000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1415 start_va = 0x7ffc018a0000 end_va = 0x7ffc01b1bfff entry_point = 0x7ffc018a0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1416 start_va = 0x7ffc01b20000 end_va = 0x7ffc01ce4fff entry_point = 0x7ffc01b20000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1417 start_va = 0x7ffc01dd0000 end_va = 0x7ffc01ef5fff entry_point = 0x7ffc01dd0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1418 start_va = 0x7ffc01f00000 end_va = 0x7ffc0204dfff entry_point = 0x7ffc01f00000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1419 start_va = 0x7ffc02050000 end_va = 0x7ffc02057fff entry_point = 0x7ffc02050000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1420 start_va = 0x7ffc02060000 end_va = 0x7ffc020fcfff entry_point = 0x7ffc02060000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1421 start_va = 0x7ffc02100000 end_va = 0x7ffc0215afff entry_point = 0x7ffc02100000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1422 start_va = 0x7ffc022c0000 end_va = 0x7ffc037e4fff entry_point = 0x7ffc022c0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1423 start_va = 0x7ffc037f0000 end_va = 0x7ffc03974fff entry_point = 0x7ffc037f0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1424 start_va = 0x7ffc03980000 end_va = 0x7ffc039e8fff entry_point = 0x7ffc03980000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1425 start_va = 0x7ffc03a50000 end_va = 0x7ffc03aa0fff entry_point = 0x7ffc03a50000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1426 start_va = 0x7ffc03ae0000 end_va = 0x7ffc03b3afff entry_point = 0x7ffc03ae0000 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1427 start_va = 0x7ffc03bb0000 end_va = 0x7ffc03cf0fff entry_point = 0x7ffc03bb0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1428 start_va = 0x7ffc03d00000 end_va = 0x7ffc03dbdfff entry_point = 0x7ffc03d00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1429 start_va = 0x7ffc03dc0000 end_va = 0x7ffc03e6cfff entry_point = 0x7ffc03dc0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1430 start_va = 0x7ffc03e70000 end_va = 0x7ffc04031fff entry_point = 0x7ffc03e70000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1554 start_va = 0x51ea290000 end_va = 0x51ea29ffff entry_point = 0x51ea290000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1555 start_va = 0x51ea2a0000 end_va = 0x51ea2affff entry_point = 0x51ea2a0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1556 start_va = 0x51ea2b0000 end_va = 0x51ea2bffff entry_point = 0x51ea2b0000 region_type = mapped_file name = "datastore.edb" filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb") Region: id = 1557 start_va = 0x51ea2c0000 end_va = 0x51ea2c1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000051ea2c0000" filename = "" Region: id = 1558 start_va = 0x51eb600000 end_va = 0x51eb6fffff entry_point = 0x0 region_type = private name = "private_0x00000051eb600000" filename = "" Region: id = 1559 start_va = 0x51eb700000 end_va = 0x51eb7fffff entry_point = 0x0 region_type = private name = "private_0x00000051eb700000" filename = "" Region: id = 1560 start_va = 0x51eb900000 end_va = 0x51eb9fffff entry_point = 0x0 region_type = private name = "private_0x00000051eb900000" filename = "" Region: id = 1561 start_va = 0x51eba00000 end_va = 0x51ebafffff entry_point = 0x0 region_type = private name = "private_0x00000051eba00000" filename = "" Region: id = 1562 start_va = 0x51ebb00000 end_va = 0x51ebbfffff entry_point = 0x0 region_type = private name = "private_0x00000051ebb00000" filename = "" Region: id = 1563 start_va = 0x51ebc00000 end_va = 0x51ebcfffff entry_point = 0x0 region_type = private name = "private_0x00000051ebc00000" filename = "" Region: id = 1564 start_va = 0x7ff7b3ac6000 end_va = 0x7ff7b3ac7fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ac6000" filename = "" Region: id = 1565 start_va = 0x7ff7b3ac8000 end_va = 0x7ff7b3ac9fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3ac8000" filename = "" Region: id = 1566 start_va = 0x7ff7b3aee000 end_va = 0x7ff7b3aeffff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3aee000" filename = "" Region: id = 1567 start_va = 0x7ff7b3af2000 end_va = 0x7ff7b3af3fff entry_point = 0x0 region_type = private name = "private_0x00007ff7b3af2000" filename = "" Region: id = 1568 start_va = 0x7ffbeda30000 end_va = 0x7ffbeda57fff entry_point = 0x7ffbeda30000 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Thread: id = 50 os_tid = 0xf2c Thread: id = 51 os_tid = 0xf28 Thread: id = 52 os_tid = 0xf24 Thread: id = 53 os_tid = 0xf20 Thread: id = 54 os_tid = 0xf18 Thread: id = 55 os_tid = 0xf14 Thread: id = 56 os_tid = 0xcb0 Thread: id = 57 os_tid = 0xb30 Thread: id = 58 os_tid = 0x798 Thread: id = 59 os_tid = 0x878 Thread: id = 60 os_tid = 0x870 Thread: id = 61 os_tid = 0x784 Thread: id = 62 os_tid = 0x780 Thread: id = 63 os_tid = 0x754 Thread: id = 64 os_tid = 0x750 Thread: id = 65 os_tid = 0x740 Thread: id = 66 os_tid = 0x73c Thread: id = 67 os_tid = 0x738 Thread: id = 68 os_tid = 0x734 Thread: id = 69 os_tid = 0x688 Thread: id = 70 os_tid = 0x730 Thread: id = 71 os_tid = 0x724 Thread: id = 72 os_tid = 0x71c Thread: id = 73 os_tid = 0x70c Thread: id = 74 os_tid = 0x708 Thread: id = 75 os_tid = 0x6f4 Thread: id = 76 os_tid = 0x6ec Thread: id = 77 os_tid = 0x6d4 Thread: id = 78 os_tid = 0x6b4 Thread: id = 79 os_tid = 0x694 Thread: id = 80 os_tid = 0x680 Thread: id = 81 os_tid = 0x664 Thread: id = 82 os_tid = 0x650 Thread: id = 83 os_tid = 0x64c Thread: id = 84 os_tid = 0x630 Thread: id = 85 os_tid = 0x628 Thread: id = 86 os_tid = 0x5f8 Thread: id = 87 os_tid = 0x5e4 Thread: id = 88 os_tid = 0x5cc Thread: id = 89 os_tid = 0x5c4 Thread: id = 90 os_tid = 0x574 Thread: id = 91 os_tid = 0x558 Thread: id = 92 os_tid = 0x530 Thread: id = 93 os_tid = 0x4dc Thread: id = 94 os_tid = 0x414 Thread: id = 95 os_tid = 0x118 Thread: id = 96 os_tid = 0xfc Thread: id = 97 os_tid = 0x140 Thread: id = 98 os_tid = 0x1a0 Thread: id = 99 os_tid = 0x14c Thread: id = 100 os_tid = 0x154 Thread: id = 101 os_tid = 0x130 Thread: id = 102 os_tid = 0x160 Thread: id = 103 os_tid = 0xf8 Thread: id = 104 os_tid = 0x3dc Thread: id = 105 os_tid = 0x3d8 Thread: id = 106 os_tid = 0x3d0 Thread: id = 107 os_tid = 0x3cc Thread: id = 108 os_tid = 0x3c8 Thread: id = 109 os_tid = 0x37c Thread: id = 111 os_tid = 0xf64 Thread: id = 112 os_tid = 0xf68 Thread: id = 123 os_tid = 0xf98 Thread: id = 124 os_tid = 0xf9c Process: id = "7" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x74046000" os_pid = "0xf6c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x378" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00079bce" [0xc000000f] Region: id = 1435 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1436 start_va = 0x6f25ef0000 end_va = 0x6f25f0ffff entry_point = 0x0 region_type = private name = "private_0x0000006f25ef0000" filename = "" Region: id = 1437 start_va = 0x6f25f10000 end_va = 0x6f25f23fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006f25f10000" filename = "" Region: id = 1438 start_va = 0x6f25f30000 end_va = 0x6f25faffff entry_point = 0x0 region_type = private name = "private_0x0000006f25f30000" filename = "" Region: id = 1439 start_va = 0x6f25fb0000 end_va = 0x6f25fb3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006f25fb0000" filename = "" Region: id = 1440 start_va = 0x6f25fc0000 end_va = 0x6f25fc0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006f25fc0000" filename = "" Region: id = 1441 start_va = 0x6f25fd0000 end_va = 0x6f25fd1fff entry_point = 0x0 region_type = private name = "private_0x0000006f25fd0000" filename = "" Region: id = 1442 start_va = 0x7df5ff040000 end_va = 0x7ff5ff03ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ff040000" filename = "" Region: id = 1443 start_va = 0x7ff75c240000 end_va = 0x7ff75c262fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff75c240000" filename = "" Region: id = 1444 start_va = 0x7ff75c269000 end_va = 0x7ff75c269fff entry_point = 0x0 region_type = private name = "private_0x00007ff75c269000" filename = "" Region: id = 1445 start_va = 0x7ff75c26e000 end_va = 0x7ff75c26ffff entry_point = 0x0 region_type = private name = "private_0x00007ff75c26e000" filename = "" Region: id = 1446 start_va = 0x7ff75cd80000 end_va = 0x7ff75cdfefff entry_point = 0x7ff75cd80000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1447 start_va = 0x7ffc03e70000 end_va = 0x7ffc04031fff entry_point = 0x7ffc03e70000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1448 start_va = 0x6f26090000 end_va = 0x6f2618ffff entry_point = 0x0 region_type = private name = "private_0x0000006f26090000" filename = "" Region: id = 1449 start_va = 0x7ffc01360000 end_va = 0x7ffc0153cfff entry_point = 0x7ffc01360000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1450 start_va = 0x7ffc03dc0000 end_va = 0x7ffc03e6cfff entry_point = 0x7ffc03dc0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1451 start_va = 0x6f25ef0000 end_va = 0x6f25efffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006f25ef0000" filename = "" Region: id = 1452 start_va = 0x6f25f00000 end_va = 0x6f25f06fff entry_point = 0x0 region_type = private name = "private_0x0000006f25f00000" filename = "" Region: id = 1453 start_va = 0x6f25fe0000 end_va = 0x6f2605ffff entry_point = 0x0 region_type = private name = "private_0x0000006f25fe0000" filename = "" Region: id = 1454 start_va = 0x6f26190000 end_va = 0x6f2624dfff entry_point = 0x6f26190000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1455 start_va = 0x7ff75c140000 end_va = 0x7ff75c23ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff75c140000" filename = "" Region: id = 1456 start_va = 0x7ff75c26c000 end_va = 0x7ff75c26dfff entry_point = 0x0 region_type = private name = "private_0x00007ff75c26c000" filename = "" Region: id = 1457 start_va = 0x7ffbf5fb0000 end_va = 0x7ffbf5fc5fff entry_point = 0x7ffbf5fb0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1458 start_va = 0x7ffbf6170000 end_va = 0x7ffbf6267fff entry_point = 0x7ffbf6170000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1459 start_va = 0x7ffbfa160000 end_va = 0x7ffbfa1defff entry_point = 0x7ffbfa160000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1460 start_va = 0x7ffc018a0000 end_va = 0x7ffc01b1bfff entry_point = 0x7ffc018a0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1461 start_va = 0x7ffc01dd0000 end_va = 0x7ffc01ef5fff entry_point = 0x7ffc01dd0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1462 start_va = 0x7ffc02050000 end_va = 0x7ffc02057fff entry_point = 0x7ffc02050000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1463 start_va = 0x7ffc02060000 end_va = 0x7ffc020fcfff entry_point = 0x7ffc02060000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1464 start_va = 0x7ffc02100000 end_va = 0x7ffc0215afff entry_point = 0x7ffc02100000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1465 start_va = 0x7ffc03980000 end_va = 0x7ffc039e8fff entry_point = 0x7ffc03980000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1466 start_va = 0x6f26060000 end_va = 0x6f26066fff entry_point = 0x0 region_type = private name = "private_0x0000006f26060000" filename = "" Region: id = 1467 start_va = 0x6f26410000 end_va = 0x6f2641ffff entry_point = 0x0 region_type = private name = "private_0x0000006f26410000" filename = "" Region: id = 1468 start_va = 0x7ffc006c0000 end_va = 0x7ffc006e7fff entry_point = 0x7ffc006c0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1469 start_va = 0x7ffc01640000 end_va = 0x7ffc016e5fff entry_point = 0x7ffc01640000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1470 start_va = 0x6f26420000 end_va = 0x6f26756fff entry_point = 0x6f26420000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1471 start_va = 0x7ffc01f00000 end_va = 0x7ffc0204dfff entry_point = 0x7ffc01f00000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1472 start_va = 0x7ffc037f0000 end_va = 0x7ffc03974fff entry_point = 0x7ffc037f0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1473 start_va = 0x6f26070000 end_va = 0x6f26070fff entry_point = 0x0 region_type = private name = "private_0x0000006f26070000" filename = "" Region: id = 1474 start_va = 0x6f26080000 end_va = 0x6f26080fff entry_point = 0x0 region_type = private name = "private_0x0000006f26080000" filename = "" Region: id = 1475 start_va = 0x6f26250000 end_va = 0x6f263d7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006f26250000" filename = "" Region: id = 1476 start_va = 0x6f263e0000 end_va = 0x6f263e4fff entry_point = 0x6f263e0000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1477 start_va = 0x6f26760000 end_va = 0x6f268e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006f26760000" filename = "" Region: id = 1478 start_va = 0x6f268f0000 end_va = 0x6f269affff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006f268f0000" filename = "" Region: id = 1479 start_va = 0x7ffc006f0000 end_va = 0x7ffc0075afff entry_point = 0x7ffc006f0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1480 start_va = 0x7ffc00910000 end_va = 0x7ffc0091efff entry_point = 0x7ffc00910000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1481 start_va = 0x6f263f0000 end_va = 0x6f263f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006f263f0000" filename = "" Region: id = 1482 start_va = 0x6f26400000 end_va = 0x6f26400fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006f26400000" filename = "" Region: id = 1483 start_va = 0x6f269b0000 end_va = 0x6f26a2ffff entry_point = 0x0 region_type = private name = "private_0x0000006f269b0000" filename = "" Region: id = 1484 start_va = 0x6f26a30000 end_va = 0x6f26b2ffff entry_point = 0x0 region_type = private name = "private_0x0000006f26a30000" filename = "" Region: id = 1485 start_va = 0x7ff75c26a000 end_va = 0x7ff75c26bfff entry_point = 0x0 region_type = private name = "private_0x00007ff75c26a000" filename = "" Region: id = 1486 start_va = 0x7ffc01540000 end_va = 0x7ffc015e4fff entry_point = 0x7ffc01540000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1487 start_va = 0x6f26b30000 end_va = 0x6f26b30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006f26b30000" filename = "" Region: id = 1488 start_va = 0x7ffbf64d0000 end_va = 0x7ffbf64e0fff entry_point = 0x7ffbf64d0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1489 start_va = 0x7ffc03d00000 end_va = 0x7ffc03dbdfff entry_point = 0x7ffc03d00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1490 start_va = 0x7ffc00170000 end_va = 0x7ffc00186fff entry_point = 0x7ffc00170000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1491 start_va = 0x7ffbffdc0000 end_va = 0x7ffbffdf2fff entry_point = 0x7ffbffdc0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1492 start_va = 0x6f26b40000 end_va = 0x6f26bbffff entry_point = 0x0 region_type = private name = "private_0x0000006f26b40000" filename = "" Region: id = 1493 start_va = 0x6f26bc0000 end_va = 0x6f26c3ffff entry_point = 0x0 region_type = private name = "private_0x0000006f26bc0000" filename = "" Region: id = 1494 start_va = 0x6f26c40000 end_va = 0x6f26cbffff entry_point = 0x0 region_type = private name = "private_0x0000006f26c40000" filename = "" Region: id = 1495 start_va = 0x6f26cc0000 end_va = 0x6f26d3ffff entry_point = 0x0 region_type = private name = "private_0x0000006f26cc0000" filename = "" Region: id = 1496 start_va = 0x6f26d40000 end_va = 0x6f26dbffff entry_point = 0x0 region_type = private name = "private_0x0000006f26d40000" filename = "" Region: id = 1497 start_va = 0x6f26dc0000 end_va = 0x6f26e3ffff entry_point = 0x0 region_type = private name = "private_0x0000006f26dc0000" filename = "" Region: id = 1498 start_va = 0x7ff75c13a000 end_va = 0x7ff75c13bfff entry_point = 0x0 region_type = private name = "private_0x00007ff75c13a000" filename = "" Region: id = 1499 start_va = 0x7ff75c13c000 end_va = 0x7ff75c13dfff entry_point = 0x0 region_type = private name = "private_0x00007ff75c13c000" filename = "" Region: id = 1500 start_va = 0x7ff75c13e000 end_va = 0x7ff75c13ffff entry_point = 0x0 region_type = private name = "private_0x00007ff75c13e000" filename = "" Region: id = 1501 start_va = 0x7ff75c263000 end_va = 0x7ff75c264fff entry_point = 0x0 region_type = private name = "private_0x00007ff75c263000" filename = "" Region: id = 1502 start_va = 0x7ff75c265000 end_va = 0x7ff75c266fff entry_point = 0x0 region_type = private name = "private_0x00007ff75c265000" filename = "" Region: id = 1503 start_va = 0x7ff75c267000 end_va = 0x7ff75c268fff entry_point = 0x0 region_type = private name = "private_0x00007ff75c267000" filename = "" Region: id = 1504 start_va = 0x7ffbf6120000 end_va = 0x7ffbf6144fff entry_point = 0x7ffbf6120000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1505 start_va = 0x7ffbf6150000 end_va = 0x7ffbf6163fff entry_point = 0x7ffbf6150000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1506 start_va = 0x7ffc002e0000 end_va = 0x7ffc002eafff entry_point = 0x7ffc002e0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1507 start_va = 0x7ffbea760000 end_va = 0x7ffbea92dfff entry_point = 0x7ffbea760000 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 1508 start_va = 0x7ffbeb990000 end_va = 0x7ffbeb9ddfff entry_point = 0x7ffbeb990000 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 1509 start_va = 0x7ffc004c0000 end_va = 0x7ffc004ebfff entry_point = 0x7ffc004c0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1510 start_va = 0x7ffc008a0000 end_va = 0x7ffc008e9fff entry_point = 0x7ffc008a0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1511 start_va = 0x7ffbf6a60000 end_va = 0x7ffbf6a6dfff entry_point = 0x7ffbf6a60000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 1512 start_va = 0x6f26e40000 end_va = 0x6f26e42fff entry_point = 0x6f26e40000 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 1513 start_va = 0x7ffbfb2b0000 end_va = 0x7ffbfb2bbfff entry_point = 0x7ffbfb2b0000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1514 start_va = 0x7ffbffc40000 end_va = 0x7ffbffcb3fff entry_point = 0x7ffbffc40000 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1515 start_va = 0x7ffc00920000 end_va = 0x7ffc00930fff entry_point = 0x7ffc00920000 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1516 start_va = 0x7ffc01190000 end_va = 0x7ffc01350fff entry_point = 0x7ffc01190000 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1517 start_va = 0x6f26e50000 end_va = 0x6f26ecffff entry_point = 0x0 region_type = private name = "private_0x0000006f26e50000" filename = "" Region: id = 1518 start_va = 0x6f26ed0000 end_va = 0x6f26ed2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006f26ed0000" filename = "" Region: id = 1519 start_va = 0x6f26ee0000 end_va = 0x6f26ee4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000006f26ee0000" filename = "" Region: id = 1520 start_va = 0x6f26ef0000 end_va = 0x6f26feffff entry_point = 0x0 region_type = private name = "private_0x0000006f26ef0000" filename = "" Region: id = 1521 start_va = 0x7ff75c138000 end_va = 0x7ff75c139fff entry_point = 0x0 region_type = private name = "private_0x00007ff75c138000" filename = "" Region: id = 1522 start_va = 0x7ffbfaa10000 end_va = 0x7ffbfaa26fff entry_point = 0x7ffbfaa10000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1523 start_va = 0x7ffbfd340000 end_va = 0x7ffbfd355fff entry_point = 0x7ffbfd340000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1524 start_va = 0x7ffbffaf0000 end_va = 0x7ffbffafbfff entry_point = 0x7ffbffaf0000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1525 start_va = 0x7ffbffb00000 end_va = 0x7ffbffb25fff entry_point = 0x7ffbffb00000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1526 start_va = 0x7ffbfcde0000 end_va = 0x7ffbfcdf7fff entry_point = 0x7ffbfcde0000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1527 start_va = 0x7ffbffed0000 end_va = 0x7ffbfff0dfff entry_point = 0x7ffbffed0000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1528 start_va = 0x7ffbf6a40000 end_va = 0x7ffbf6a53fff entry_point = 0x7ffbf6a40000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 1529 start_va = 0x7ffbf6a30000 end_va = 0x7ffbf6a3afff entry_point = 0x7ffbf6a30000 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 1530 start_va = 0x7ffbfdc10000 end_va = 0x7ffbfdc19fff entry_point = 0x7ffbfdc10000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1531 start_va = 0x7ffbf6f50000 end_va = 0x7ffbf6f61fff entry_point = 0x7ffbf6f50000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1543 start_va = 0x6f26ff0000 end_va = 0x6f26ff2fff entry_point = 0x6f26ff0000 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 1544 start_va = 0x6f27000000 end_va = 0x6f27002fff entry_point = 0x6f27000000 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 1545 start_va = 0x7ffbfd810000 end_va = 0x7ffbfd820fff entry_point = 0x7ffbfd810000 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1551 start_va = 0x6f27010000 end_va = 0x6f2710ffff entry_point = 0x0 region_type = private name = "private_0x0000006f27010000" filename = "" Region: id = 1552 start_va = 0x6f27110000 end_va = 0x6f2730ffff entry_point = 0x0 region_type = private name = "private_0x0000006f27110000" filename = "" Region: id = 1553 start_va = 0x7ffbf6a20000 end_va = 0x7ffbf6a2dfff entry_point = 0x7ffbf6a20000 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 1570 start_va = 0x7ffbff210000 end_va = 0x7ffbff236fff entry_point = 0x7ffbff210000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1571 start_va = 0x7ffc00f70000 end_va = 0x7ffc00fb3fff entry_point = 0x7ffc00f70000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1572 start_va = 0x7ffbfe650000 end_va = 0x7ffbfe6ebfff entry_point = 0x7ffbfe650000 region_type = mapped_file name = "dxgi.dll" filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll") Region: id = 1573 start_va = 0x7ffc01b20000 end_va = 0x7ffc01ce4fff entry_point = 0x7ffc01b20000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1574 start_va = 0x7ffc01080000 end_va = 0x7ffc010d3fff entry_point = 0x7ffc01080000 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Thread: id = 113 os_tid = 0xf70 Thread: id = 114 os_tid = 0xf74 Thread: id = 115 os_tid = 0xf78 Thread: id = 116 os_tid = 0xf7c Thread: id = 117 os_tid = 0xf80 Thread: id = 118 os_tid = 0xf84 Thread: id = 119 os_tid = 0xf88 Thread: id = 120 os_tid = 0xf8c Thread: id = 121 os_tid = 0xf90 Thread: id = 122 os_tid = 0xf94 Process: id = "8" image_name = "wmiprvse.exe" filename = "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" page_root = "0x1bae0000" os_pid = "0xffc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x378" cmd_line = "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xe], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e0e3" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1641 start_va = 0xf0000 end_va = 0x158fff entry_point = 0xf0000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\syswow64\\wbem\\wmiprvse.exe") Region: id = 1642 start_va = 0xe80000 end_va = 0x4e7ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e80000" filename = "" Region: id = 1643 start_va = 0x4e80000 end_va = 0x4e9ffff entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 1644 start_va = 0x4ea0000 end_va = 0x4ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 1645 start_va = 0x4eb0000 end_va = 0x4ec3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004eb0000" filename = "" Region: id = 1646 start_va = 0x4ed0000 end_va = 0x4f0ffff entry_point = 0x0 region_type = private name = "private_0x0000000004ed0000" filename = "" Region: id = 1647 start_va = 0x4f10000 end_va = 0x4f4ffff entry_point = 0x0 region_type = private name = "private_0x0000000004f10000" filename = "" Region: id = 1648 start_va = 0x4f50000 end_va = 0x4f53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f50000" filename = "" Region: id = 1649 start_va = 0x4f60000 end_va = 0x4f60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f60000" filename = "" Region: id = 1650 start_va = 0x4f70000 end_va = 0x4f71fff entry_point = 0x0 region_type = private name = "private_0x0000000004f70000" filename = "" Region: id = 1651 start_va = 0x77c40000 end_va = 0x77db8fff entry_point = 0x77c40000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1652 start_va = 0x7efa0000 end_va = 0x7efc2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efa0000" filename = "" Region: id = 1653 start_va = 0x7efc9000 end_va = 0x7efc9fff entry_point = 0x0 region_type = private name = "private_0x000000007efc9000" filename = "" Region: id = 1654 start_va = 0x7efcb000 end_va = 0x7efcdfff entry_point = 0x0 region_type = private name = "private_0x000000007efcb000" filename = "" Region: id = 1655 start_va = 0x7efce000 end_va = 0x7efcefff entry_point = 0x0 region_type = private name = "private_0x000000007efce000" filename = "" Region: id = 1656 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1657 start_va = 0x7fff0000 end_va = 0x7dfc03e6ffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1658 start_va = 0x7dfc03e70000 end_va = 0x7ffc03e6ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfc03e70000" filename = "" Region: id = 1659 start_va = 0x7ffc03e70000 end_va = 0x7ffc04031fff entry_point = 0x7ffc03e70000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1660 start_va = 0x7ffc04032000 end_va = 0x7ffffffeffff entry_point = 0x0 region_type = private name = "private_0x00007ffc04032000" filename = "" Region: id = 1661 start_va = 0x5150000 end_va = 0x515ffff entry_point = 0x0 region_type = private name = "private_0x0000000005150000" filename = "" Region: id = 1662 start_va = 0x59300000 end_va = 0x5934efff entry_point = 0x59300000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1663 start_va = 0x59360000 end_va = 0x593d2fff entry_point = 0x59360000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1664 start_va = 0x52a0000 end_va = 0x539ffff entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 1665 start_va = 0x59350000 end_va = 0x59357fff entry_point = 0x59350000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1669 start_va = 0x76970000 end_va = 0x76ae5fff entry_point = 0x76970000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1670 start_va = 0x77670000 end_va = 0x7775ffff entry_point = 0x77670000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1671 start_va = 0x4e80000 end_va = 0x4e8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004e80000" filename = "" Region: id = 1672 start_va = 0x4e90000 end_va = 0x4e97fff entry_point = 0x0 region_type = private name = "private_0x0000000004e90000" filename = "" Region: id = 1673 start_va = 0x4f80000 end_va = 0x503dfff entry_point = 0x4f80000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1674 start_va = 0x5040000 end_va = 0x507ffff entry_point = 0x0 region_type = private name = "private_0x0000000005040000" filename = "" Region: id = 1675 start_va = 0x5080000 end_va = 0x50bffff entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 1676 start_va = 0x71360000 end_va = 0x71371fff entry_point = 0x71360000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\SysWOW64\\ncobjapi.dll" (normalized: "c:\\windows\\syswow64\\ncobjapi.dll") Region: id = 1677 start_va = 0x71780000 end_va = 0x7183bfff entry_point = 0x71780000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1678 start_va = 0x71860000 end_va = 0x718c5fff entry_point = 0x71860000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 1679 start_va = 0x74b60000 end_va = 0x74b7afff entry_point = 0x74b60000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 1680 start_va = 0x74ce0000 end_va = 0x74d38fff entry_point = 0x74ce0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 1681 start_va = 0x74d40000 end_va = 0x74d49fff entry_point = 0x74d40000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1682 start_va = 0x74d50000 end_va = 0x74d6dfff entry_point = 0x74d50000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1683 start_va = 0x77090000 end_va = 0x77249fff entry_point = 0x77090000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 1684 start_va = 0x77250000 end_va = 0x77292fff entry_point = 0x77250000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1685 start_va = 0x77930000 end_va = 0x7798bfff entry_point = 0x77930000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1686 start_va = 0x77a10000 end_va = 0x77acdfff entry_point = 0x77a10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1687 start_va = 0x77ad0000 end_va = 0x77ad6fff entry_point = 0x77ad0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 1688 start_va = 0x77af0000 end_va = 0x77b9bfff entry_point = 0x77af0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1689 start_va = 0x7eea0000 end_va = 0x7ef9ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007eea0000" filename = "" Region: id = 1690 start_va = 0x7efc6000 end_va = 0x7efc8fff entry_point = 0x0 region_type = private name = "private_0x000000007efc6000" filename = "" Region: id = 1691 start_va = 0x5290000 end_va = 0x529ffff entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 1692 start_va = 0x53a0000 end_va = 0x56d6fff entry_point = 0x53a0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1693 start_va = 0x74d70000 end_va = 0x74eaffff entry_point = 0x74d70000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1694 start_va = 0x76ca0000 end_va = 0x76decfff entry_point = 0x76ca0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1695 start_va = 0x77990000 end_va = 0x77a0afff entry_point = 0x77990000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1696 start_va = 0x4ea0000 end_va = 0x4ea0fff entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 1697 start_va = 0x50c0000 end_va = 0x50c0fff entry_point = 0x0 region_type = private name = "private_0x00000000050c0000" filename = "" Region: id = 1698 start_va = 0x50d0000 end_va = 0x50d4fff entry_point = 0x50d0000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 1699 start_va = 0x5160000 end_va = 0x521ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005160000" filename = "" Region: id = 1700 start_va = 0x56e0000 end_va = 0x5867fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000056e0000" filename = "" Region: id = 1701 start_va = 0x5870000 end_va = 0x59f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005870000" filename = "" Region: id = 1702 start_va = 0x76f60000 end_va = 0x76f6bfff entry_point = 0x76f60000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 1703 start_va = 0x50e0000 end_va = 0x50e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000050e0000" filename = "" Region: id = 1704 start_va = 0x50f0000 end_va = 0x512ffff entry_point = 0x0 region_type = private name = "private_0x00000000050f0000" filename = "" Region: id = 1705 start_va = 0x5130000 end_va = 0x5137fff entry_point = 0x0 region_type = private name = "private_0x0000000005130000" filename = "" Region: id = 1706 start_va = 0x5140000 end_va = 0x5140fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005140000" filename = "" Region: id = 1707 start_va = 0x5220000 end_va = 0x525ffff entry_point = 0x0 region_type = private name = "private_0x0000000005220000" filename = "" Region: id = 1708 start_va = 0x5a00000 end_va = 0x5afffff entry_point = 0x0 region_type = private name = "private_0x0000000005a00000" filename = "" Region: id = 1709 start_va = 0x77760000 end_va = 0x777e1fff entry_point = 0x77760000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 1710 start_va = 0x7efc3000 end_va = 0x7efc5fff entry_point = 0x0 region_type = private name = "private_0x000000007efc3000" filename = "" Region: id = 1711 start_va = 0x5260000 end_va = 0x5260fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005260000" filename = "" Region: id = 1712 start_va = 0x74b10000 end_va = 0x74b1cfff entry_point = 0x74b10000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 1713 start_va = 0x77ba0000 end_va = 0x77c31fff entry_point = 0x77ba0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1714 start_va = 0x74b80000 end_va = 0x74b92fff entry_point = 0x74b80000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1715 start_va = 0x74b30000 end_va = 0x74b5efff entry_point = 0x74b30000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1716 start_va = 0x5b00000 end_va = 0x5b3ffff entry_point = 0x0 region_type = private name = "private_0x0000000005b00000" filename = "" Region: id = 1717 start_va = 0x5b40000 end_va = 0x5b7ffff entry_point = 0x0 region_type = private name = "private_0x0000000005b40000" filename = "" Region: id = 1718 start_va = 0x5b80000 end_va = 0x5bbffff entry_point = 0x0 region_type = private name = "private_0x0000000005b80000" filename = "" Region: id = 1719 start_va = 0x5bc0000 end_va = 0x5bfffff entry_point = 0x0 region_type = private name = "private_0x0000000005bc0000" filename = "" Region: id = 1720 start_va = 0x5c00000 end_va = 0x5c3ffff entry_point = 0x0 region_type = private name = "private_0x0000000005c00000" filename = "" Region: id = 1721 start_va = 0x5c40000 end_va = 0x5c7ffff entry_point = 0x0 region_type = private name = "private_0x0000000005c40000" filename = "" Region: id = 1722 start_va = 0x71840000 end_va = 0x71850fff entry_point = 0x71840000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 1723 start_va = 0x7ee97000 end_va = 0x7ee99fff entry_point = 0x0 region_type = private name = "private_0x000000007ee97000" filename = "" Region: id = 1724 start_va = 0x7ee9a000 end_va = 0x7ee9cfff entry_point = 0x0 region_type = private name = "private_0x000000007ee9a000" filename = "" Region: id = 1725 start_va = 0x7ee9d000 end_va = 0x7ee9ffff entry_point = 0x0 region_type = private name = "private_0x000000007ee9d000" filename = "" Region: id = 1726 start_va = 0x5c80000 end_va = 0x5cbffff entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 1727 start_va = 0x5cc0000 end_va = 0x5cfffff entry_point = 0x0 region_type = private name = "private_0x0000000005cc0000" filename = "" Region: id = 1728 start_va = 0x5d00000 end_va = 0x5d3ffff entry_point = 0x0 region_type = private name = "private_0x0000000005d00000" filename = "" Region: id = 1729 start_va = 0x5d40000 end_va = 0x5d7ffff entry_point = 0x0 region_type = private name = "private_0x0000000005d40000" filename = "" Region: id = 1730 start_va = 0x5d80000 end_va = 0x5dbffff entry_point = 0x0 region_type = private name = "private_0x0000000005d80000" filename = "" Region: id = 1731 start_va = 0x5dc0000 end_va = 0x5dfffff entry_point = 0x0 region_type = private name = "private_0x0000000005dc0000" filename = "" Region: id = 1732 start_va = 0x73ff0000 end_va = 0x7400dfff entry_point = 0x73ff0000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 1733 start_va = 0x7ee8e000 end_va = 0x7ee90fff entry_point = 0x0 region_type = private name = "private_0x000000007ee8e000" filename = "" Region: id = 1734 start_va = 0x7ee91000 end_va = 0x7ee93fff entry_point = 0x0 region_type = private name = "private_0x000000007ee91000" filename = "" Region: id = 1735 start_va = 0x7ee94000 end_va = 0x7ee96fff entry_point = 0x0 region_type = private name = "private_0x000000007ee94000" filename = "" Region: id = 1736 start_va = 0x5e00000 end_va = 0x5e3ffff entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 1737 start_va = 0x5e40000 end_va = 0x5e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000005e40000" filename = "" Region: id = 1738 start_va = 0x712a0000 end_va = 0x712edfff entry_point = 0x712a0000 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\SysWOW64\\wevtapi.dll" (normalized: "c:\\windows\\syswow64\\wevtapi.dll") Region: id = 1739 start_va = 0x712f0000 end_va = 0x71332fff entry_point = 0x712f0000 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\SysWOW64\\pdh.dll" (normalized: "c:\\windows\\syswow64\\pdh.dll") Region: id = 1740 start_va = 0x71340000 end_va = 0x71359fff entry_point = 0x71340000 region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\SysWOW64\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiperfclass.dll") Region: id = 1741 start_va = 0x7ee8b000 end_va = 0x7ee8dfff entry_point = 0x0 region_type = private name = "private_0x000000007ee8b000" filename = "" Region: id = 1757 start_va = 0x5e80000 end_va = 0x5efffff entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 1758 start_va = 0x5f00000 end_va = 0x5ffffff entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 1759 start_va = 0x6000000 end_va = 0x612ffff entry_point = 0x0 region_type = private name = "private_0x0000000006000000" filename = "" Region: id = 1760 start_va = 0x71290000 end_va = 0x7129efff entry_point = 0x71290000 region_type = mapped_file name = "netfxperf.dll" filename = "\\Windows\\SysWOW64\\netfxperf.dll" (normalized: "c:\\windows\\syswow64\\netfxperf.dll") Region: id = 1761 start_va = 0x73f90000 end_va = 0x73fe8fff entry_point = 0x73f90000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 1762 start_va = 0x61c0000 end_va = 0x61cffff entry_point = 0x0 region_type = private name = "private_0x00000000061c0000" filename = "" Region: id = 1763 start_va = 0x6220000 end_va = 0x622ffff entry_point = 0x0 region_type = private name = "private_0x0000000006220000" filename = "" Region: id = 1764 start_va = 0x73f10000 end_va = 0x73f87fff entry_point = 0x73f10000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 1765 start_va = 0x75080000 end_va = 0x750c3fff entry_point = 0x75080000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1766 start_va = 0x73f00000 end_va = 0x73f07fff entry_point = 0x73f00000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1773 start_va = 0x71230000 end_va = 0x71263fff entry_point = 0x71230000 region_type = mapped_file name = "perfcounter.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\PerfCounter.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\perfcounter.dll") Region: id = 1787 start_va = 0x5270000 end_va = 0x528ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005270000" filename = "" Region: id = 1788 start_va = 0x71030000 end_va = 0x71124fff entry_point = 0x71030000 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 1789 start_va = 0x71130000 end_va = 0x7113efff entry_point = 0x71130000 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 1790 start_va = 0x71140000 end_va = 0x7115efff entry_point = 0x71140000 region_type = mapped_file name = "corperfmonext.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\CORPerfMonExt.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\corperfmonext.dll") Region: id = 1794 start_va = 0x6130000 end_va = 0x616ffff entry_point = 0x0 region_type = private name = "private_0x0000000006130000" filename = "" Region: id = 1795 start_va = 0x6170000 end_va = 0x61affff entry_point = 0x0 region_type = private name = "private_0x0000000006170000" filename = "" Region: id = 1796 start_va = 0x61b0000 end_va = 0x61b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000061b0000" filename = "" Region: id = 1797 start_va = 0x6230000 end_va = 0x632ffff entry_point = 0x0 region_type = private name = "private_0x0000000006230000" filename = "" Region: id = 1798 start_va = 0x70fb0000 end_va = 0x70fb8fff entry_point = 0x70fb0000 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\SysWOW64\\bitsperf.dll" (normalized: "c:\\windows\\syswow64\\bitsperf.dll") Region: id = 1799 start_va = 0x7ee88000 end_va = 0x7ee8afff entry_point = 0x0 region_type = private name = "private_0x000000007ee88000" filename = "" Region: id = 1800 start_va = 0x61d0000 end_va = 0x61d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000061d0000" filename = "" Region: id = 1801 start_va = 0x70f90000 end_va = 0x70fa4fff entry_point = 0x70f90000 region_type = mapped_file name = "esentprf.dll" filename = "\\Windows\\SysWOW64\\esentprf.dll" (normalized: "c:\\windows\\syswow64\\esentprf.dll") Region: id = 1802 start_va = 0x61e0000 end_va = 0x61e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000061e0000" filename = "" Region: id = 1803 start_va = 0x61f0000 end_va = 0x61fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000061f0000" filename = "" Region: id = 1804 start_va = 0x6200000 end_va = 0x6201fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006200000" filename = "" Region: id = 1805 start_va = 0x6330000 end_va = 0x637cfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006330000" filename = "" Region: id = 1806 start_va = 0x6380000 end_va = 0x63ccfff entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 1807 start_va = 0x63d0000 end_va = 0x640ffff entry_point = 0x0 region_type = private name = "private_0x00000000063d0000" filename = "" Region: id = 1808 start_va = 0x6410000 end_va = 0x644ffff entry_point = 0x0 region_type = private name = "private_0x0000000006410000" filename = "" Region: id = 1809 start_va = 0x70d20000 end_va = 0x70d28fff entry_point = 0x70d20000 region_type = mapped_file name = "ktmw32.dll" filename = "\\Windows\\SysWOW64\\ktmw32.dll" (normalized: "c:\\windows\\syswow64\\ktmw32.dll") Region: id = 1810 start_va = 0x70d30000 end_va = 0x70de7fff entry_point = 0x70d30000 region_type = mapped_file name = "msdtcprx.dll" filename = "\\Windows\\SysWOW64\\msdtcprx.dll" (normalized: "c:\\windows\\syswow64\\msdtcprx.dll") Region: id = 1811 start_va = 0x70df0000 end_va = 0x70e66fff entry_point = 0x70df0000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\SysWOW64\\clusapi.dll" (normalized: "c:\\windows\\syswow64\\clusapi.dll") Region: id = 1812 start_va = 0x70e70000 end_va = 0x70eb8fff entry_point = 0x70e70000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\SysWOW64\\resutils.dll" (normalized: "c:\\windows\\syswow64\\resutils.dll") Region: id = 1813 start_va = 0x70ec0000 end_va = 0x70f1afff entry_point = 0x70ec0000 region_type = mapped_file name = "mtxclu.dll" filename = "\\Windows\\SysWOW64\\mtxclu.dll" (normalized: "c:\\windows\\syswow64\\mtxclu.dll") Region: id = 1814 start_va = 0x70f20000 end_va = 0x70f37fff entry_point = 0x70f20000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 1815 start_va = 0x70f40000 end_va = 0x70f84fff entry_point = 0x70f40000 region_type = mapped_file name = "msdtcuiu.dll" filename = "\\Windows\\SysWOW64\\msdtcuiu.dll" (normalized: "c:\\windows\\syswow64\\msdtcuiu.dll") Region: id = 1816 start_va = 0x71020000 end_va = 0x71029fff entry_point = 0x71020000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 1817 start_va = 0x74860000 end_va = 0x748e3fff entry_point = 0x74860000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 1818 start_va = 0x75070000 end_va = 0x7507efff entry_point = 0x75070000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 1819 start_va = 0x750d0000 end_va = 0x755acfff entry_point = 0x750d0000 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 1820 start_va = 0x755b0000 end_va = 0x7696efff entry_point = 0x755b0000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 1821 start_va = 0x77430000 end_va = 0x77519fff entry_point = 0x77430000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1822 start_va = 0x777f0000 end_va = 0x77833fff entry_point = 0x777f0000 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 1823 start_va = 0x778a0000 end_va = 0x7792cfff entry_point = 0x778a0000 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 1824 start_va = 0x7ee85000 end_va = 0x7ee87fff entry_point = 0x0 region_type = private name = "private_0x000000007ee85000" filename = "" Region: id = 1825 start_va = 0x6210000 end_va = 0x6210fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006210000" filename = "" Region: id = 1826 start_va = 0x71390000 end_va = 0x713b7fff entry_point = 0x71390000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 1827 start_va = 0x70d10000 end_va = 0x70d1cfff entry_point = 0x70d10000 region_type = mapped_file name = "msscntrs.dll" filename = "\\Windows\\SysWOW64\\msscntrs.dll" (normalized: "c:\\windows\\syswow64\\msscntrs.dll") Region: id = 1828 start_va = 0x70cf0000 end_va = 0x70cfdfff entry_point = 0x70cf0000 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\SysWOW64\\wmiclnt.dll" (normalized: "c:\\windows\\syswow64\\wmiclnt.dll") Region: id = 1829 start_va = 0x70d00000 end_va = 0x70d0bfff entry_point = 0x70d00000 region_type = mapped_file name = "perfdisk.dll" filename = "\\Windows\\SysWOW64\\perfdisk.dll" (normalized: "c:\\windows\\syswow64\\perfdisk.dll") Region: id = 1830 start_va = 0x6450000 end_va = 0x648ffff entry_point = 0x0 region_type = private name = "private_0x0000000006450000" filename = "" Region: id = 1831 start_va = 0x6490000 end_va = 0x64cffff entry_point = 0x0 region_type = private name = "private_0x0000000006490000" filename = "" Region: id = 1832 start_va = 0x75030000 end_va = 0x75065fff entry_point = 0x75030000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 1833 start_va = 0x7ee82000 end_va = 0x7ee84fff entry_point = 0x0 region_type = private name = "private_0x000000007ee82000" filename = "" Region: id = 1834 start_va = 0x70ce0000 end_va = 0x70ce8fff entry_point = 0x70ce0000 region_type = mapped_file name = "perfnet.dll" filename = "\\Windows\\SysWOW64\\perfnet.dll" (normalized: "c:\\windows\\syswow64\\perfnet.dll") Region: id = 1837 start_va = 0x70c20000 end_va = 0x70c3bfff entry_point = 0x70c20000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1838 start_va = 0x70c40000 end_va = 0x70c49fff entry_point = 0x70c40000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1839 start_va = 0x70c80000 end_va = 0x70c8ffff entry_point = 0x70c80000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 1840 start_va = 0x70cc0000 end_va = 0x70cd2fff entry_point = 0x70cc0000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\SysWOW64\\netapi32.dll" (normalized: "c:\\windows\\syswow64\\netapi32.dll") Region: id = 1845 start_va = 0x70c10000 end_va = 0x70c1efff entry_point = 0x70c10000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 1846 start_va = 0x70c00000 end_va = 0x70c0bfff entry_point = 0x70c00000 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\SysWOW64\\perfos.dll" (normalized: "c:\\windows\\syswow64\\perfos.dll") Region: id = 1848 start_va = 0x64d0000 end_va = 0x650ffff entry_point = 0x0 region_type = private name = "private_0x00000000064d0000" filename = "" Region: id = 1849 start_va = 0x6510000 end_va = 0x654ffff entry_point = 0x0 region_type = private name = "private_0x0000000006510000" filename = "" Region: id = 1850 start_va = 0x70af0000 end_va = 0x70afbfff entry_point = 0x70af0000 region_type = mapped_file name = "perfproc.dll" filename = "\\Windows\\SysWOW64\\perfproc.dll" (normalized: "c:\\windows\\syswow64\\perfproc.dll") Region: id = 1851 start_va = 0x7ee7f000 end_va = 0x7ee81fff entry_point = 0x0 region_type = private name = "private_0x000000007ee7f000" filename = "" Region: id = 1856 start_va = 0x70ac0000 end_va = 0x70ac7fff entry_point = 0x70ac0000 region_type = mapped_file name = "rasctrs.dll" filename = "\\Windows\\SysWOW64\\rasctrs.dll" (normalized: "c:\\windows\\syswow64\\rasctrs.dll") Region: id = 1860 start_va = 0x6550000 end_va = 0x658ffff entry_point = 0x0 region_type = private name = "private_0x0000000006550000" filename = "" Region: id = 1861 start_va = 0x6590000 end_va = 0x65cffff entry_point = 0x0 region_type = private name = "private_0x0000000006590000" filename = "" Region: id = 1862 start_va = 0x70a20000 end_va = 0x70a86fff entry_point = 0x70a20000 region_type = mapped_file name = "winspool.drv" filename = "\\Windows\\SysWOW64\\winspool.drv" (normalized: "c:\\windows\\syswow64\\winspool.drv") Region: id = 1863 start_va = 0x70b00000 end_va = 0x70b22fff entry_point = 0x70b00000 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 1864 start_va = 0x7ee7c000 end_va = 0x7ee7efff entry_point = 0x0 region_type = private name = "private_0x000000007ee7c000" filename = "" Region: id = 1869 start_va = 0x709a0000 end_va = 0x709a6fff entry_point = 0x709a0000 region_type = mapped_file name = "tapiperf.dll" filename = "\\Windows\\SysWOW64\\tapiperf.dll" (normalized: "c:\\windows\\syswow64\\tapiperf.dll") Region: id = 1870 start_va = 0x70990000 end_va = 0x7099dfff entry_point = 0x70990000 region_type = mapped_file name = "perfctrs.dll" filename = "\\Windows\\SysWOW64\\perfctrs.dll" (normalized: "c:\\windows\\syswow64\\perfctrs.dll") Region: id = 1871 start_va = 0x748f0000 end_va = 0x7491ffff entry_point = 0x748f0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 1872 start_va = 0x74b20000 end_va = 0x74b27fff entry_point = 0x74b20000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 1873 start_va = 0x708c0000 end_va = 0x708eefff entry_point = 0x708c0000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\SysWOW64\\logoncli.dll" (normalized: "c:\\windows\\syswow64\\logoncli.dll") Region: id = 1874 start_va = 0x708f0000 end_va = 0x70903fff entry_point = 0x708f0000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\SysWOW64\\samcli.dll" (normalized: "c:\\windows\\syswow64\\samcli.dll") Region: id = 1875 start_va = 0x70910000 end_va = 0x70923fff entry_point = 0x70910000 region_type = mapped_file name = "utildll.dll" filename = "\\Windows\\SysWOW64\\utildll.dll" (normalized: "c:\\windows\\syswow64\\utildll.dll") Region: id = 1876 start_va = 0x70930000 end_va = 0x70973fff entry_point = 0x70930000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 1877 start_va = 0x70980000 end_va = 0x70986fff entry_point = 0x70980000 region_type = mapped_file name = "perfts.dll" filename = "\\Windows\\SysWOW64\\perfts.dll" (normalized: "c:\\windows\\syswow64\\perfts.dll") Region: id = 1878 start_va = 0x76af0000 end_va = 0x76c94fff entry_point = 0x76af0000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 1879 start_va = 0x708b0000 end_va = 0x708b6fff entry_point = 0x708b0000 region_type = mapped_file name = "usbperf.dll" filename = "\\Windows\\SysWOW64\\usbperf.dll" (normalized: "c:\\windows\\syswow64\\usbperf.dll") Region: id = 1886 start_va = 0x70870000 end_va = 0x7088efff entry_point = 0x70870000 region_type = mapped_file name = "loadperf.dll" filename = "\\Windows\\SysWOW64\\loadperf.dll" (normalized: "c:\\windows\\syswow64\\loadperf.dll") Region: id = 1887 start_va = 0x70890000 end_va = 0x708aafff entry_point = 0x70890000 region_type = mapped_file name = "wmiaprpl.dll" filename = "\\Windows\\SysWOW64\\wbem\\WmiApRpl.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiaprpl.dll") Region: id = 1892 start_va = 0x65d0000 end_va = 0x65d0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000065d0000" filename = "" Region: id = 1893 start_va = 0x70590000 end_va = 0x70832fff entry_point = 0x70590000 region_type = mapped_file name = "tquery.dll" filename = "\\Windows\\SysWOW64\\tquery.dll" (normalized: "c:\\windows\\syswow64\\tquery.dll") Thread: id = 135 os_tid = 0x278 Thread: id = 137 os_tid = 0xa1c Thread: id = 138 os_tid = 0x2fc Thread: id = 139 os_tid = 0x200 Thread: id = 140 os_tid = 0x3d4 Thread: id = 141 os_tid = 0x6c8 Thread: id = 142 os_tid = 0x758 Thread: id = 143 os_tid = 0x938 Thread: id = 144 os_tid = 0x7c4 Thread: id = 145 os_tid = 0x2b8 Thread: id = 155 os_tid = 0xb58 Thread: id = 156 os_tid = 0x518 Thread: id = 157 os_tid = 0x350 Thread: id = 159 os_tid = 0x32c Thread: id = 161 os_tid = 0xb0c Process: id = "9" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0xf775000" os_pid = "0xc38" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x378" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xe], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e0e3" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1895 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1896 start_va = 0xdc70ac0000 end_va = 0xdc70adffff entry_point = 0x0 region_type = private name = "private_0x000000dc70ac0000" filename = "" Region: id = 1897 start_va = 0xdc70ae0000 end_va = 0xdc70af3fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc70ae0000" filename = "" Region: id = 1898 start_va = 0xdc70b00000 end_va = 0xdc70b7ffff entry_point = 0x0 region_type = private name = "private_0x000000dc70b00000" filename = "" Region: id = 1899 start_va = 0xdc70b80000 end_va = 0xdc70b83fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc70b80000" filename = "" Region: id = 1900 start_va = 0xdc70b90000 end_va = 0xdc70b90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc70b90000" filename = "" Region: id = 1901 start_va = 0xdc70ba0000 end_va = 0xdc70ba1fff entry_point = 0x0 region_type = private name = "private_0x000000dc70ba0000" filename = "" Region: id = 1902 start_va = 0x7df5ffa90000 end_va = 0x7ff5ffa8ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffa90000" filename = "" Region: id = 1903 start_va = 0x7ff75c180000 end_va = 0x7ff75c1a2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff75c180000" filename = "" Region: id = 1904 start_va = 0x7ff75c1a8000 end_va = 0x7ff75c1a8fff entry_point = 0x0 region_type = private name = "private_0x00007ff75c1a8000" filename = "" Region: id = 1905 start_va = 0x7ff75c1ae000 end_va = 0x7ff75c1affff entry_point = 0x0 region_type = private name = "private_0x00007ff75c1ae000" filename = "" Region: id = 1906 start_va = 0x7ff75cd80000 end_va = 0x7ff75cdfefff entry_point = 0x7ff75cd80000 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 1907 start_va = 0x7ffc03e70000 end_va = 0x7ffc04031fff entry_point = 0x7ffc03e70000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1908 start_va = 0xdc70ac0000 end_va = 0xdc70acffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc70ac0000" filename = "" Region: id = 1909 start_va = 0xdc70ad0000 end_va = 0xdc70adcfff entry_point = 0x0 region_type = private name = "private_0x000000dc70ad0000" filename = "" Region: id = 1910 start_va = 0xdc70bb0000 end_va = 0xdc70c6dfff entry_point = 0xdc70bb0000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1911 start_va = 0xdc70c70000 end_va = 0xdc70ceffff entry_point = 0x0 region_type = private name = "private_0x000000dc70c70000" filename = "" Region: id = 1912 start_va = 0xdc70cf0000 end_va = 0xdc70cfcfff entry_point = 0x0 region_type = private name = "private_0x000000dc70cf0000" filename = "" Region: id = 1913 start_va = 0xdc70d00000 end_va = 0xdc70d00fff entry_point = 0x0 region_type = private name = "private_0x000000dc70d00000" filename = "" Region: id = 1914 start_va = 0xdc70d10000 end_va = 0xdc70d10fff entry_point = 0x0 region_type = private name = "private_0x000000dc70d10000" filename = "" Region: id = 1915 start_va = 0xdc70d20000 end_va = 0xdc70d24fff entry_point = 0xdc70d20000 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1916 start_va = 0xdc70d30000 end_va = 0xdc70d30fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc70d30000" filename = "" Region: id = 1917 start_va = 0xdc70d40000 end_va = 0xdc70d40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc70d40000" filename = "" Region: id = 1918 start_va = 0xdc70d50000 end_va = 0xdc70d50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc70d50000" filename = "" Region: id = 1919 start_va = 0xdc70d60000 end_va = 0xdc70e5ffff entry_point = 0x0 region_type = private name = "private_0x000000dc70d60000" filename = "" Region: id = 1920 start_va = 0xdc70e60000 end_va = 0xdc70edffff entry_point = 0x0 region_type = private name = "private_0x000000dc70e60000" filename = "" Region: id = 1921 start_va = 0xdc70f10000 end_va = 0xdc70f1ffff entry_point = 0x0 region_type = private name = "private_0x000000dc70f10000" filename = "" Region: id = 1922 start_va = 0xdc70f20000 end_va = 0xdc71256fff entry_point = 0xdc70f20000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1923 start_va = 0xdc71260000 end_va = 0xdc713e7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc71260000" filename = "" Region: id = 1924 start_va = 0xdc713f0000 end_va = 0xdc71570fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc713f0000" filename = "" Region: id = 1925 start_va = 0xdc71580000 end_va = 0xdc7163ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000dc71580000" filename = "" Region: id = 1926 start_va = 0xdc71640000 end_va = 0xdc7173ffff entry_point = 0x0 region_type = private name = "private_0x000000dc71640000" filename = "" Region: id = 1927 start_va = 0xdc71740000 end_va = 0xdc717bffff entry_point = 0x0 region_type = private name = "private_0x000000dc71740000" filename = "" Region: id = 1928 start_va = 0xdc717c0000 end_va = 0xdc7183ffff entry_point = 0x0 region_type = private name = "private_0x000000dc717c0000" filename = "" Region: id = 1929 start_va = 0xdc71840000 end_va = 0xdc718bffff entry_point = 0x0 region_type = private name = "private_0x000000dc71840000" filename = "" Region: id = 1930 start_va = 0xdc718c0000 end_va = 0xdc7193ffff entry_point = 0x0 region_type = private name = "private_0x000000dc718c0000" filename = "" Region: id = 1931 start_va = 0xdc71940000 end_va = 0xdc719bffff entry_point = 0x0 region_type = private name = "private_0x000000dc71940000" filename = "" Region: id = 1932 start_va = 0xdc719c0000 end_va = 0xdc71a3ffff entry_point = 0x0 region_type = private name = "private_0x000000dc719c0000" filename = "" Region: id = 1933 start_va = 0x7ff75c078000 end_va = 0x7ff75c079fff entry_point = 0x0 region_type = private name = "private_0x00007ff75c078000" filename = "" Region: id = 1934 start_va = 0x7ff75c07a000 end_va = 0x7ff75c07bfff entry_point = 0x0 region_type = private name = "private_0x00007ff75c07a000" filename = "" Region: id = 1935 start_va = 0x7ff75c07c000 end_va = 0x7ff75c07dfff entry_point = 0x0 region_type = private name = "private_0x00007ff75c07c000" filename = "" Region: id = 1936 start_va = 0x7ff75c07e000 end_va = 0x7ff75c07ffff entry_point = 0x0 region_type = private name = "private_0x00007ff75c07e000" filename = "" Region: id = 1937 start_va = 0x7ff75c080000 end_va = 0x7ff75c17ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff75c080000" filename = "" Region: id = 1938 start_va = 0x7ff75c1a4000 end_va = 0x7ff75c1a5fff entry_point = 0x0 region_type = private name = "private_0x00007ff75c1a4000" filename = "" Region: id = 1939 start_va = 0x7ff75c1a6000 end_va = 0x7ff75c1a7fff entry_point = 0x0 region_type = private name = "private_0x00007ff75c1a6000" filename = "" Region: id = 1940 start_va = 0x7ff75c1aa000 end_va = 0x7ff75c1abfff entry_point = 0x0 region_type = private name = "private_0x00007ff75c1aa000" filename = "" Region: id = 1941 start_va = 0x7ff75c1ac000 end_va = 0x7ff75c1adfff entry_point = 0x0 region_type = private name = "private_0x00007ff75c1ac000" filename = "" Region: id = 1942 start_va = 0x7ffbf5fb0000 end_va = 0x7ffbf5fc5fff entry_point = 0x7ffbf5fb0000 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1943 start_va = 0x7ffbf6120000 end_va = 0x7ffbf6144fff entry_point = 0x7ffbf6120000 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1944 start_va = 0x7ffbf6150000 end_va = 0x7ffbf6163fff entry_point = 0x7ffbf6150000 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1945 start_va = 0x7ffbf6170000 end_va = 0x7ffbf6267fff entry_point = 0x7ffbf6170000 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1946 start_va = 0x7ffbf64d0000 end_va = 0x7ffbf64e0fff entry_point = 0x7ffbf64d0000 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1947 start_va = 0x7ffbfa160000 end_va = 0x7ffbfa1defff entry_point = 0x7ffbfa160000 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1948 start_va = 0x7ffbfc910000 end_va = 0x7ffbfc94cfff entry_point = 0x7ffbfc910000 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 1949 start_va = 0x7ffbffbe0000 end_va = 0x7ffbffc11fff entry_point = 0x7ffbffbe0000 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1950 start_va = 0x7ffbffdc0000 end_va = 0x7ffbffdf2fff entry_point = 0x7ffbffdc0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1951 start_va = 0x7ffc00170000 end_va = 0x7ffc00186fff entry_point = 0x7ffc00170000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1952 start_va = 0x7ffc002e0000 end_va = 0x7ffc002eafff entry_point = 0x7ffc002e0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1953 start_va = 0x7ffc006c0000 end_va = 0x7ffc006e7fff entry_point = 0x7ffc006c0000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1954 start_va = 0x7ffc006f0000 end_va = 0x7ffc0075afff entry_point = 0x7ffc006f0000 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1955 start_va = 0x7ffc00910000 end_va = 0x7ffc0091efff entry_point = 0x7ffc00910000 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1956 start_va = 0x7ffc01360000 end_va = 0x7ffc0153cfff entry_point = 0x7ffc01360000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1957 start_va = 0x7ffc01540000 end_va = 0x7ffc015e4fff entry_point = 0x7ffc01540000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1958 start_va = 0x7ffc01640000 end_va = 0x7ffc016e5fff entry_point = 0x7ffc01640000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1959 start_va = 0x7ffc018a0000 end_va = 0x7ffc01b1bfff entry_point = 0x7ffc018a0000 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1960 start_va = 0x7ffc01dd0000 end_va = 0x7ffc01ef5fff entry_point = 0x7ffc01dd0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1961 start_va = 0x7ffc01f00000 end_va = 0x7ffc0204dfff entry_point = 0x7ffc01f00000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1962 start_va = 0x7ffc02050000 end_va = 0x7ffc02057fff entry_point = 0x7ffc02050000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1963 start_va = 0x7ffc02060000 end_va = 0x7ffc020fcfff entry_point = 0x7ffc02060000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1964 start_va = 0x7ffc02100000 end_va = 0x7ffc0215afff entry_point = 0x7ffc02100000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1965 start_va = 0x7ffc037f0000 end_va = 0x7ffc03974fff entry_point = 0x7ffc037f0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1966 start_va = 0x7ffc03980000 end_va = 0x7ffc039e8fff entry_point = 0x7ffc03980000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1967 start_va = 0x7ffc03d00000 end_va = 0x7ffc03dbdfff entry_point = 0x7ffc03d00000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1968 start_va = 0x7ffc03dc0000 end_va = 0x7ffc03e6cfff entry_point = 0x7ffc03dc0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1969 start_va = 0xdc71a40000 end_va = 0xdc71a87fff entry_point = 0xdc71a40000 region_type = mapped_file name = "advapi32.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32.dll.mui") Region: id = 1970 start_va = 0x7ffbfc100000 end_va = 0x7ffbfc140fff entry_point = 0x7ffbfc100000 region_type = mapped_file name = "mofd.dll" filename = "\\Windows\\System32\\wbem\\mofd.dll" (normalized: "c:\\windows\\system32\\wbem\\mofd.dll") Region: id = 1971 start_va = 0x7ffbfd810000 end_va = 0x7ffbfd820fff entry_point = 0x7ffbfd810000 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Thread: id = 165 os_tid = 0xc28 Thread: id = 166 os_tid = 0xc30 Thread: id = 167 os_tid = 0xc34 Thread: id = 168 os_tid = 0xc44 Thread: id = 169 os_tid = 0xc2c Thread: id = 170 os_tid = 0xc24 Thread: id = 171 os_tid = 0xbd4 Thread: id = 172 os_tid = 0xb68 Thread: id = 173 os_tid = 0xc74