# Flog Txt Version 1 # Analyzer Version: 4.4.0 # Analyzer Build Date: Dec 8 2021 20:04:45 # Log Creation Date: 29.12.2021 08:38:31.027 Process: id = "1" image_name = "213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe" page_root = "0x73838000" os_pid = "0xe9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x618" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 117 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 118 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 119 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 120 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 121 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 122 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 123 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 124 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 125 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 126 start_va = 0x400000 end_va = 0xae9fff monitored = 1 entry_point = 0x401000 region_type = mapped_file name = "213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe") Region: id = 127 start_va = 0x77b90000 end_va = 0x77d0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 128 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 129 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 130 start_va = 0x7fff0000 end_va = 0x7ffd504cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 131 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 132 start_va = 0x7ffd50691000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffd50691000" filename = "" Region: id = 270 start_va = 0xb90000 end_va = 0xb9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b90000" filename = "" Region: id = 271 start_va = 0x6edd0000 end_va = 0x6ee1ffff monitored = 0 entry_point = 0x6ede8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 272 start_va = 0x6ee20000 end_va = 0x6ee99fff monitored = 0 entry_point = 0x6ee33290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 273 start_va = 0x74f30000 end_va = 0x7500ffff monitored = 0 entry_point = 0x74f43980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 274 start_va = 0x6eea0000 end_va = 0x6eea7fff monitored = 0 entry_point = 0x6eea17c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 275 start_va = 0xba0000 end_va = 0xe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ba0000" filename = "" Region: id = 276 start_va = 0x74f30000 end_va = 0x7500ffff monitored = 0 entry_point = 0x74f43980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 277 start_va = 0x76ad0000 end_va = 0x76c4dfff monitored = 0 entry_point = 0x76b81b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 278 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 279 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 280 start_va = 0xba0000 end_va = 0xc5dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 281 start_va = 0xd30000 end_va = 0xe2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d30000" filename = "" Region: id = 282 start_va = 0x74810000 end_va = 0x748a1fff monitored = 0 entry_point = 0x74850380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 283 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 284 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 285 start_va = 0x750d0000 end_va = 0x75216fff monitored = 0 entry_point = 0x750e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 286 start_va = 0x77440000 end_va = 0x7758efff monitored = 0 entry_point = 0x774f6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 287 start_va = 0xaf0000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 288 start_va = 0xe30000 end_va = 0xf2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 289 start_va = 0x74d80000 end_va = 0x74e11fff monitored = 0 entry_point = 0x74db8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 290 start_va = 0x6ce20000 end_va = 0x6ce2efff monitored = 0 entry_point = 0x6ce22a50 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\SysWOW64\\wtsapi32.dll" (normalized: "c:\\windows\\syswow64\\wtsapi32.dll") Region: id = 291 start_va = 0x74a10000 end_va = 0x74acdfff monitored = 0 entry_point = 0x74a45630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 292 start_va = 0xb30000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 293 start_va = 0xf30000 end_va = 0x102ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 294 start_va = 0x752b0000 end_va = 0x7546cfff monitored = 0 entry_point = 0x75392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 295 start_va = 0x74e80000 end_va = 0x74f2cfff monitored = 0 entry_point = 0x74e94f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 296 start_va = 0x748c0000 end_va = 0x748ddfff monitored = 0 entry_point = 0x748cb640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 297 start_va = 0x748b0000 end_va = 0x748b9fff monitored = 0 entry_point = 0x748b2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 298 start_va = 0x77680000 end_va = 0x776d7fff monitored = 0 entry_point = 0x776c25c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 299 start_va = 0x76c50000 end_va = 0x76c93fff monitored = 0 entry_point = 0x76c69d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 300 start_va = 0x1d0000 end_va = 0x1f9fff monitored = 0 entry_point = 0x1d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 301 start_va = 0x1030000 end_va = 0x11b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001030000" filename = "" Region: id = 302 start_va = 0x75660000 end_va = 0x7568afff monitored = 0 entry_point = 0x75665680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 303 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 304 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 305 start_va = 0x11c0000 end_va = 0x1340fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011c0000" filename = "" Region: id = 306 start_va = 0x1350000 end_va = 0x274ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001350000" filename = "" Region: id = 307 start_va = 0x2750000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 308 start_va = 0x2750000 end_va = 0x2839fff monitored = 0 entry_point = 0x278d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 309 start_va = 0x28f0000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028f0000" filename = "" Region: id = 310 start_va = 0xc60000 end_va = 0xcbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 311 start_va = 0xcc0000 end_va = 0xd1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cc0000" filename = "" Region: id = 312 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 313 start_va = 0xc60000 end_va = 0xca4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 314 start_va = 0x1e0000 end_va = 0x1e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 315 start_va = 0x1e0000 end_va = 0x1e1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 316 start_va = 0x1e0000 end_va = 0x1e3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 317 start_va = 0x77b10000 end_va = 0x77b8afff monitored = 0 entry_point = 0x77b2e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 318 start_va = 0x6ce10000 end_va = 0x6ce17fff monitored = 0 entry_point = 0x6ce117b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 319 start_va = 0x74ad0000 end_va = 0x74bbafff monitored = 0 entry_point = 0x74b0d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 320 start_va = 0x6ce00000 end_va = 0x6ce07fff monitored = 0 entry_point = 0x6ce01740 region_type = mapped_file name = "wsock32.dll" filename = "\\Windows\\SysWOW64\\wsock32.dll" (normalized: "c:\\windows\\syswow64\\wsock32.dll") Region: id = 321 start_va = 0x773e0000 end_va = 0x7743efff monitored = 0 entry_point = 0x773e4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 322 start_va = 0x2750000 end_va = 0x284ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 323 start_va = 0x70970000 end_va = 0x709e4fff monitored = 0 entry_point = 0x709a9a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 324 start_va = 0x1e0000 end_va = 0x1effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 325 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 326 start_va = 0xb70000 end_va = 0xb70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b70000" filename = "" Region: id = 327 start_va = 0xb80000 end_va = 0xb80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b80000" filename = "" Region: id = 328 start_va = 0xc60000 end_va = 0xc60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c60000" filename = "" Region: id = 329 start_va = 0xc70000 end_va = 0xc70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c70000" filename = "" Region: id = 330 start_va = 0xc80000 end_va = 0xc80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c80000" filename = "" Region: id = 331 start_va = 0xc90000 end_va = 0xc90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 332 start_va = 0xca0000 end_va = 0xca0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ca0000" filename = "" Region: id = 333 start_va = 0xcb0000 end_va = 0xcb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000cb0000" filename = "" Region: id = 334 start_va = 0xd20000 end_va = 0xd20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000d20000" filename = "" Region: id = 335 start_va = 0x2850000 end_va = 0x2850fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002850000" filename = "" Region: id = 336 start_va = 0x2860000 end_va = 0x2860fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002860000" filename = "" Region: id = 337 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 338 start_va = 0x2880000 end_va = 0x2880fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 339 start_va = 0x2890000 end_va = 0x2890fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002890000" filename = "" Region: id = 340 start_va = 0x28a0000 end_va = 0x28a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 341 start_va = 0x28b0000 end_va = 0x28b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028b0000" filename = "" Region: id = 342 start_va = 0x28c0000 end_va = 0x28c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028c0000" filename = "" Region: id = 343 start_va = 0x28d0000 end_va = 0x28d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028d0000" filename = "" Region: id = 344 start_va = 0x28e0000 end_va = 0x28e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028e0000" filename = "" Region: id = 345 start_va = 0x2900000 end_va = 0x2900fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 346 start_va = 0x2910000 end_va = 0x2910fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002910000" filename = "" Region: id = 347 start_va = 0x2920000 end_va = 0x2920fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 348 start_va = 0x2930000 end_va = 0x2930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 349 start_va = 0x2940000 end_va = 0x2940fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 350 start_va = 0x2950000 end_va = 0x2950fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002950000" filename = "" Region: id = 351 start_va = 0x2960000 end_va = 0x2960fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002960000" filename = "" Region: id = 352 start_va = 0x2970000 end_va = 0x2970fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002970000" filename = "" Region: id = 353 start_va = 0x2980000 end_va = 0x2980fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 354 start_va = 0x2990000 end_va = 0x2990fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 355 start_va = 0x29a0000 end_va = 0x29a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029a0000" filename = "" Region: id = 356 start_va = 0x29b0000 end_va = 0x29b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029b0000" filename = "" Region: id = 357 start_va = 0x29c0000 end_va = 0x29c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 358 start_va = 0x29d0000 end_va = 0x29d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029d0000" filename = "" Region: id = 359 start_va = 0x29e0000 end_va = 0x29e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 360 start_va = 0x29f0000 end_va = 0x29f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029f0000" filename = "" Region: id = 361 start_va = 0x2a00000 end_va = 0x2a00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 362 start_va = 0x2a10000 end_va = 0x2a10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a10000" filename = "" Region: id = 363 start_va = 0x2a20000 end_va = 0x2a20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a20000" filename = "" Region: id = 364 start_va = 0x2a30000 end_va = 0x2a30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a30000" filename = "" Region: id = 365 start_va = 0x2a40000 end_va = 0x2a40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 366 start_va = 0x2a50000 end_va = 0x2a50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a50000" filename = "" Region: id = 367 start_va = 0x2a60000 end_va = 0x2a60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a60000" filename = "" Region: id = 368 start_va = 0x2a70000 end_va = 0x2a70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 369 start_va = 0x2a80000 end_va = 0x2a80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 370 start_va = 0x2a90000 end_va = 0x2a90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a90000" filename = "" Region: id = 371 start_va = 0x2aa0000 end_va = 0x2aa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002aa0000" filename = "" Region: id = 372 start_va = 0x2ab0000 end_va = 0x2ab0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ab0000" filename = "" Region: id = 373 start_va = 0x2ac0000 end_va = 0x2ac0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 374 start_va = 0x2ad0000 end_va = 0x2ad0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ad0000" filename = "" Region: id = 375 start_va = 0x2ae0000 end_va = 0x2ae0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ae0000" filename = "" Region: id = 376 start_va = 0x2af0000 end_va = 0x2af0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002af0000" filename = "" Region: id = 377 start_va = 0x2b00000 end_va = 0x2b00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 378 start_va = 0x2b10000 end_va = 0x2b10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b10000" filename = "" Region: id = 379 start_va = 0x2b20000 end_va = 0x2b20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 380 start_va = 0x2b30000 end_va = 0x2b30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b30000" filename = "" Region: id = 381 start_va = 0x2b40000 end_va = 0x2b40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 382 start_va = 0x2b50000 end_va = 0x2b50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b50000" filename = "" Region: id = 383 start_va = 0x2b60000 end_va = 0x2b60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b60000" filename = "" Region: id = 384 start_va = 0x2b70000 end_va = 0x2b70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b70000" filename = "" Region: id = 385 start_va = 0x2b80000 end_va = 0x2b80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b80000" filename = "" Region: id = 386 start_va = 0x2b90000 end_va = 0x2b90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b90000" filename = "" Region: id = 387 start_va = 0x2ba0000 end_va = 0x2ba0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ba0000" filename = "" Region: id = 388 start_va = 0x2bb0000 end_va = 0x2bb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bb0000" filename = "" Region: id = 389 start_va = 0x2bc0000 end_va = 0x2bc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bc0000" filename = "" Region: id = 390 start_va = 0x2bd0000 end_va = 0x2bd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bd0000" filename = "" Region: id = 391 start_va = 0x2be0000 end_va = 0x2be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002be0000" filename = "" Region: id = 392 start_va = 0x2bf0000 end_va = 0x2bf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002bf0000" filename = "" Region: id = 393 start_va = 0x2c00000 end_va = 0x2c00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 394 start_va = 0x2c10000 end_va = 0x2c10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c10000" filename = "" Region: id = 395 start_va = 0x2c20000 end_va = 0x2c20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c20000" filename = "" Region: id = 396 start_va = 0x2c30000 end_va = 0x2c30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c30000" filename = "" Region: id = 397 start_va = 0x2c40000 end_va = 0x2c40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c40000" filename = "" Region: id = 398 start_va = 0x2c50000 end_va = 0x2c50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c50000" filename = "" Region: id = 399 start_va = 0x2c60000 end_va = 0x2c60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c60000" filename = "" Region: id = 400 start_va = 0x2c70000 end_va = 0x2c70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c70000" filename = "" Region: id = 401 start_va = 0x2c80000 end_va = 0x2c80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c80000" filename = "" Region: id = 402 start_va = 0x2c90000 end_va = 0x2c90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c90000" filename = "" Region: id = 403 start_va = 0x2ca0000 end_va = 0x2ca0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ca0000" filename = "" Region: id = 404 start_va = 0x2cb0000 end_va = 0x2cb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002cb0000" filename = "" Region: id = 405 start_va = 0x2cc0000 end_va = 0x2cc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002cc0000" filename = "" Region: id = 406 start_va = 0x2cd0000 end_va = 0x2cd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002cd0000" filename = "" Region: id = 407 start_va = 0x2ce0000 end_va = 0x2ce0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ce0000" filename = "" Region: id = 408 start_va = 0x2cf0000 end_va = 0x2cf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002cf0000" filename = "" Region: id = 409 start_va = 0x2d00000 end_va = 0x2d00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 410 start_va = 0x2d10000 end_va = 0x2d10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d10000" filename = "" Region: id = 411 start_va = 0x2d20000 end_va = 0x2d20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d20000" filename = "" Region: id = 412 start_va = 0x2d30000 end_va = 0x2d30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d30000" filename = "" Region: id = 413 start_va = 0x2d40000 end_va = 0x2d40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d40000" filename = "" Region: id = 414 start_va = 0x2d50000 end_va = 0x2d50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d50000" filename = "" Region: id = 415 start_va = 0x2d60000 end_va = 0x2d60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d60000" filename = "" Region: id = 416 start_va = 0x2d70000 end_va = 0x2d70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d70000" filename = "" Region: id = 417 start_va = 0x2d80000 end_va = 0x2d80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d80000" filename = "" Region: id = 418 start_va = 0x2d90000 end_va = 0x2d90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d90000" filename = "" Region: id = 419 start_va = 0x2da0000 end_va = 0x2da0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002da0000" filename = "" Region: id = 420 start_va = 0x2db0000 end_va = 0x2db0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002db0000" filename = "" Region: id = 421 start_va = 0x2dc0000 end_va = 0x2dc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002dc0000" filename = "" Region: id = 422 start_va = 0x2dd0000 end_va = 0x2dd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002dd0000" filename = "" Region: id = 423 start_va = 0x2de0000 end_va = 0x2de0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 424 start_va = 0x2df0000 end_va = 0x2df0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002df0000" filename = "" Region: id = 425 start_va = 0x2e00000 end_va = 0x2e00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e00000" filename = "" Region: id = 426 start_va = 0x2e10000 end_va = 0x2e10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e10000" filename = "" Region: id = 427 start_va = 0x2e20000 end_va = 0x2e20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e20000" filename = "" Region: id = 428 start_va = 0x2e30000 end_va = 0x2e30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e30000" filename = "" Region: id = 429 start_va = 0x2e40000 end_va = 0x2e40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e40000" filename = "" Region: id = 430 start_va = 0x2e50000 end_va = 0x2e50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e50000" filename = "" Region: id = 431 start_va = 0x2e60000 end_va = 0x2e60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e60000" filename = "" Region: id = 432 start_va = 0x2e70000 end_va = 0x2e70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e70000" filename = "" Region: id = 433 start_va = 0x2e80000 end_va = 0x2e80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e80000" filename = "" Region: id = 434 start_va = 0x2e90000 end_va = 0x2e90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e90000" filename = "" Region: id = 435 start_va = 0x2ea0000 end_va = 0x2ea0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ea0000" filename = "" Region: id = 436 start_va = 0x2eb0000 end_va = 0x2eb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002eb0000" filename = "" Region: id = 437 start_va = 0x2ec0000 end_va = 0x2ec0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ec0000" filename = "" Region: id = 438 start_va = 0x2ed0000 end_va = 0x2ed0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ed0000" filename = "" Region: id = 439 start_va = 0x2ee0000 end_va = 0x2ee0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 440 start_va = 0x2ef0000 end_va = 0x2ef0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 441 start_va = 0x2f00000 end_va = 0x2f00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 442 start_va = 0x2f10000 end_va = 0x2f10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 443 start_va = 0x2f20000 end_va = 0x2f20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f20000" filename = "" Region: id = 444 start_va = 0x2f30000 end_va = 0x2f30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f30000" filename = "" Region: id = 445 start_va = 0x2f40000 end_va = 0x2f40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f40000" filename = "" Region: id = 446 start_va = 0x2f50000 end_va = 0x2f50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 447 start_va = 0x2f60000 end_va = 0x2f60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f60000" filename = "" Region: id = 448 start_va = 0x2f70000 end_va = 0x2f70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f70000" filename = "" Region: id = 449 start_va = 0x2f80000 end_va = 0x2f80fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f80000" filename = "" Region: id = 450 start_va = 0x2f90000 end_va = 0x2f90fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f90000" filename = "" Region: id = 451 start_va = 0x2fa0000 end_va = 0x2fa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fa0000" filename = "" Region: id = 452 start_va = 0x2fb0000 end_va = 0x2fb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fb0000" filename = "" Region: id = 453 start_va = 0x2fc0000 end_va = 0x2fc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fc0000" filename = "" Region: id = 454 start_va = 0x2fd0000 end_va = 0x2fd0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fd0000" filename = "" Region: id = 455 start_va = 0x2fe0000 end_va = 0x2fe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002fe0000" filename = "" Region: id = 456 start_va = 0x2ff0000 end_va = 0x2ff0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 457 start_va = 0x3000000 end_va = 0x3000fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 458 start_va = 0x3010000 end_va = 0x3010fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003010000" filename = "" Region: id = 459 start_va = 0x3020000 end_va = 0x3020fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003020000" filename = "" Region: id = 460 start_va = 0x3030000 end_va = 0x3030fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003030000" filename = "" Region: id = 461 start_va = 0x3040000 end_va = 0x3040fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003040000" filename = "" Region: id = 462 start_va = 0x3050000 end_va = 0x3050fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003050000" filename = "" Region: id = 463 start_va = 0x3060000 end_va = 0x3060fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003060000" filename = "" Region: id = 464 start_va = 0x3070000 end_va = 0x3070fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003070000" filename = "" Region: id = 465 start_va = 0x3080000 end_va = 0x3080fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003080000" filename = "" Region: id = 466 start_va = 0x3090000 end_va = 0x3090fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003090000" filename = "" Region: id = 467 start_va = 0x30a0000 end_va = 0x30a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030a0000" filename = "" Region: id = 468 start_va = 0x30b0000 end_va = 0x30b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 469 start_va = 0x30c0000 end_va = 0x30c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030c0000" filename = "" Region: id = 470 start_va = 0x30d0000 end_va = 0x30d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030d0000" filename = "" Region: id = 471 start_va = 0x30e0000 end_va = 0x30e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030e0000" filename = "" Region: id = 472 start_va = 0x30f0000 end_va = 0x30f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000030f0000" filename = "" Region: id = 473 start_va = 0x3100000 end_va = 0x3100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003100000" filename = "" Region: id = 474 start_va = 0x3110000 end_va = 0x3110fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003110000" filename = "" Region: id = 475 start_va = 0x3120000 end_va = 0x3120fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003120000" filename = "" Region: id = 476 start_va = 0x3130000 end_va = 0x3130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003130000" filename = "" Region: id = 477 start_va = 0x3140000 end_va = 0x3140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003140000" filename = "" Region: id = 478 start_va = 0x3150000 end_va = 0x3150fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003150000" filename = "" Region: id = 479 start_va = 0x3160000 end_va = 0x3160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003160000" filename = "" Region: id = 480 start_va = 0x3170000 end_va = 0x3170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 481 start_va = 0x3180000 end_va = 0x3180fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003180000" filename = "" Region: id = 482 start_va = 0x3190000 end_va = 0x3190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 483 start_va = 0x31a0000 end_va = 0x31a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031a0000" filename = "" Region: id = 484 start_va = 0x31b0000 end_va = 0x31b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031b0000" filename = "" Region: id = 485 start_va = 0x31c0000 end_va = 0x31c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031c0000" filename = "" Region: id = 486 start_va = 0x31d0000 end_va = 0x31d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031d0000" filename = "" Region: id = 487 start_va = 0x31e0000 end_va = 0x31e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031e0000" filename = "" Region: id = 488 start_va = 0x31f0000 end_va = 0x31f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031f0000" filename = "" Region: id = 489 start_va = 0x3200000 end_va = 0x3200fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 490 start_va = 0x3210000 end_va = 0x3210fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003210000" filename = "" Region: id = 491 start_va = 0x3220000 end_va = 0x3220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003220000" filename = "" Region: id = 492 start_va = 0x3230000 end_va = 0x3230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003230000" filename = "" Region: id = 493 start_va = 0x3240000 end_va = 0x3240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 494 start_va = 0x3250000 end_va = 0x3250fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003250000" filename = "" Region: id = 495 start_va = 0x3260000 end_va = 0x3260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003260000" filename = "" Region: id = 496 start_va = 0x3270000 end_va = 0x3270fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003270000" filename = "" Region: id = 497 start_va = 0x3280000 end_va = 0x3280fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003280000" filename = "" Region: id = 498 start_va = 0x3290000 end_va = 0x3290fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003290000" filename = "" Region: id = 499 start_va = 0x32a0000 end_va = 0x32a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032a0000" filename = "" Region: id = 500 start_va = 0x32b0000 end_va = 0x32b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032b0000" filename = "" Region: id = 501 start_va = 0x32c0000 end_va = 0x32c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032c0000" filename = "" Region: id = 502 start_va = 0x32d0000 end_va = 0x32d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032d0000" filename = "" Region: id = 503 start_va = 0x32e0000 end_va = 0x32e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032e0000" filename = "" Region: id = 504 start_va = 0x32f0000 end_va = 0x32f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000032f0000" filename = "" Region: id = 505 start_va = 0x3300000 end_va = 0x3300fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003300000" filename = "" Region: id = 506 start_va = 0x3310000 end_va = 0x3310fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003310000" filename = "" Region: id = 507 start_va = 0x3320000 end_va = 0x3320fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003320000" filename = "" Region: id = 508 start_va = 0x3330000 end_va = 0x3330fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003330000" filename = "" Region: id = 509 start_va = 0x3340000 end_va = 0x3340fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003340000" filename = "" Region: id = 510 start_va = 0x3350000 end_va = 0x3350fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003350000" filename = "" Region: id = 511 start_va = 0x3360000 end_va = 0x3360fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003360000" filename = "" Region: id = 512 start_va = 0x3370000 end_va = 0x3370fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003370000" filename = "" Region: id = 513 start_va = 0x3380000 end_va = 0x3380fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003380000" filename = "" Region: id = 514 start_va = 0x3390000 end_va = 0x3390fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003390000" filename = "" Region: id = 515 start_va = 0x33a0000 end_va = 0x33a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033a0000" filename = "" Region: id = 516 start_va = 0x33b0000 end_va = 0x33b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033b0000" filename = "" Region: id = 517 start_va = 0x33c0000 end_va = 0x33c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033c0000" filename = "" Region: id = 518 start_va = 0x33d0000 end_va = 0x33d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033d0000" filename = "" Region: id = 519 start_va = 0x33e0000 end_va = 0x33e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033e0000" filename = "" Region: id = 520 start_va = 0x33f0000 end_va = 0x33f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000033f0000" filename = "" Region: id = 521 start_va = 0x3400000 end_va = 0x3400fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003400000" filename = "" Region: id = 522 start_va = 0x3410000 end_va = 0x3410fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003410000" filename = "" Region: id = 523 start_va = 0x3420000 end_va = 0x3420fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003420000" filename = "" Region: id = 524 start_va = 0x3430000 end_va = 0x3430fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003430000" filename = "" Region: id = 525 start_va = 0x3440000 end_va = 0x3440fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003440000" filename = "" Region: id = 526 start_va = 0x3450000 end_va = 0x3450fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003450000" filename = "" Region: id = 527 start_va = 0x3460000 end_va = 0x3460fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003460000" filename = "" Region: id = 528 start_va = 0x3470000 end_va = 0x3470fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003470000" filename = "" Region: id = 529 start_va = 0x3480000 end_va = 0x3480fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 530 start_va = 0x3490000 end_va = 0x3490fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003490000" filename = "" Region: id = 531 start_va = 0x34a0000 end_va = 0x34a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034a0000" filename = "" Region: id = 532 start_va = 0x34b0000 end_va = 0x34b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034b0000" filename = "" Region: id = 533 start_va = 0x34c0000 end_va = 0x34c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034c0000" filename = "" Region: id = 534 start_va = 0x34d0000 end_va = 0x34d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034d0000" filename = "" Region: id = 535 start_va = 0x34e0000 end_va = 0x34e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034e0000" filename = "" Region: id = 536 start_va = 0x34f0000 end_va = 0x34f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000034f0000" filename = "" Region: id = 537 start_va = 0x3500000 end_va = 0x3500fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003500000" filename = "" Region: id = 538 start_va = 0x3510000 end_va = 0x3510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003510000" filename = "" Region: id = 539 start_va = 0x3520000 end_va = 0x3520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003520000" filename = "" Region: id = 540 start_va = 0x3530000 end_va = 0x3530fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003530000" filename = "" Region: id = 541 start_va = 0x3540000 end_va = 0x3540fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003540000" filename = "" Region: id = 542 start_va = 0x3550000 end_va = 0x3550fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003550000" filename = "" Region: id = 543 start_va = 0x3560000 end_va = 0x3560fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003560000" filename = "" Region: id = 544 start_va = 0x3570000 end_va = 0x3570fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003570000" filename = "" Region: id = 545 start_va = 0x3580000 end_va = 0x3580fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003580000" filename = "" Region: id = 546 start_va = 0x3590000 end_va = 0x3590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003590000" filename = "" Region: id = 547 start_va = 0x35a0000 end_va = 0x35a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 548 start_va = 0x35b0000 end_va = 0x35b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035b0000" filename = "" Region: id = 549 start_va = 0x35c0000 end_va = 0x35c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035c0000" filename = "" Region: id = 550 start_va = 0x35d0000 end_va = 0x35d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035d0000" filename = "" Region: id = 551 start_va = 0x35e0000 end_va = 0x35e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035e0000" filename = "" Region: id = 552 start_va = 0x35f0000 end_va = 0x35f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035f0000" filename = "" Region: id = 553 start_va = 0x3600000 end_va = 0x3600fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003600000" filename = "" Region: id = 554 start_va = 0x3610000 end_va = 0x3610fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003610000" filename = "" Region: id = 555 start_va = 0x3620000 end_va = 0x3620fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003620000" filename = "" Region: id = 556 start_va = 0x3630000 end_va = 0x3630fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003630000" filename = "" Region: id = 557 start_va = 0x3640000 end_va = 0x3640fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003640000" filename = "" Region: id = 558 start_va = 0x3650000 end_va = 0x3650fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003650000" filename = "" Region: id = 559 start_va = 0x3660000 end_va = 0x3660fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003660000" filename = "" Region: id = 560 start_va = 0x3670000 end_va = 0x3670fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003670000" filename = "" Region: id = 561 start_va = 0x3680000 end_va = 0x3680fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003680000" filename = "" Region: id = 562 start_va = 0x3690000 end_va = 0x3690fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003690000" filename = "" Region: id = 563 start_va = 0x36a0000 end_va = 0x36a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036a0000" filename = "" Region: id = 564 start_va = 0x36b0000 end_va = 0x36b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036b0000" filename = "" Region: id = 565 start_va = 0x36c0000 end_va = 0x36c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036c0000" filename = "" Region: id = 566 start_va = 0x36d0000 end_va = 0x36d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036d0000" filename = "" Region: id = 567 start_va = 0x36e0000 end_va = 0x36e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036e0000" filename = "" Region: id = 568 start_va = 0x36f0000 end_va = 0x36f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000036f0000" filename = "" Region: id = 569 start_va = 0x3700000 end_va = 0x3700fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 570 start_va = 0x3710000 end_va = 0x3710fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003710000" filename = "" Region: id = 571 start_va = 0x3720000 end_va = 0x3720fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003720000" filename = "" Region: id = 572 start_va = 0x3730000 end_va = 0x3730fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003730000" filename = "" Region: id = 573 start_va = 0x3740000 end_va = 0x3740fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003740000" filename = "" Region: id = 574 start_va = 0x3750000 end_va = 0x3750fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003750000" filename = "" Region: id = 575 start_va = 0x3760000 end_va = 0x3760fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003760000" filename = "" Region: id = 576 start_va = 0x3770000 end_va = 0x3770fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003770000" filename = "" Region: id = 577 start_va = 0x3780000 end_va = 0x3780fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 578 start_va = 0x3790000 end_va = 0x3790fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003790000" filename = "" Region: id = 579 start_va = 0x37a0000 end_va = 0x37a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037a0000" filename = "" Region: id = 580 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 581 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 582 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 583 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 584 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 585 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 586 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 587 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 588 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 589 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 590 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 591 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 592 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 593 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 594 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 595 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 596 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 597 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 598 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 599 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 600 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 601 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 602 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 603 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 604 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 605 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 606 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 607 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 608 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 609 start_va = 0x37b0000 end_va = 0x37b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037b0000" filename = "" Region: id = 610 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 611 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 612 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 613 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 614 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 615 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 616 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 617 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 618 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 619 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 620 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 621 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 622 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 623 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 624 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 625 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 626 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 627 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 628 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 629 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 630 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 631 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 632 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 633 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 634 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 635 start_va = 0x37d0000 end_va = 0x37d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037d0000" filename = "" Region: id = 636 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 637 start_va = 0x37c0000 end_va = 0x3bbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 638 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 639 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 640 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 641 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 642 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 643 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 644 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 645 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 646 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 647 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 648 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 649 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 650 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 651 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 652 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 653 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 654 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 655 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 656 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 657 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 658 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 659 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 660 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 661 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 662 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 663 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 664 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 665 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 666 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 667 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 668 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 669 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 670 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 671 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 672 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 673 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 674 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 675 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 676 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 677 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 678 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 679 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 680 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 681 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 682 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 683 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 684 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 685 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 686 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 687 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 688 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 689 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 690 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 691 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 692 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 693 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 694 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 695 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 696 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 697 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 698 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 699 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 700 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 701 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 702 start_va = 0x37c0000 end_va = 0x37c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 703 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 704 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 705 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 706 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 707 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 708 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 709 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 710 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 711 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 712 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 713 start_va = 0x2930000 end_va = 0x2930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 714 start_va = 0x2930000 end_va = 0x2930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 715 start_va = 0x2930000 end_va = 0x2930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 716 start_va = 0x2930000 end_va = 0x2930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 717 start_va = 0x2930000 end_va = 0x2930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 718 start_va = 0x2930000 end_va = 0x2930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 719 start_va = 0x2930000 end_va = 0x2930fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002930000" filename = "" Region: id = 720 start_va = 0x2870000 end_va = 0x2870fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 721 start_va = 0x37c0000 end_va = 0x38effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 722 start_va = 0x2870000 end_va = 0x287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002870000" filename = "" Region: id = 723 start_va = 0x37c0000 end_va = 0x38bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 724 start_va = 0x38e0000 end_va = 0x38effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038e0000" filename = "" Region: id = 725 start_va = 0x38c0000 end_va = 0x38dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000038c0000" filename = "" Region: id = 726 start_va = 0x2870000 end_va = 0x2875fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002870000" filename = "" Region: id = 727 start_va = 0x2870000 end_va = 0x2875fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002870000" filename = "" Region: id = 728 start_va = 0x2870000 end_va = 0x2875fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002870000" filename = "" Region: id = 732 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 733 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 734 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 735 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 736 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 737 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 738 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 739 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 740 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 741 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 742 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 743 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 744 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 745 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 746 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 747 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 748 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 749 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 750 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 751 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 752 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 753 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 754 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 755 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 756 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 757 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 758 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 759 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 760 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 761 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 762 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 763 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 764 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 765 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 766 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 767 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 768 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 769 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 770 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 771 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 772 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 773 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 774 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 775 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 776 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 777 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 778 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 779 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 780 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 781 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 782 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 783 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 784 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 785 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 786 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 787 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 788 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 789 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 790 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 791 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 792 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 793 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 794 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 795 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 796 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 797 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 798 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 799 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 800 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 801 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 802 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 803 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 804 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 805 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 806 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 807 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 808 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 809 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 810 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 811 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 812 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 813 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 814 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 815 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 816 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 817 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 818 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 819 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 820 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 821 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 822 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 823 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 824 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 825 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 826 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 827 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 828 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 829 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 830 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 831 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 832 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 833 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 834 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 835 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 836 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 837 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 838 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 839 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 840 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 841 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 842 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 843 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 844 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 845 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 846 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 847 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 848 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 849 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 850 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 851 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 852 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 853 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 854 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 855 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 856 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 857 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 858 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 859 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 860 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 861 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 862 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 863 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 864 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 865 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 866 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 867 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 868 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 869 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 870 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 871 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 872 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 873 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 874 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 875 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 876 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 877 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 878 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 879 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 880 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 881 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 882 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 883 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 884 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 885 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 886 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 887 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 888 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 889 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 890 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 891 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 892 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 893 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 894 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 895 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 896 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 897 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 898 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 899 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 900 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 901 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 902 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 903 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 904 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 905 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 906 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 907 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 908 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 909 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 910 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 911 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 912 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 913 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 914 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 915 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 916 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 917 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 918 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 919 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 920 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 921 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 922 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 923 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 924 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 925 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 926 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 927 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 928 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 929 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 930 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 931 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 932 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 933 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 934 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 935 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 936 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 937 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 938 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 939 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 940 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 941 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 942 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 943 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 944 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 945 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 946 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 947 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 948 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 949 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 950 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 951 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 952 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 953 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 954 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 955 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 956 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 957 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 958 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 959 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 960 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 961 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 962 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 963 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 964 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 965 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 966 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 967 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 968 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 969 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 970 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 971 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 972 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 973 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 974 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 975 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 976 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 977 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 978 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 979 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 980 start_va = 0xaf0000 end_va = 0xaf5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000af0000" filename = "" Region: id = 981 start_va = 0xaf0000 end_va = 0xaf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 982 start_va = 0xb00000 end_va = 0xb00fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 983 start_va = 0xb10000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 984 start_va = 0xb20000 end_va = 0xb23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 985 start_va = 0xb30000 end_va = 0xb30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 986 start_va = 0xb40000 end_va = 0xb40fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 987 start_va = 0xb50000 end_va = 0xb50fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b50000" filename = "" Region: id = 988 start_va = 0xb60000 end_va = 0xb6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b60000" filename = "" Region: id = 989 start_va = 0xe30000 end_va = 0xe4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 990 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 991 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 992 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 993 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 994 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 995 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 996 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 997 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 998 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 999 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1000 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1001 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1002 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1003 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1004 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1005 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1006 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1007 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1008 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1009 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1010 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1011 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1012 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1013 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1014 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1015 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1016 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1017 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1018 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1019 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1020 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1021 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1022 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1023 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1024 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1025 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1026 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1027 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1028 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1029 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1030 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1031 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1032 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1033 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1034 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1035 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1036 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1037 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1038 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1039 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1040 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1041 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1042 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1043 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1044 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1045 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1046 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1047 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1048 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1049 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1050 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1051 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1052 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1053 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1054 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1055 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1056 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1057 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1058 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1059 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1060 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1061 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1062 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1063 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1064 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1065 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1066 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1067 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1068 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1069 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1070 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1071 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1072 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1073 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1074 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1075 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1076 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1077 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1078 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1079 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1080 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1081 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1082 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1083 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1084 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1085 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1086 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1087 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1088 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1089 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1090 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1091 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1092 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1093 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1094 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1095 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1096 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1097 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1098 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1099 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1100 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1101 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1102 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1103 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1104 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1105 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1106 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1107 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1108 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1109 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1110 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1111 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1112 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1113 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1114 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1115 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1116 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1117 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1118 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1119 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1120 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1121 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1122 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1123 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1124 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1125 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1126 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1127 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1128 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1129 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1130 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1131 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1132 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1133 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1134 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1135 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1136 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1137 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1138 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1139 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1140 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1141 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1142 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1143 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1144 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1145 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1146 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1147 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1148 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1149 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1150 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1151 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1152 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1153 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1154 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1155 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1156 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1157 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1158 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1159 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1160 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1161 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1162 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1163 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1164 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1165 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1166 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1167 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1168 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1169 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1170 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1171 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1172 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1173 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1174 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1175 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1176 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1177 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1178 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1179 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1180 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1181 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1182 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1183 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1184 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1185 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1186 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1187 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1188 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1189 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1190 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1191 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1192 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1193 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1194 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1195 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1196 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1197 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1198 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1199 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1200 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1201 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1202 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1203 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1204 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1205 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1206 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1207 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1208 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1209 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1210 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1211 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1212 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1213 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1214 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1215 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1216 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1217 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1218 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1219 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1220 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1221 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1222 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1223 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1224 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1225 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1226 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1227 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1228 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1229 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1230 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1231 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1232 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1233 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1234 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1235 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1236 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1237 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1238 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1239 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1240 start_va = 0xb60000 end_va = 0xb65fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b60000" filename = "" Region: id = 1241 start_va = 0xe30000 end_va = 0xf2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e30000" filename = "" Region: id = 1258 start_va = 0xf30000 end_va = 0xf4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f30000" filename = "" Region: id = 1273 start_va = 0x77320000 end_va = 0x7732bfff monitored = 0 entry_point = 0x77323930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Thread: id = 1 os_tid = 0x39c [0086.229] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x1000, flProtect=0x40) returned 0xc60000 [0087.141] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x1000, flProtect=0x40) returned 0xcc0000 [0087.147] VirtualFree (lpAddress=0xc60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.171] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74f30000 [0087.171] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualAlloc") returned 0x74f47810 [0087.171] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualFree") returned 0x74f47600 [0087.171] VirtualAlloc (lpAddress=0x0, dwSize=0x546, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000 [0087.171] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.172] VirtualAlloc (lpAddress=0x0, dwSize=0x44400, flAllocationType=0x1000, flProtect=0x4) returned 0xc60000 [0087.194] VirtualFree (lpAddress=0xc60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.199] VirtualAlloc (lpAddress=0x0, dwSize=0x1600, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000 [0087.200] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.201] VirtualAlloc (lpAddress=0x0, dwSize=0x1400, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000 [0087.201] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.202] VirtualAlloc (lpAddress=0x0, dwSize=0x3400, flAllocationType=0x1000, flProtect=0x4) returned 0x1e0000 [0087.203] VirtualFree (lpAddress=0x1e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.203] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74f30000 [0087.203] GetProcAddress (hModule=0x74f30000, lpProcName="GetCurrentThreadId") returned 0x74f41b90 [0087.203] GetProcAddress (hModule=0x74f30000, lpProcName="DeleteCriticalSection") returned 0x77be0e60 [0087.204] GetProcAddress (hModule=0x74f30000, lpProcName="LeaveCriticalSection") returned 0x77bcf210 [0087.204] GetProcAddress (hModule=0x74f30000, lpProcName="EnterCriticalSection") returned 0x77bcf290 [0087.204] GetProcAddress (hModule=0x74f30000, lpProcName="InitializeCriticalSection") returned 0x77bea200 [0087.204] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualFree") returned 0x74f47600 [0087.204] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualAlloc") returned 0x74f47810 [0087.204] GetProcAddress (hModule=0x74f30000, lpProcName="LocalFree") returned 0x74f479a0 [0087.204] GetProcAddress (hModule=0x74f30000, lpProcName="LocalAlloc") returned 0x74f47a30 [0087.205] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualQuery") returned 0x74f47a90 [0087.205] GetProcAddress (hModule=0x74f30000, lpProcName="WideCharToMultiByte") returned 0x74f43880 [0087.205] GetProcAddress (hModule=0x74f30000, lpProcName="MultiByteToWideChar") returned 0x74f42ad0 [0087.205] GetProcAddress (hModule=0x74f30000, lpProcName="lstrlenA") returned 0x74f48c80 [0087.205] GetProcAddress (hModule=0x74f30000, lpProcName="lstrcpynA") returned 0x74f4fe40 [0087.205] GetProcAddress (hModule=0x74f30000, lpProcName="lstrcpyA") returned 0x74f4ea30 [0087.205] GetProcAddress (hModule=0x74f30000, lpProcName="LoadLibraryExA") returned 0x74f4a270 [0087.205] GetProcAddress (hModule=0x74f30000, lpProcName="GetThreadLocale") returned 0x74f4af90 [0087.205] GetProcAddress (hModule=0x74f30000, lpProcName="GetStartupInfoA") returned 0x74f49c10 [0087.205] GetProcAddress (hModule=0x74f30000, lpProcName="GetProcAddress") returned 0x74f478b0 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="GetModuleHandleA") returned 0x74f499f0 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="GetModuleFileNameA") returned 0x74f4a720 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="GetLocaleInfoA") returned 0x74f4e7b0 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="GetLastError") returned 0x74f43870 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="GetCommandLineA") returned 0x74f4ab60 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="FreeLibrary") returned 0x74f49f50 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="FindFirstFileA") returned 0x74f56920 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="FindClose") returned 0x74f568e0 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="ExitProcess") returned 0x74f57b30 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="WriteFile") returned 0x74f56ca0 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="UnhandledExceptionFilter") returned 0x74f72670 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="SetFilePointer") returned 0x74f56c40 [0087.206] GetProcAddress (hModule=0x74f30000, lpProcName="SetEndOfFile") returned 0x74f56c00 [0087.207] GetProcAddress (hModule=0x74f30000, lpProcName="RtlUnwind") returned 0x74f48c10 [0087.207] GetProcAddress (hModule=0x74f30000, lpProcName="ReadFile") returned 0x74f56bb0 [0087.207] GetProcAddress (hModule=0x74f30000, lpProcName="RaiseException") returned 0x74f48c20 [0087.207] GetProcAddress (hModule=0x74f30000, lpProcName="GetStdHandle") returned 0x74f4a6e0 [0087.207] GetProcAddress (hModule=0x74f30000, lpProcName="GetFileSize") returned 0x74f56a70 [0087.207] GetProcAddress (hModule=0x74f30000, lpProcName="GetSystemTime") returned 0x74f54940 [0087.208] GetProcAddress (hModule=0x74f30000, lpProcName="GetFileType") returned 0x74f56aa0 [0087.208] GetProcAddress (hModule=0x74f30000, lpProcName="CreateFileA") returned 0x74f56880 [0087.208] GetProcAddress (hModule=0x74f30000, lpProcName="CloseHandle") returned 0x74f56630 [0087.208] GetModuleHandleA (lpModuleName="user32.dll") returned 0x750d0000 [0087.208] GetProcAddress (hModule=0x750d0000, lpProcName="GetKeyboardType") returned 0x7512cd00 [0087.208] GetProcAddress (hModule=0x750d0000, lpProcName="LoadStringA") returned 0x750ffd20 [0087.208] GetProcAddress (hModule=0x750d0000, lpProcName="MessageBoxA") returned 0x7514fec0 [0087.208] GetProcAddress (hModule=0x750d0000, lpProcName="CharNextA") returned 0x750fe240 [0087.208] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x0 [0087.209] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77b10000 [0088.549] GetProcAddress (hModule=0x77b10000, lpProcName="RegQueryValueExA") returned 0x77b2f500 [0088.550] GetProcAddress (hModule=0x77b10000, lpProcName="RegOpenKeyExA") returned 0x77b2f790 [0088.550] GetProcAddress (hModule=0x77b10000, lpProcName="RegCloseKey") returned 0x77b2f620 [0088.550] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x74d80000 [0088.551] GetProcAddress (hModule=0x74d80000, lpProcName="VariantChangeTypeEx") returned 0x74d97260 [0088.551] GetProcAddress (hModule=0x74d80000, lpProcName="VariantCopyInd") returned 0x74d97070 [0088.551] GetProcAddress (hModule=0x74d80000, lpProcName="VariantClear") returned 0x74d99570 [0088.551] GetProcAddress (hModule=0x74d80000, lpProcName="SysStringLen") returned 0x74d92640 [0088.551] GetProcAddress (hModule=0x74d80000, lpProcName="SysFreeString") returned 0x74d99d40 [0088.551] GetProcAddress (hModule=0x74d80000, lpProcName="SysReAllocStringLen") returned 0x74d949e0 [0088.551] GetProcAddress (hModule=0x74d80000, lpProcName="SysAllocStringLen") returned 0x74d99c00 [0088.551] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74f30000 [0088.551] GetProcAddress (hModule=0x74f30000, lpProcName="TlsSetValue") returned 0x74f429d0 [0088.551] GetProcAddress (hModule=0x74f30000, lpProcName="TlsGetValue") returned 0x74f41b70 [0088.552] GetProcAddress (hModule=0x74f30000, lpProcName="TlsFree") returned 0x74f4a040 [0088.552] GetProcAddress (hModule=0x74f30000, lpProcName="TlsAlloc") returned 0x74f4a120 [0088.552] GetProcAddress (hModule=0x74f30000, lpProcName="LocalFree") returned 0x74f479a0 [0088.552] GetProcAddress (hModule=0x74f30000, lpProcName="LocalAlloc") returned 0x74f47a30 [0088.552] GetProcAddress (hModule=0x74f30000, lpProcName="GetModuleFileNameA") returned 0x74f4a720 [0088.552] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x77b10000 [0088.552] GetProcAddress (hModule=0x77b10000, lpProcName="RegSetValueExA") returned 0x77b30a20 [0088.552] GetProcAddress (hModule=0x77b10000, lpProcName="RegSetValueA") returned 0x77b5a5e0 [0088.552] GetProcAddress (hModule=0x77b10000, lpProcName="RegQueryValueExA") returned 0x77b2f500 [0088.552] GetProcAddress (hModule=0x77b10000, lpProcName="RegQueryInfoKeyA") returned 0x77b306b0 [0088.553] GetProcAddress (hModule=0x77b10000, lpProcName="RegOpenKeyExA") returned 0x77b2f790 [0088.553] GetProcAddress (hModule=0x77b10000, lpProcName="RegEnumKeyExA") returned 0x77b31810 [0088.553] GetProcAddress (hModule=0x77b10000, lpProcName="RegCreateKeyExA") returned 0x77b2fa60 [0088.553] GetProcAddress (hModule=0x77b10000, lpProcName="RegCloseKey") returned 0x77b2f620 [0088.553] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74f30000 [0088.553] GetProcAddress (hModule=0x74f30000, lpProcName="WritePrivateProfileStringA") returned 0x74f50560 [0088.553] GetProcAddress (hModule=0x74f30000, lpProcName="WriteFile") returned 0x74f56ca0 [0088.553] GetProcAddress (hModule=0x74f30000, lpProcName="WaitForSingleObject") returned 0x74f56820 [0088.553] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualUnlock") returned 0x74f4e060 [0088.553] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualQuery") returned 0x74f47a90 [0088.554] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualLock") returned 0x74f72770 [0088.554] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualFree") returned 0x74f47600 [0088.554] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualAlloc") returned 0x74f47810 [0088.554] GetProcAddress (hModule=0x74f30000, lpProcName="Sleep") returned 0x74f47990 [0088.554] GetProcAddress (hModule=0x74f30000, lpProcName="SetThreadPriority") returned 0x74f49990 [0088.554] GetProcAddress (hModule=0x74f30000, lpProcName="SetFilePointer") returned 0x74f56c40 [0088.554] GetProcAddress (hModule=0x74f30000, lpProcName="SetFileAttributesA") returned 0x74f56c10 [0088.554] GetProcAddress (hModule=0x74f30000, lpProcName="SetEndOfFile") returned 0x74f56c00 [0088.554] GetProcAddress (hModule=0x74f30000, lpProcName="RemoveDirectoryA") returned 0x74f56be0 [0088.554] GetProcAddress (hModule=0x74f30000, lpProcName="ReadFile") returned 0x74f56bb0 [0088.554] GetProcAddress (hModule=0x74f30000, lpProcName="QueryPerformanceFrequency") returned 0x74f48cc0 [0088.555] GetProcAddress (hModule=0x74f30000, lpProcName="QueryPerformanceCounter") returned 0x74f438a0 [0088.555] GetProcAddress (hModule=0x74f30000, lpProcName="LoadLibraryA") returned 0x74f54bf0 [0088.555] GetProcAddress (hModule=0x74f30000, lpProcName="LeaveCriticalSection") returned 0x77bcf210 [0088.555] GetProcAddress (hModule=0x74f30000, lpProcName="IsBadReadPtr") returned 0x74f42510 [0088.555] GetProcAddress (hModule=0x74f30000, lpProcName="InitializeCriticalSection") returned 0x77bea200 [0088.555] GetProcAddress (hModule=0x74f30000, lpProcName="GlobalUnlock") returned 0x74f429f0 [0088.555] GetProcAddress (hModule=0x74f30000, lpProcName="GlobalHandle") returned 0x74f4e6e0 [0088.556] GetProcAddress (hModule=0x74f30000, lpProcName="GlobalLock") returned 0x74f423f0 [0088.556] GetProcAddress (hModule=0x74f30000, lpProcName="GlobalFree") returned 0x74f4ccf0 [0088.556] GetProcAddress (hModule=0x74f30000, lpProcName="GlobalAlloc") returned 0x74f49950 [0088.556] GetProcAddress (hModule=0x74f30000, lpProcName="GetWindowsDirectoryA") returned 0x74f4b060 [0088.556] GetProcAddress (hModule=0x74f30000, lpProcName="GetVolumeInformationA") returned 0x74f56b40 [0088.556] GetProcAddress (hModule=0x74f30000, lpProcName="GetVersionExA") returned 0x74f4a700 [0088.556] GetProcAddress (hModule=0x74f30000, lpProcName="GetVersion") returned 0x74f4aaf0 [0088.556] GetProcAddress (hModule=0x74f30000, lpProcName="GetThreadPriority") returned 0x74f49e50 [0088.556] GetProcAddress (hModule=0x74f30000, lpProcName="GetThreadLocale") returned 0x74f4af90 [0088.556] GetProcAddress (hModule=0x74f30000, lpProcName="GetTempPathA") returned 0x74f56b20 [0088.557] GetProcAddress (hModule=0x74f30000, lpProcName="GetTempFileNameA") returned 0x74f56b00 [0088.557] GetProcAddress (hModule=0x74f30000, lpProcName="GetSystemInfo") returned 0x74f4a0f0 [0088.557] GetProcAddress (hModule=0x74f30000, lpProcName="GetProcAddress") returned 0x74f478b0 [0088.557] GetProcAddress (hModule=0x74f30000, lpProcName="GetPrivateProfileStringA") returned 0x74f50ed0 [0088.557] GetProcAddress (hModule=0x74f30000, lpProcName="GetModuleHandleA") returned 0x74f499f0 [0088.557] GetProcAddress (hModule=0x74f30000, lpProcName="GetModuleFileNameA") returned 0x74f4a720 [0088.557] GetProcAddress (hModule=0x74f30000, lpProcName="GetLocaleInfoA") returned 0x74f4e7b0 [0088.557] GetProcAddress (hModule=0x74f30000, lpProcName="GetLocalTime") returned 0x74f49be0 [0088.558] GetProcAddress (hModule=0x74f30000, lpProcName="GetLastError") returned 0x74f43870 [0088.558] GetProcAddress (hModule=0x74f30000, lpProcName="GetFileSize") returned 0x74f56a70 [0088.558] GetProcAddress (hModule=0x74f30000, lpProcName="GetFileAttributesA") returned 0x74f56a20 [0088.558] GetProcAddress (hModule=0x74f30000, lpProcName="GetExitCodeProcess") returned 0x74f4fdb0 [0088.558] GetProcAddress (hModule=0x74f30000, lpProcName="GetDriveTypeA") returned 0x74f56a00 [0088.558] GetProcAddress (hModule=0x74f30000, lpProcName="GetDiskFreeSpaceA") returned 0x74f569c0 [0088.558] GetProcAddress (hModule=0x74f30000, lpProcName="GetDateFormatA") returned 0x74f70de0 [0088.559] GetProcAddress (hModule=0x74f30000, lpProcName="GetCurrentThreadId") returned 0x74f41b90 [0088.559] GetProcAddress (hModule=0x74f30000, lpProcName="GetCurrentThread") returned 0x74f475f0 [0088.559] GetProcAddress (hModule=0x74f30000, lpProcName="GetCurrentProcess") returned 0x74f438c0 [0088.559] GetProcAddress (hModule=0x74f30000, lpProcName="GetCurrentDirectoryA") returned 0x74f70dc0 [0088.559] GetProcAddress (hModule=0x74f30000, lpProcName="GetCPInfo") returned 0x74f4a290 [0088.559] GetProcAddress (hModule=0x74f30000, lpProcName="FreeLibrary") returned 0x74f49f50 [0088.559] GetProcAddress (hModule=0x74f30000, lpProcName="FormatMessageA") returned 0x74f4f830 [0088.559] GetProcAddress (hModule=0x74f30000, lpProcName="FindNextFileA") returned 0x74f56980 [0088.560] GetProcAddress (hModule=0x74f30000, lpProcName="FindFirstFileA") returned 0x74f56920 [0088.560] GetProcAddress (hModule=0x74f30000, lpProcName="FindClose") returned 0x74f568e0 [0088.560] GetProcAddress (hModule=0x74f30000, lpProcName="FileTimeToLocalFileTime") returned 0x74f568d0 [0088.560] GetProcAddress (hModule=0x74f30000, lpProcName="FileTimeToDosDateTime") returned 0x74f52930 [0088.560] GetProcAddress (hModule=0x74f30000, lpProcName="ExpandEnvironmentStringsA") returned 0x74f55dd0 [0088.561] GetProcAddress (hModule=0x74f30000, lpProcName="ExitProcess") returned 0x74f57b30 [0088.561] GetProcAddress (hModule=0x74f30000, lpProcName="EnumCalendarInfoA") returned 0x74f4fdf0 [0088.561] GetProcAddress (hModule=0x74f30000, lpProcName="EnterCriticalSection") returned 0x77bcf290 [0088.561] GetProcAddress (hModule=0x74f30000, lpProcName="DeviceIoControl") returned 0x74f478d0 [0088.561] GetProcAddress (hModule=0x74f30000, lpProcName="DeleteFileA") returned 0x74f568b0 [0088.561] GetProcAddress (hModule=0x74f30000, lpProcName="DeleteCriticalSection") returned 0x77be0e60 [0088.561] GetProcAddress (hModule=0x74f30000, lpProcName="CreateProcessA") returned 0x74f70750 [0088.561] GetProcAddress (hModule=0x74f30000, lpProcName="CreateFileA") returned 0x74f56880 [0088.562] GetProcAddress (hModule=0x74f30000, lpProcName="CreateEventA") returned 0x74f56680 [0088.562] GetProcAddress (hModule=0x74f30000, lpProcName="CreateDirectoryA") returned 0x74f56850 [0088.562] GetProcAddress (hModule=0x74f30000, lpProcName="CopyFileA") returned 0x74f4f780 [0088.562] GetProcAddress (hModule=0x74f30000, lpProcName="CompareStringA") returned 0x74f4e1c0 [0088.562] GetProcAddress (hModule=0x74f30000, lpProcName="CloseHandle") returned 0x74f56630 [0088.562] GetModuleHandleA (lpModuleName="version.dll") returned 0x0 [0088.562] LoadLibraryA (lpLibFileName="version.dll") returned 0x6ce10000 [0088.723] GetProcAddress (hModule=0x6ce10000, lpProcName="VerQueryValueA") returned 0x6ce114d0 [0088.723] GetProcAddress (hModule=0x6ce10000, lpProcName="GetFileVersionInfoSizeA") returned 0x6ce114b0 [0088.723] GetProcAddress (hModule=0x6ce10000, lpProcName="GetFileVersionInfoA") returned 0x6ce11490 [0088.723] GetModuleHandleA (lpModuleName="gdi32.dll") returned 0x77440000 [0088.723] GetProcAddress (hModule=0x77440000, lpProcName="SetBkMode") returned 0x774c20d0 [0088.723] GetProcAddress (hModule=0x77440000, lpProcName="GetStockObject") returned 0x774c2550 [0088.723] GetProcAddress (hModule=0x77440000, lpProcName="CreateFontA") returned 0x774f4d20 [0088.723] GetProcAddress (hModule=0x77440000, lpProcName="CreateDIBitmap") returned 0x774c19d0 [0088.724] GetModuleHandleA (lpModuleName="user32.dll") returned 0x750d0000 [0088.724] GetProcAddress (hModule=0x750d0000, lpProcName="TranslateMessage") returned 0x750ed9b0 [0088.724] GetProcAddress (hModule=0x750d0000, lpProcName="ShowWindow") returned 0x75108e60 [0088.724] GetProcAddress (hModule=0x750d0000, lpProcName="SetWindowTextA") returned 0x750fc9f0 [0088.724] GetProcAddress (hModule=0x750d0000, lpProcName="SetWindowPos") returned 0x75108b30 [0088.724] GetProcAddress (hModule=0x750d0000, lpProcName="SetFocus") returned 0x75108e00 [0088.724] GetProcAddress (hModule=0x750d0000, lpProcName="SetDlgItemTextA") returned 0x750fcff0 [0088.724] GetProcAddress (hModule=0x750d0000, lpProcName="SetClipboardData") returned 0x75102d80 [0088.724] GetProcAddress (hModule=0x750d0000, lpProcName="SendMessageA") returned 0x750fa220 [0088.724] GetProcAddress (hModule=0x750d0000, lpProcName="SendDlgItemMessageA") returned 0x750fa1e0 [0088.725] GetProcAddress (hModule=0x750d0000, lpProcName="RegisterClassA") returned 0x751063d0 [0088.725] GetProcAddress (hModule=0x750d0000, lpProcName="PostQuitMessage") returned 0x751072f0 [0088.725] GetProcAddress (hModule=0x750d0000, lpProcName="PeekMessageA") returned 0x750eca40 [0088.725] GetProcAddress (hModule=0x750d0000, lpProcName="OpenClipboard") returned 0x75103920 [0088.725] GetProcAddress (hModule=0x750d0000, lpProcName="MsgWaitForMultipleObjects") returned 0x750ec2c0 [0088.726] GetProcAddress (hModule=0x750d0000, lpProcName="MessageBoxA") returned 0x7514fec0 [0088.726] GetProcAddress (hModule=0x750d0000, lpProcName="LoadStringA") returned 0x750ffd20 [0088.726] GetProcAddress (hModule=0x750d0000, lpProcName="LoadIconA") returned 0x75103dd0 [0088.726] GetProcAddress (hModule=0x750d0000, lpProcName="LoadCursorA") returned 0x75106ea0 [0088.726] GetProcAddress (hModule=0x750d0000, lpProcName="IsClipboardFormatAvailable") returned 0x75108be0 [0088.726] GetProcAddress (hModule=0x750d0000, lpProcName="GetWindowTextA") returned 0x750fcaa0 [0088.726] GetProcAddress (hModule=0x750d0000, lpProcName="GetWindowRect") returned 0x750e4140 [0088.726] GetProcAddress (hModule=0x750d0000, lpProcName="GetSystemMetrics") returned 0x750e9160 [0088.726] GetProcAddress (hModule=0x750d0000, lpProcName="GetMessageA") returned 0x750fe130 [0088.726] GetProcAddress (hModule=0x750d0000, lpProcName="GetFocus") returned 0x750eedb0 [0088.727] GetProcAddress (hModule=0x750d0000, lpProcName="GetDlgItemTextA") returned 0x751590f0 [0088.727] GetProcAddress (hModule=0x750d0000, lpProcName="GetDlgItem") returned 0x750fcc40 [0088.727] GetProcAddress (hModule=0x750d0000, lpProcName="GetDesktopWindow") returned 0x750e3470 [0088.727] GetProcAddress (hModule=0x750d0000, lpProcName="GetDC") returned 0x75108990 [0088.727] GetProcAddress (hModule=0x750d0000, lpProcName="GetAsyncKeyState") returned 0x750ee820 [0088.727] GetProcAddress (hModule=0x750d0000, lpProcName="GetActiveWindow") returned 0x75102840 [0088.727] GetProcAddress (hModule=0x750d0000, lpProcName="EndDialog") returned 0x750f9e60 [0088.727] GetProcAddress (hModule=0x750d0000, lpProcName="EnableWindow") returned 0x751029d0 [0088.728] GetProcAddress (hModule=0x750d0000, lpProcName="EmptyClipboard") returned 0x75109860 [0088.728] GetProcAddress (hModule=0x750d0000, lpProcName="DispatchMessageA") returned 0x75106f10 [0088.728] GetProcAddress (hModule=0x750d0000, lpProcName="DialogBoxIndirectParamA") returned 0x751305d0 [0088.728] GetProcAddress (hModule=0x750d0000, lpProcName="DestroyWindow") returned 0x751092b0 [0088.728] GetProcAddress (hModule=0x750d0000, lpProcName="DefWindowProcA") returned 0x77c1aed0 [0088.728] GetProcAddress (hModule=0x750d0000, lpProcName="CreateWindowExA") returned 0x75106f30 [0088.728] GetProcAddress (hModule=0x750d0000, lpProcName="CloseClipboard") returned 0x751095c0 [0088.728] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x0 [0088.728] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x74ad0000 [0088.734] GetProcAddress (hModule=0x74ad0000, lpProcName="CoCreateGuid") returned 0x7536e9c0 [0088.734] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74f30000 [0088.734] GetProcAddress (hModule=0x74f30000, lpProcName="GetVersionExA") returned 0x74f4a700 [0088.734] GetModuleHandleA (lpModuleName="wsock32.dll") returned 0x0 [0088.735] LoadLibraryA (lpLibFileName="wsock32.dll") returned 0x6ce00000 [0089.169] GetProcAddress (hModule=0x6ce00000, lpProcName="ioctlsocket") returned 0x773ee180 [0089.169] GetProcAddress (hModule=0x6ce00000, lpProcName="WSACancelBlockingCall") returned 0x7740f000 [0089.169] GetProcAddress (hModule=0x6ce00000, lpProcName="WSAIsBlocking") returned 0x7740f0a0 [0089.169] GetProcAddress (hModule=0x6ce00000, lpProcName="gethostbyname") returned 0x77411110 [0089.169] GetProcAddress (hModule=0x6ce00000, lpProcName="send") returned 0x773f1b90 [0089.169] GetProcAddress (hModule=0x6ce00000, lpProcName="recv") returned 0x6ce01440 [0089.169] GetProcAddress (hModule=0x6ce00000, lpProcName="connect") returned 0x773f6090 [0089.169] GetProcAddress (hModule=0x6ce00000, lpProcName="WSACleanup") returned 0x773f4c00 [0089.170] GetProcAddress (hModule=0x6ce00000, lpProcName="closesocket") returned 0x773eead0 [0089.170] GetProcAddress (hModule=0x6ce00000, lpProcName="shutdown") returned 0x773f4970 [0089.170] GetProcAddress (hModule=0x6ce00000, lpProcName="socket") returned 0x773ee6b0 [0089.170] GetProcAddress (hModule=0x6ce00000, lpProcName="WSAStartup") returned 0x773e6520 [0089.183] GetModuleFileNameA (in: hModule=0xcc0000, lpFilename=0x19fde0, nSize=0x105 | out: lpFilename="") returned 0x0 [0089.194] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x19fcbb, nSize=0x105 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe")) returned 0x62 [0089.195] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x19fdd0 | out: phkResult=0x19fdd0*=0x0) returned 0x2 [0089.195] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x19fdd0 | out: phkResult=0x19fdd0*=0x0) returned 0x2 [0089.195] lstrcpyA (in: lpString1=0x19fcbb, lpString2="" | out: lpString1="") returned="" [0089.195] GetThreadLocale () returned 0x409 [0089.195] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x19fdcb, cchData=5 | out: lpLCData="ENU") returned 4 [0089.217] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0xd3a150 [0089.229] GetKeyboardType (nTypeFlag=0) returned 4 [0089.230] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe\" " [0089.230] GetStartupInfoA (in: lpStartupInfo=0x19fe70 | out: lpStartupInfo=0x19fe70*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0089.230] GetCurrentThreadId () returned 0x39c [0089.248] LoadStringA (in: hInstance=0xcc0000, uID=0xffdc, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.248] LoadStringA (in: hInstance=0xcc0000, uID=0xffdb, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.248] LoadStringA (in: hInstance=0xcc0000, uID=0xffd9, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.248] LoadStringA (in: hInstance=0xcc0000, uID=0xffda, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.248] LoadStringA (in: hInstance=0xcc0000, uID=0xffd8, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffd7, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffd6, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffd3, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffd2, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffd1, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffea, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffeb, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffec, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffe9, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffe8, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffe6, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffe5, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffe4, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffe3, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffe2, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffe1, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffe0, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xffff, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xfffe, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xfffd, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xfffc, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xfffb, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xfffa, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.249] LoadStringA (in: hInstance=0xcc0000, uID=0xfff9, lpBuffer=0x19faa4, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.286] LoadStringA (in: hInstance=0xcc0000, uID=0xfff7, lpBuffer=0x19fa94, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.286] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0xd46a68 [0089.286] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x2750000 [0089.286] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0xd47a68 [0089.287] VirtualAlloc (lpAddress=0x2750000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000 [0089.287] LoadStringA (in: hInstance=0xcc0000, uID=0xffe7, lpBuffer=0x19fa94, cchBufferMax=1024 | out: lpBuffer="") returned 0x0 [0089.297] GetThreadLocale () returned 0x409 [0089.297] GetSystemMetrics (nIndex=74) returned 0 [0090.099] GetSystemMetrics (nIndex=42) returned 0 [0090.106] GetThreadLocale () returned 0x409 [0090.106] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Jan") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="January") returned 8 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Feb") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="February") returned 9 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Mar") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="March") returned 6 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Apr") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="April") returned 6 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="May") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="May") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Jun") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="June") returned 5 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Jul") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="July") returned 5 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Aug") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="August") returned 7 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Sep") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="September") returned 10 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Oct") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="October") returned 8 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Nov") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="November") returned 9 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Dec") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="December") returned 9 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Sun") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Sunday") returned 7 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Mon") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Monday") returned 7 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Tue") returned 4 [0090.107] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Tuesday") returned 8 [0090.108] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Wed") returned 4 [0090.108] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Wednesday") returned 10 [0090.108] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Thu") returned 4 [0090.108] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Thursday") returned 9 [0090.108] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Fri") returned 4 [0090.108] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Friday") returned 7 [0090.108] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Sat") returned 4 [0090.108] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x19fcfc, cchData=256 | out: lpLCData="Saturday") returned 9 [0090.108] GetThreadLocale () returned 0x409 [0090.108] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x19fd58, cchData=256 | out: lpLCData="$") returned 2 [0090.108] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x19fd58, cchData=256 | out: lpLCData="0") returned 2 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x19fd58, cchData=256 | out: lpLCData="0") returned 2 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x19fe50, cchData=2 | out: lpLCData=",") returned 2 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x19fe50, cchData=2 | out: lpLCData=".") returned 2 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x19fd58, cchData=256 | out: lpLCData="2") returned 2 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x19fe50, cchData=2 | out: lpLCData="/") returned 2 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x19fd58, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0090.117] GetThreadLocale () returned 0x409 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x19fd28, cchData=256 | out: lpLCData="1") returned 2 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x19fd58, cchData=256 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0090.117] GetThreadLocale () returned 0x409 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x1009, lpLCData=0x19fd28, cchData=256 | out: lpLCData="1") returned 2 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x19fe50, cchData=2 | out: lpLCData=":") returned 2 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x19fd58, cchData=256 | out: lpLCData="AM") returned 3 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x19fd58, cchData=256 | out: lpLCData="PM") returned 3 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x19fd58, cchData=256 | out: lpLCData="0") returned 2 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd58, cchData=256 | out: lpLCData="0") returned 2 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0x1005, lpLCData=0x19fd58, cchData=256 | out: lpLCData="0") returned 2 [0090.117] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x19fe50, cchData=2 | out: lpLCData=",") returned 2 [0090.117] GetVersionExA (in: lpVersionInformation=0x19fe24*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x275030c, dwMinorVersion=0x27502fc, dwBuildNumber=0x30, dwPlatformId=0xcc22c9, szCSDVersion="¼þ\x19") | out: lpVersionInformation=0x19fe24*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0090.117] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74f30000 [0090.118] GetProcAddress (hModule=0x74f30000, lpProcName="GetDiskFreeSpaceExA") returned 0x74f569d0 [0090.185] WSAStartup (in: wVersionRequired=0x101, lpWSAData=0x19fd38 | out: lpWSAData=0x19fd38) returned 0 [0090.266] GetCurrentThreadId () returned 0x39c [0090.287] VirtualAlloc (lpAddress=0x2754000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x2754000 [0090.462] GetLocalTime (in: lpSystemTime=0x19feb0 | out: lpSystemTime=0x19feb0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x27, wSecond=0x3b, wMilliseconds=0x13b)) [0090.463] GetSystemTime (in: lpSystemTime=0x19feac | out: lpSystemTime=0x19feac*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x8, wMinute=0x27, wSecond=0x3b, wMilliseconds=0x13b)) [0090.472] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x120 [0090.472] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74f30000 [0090.473] GetCurrentProcess () returned 0xffffffff [0090.473] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x19fef8, lpSystemAffinityMask=0x19fef4 | out: lpProcessAffinityMask=0x19fef8, lpSystemAffinityMask=0x19fef4) returned 1 [0090.505] VirtualAlloc (lpAddress=0x2778000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x2778000 [0090.518] VirtualFree (lpAddress=0x2798000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0090.527] GetModuleHandleA (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0090.527] GetProcAddress (hModule=0x74f30000, lpProcName="GetProcAddress") returned 0x74f478b0 [0090.527] GetProcAddress (hModule=0x74f30000, lpProcName="LoadLibraryA") returned 0x74f54bf0 [0090.528] GetProcAddress (hModule=0x74f30000, lpProcName="MapViewOfFile") returned 0x74f48d60 [0090.528] GetProcAddress (hModule=0x74f30000, lpProcName="FindResourceA") returned 0x74f4cb90 [0090.528] GetProcAddress (hModule=0x74f30000, lpProcName="IsBadReadPtr") returned 0x74f42510 [0090.528] GetProcAddress (hModule=0x74f30000, lpProcName="UnmapViewOfFile") returned 0x74f49b20 [0090.528] GetProcAddress (hModule=0x74f30000, lpProcName="CloseHandle") returned 0x74f56630 [0090.528] GetProcAddress (hModule=0x74f30000, lpProcName="CreateFileMappingA") returned 0x74f479c0 [0090.528] GetProcAddress (hModule=0x74f30000, lpProcName="CreateFileA") returned 0x74f56880 [0090.529] GetProcAddress (hModule=0x74f30000, lpProcName="IsDebuggerPresent") returned 0x74f4b0b0 [0090.529] GetProcAddress (hModule=0x74f30000, lpProcName="GetSystemTime") returned 0x74f54940 [0090.529] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualAlloc") returned 0x74f47810 [0090.529] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualFree") returned 0x74f47600 [0090.529] GetProcAddress (hModule=0x74f30000, lpProcName="GetCurrentProcessId") returned 0x74f423e0 [0090.529] LoadLibraryA (lpLibFileName="NTDLL.DLL") returned 0x77b90000 [0090.529] LoadLibraryA (lpLibFileName="ADVAPI32.DLL") returned 0x77b10000 [0090.530] GetProcAddress (hModule=0x74f30000, lpProcName="GetProcAddress") returned 0x74f478b0 [0090.530] GetProcAddress (hModule=0x74f30000, lpProcName="RaiseException") returned 0x74f48c20 [0090.530] GetProcAddress (hModule=0x74f30000, lpProcName="GetLastError") returned 0x74f43870 [0090.530] GetProcAddress (hModule=0x74f30000, lpProcName="SetLastError") returned 0x74f42af0 [0090.530] VirtualAlloc (lpAddress=0x0, dwSize=0x11, flAllocationType=0x1000, flProtect=0x40) returned 0x1f0000 [0090.531] VirtualAlloc (lpAddress=0x0, dwSize=0x21, flAllocationType=0x1000, flProtect=0x40) returned 0xb70000 [0090.531] VirtualAlloc (lpAddress=0x2798000, dwSize=0x28000, flAllocationType=0x1000, flProtect=0x4) returned 0x2798000 [0090.538] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x40) returned 0xb80000 [0090.538] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x1000, flProtect=0x40) returned 0xc60000 [0090.539] VirtualAlloc (lpAddress=0x0, dwSize=0x83, flAllocationType=0x1000, flProtect=0x40) returned 0xc70000 [0090.539] VirtualAlloc (lpAddress=0x0, dwSize=0x9e, flAllocationType=0x1000, flProtect=0x40) returned 0xc80000 [0090.539] VirtualAlloc (lpAddress=0x0, dwSize=0x437, flAllocationType=0x1000, flProtect=0x40) returned 0xc90000 [0090.540] VirtualAlloc (lpAddress=0x0, dwSize=0x1c9, flAllocationType=0x1000, flProtect=0x40) returned 0xca0000 [0090.549] VirtualAlloc (lpAddress=0x0, dwSize=0xa2, flAllocationType=0x1000, flProtect=0x40) returned 0xcb0000 [0090.549] VirtualAlloc (lpAddress=0x0, dwSize=0xae, flAllocationType=0x1000, flProtect=0x40) returned 0xd20000 [0090.549] VirtualAlloc (lpAddress=0x0, dwSize=0xac, flAllocationType=0x1000, flProtect=0x40) returned 0x2850000 [0090.550] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x40) returned 0x2860000 [0090.550] GetCurrentProcessId () returned 0xe9c [0090.550] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2870000 [0090.550] VirtualAlloc (lpAddress=0x27c0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27c0000 [0090.551] VirtualAlloc (lpAddress=0x0, dwSize=0xbf, flAllocationType=0x1000, flProtect=0x40) returned 0x2880000 [0090.551] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x40) returned 0x2890000 [0090.551] VirtualAlloc (lpAddress=0x0, dwSize=0xac, flAllocationType=0x1000, flProtect=0x40) returned 0x28a0000 [0090.551] VirtualAlloc (lpAddress=0x0, dwSize=0xac, flAllocationType=0x1000, flProtect=0x40) returned 0x28b0000 [0090.552] VirtualAlloc (lpAddress=0x0, dwSize=0x89, flAllocationType=0x1000, flProtect=0x40) returned 0x28c0000 [0090.552] VirtualAlloc (lpAddress=0x0, dwSize=0xd4, flAllocationType=0x1000, flProtect=0x40) returned 0x28d0000 [0090.552] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x1000, flProtect=0x40) returned 0x28e0000 [0090.552] VirtualAlloc (lpAddress=0x0, dwSize=0xb8, flAllocationType=0x1000, flProtect=0x40) returned 0x2900000 [0090.553] VirtualAlloc (lpAddress=0x0, dwSize=0x17c, flAllocationType=0x1000, flProtect=0x40) returned 0x2910000 [0090.553] VirtualAlloc (lpAddress=0x0, dwSize=0xa6, flAllocationType=0x1000, flProtect=0x40) returned 0x2920000 [0090.553] GetCurrentProcessId () returned 0xe9c [0090.553] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2930000 [0090.554] VirtualAlloc (lpAddress=0x0, dwSize=0x284, flAllocationType=0x1000, flProtect=0x40) returned 0x2940000 [0090.554] VirtualAlloc (lpAddress=0x0, dwSize=0x37d, flAllocationType=0x1000, flProtect=0x40) returned 0x2950000 [0090.554] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x40) returned 0x2960000 [0090.554] VirtualAlloc (lpAddress=0x0, dwSize=0x7e, flAllocationType=0x1000, flProtect=0x40) returned 0x2970000 [0090.555] VirtualAlloc (lpAddress=0x0, dwSize=0x91, flAllocationType=0x1000, flProtect=0x40) returned 0x2980000 [0090.555] VirtualAlloc (lpAddress=0x0, dwSize=0x87, flAllocationType=0x1000, flProtect=0x40) returned 0x2990000 [0090.555] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x1000, flProtect=0x40) returned 0x29a0000 [0090.556] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x40) returned 0x29b0000 [0090.557] VirtualAlloc (lpAddress=0x0, dwSize=0x9c, flAllocationType=0x1000, flProtect=0x40) returned 0x29c0000 [0090.557] VirtualAlloc (lpAddress=0x0, dwSize=0xb9, flAllocationType=0x1000, flProtect=0x40) returned 0x29d0000 [0090.558] GetCurrentProcessId () returned 0xe9c [0090.558] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x29e0000 [0090.559] VirtualAlloc (lpAddress=0x0, dwSize=0x149, flAllocationType=0x1000, flProtect=0x40) returned 0x29f0000 [0090.559] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x40) returned 0x2a00000 [0090.560] VirtualAlloc (lpAddress=0x0, dwSize=0x11d, flAllocationType=0x1000, flProtect=0x40) returned 0x2a10000 [0090.560] VirtualAlloc (lpAddress=0x0, dwSize=0x98, flAllocationType=0x1000, flProtect=0x40) returned 0x2a20000 [0090.561] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x40) returned 0x2a30000 [0090.561] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x1000, flProtect=0x40) returned 0x2a40000 [0090.561] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x40) returned 0x2a50000 [0090.562] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x40) returned 0x2a60000 [0090.562] VirtualAlloc (lpAddress=0x0, dwSize=0x3b1, flAllocationType=0x1000, flProtect=0x40) returned 0x2a70000 [0090.563] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x40) returned 0x2a80000 [0090.563] GetCurrentProcessId () returned 0xe9c [0090.563] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2a90000 [0090.564] VirtualAlloc (lpAddress=0x0, dwSize=0xae, flAllocationType=0x1000, flProtect=0x40) returned 0x2aa0000 [0090.564] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x40) returned 0x2ab0000 [0090.564] VirtualAlloc (lpAddress=0x0, dwSize=0xa4, flAllocationType=0x1000, flProtect=0x40) returned 0x2ac0000 [0090.565] VirtualAlloc (lpAddress=0x0, dwSize=0x1df, flAllocationType=0x1000, flProtect=0x40) returned 0x2ad0000 [0090.565] VirtualAlloc (lpAddress=0x0, dwSize=0x8c, flAllocationType=0x1000, flProtect=0x40) returned 0x2ae0000 [0090.566] VirtualAlloc (lpAddress=0x0, dwSize=0x189, flAllocationType=0x1000, flProtect=0x40) returned 0x2af0000 [0090.566] VirtualAlloc (lpAddress=0x0, dwSize=0x483, flAllocationType=0x1000, flProtect=0x40) returned 0x2b00000 [0090.567] VirtualAlloc (lpAddress=0x0, dwSize=0xb4, flAllocationType=0x1000, flProtect=0x40) returned 0x2b10000 [0090.567] VirtualAlloc (lpAddress=0x0, dwSize=0x247, flAllocationType=0x1000, flProtect=0x40) returned 0x2b20000 [0090.568] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x40) returned 0x2b30000 [0090.568] GetCurrentProcessId () returned 0xe9c [0090.568] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2b40000 [0090.569] VirtualAlloc (lpAddress=0x0, dwSize=0xe2, flAllocationType=0x1000, flProtect=0x40) returned 0x2b50000 [0090.569] VirtualAlloc (lpAddress=0x0, dwSize=0x89, flAllocationType=0x1000, flProtect=0x40) returned 0x2b60000 [0090.570] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x40) returned 0x2b70000 [0090.570] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x40) returned 0x2b80000 [0090.571] VirtualAlloc (lpAddress=0x0, dwSize=0xc4, flAllocationType=0x1000, flProtect=0x40) returned 0x2b90000 [0090.571] VirtualAlloc (lpAddress=0x0, dwSize=0x95, flAllocationType=0x1000, flProtect=0x40) returned 0x2ba0000 [0090.572] VirtualAlloc (lpAddress=0x0, dwSize=0xcc, flAllocationType=0x1000, flProtect=0x40) returned 0x2bb0000 [0090.572] VirtualAlloc (lpAddress=0x0, dwSize=0xd6, flAllocationType=0x1000, flProtect=0x40) returned 0x2bc0000 [0090.573] VirtualAlloc (lpAddress=0x0, dwSize=0x9a, flAllocationType=0x1000, flProtect=0x40) returned 0x2bd0000 [0090.573] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x40) returned 0x2be0000 [0090.573] GetCurrentProcessId () returned 0xe9c [0090.574] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2bf0000 [0090.574] VirtualAlloc (lpAddress=0x0, dwSize=0xd1, flAllocationType=0x1000, flProtect=0x40) returned 0x2c00000 [0090.575] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x40) returned 0x2c10000 [0090.575] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x40) returned 0x2c20000 [0090.576] VirtualAlloc (lpAddress=0x0, dwSize=0xc4, flAllocationType=0x1000, flProtect=0x40) returned 0x2c30000 [0090.576] VirtualAlloc (lpAddress=0x0, dwSize=0xa6, flAllocationType=0x1000, flProtect=0x40) returned 0x2c40000 [0090.576] VirtualAlloc (lpAddress=0x0, dwSize=0x9e, flAllocationType=0x1000, flProtect=0x40) returned 0x2c50000 [0090.577] VirtualAlloc (lpAddress=0x0, dwSize=0x9a, flAllocationType=0x1000, flProtect=0x40) returned 0x2c60000 [0090.578] VirtualAlloc (lpAddress=0x0, dwSize=0x17e, flAllocationType=0x1000, flProtect=0x40) returned 0x2c70000 [0090.578] VirtualAlloc (lpAddress=0x0, dwSize=0x1b1, flAllocationType=0x1000, flProtect=0x40) returned 0x2c80000 [0090.579] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x40) returned 0x2c90000 [0090.579] VirtualAlloc (lpAddress=0x27c4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27c4000 [0090.580] GetCurrentProcessId () returned 0xe9c [0090.580] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2ca0000 [0090.580] VirtualAlloc (lpAddress=0x0, dwSize=0x94, flAllocationType=0x1000, flProtect=0x40) returned 0x2cb0000 [0090.581] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x40) returned 0x2cc0000 [0090.581] VirtualAlloc (lpAddress=0x0, dwSize=0xbb, flAllocationType=0x1000, flProtect=0x40) returned 0x2cd0000 [0090.582] VirtualAlloc (lpAddress=0x0, dwSize=0xa2, flAllocationType=0x1000, flProtect=0x40) returned 0x2ce0000 [0090.582] VirtualAlloc (lpAddress=0x0, dwSize=0x9c, flAllocationType=0x1000, flProtect=0x40) returned 0x2cf0000 [0090.583] VirtualAlloc (lpAddress=0x0, dwSize=0xfa, flAllocationType=0x1000, flProtect=0x40) returned 0x2d00000 [0090.583] VirtualAlloc (lpAddress=0x0, dwSize=0xa4, flAllocationType=0x1000, flProtect=0x40) returned 0x2d10000 [0090.584] VirtualAlloc (lpAddress=0x0, dwSize=0xb4, flAllocationType=0x1000, flProtect=0x40) returned 0x2d20000 [0090.584] VirtualAlloc (lpAddress=0x0, dwSize=0xa2, flAllocationType=0x1000, flProtect=0x40) returned 0x2d30000 [0090.601] VirtualAlloc (lpAddress=0x0, dwSize=0x328, flAllocationType=0x1000, flProtect=0x40) returned 0x2d40000 [0090.602] GetCurrentProcessId () returned 0xe9c [0090.602] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2d50000 [0090.602] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x40) returned 0x2d60000 [0090.603] VirtualAlloc (lpAddress=0x0, dwSize=0xb4, flAllocationType=0x1000, flProtect=0x40) returned 0x2d70000 [0090.603] VirtualAlloc (lpAddress=0x0, dwSize=0x1a2, flAllocationType=0x1000, flProtect=0x40) returned 0x2d80000 [0090.604] VirtualAlloc (lpAddress=0x0, dwSize=0x8d, flAllocationType=0x1000, flProtect=0x40) returned 0x2d90000 [0090.604] VirtualAlloc (lpAddress=0x0, dwSize=0x95, flAllocationType=0x1000, flProtect=0x40) returned 0x2da0000 [0090.605] VirtualAlloc (lpAddress=0x0, dwSize=0x293, flAllocationType=0x1000, flProtect=0x40) returned 0x2db0000 [0090.605] VirtualAlloc (lpAddress=0x0, dwSize=0x8c, flAllocationType=0x1000, flProtect=0x40) returned 0x2dc0000 [0090.606] VirtualAlloc (lpAddress=0x0, dwSize=0x14f, flAllocationType=0x1000, flProtect=0x40) returned 0x2dd0000 [0090.606] VirtualAlloc (lpAddress=0x0, dwSize=0xc1, flAllocationType=0x1000, flProtect=0x40) returned 0x2de0000 [0090.607] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x1000, flProtect=0x40) returned 0x2df0000 [0090.607] GetCurrentProcessId () returned 0xe9c [0090.607] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2e00000 [0090.608] VirtualAlloc (lpAddress=0x0, dwSize=0xb8, flAllocationType=0x1000, flProtect=0x40) returned 0x2e10000 [0090.608] VirtualAlloc (lpAddress=0x0, dwSize=0xb1, flAllocationType=0x1000, flProtect=0x40) returned 0x2e20000 [0090.608] VirtualAlloc (lpAddress=0x0, dwSize=0x1bc, flAllocationType=0x1000, flProtect=0x40) returned 0x2e30000 [0090.609] VirtualAlloc (lpAddress=0x0, dwSize=0x2c1, flAllocationType=0x1000, flProtect=0x40) returned 0x2e40000 [0090.610] VirtualAlloc (lpAddress=0x0, dwSize=0x92, flAllocationType=0x1000, flProtect=0x40) returned 0x2e50000 [0090.610] VirtualAlloc (lpAddress=0x0, dwSize=0xdd, flAllocationType=0x1000, flProtect=0x40) returned 0x2e60000 [0090.610] VirtualAlloc (lpAddress=0x0, dwSize=0x84, flAllocationType=0x1000, flProtect=0x40) returned 0x2e70000 [0090.611] VirtualAlloc (lpAddress=0x0, dwSize=0x95, flAllocationType=0x1000, flProtect=0x40) returned 0x2e80000 [0090.612] VirtualAlloc (lpAddress=0x0, dwSize=0x9c, flAllocationType=0x1000, flProtect=0x40) returned 0x2e90000 [0090.612] VirtualAlloc (lpAddress=0x0, dwSize=0xc3, flAllocationType=0x1000, flProtect=0x40) returned 0x2ea0000 [0090.612] VirtualAlloc (lpAddress=0x27c8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27c8000 [0090.613] GetCurrentProcessId () returned 0xe9c [0090.613] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2eb0000 [0090.613] VirtualAlloc (lpAddress=0x0, dwSize=0xc7, flAllocationType=0x1000, flProtect=0x40) returned 0x2ec0000 [0090.614] VirtualAlloc (lpAddress=0x0, dwSize=0xb6, flAllocationType=0x1000, flProtect=0x40) returned 0x2ed0000 [0090.614] VirtualAlloc (lpAddress=0x0, dwSize=0x8c, flAllocationType=0x1000, flProtect=0x40) returned 0x2ee0000 [0090.615] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x1000, flProtect=0x40) returned 0x2ef0000 [0090.615] VirtualAlloc (lpAddress=0x0, dwSize=0x272, flAllocationType=0x1000, flProtect=0x40) returned 0x2f00000 [0090.616] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x40) returned 0x2f10000 [0090.616] VirtualAlloc (lpAddress=0x0, dwSize=0x8f, flAllocationType=0x1000, flProtect=0x40) returned 0x2f20000 [0090.616] VirtualAlloc (lpAddress=0x0, dwSize=0xca, flAllocationType=0x1000, flProtect=0x40) returned 0x2f30000 [0090.617] VirtualAlloc (lpAddress=0x0, dwSize=0xe3, flAllocationType=0x1000, flProtect=0x40) returned 0x2f40000 [0090.617] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x40) returned 0x2f50000 [0090.618] GetCurrentProcessId () returned 0xe9c [0090.618] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2f60000 [0090.618] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x40) returned 0x2f70000 [0090.619] VirtualAlloc (lpAddress=0x0, dwSize=0xe1, flAllocationType=0x1000, flProtect=0x40) returned 0x2f80000 [0090.619] VirtualAlloc (lpAddress=0x0, dwSize=0x7b, flAllocationType=0x1000, flProtect=0x40) returned 0x2f90000 [0090.620] VirtualAlloc (lpAddress=0x0, dwSize=0xb2, flAllocationType=0x1000, flProtect=0x40) returned 0x2fa0000 [0090.620] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x1000, flProtect=0x40) returned 0x2fb0000 [0090.621] VirtualAlloc (lpAddress=0x0, dwSize=0x399, flAllocationType=0x1000, flProtect=0x40) returned 0x2fc0000 [0090.621] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x40) returned 0x2fd0000 [0090.622] VirtualAlloc (lpAddress=0x0, dwSize=0xb6, flAllocationType=0x1000, flProtect=0x40) returned 0x2fe0000 [0090.623] VirtualAlloc (lpAddress=0x0, dwSize=0x133, flAllocationType=0x1000, flProtect=0x40) returned 0x2ff0000 [0090.623] VirtualAlloc (lpAddress=0x0, dwSize=0x92, flAllocationType=0x1000, flProtect=0x40) returned 0x3000000 [0090.624] GetCurrentProcessId () returned 0xe9c [0090.624] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x3010000 [0090.625] VirtualAlloc (lpAddress=0x0, dwSize=0xae, flAllocationType=0x1000, flProtect=0x40) returned 0x3020000 [0090.625] VirtualAlloc (lpAddress=0x0, dwSize=0xc6, flAllocationType=0x1000, flProtect=0x40) returned 0x3030000 [0090.626] VirtualAlloc (lpAddress=0x0, dwSize=0x86, flAllocationType=0x1000, flProtect=0x40) returned 0x3040000 [0090.626] VirtualAlloc (lpAddress=0x0, dwSize=0x99, flAllocationType=0x1000, flProtect=0x40) returned 0x3050000 [0090.627] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x1000, flProtect=0x40) returned 0x3060000 [0090.627] VirtualAlloc (lpAddress=0x0, dwSize=0xa8, flAllocationType=0x1000, flProtect=0x40) returned 0x3070000 [0090.628] VirtualAlloc (lpAddress=0x0, dwSize=0xd1, flAllocationType=0x1000, flProtect=0x40) returned 0x3080000 [0090.629] VirtualAlloc (lpAddress=0x0, dwSize=0x87, flAllocationType=0x1000, flProtect=0x40) returned 0x3090000 [0090.629] VirtualAlloc (lpAddress=0x0, dwSize=0x1af, flAllocationType=0x1000, flProtect=0x40) returned 0x30a0000 [0090.630] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x40) returned 0x30b0000 [0090.631] GetCurrentProcessId () returned 0xe9c [0090.631] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x30c0000 [0090.632] VirtualAlloc (lpAddress=0x0, dwSize=0xdc, flAllocationType=0x1000, flProtect=0x40) returned 0x30d0000 [0090.632] VirtualAlloc (lpAddress=0x0, dwSize=0xa6, flAllocationType=0x1000, flProtect=0x40) returned 0x30e0000 [0090.633] VirtualAlloc (lpAddress=0x0, dwSize=0x65, flAllocationType=0x1000, flProtect=0x40) returned 0x30f0000 [0090.633] VirtualAlloc (lpAddress=0x0, dwSize=0x3a6, flAllocationType=0x1000, flProtect=0x40) returned 0x3100000 [0090.634] VirtualAlloc (lpAddress=0x0, dwSize=0x139, flAllocationType=0x1000, flProtect=0x40) returned 0x3110000 [0090.634] VirtualAlloc (lpAddress=0x0, dwSize=0x388, flAllocationType=0x1000, flProtect=0x40) returned 0x3120000 [0090.635] VirtualAlloc (lpAddress=0x0, dwSize=0xfc, flAllocationType=0x1000, flProtect=0x40) returned 0x3130000 [0090.635] VirtualAlloc (lpAddress=0x0, dwSize=0xa6, flAllocationType=0x1000, flProtect=0x40) returned 0x3140000 [0090.636] VirtualAlloc (lpAddress=0x0, dwSize=0xcb, flAllocationType=0x1000, flProtect=0x40) returned 0x3150000 [0090.636] VirtualAlloc (lpAddress=0x0, dwSize=0xa1, flAllocationType=0x1000, flProtect=0x40) returned 0x3160000 [0090.638] GetCurrentProcessId () returned 0xe9c [0090.638] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x3170000 [0090.639] VirtualAlloc (lpAddress=0x0, dwSize=0xc5, flAllocationType=0x1000, flProtect=0x40) returned 0x3180000 [0090.640] VirtualAlloc (lpAddress=0x0, dwSize=0xa7, flAllocationType=0x1000, flProtect=0x40) returned 0x3190000 [0090.640] VirtualAlloc (lpAddress=0x0, dwSize=0xa4, flAllocationType=0x1000, flProtect=0x40) returned 0x31a0000 [0090.641] VirtualAlloc (lpAddress=0x0, dwSize=0x281, flAllocationType=0x1000, flProtect=0x40) returned 0x31b0000 [0090.641] VirtualAlloc (lpAddress=0x0, dwSize=0x8e, flAllocationType=0x1000, flProtect=0x40) returned 0x31c0000 [0090.641] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x40) returned 0x31d0000 [0090.642] VirtualAlloc (lpAddress=0x0, dwSize=0x9c, flAllocationType=0x1000, flProtect=0x40) returned 0x31e0000 [0090.642] VirtualAlloc (lpAddress=0x0, dwSize=0xbe, flAllocationType=0x1000, flProtect=0x40) returned 0x31f0000 [0090.643] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x1000, flProtect=0x40) returned 0x3200000 [0090.644] VirtualAlloc (lpAddress=0x0, dwSize=0x323, flAllocationType=0x1000, flProtect=0x40) returned 0x3210000 [0090.644] VirtualAlloc (lpAddress=0x27cc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27cc000 [0090.645] GetCurrentProcessId () returned 0xe9c [0090.645] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x3220000 [0090.646] VirtualAlloc (lpAddress=0x0, dwSize=0x9d, flAllocationType=0x1000, flProtect=0x40) returned 0x3230000 [0090.646] VirtualAlloc (lpAddress=0x0, dwSize=0x9a, flAllocationType=0x1000, flProtect=0x40) returned 0x3240000 [0090.647] VirtualAlloc (lpAddress=0x0, dwSize=0x9e, flAllocationType=0x1000, flProtect=0x40) returned 0x3250000 [0090.648] VirtualAlloc (lpAddress=0x0, dwSize=0x97, flAllocationType=0x1000, flProtect=0x40) returned 0x3260000 [0090.649] VirtualAlloc (lpAddress=0x0, dwSize=0x42b, flAllocationType=0x1000, flProtect=0x40) returned 0x3270000 [0090.649] VirtualAlloc (lpAddress=0x0, dwSize=0xac, flAllocationType=0x1000, flProtect=0x40) returned 0x3280000 [0090.650] VirtualAlloc (lpAddress=0x0, dwSize=0x20b, flAllocationType=0x1000, flProtect=0x40) returned 0x3290000 [0090.651] VirtualAlloc (lpAddress=0x0, dwSize=0x8f, flAllocationType=0x1000, flProtect=0x40) returned 0x32a0000 [0090.652] VirtualAlloc (lpAddress=0x0, dwSize=0x99, flAllocationType=0x1000, flProtect=0x40) returned 0x32b0000 [0090.652] VirtualAlloc (lpAddress=0x0, dwSize=0xab, flAllocationType=0x1000, flProtect=0x40) returned 0x32c0000 [0090.653] GetCurrentProcessId () returned 0xe9c [0090.653] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x32d0000 [0090.654] VirtualAlloc (lpAddress=0x0, dwSize=0xdc, flAllocationType=0x1000, flProtect=0x40) returned 0x32e0000 [0090.655] VirtualAlloc (lpAddress=0x0, dwSize=0x65f, flAllocationType=0x1000, flProtect=0x40) returned 0x32f0000 [0090.655] VirtualAlloc (lpAddress=0x0, dwSize=0xd2, flAllocationType=0x1000, flProtect=0x40) returned 0x3300000 [0090.656] VirtualAlloc (lpAddress=0x0, dwSize=0x9f, flAllocationType=0x1000, flProtect=0x40) returned 0x3310000 [0090.656] VirtualAlloc (lpAddress=0x0, dwSize=0xa1, flAllocationType=0x1000, flProtect=0x40) returned 0x3320000 [0090.657] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x40) returned 0x3330000 [0090.658] VirtualAlloc (lpAddress=0x0, dwSize=0x418, flAllocationType=0x1000, flProtect=0x40) returned 0x3340000 [0090.658] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x1000, flProtect=0x40) returned 0x3350000 [0090.659] VirtualAlloc (lpAddress=0x0, dwSize=0xd8, flAllocationType=0x1000, flProtect=0x40) returned 0x3360000 [0090.660] VirtualAlloc (lpAddress=0x0, dwSize=0x97, flAllocationType=0x1000, flProtect=0x40) returned 0x3370000 [0090.660] VirtualAlloc (lpAddress=0x27d0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27d0000 [0090.661] GetCurrentProcessId () returned 0xe9c [0090.661] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x3380000 [0090.662] VirtualAlloc (lpAddress=0x0, dwSize=0x26a, flAllocationType=0x1000, flProtect=0x40) returned 0x3390000 [0090.662] VirtualAlloc (lpAddress=0x0, dwSize=0x81, flAllocationType=0x1000, flProtect=0x40) returned 0x33a0000 [0090.663] VirtualAlloc (lpAddress=0x0, dwSize=0x79, flAllocationType=0x1000, flProtect=0x40) returned 0x33b0000 [0090.663] VirtualAlloc (lpAddress=0x0, dwSize=0xae, flAllocationType=0x1000, flProtect=0x40) returned 0x33c0000 [0090.664] VirtualAlloc (lpAddress=0x0, dwSize=0xa4, flAllocationType=0x1000, flProtect=0x40) returned 0x33d0000 [0090.664] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x40) returned 0x33e0000 [0090.665] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x1000, flProtect=0x40) returned 0x33f0000 [0090.666] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x40) returned 0x3400000 [0090.666] VirtualAlloc (lpAddress=0x0, dwSize=0x396, flAllocationType=0x1000, flProtect=0x40) returned 0x3410000 [0090.667] VirtualAlloc (lpAddress=0x0, dwSize=0x92, flAllocationType=0x1000, flProtect=0x40) returned 0x3420000 [0090.667] GetCurrentProcessId () returned 0xe9c [0090.667] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x3430000 [0090.668] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x40) returned 0x3440000 [0090.668] VirtualAlloc (lpAddress=0x0, dwSize=0xb2, flAllocationType=0x1000, flProtect=0x40) returned 0x3450000 [0090.669] VirtualAlloc (lpAddress=0x0, dwSize=0x521, flAllocationType=0x1000, flProtect=0x40) returned 0x3460000 [0090.670] VirtualAlloc (lpAddress=0x0, dwSize=0xcb, flAllocationType=0x1000, flProtect=0x40) returned 0x3470000 [0090.670] VirtualAlloc (lpAddress=0x0, dwSize=0xad, flAllocationType=0x1000, flProtect=0x40) returned 0x3480000 [0090.671] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x40) returned 0x3490000 [0090.671] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x40) returned 0x34a0000 [0090.672] VirtualAlloc (lpAddress=0x0, dwSize=0x88, flAllocationType=0x1000, flProtect=0x40) returned 0x34b0000 [0090.672] VirtualAlloc (lpAddress=0x0, dwSize=0xa0, flAllocationType=0x1000, flProtect=0x40) returned 0x34c0000 [0090.673] VirtualAlloc (lpAddress=0x0, dwSize=0x98, flAllocationType=0x1000, flProtect=0x40) returned 0x34d0000 [0090.674] GetCurrentProcessId () returned 0xe9c [0090.674] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x34e0000 [0090.678] VirtualAlloc (lpAddress=0x0, dwSize=0x8b, flAllocationType=0x1000, flProtect=0x40) returned 0x34f0000 [0090.678] VirtualAlloc (lpAddress=0x0, dwSize=0x99, flAllocationType=0x1000, flProtect=0x40) returned 0x3500000 [0090.679] VirtualAlloc (lpAddress=0x0, dwSize=0xb6, flAllocationType=0x1000, flProtect=0x40) returned 0x3510000 [0090.680] VirtualAlloc (lpAddress=0x0, dwSize=0xa5, flAllocationType=0x1000, flProtect=0x40) returned 0x3520000 [0090.680] VirtualAlloc (lpAddress=0x0, dwSize=0xc0, flAllocationType=0x1000, flProtect=0x40) returned 0x3530000 [0090.681] VirtualAlloc (lpAddress=0x0, dwSize=0x86, flAllocationType=0x1000, flProtect=0x40) returned 0x3540000 [0090.682] VirtualAlloc (lpAddress=0x0, dwSize=0x91, flAllocationType=0x1000, flProtect=0x40) returned 0x3550000 [0090.682] VirtualAlloc (lpAddress=0x0, dwSize=0x98, flAllocationType=0x1000, flProtect=0x40) returned 0x3560000 [0090.683] VirtualAlloc (lpAddress=0x0, dwSize=0x371, flAllocationType=0x1000, flProtect=0x40) returned 0x3570000 [0090.683] VirtualAlloc (lpAddress=0x0, dwSize=0x7f, flAllocationType=0x1000, flProtect=0x40) returned 0x3580000 [0090.684] VirtualAlloc (lpAddress=0x27d4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x27d4000 [0090.684] GetCurrentProcessId () returned 0xe9c [0090.684] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x3590000 [0090.685] VirtualAlloc (lpAddress=0x0, dwSize=0xae, flAllocationType=0x1000, flProtect=0x40) returned 0x35a0000 [0090.685] VirtualAlloc (lpAddress=0x0, dwSize=0xa1, flAllocationType=0x1000, flProtect=0x40) returned 0x35b0000 [0090.686] VirtualAlloc (lpAddress=0x0, dwSize=0x327, flAllocationType=0x1000, flProtect=0x40) returned 0x35c0000 [0090.686] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x40) returned 0x35d0000 [0090.687] VirtualAlloc (lpAddress=0x0, dwSize=0xa8, flAllocationType=0x1000, flProtect=0x40) returned 0x35e0000 [0090.687] VirtualAlloc (lpAddress=0x0, dwSize=0xaa, flAllocationType=0x1000, flProtect=0x40) returned 0x35f0000 [0090.688] VirtualAlloc (lpAddress=0x0, dwSize=0xb7, flAllocationType=0x1000, flProtect=0x40) returned 0x3600000 [0090.689] VirtualAlloc (lpAddress=0x0, dwSize=0xc1, flAllocationType=0x1000, flProtect=0x40) returned 0x3610000 [0090.690] VirtualAlloc (lpAddress=0x0, dwSize=0xa8, flAllocationType=0x1000, flProtect=0x40) returned 0x3620000 [0090.690] VirtualAlloc (lpAddress=0x0, dwSize=0x92, flAllocationType=0x1000, flProtect=0x40) returned 0x3630000 [0090.691] GetCurrentProcessId () returned 0xe9c [0090.691] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x3640000 [0090.693] VirtualAlloc (lpAddress=0x0, dwSize=0xaf, flAllocationType=0x1000, flProtect=0x40) returned 0x3650000 [0090.694] VirtualAlloc (lpAddress=0x0, dwSize=0x9e, flAllocationType=0x1000, flProtect=0x40) returned 0x3660000 [0090.695] VirtualAlloc (lpAddress=0x0, dwSize=0x9c, flAllocationType=0x1000, flProtect=0x40) returned 0x3670000 [0090.696] VirtualAlloc (lpAddress=0x0, dwSize=0x9a, flAllocationType=0x1000, flProtect=0x40) returned 0x3680000 [0090.697] VirtualAlloc (lpAddress=0x0, dwSize=0xb5, flAllocationType=0x1000, flProtect=0x40) returned 0x3690000 [0090.697] VirtualAlloc (lpAddress=0x0, dwSize=0xd1, flAllocationType=0x1000, flProtect=0x40) returned 0x36a0000 [0090.698] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x1000, flProtect=0x40) returned 0x36b0000 [0090.698] VirtualAlloc (lpAddress=0x0, dwSize=0xa3, flAllocationType=0x1000, flProtect=0x40) returned 0x36c0000 [0090.699] VirtualAlloc (lpAddress=0x0, dwSize=0xb3, flAllocationType=0x1000, flProtect=0x40) returned 0x36d0000 [0090.700] VirtualAlloc (lpAddress=0x0, dwSize=0x1f3, flAllocationType=0x1000, flProtect=0x40) returned 0x36e0000 [0090.700] GetCurrentProcessId () returned 0xe9c [0090.700] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x36f0000 [0090.701] VirtualAlloc (lpAddress=0x0, dwSize=0x18a, flAllocationType=0x1000, flProtect=0x40) returned 0x3700000 [0090.701] VirtualAlloc (lpAddress=0x0, dwSize=0xb0, flAllocationType=0x1000, flProtect=0x40) returned 0x3710000 [0090.702] VirtualAlloc (lpAddress=0x0, dwSize=0xa9, flAllocationType=0x1000, flProtect=0x40) returned 0x3720000 [0090.702] VirtualAlloc (lpAddress=0x0, dwSize=0xaa, flAllocationType=0x1000, flProtect=0x40) returned 0x3730000 [0090.703] VirtualAlloc (lpAddress=0x0, dwSize=0x9b, flAllocationType=0x1000, flProtect=0x40) returned 0x3740000 [0090.703] VirtualAlloc (lpAddress=0x0, dwSize=0xc2, flAllocationType=0x1000, flProtect=0x40) returned 0x3750000 [0090.704] VirtualAlloc (lpAddress=0x0, dwSize=0x82, flAllocationType=0x1000, flProtect=0x40) returned 0x3760000 [0090.706] GetCurrentProcessId () returned 0xe9c [0090.720] GetCurrentProcessId () returned 0xe9c [0090.720] GetCurrentProcessId () returned 0xe9c [0090.732] GetCurrentProcessId () returned 0xe9c [0090.732] GetCurrentProcessId () returned 0xe9c [0090.732] GetCurrentProcessId () returned 0xe9c [0090.732] GetCurrentProcessId () returned 0xe9c [0090.735] GetCurrentProcessId () returned 0xe9c [0090.737] GetCurrentProcessId () returned 0xe9c [0090.737] GetCurrentProcessId () returned 0xe9c [0090.737] GetCurrentProcessId () returned 0xe9c [0090.737] GetCurrentProcessId () returned 0xe9c [0090.737] GetCurrentProcessId () returned 0xe9c [0090.737] GetCurrentProcessId () returned 0xe9c [0090.739] GetCurrentProcessId () returned 0xe9c [0090.739] GetCurrentProcessId () returned 0xe9c [0090.739] GetCurrentProcessId () returned 0xe9c [0090.739] GetCurrentProcessId () returned 0xe9c [0090.739] GetCurrentProcessId () returned 0xe9c [0090.739] GetCurrentProcessId () returned 0xe9c [0090.739] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.740] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.741] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.742] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.743] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.744] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.745] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] GetCurrentProcessId () returned 0xe9c [0090.746] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.749] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.750] GetCurrentProcessId () returned 0xe9c [0090.750] GetCurrentProcessId () returned 0xe9c [0090.750] GetCurrentProcessId () returned 0xe9c [0090.750] GetCurrentProcessId () returned 0xe9c [0090.750] GetCurrentProcessId () returned 0xe9c [0090.750] GetCurrentProcessId () returned 0xe9c [0090.751] GetCurrentProcessId () returned 0xe9c [0090.751] GetCurrentProcessId () returned 0xe9c [0090.751] GetCurrentProcessId () returned 0xe9c [0090.762] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.764] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.765] GetCurrentProcessId () returned 0xe9c [0090.765] GetCurrentProcessId () returned 0xe9c [0090.765] GetCurrentProcessId () returned 0xe9c [0090.766] GetCurrentProcessId () returned 0xe9c [0090.766] GetCurrentProcessId () returned 0xe9c [0090.766] GetCurrentProcessId () returned 0xe9c [0090.766] GetCurrentProcessId () returned 0xe9c [0090.766] GetCurrentProcessId () returned 0xe9c [0090.766] GetCurrentProcessId () returned 0xe9c [0090.766] GetCurrentProcessId () returned 0xe9c [0090.766] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.767] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.768] GetCurrentProcessId () returned 0xe9c [0090.768] GetCurrentProcessId () returned 0xe9c [0090.768] GetCurrentProcessId () returned 0xe9c [0090.768] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.769] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.770] GetCurrentProcessId () returned 0xe9c [0090.771] GetCurrentProcessId () returned 0xe9c [0090.771] GetCurrentProcessId () returned 0xe9c [0090.771] GetCurrentProcessId () returned 0xe9c [0090.771] GetCurrentProcessId () returned 0xe9c [0090.771] GetCurrentProcessId () returned 0xe9c [0090.771] GetCurrentProcessId () returned 0xe9c [0090.771] GetCurrentProcessId () returned 0xe9c [0090.771] GetCurrentProcessId () returned 0xe9c [0090.771] GetCurrentProcessId () returned 0xe9c [0090.771] GetCurrentProcessId () returned 0xe9c [0090.771] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.773] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.774] GetCurrentProcessId () returned 0xe9c [0090.774] GetCurrentProcessId () returned 0xe9c [0090.774] GetCurrentProcessId () returned 0xe9c [0090.774] GetCurrentProcessId () returned 0xe9c [0090.774] GetCurrentProcessId () returned 0xe9c [0090.774] GetCurrentProcessId () returned 0xe9c [0090.774] GetCurrentProcessId () returned 0xe9c [0090.774] GetCurrentProcessId () returned 0xe9c [0090.774] GetCurrentProcessId () returned 0xe9c [0090.774] GetCurrentProcessId () returned 0xe9c [0090.774] GetCurrentProcessId () returned 0xe9c [0090.774] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.775] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.776] GetCurrentProcessId () returned 0xe9c [0090.776] GetCurrentProcessId () returned 0xe9c [0090.776] GetCurrentProcessId () returned 0xe9c [0090.776] GetCurrentProcessId () returned 0xe9c [0090.776] GetCurrentProcessId () returned 0xe9c [0090.776] GetCurrentProcessId () returned 0xe9c [0090.776] GetCurrentProcessId () returned 0xe9c [0090.776] GetCurrentProcessId () returned 0xe9c [0090.776] GetCurrentProcessId () returned 0xe9c [0090.776] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.777] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.778] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.779] GetCurrentProcessId () returned 0xe9c [0090.780] GetCurrentProcessId () returned 0xe9c [0090.780] GetCurrentProcessId () returned 0xe9c [0090.780] GetCurrentProcessId () returned 0xe9c [0090.780] GetCurrentProcessId () returned 0xe9c [0090.780] GetCurrentProcessId () returned 0xe9c [0090.780] GetCurrentProcessId () returned 0xe9c [0090.780] GetCurrentProcessId () returned 0xe9c [0090.780] GetCurrentProcessId () returned 0xe9c [0090.780] GetCurrentProcessId () returned 0xe9c [0090.780] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.781] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.782] GetCurrentProcessId () returned 0xe9c [0090.782] GetCurrentProcessId () returned 0xe9c [0090.782] GetCurrentProcessId () returned 0xe9c [0090.782] GetCurrentProcessId () returned 0xe9c [0090.782] GetCurrentProcessId () returned 0xe9c [0090.783] GetCurrentProcessId () returned 0xe9c [0090.783] GetCurrentProcessId () returned 0xe9c [0090.783] GetCurrentProcessId () returned 0xe9c [0090.783] GetCurrentProcessId () returned 0xe9c [0090.783] GetCurrentProcessId () returned 0xe9c [0090.783] GetCurrentProcessId () returned 0xe9c [0090.783] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.784] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.785] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] GetCurrentProcessId () returned 0xe9c [0090.786] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.787] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.788] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.789] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.791] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.792] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.794] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.794] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.795] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.796] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.799] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.800] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.801] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.802] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.803] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.804] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.805] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.806] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.810] GetCurrentProcessId () returned 0xe9c [0090.810] GetCurrentProcessId () returned 0xe9c [0090.810] GetCurrentProcessId () returned 0xe9c [0090.810] GetCurrentProcessId () returned 0xe9c [0090.814] GetCurrentProcessId () returned 0xe9c [0090.815] GetCurrentProcessId () returned 0xe9c [0090.815] GetCurrentProcessId () returned 0xe9c [0090.815] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.816] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] GetCurrentProcessId () returned 0xe9c [0090.817] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.819] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] GetCurrentProcessId () returned 0xe9c [0090.821] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.822] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.823] GetCurrentProcessId () returned 0xe9c [0090.823] GetCurrentProcessId () returned 0xe9c [0090.823] GetCurrentProcessId () returned 0xe9c [0090.823] GetCurrentProcessId () returned 0xe9c [0090.823] GetCurrentProcessId () returned 0xe9c [0090.823] GetCurrentProcessId () returned 0xe9c [0090.823] GetCurrentProcessId () returned 0xe9c [0090.823] GetCurrentProcessId () returned 0xe9c [0090.823] GetCurrentProcessId () returned 0xe9c [0090.823] GetCurrentProcessId () returned 0xe9c [0090.824] GetCurrentProcessId () returned 0xe9c [0090.824] GetCurrentProcessId () returned 0xe9c [0090.824] GetCurrentProcessId () returned 0xe9c [0090.824] GetCurrentProcessId () returned 0xe9c [0090.824] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.825] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.826] GetCurrentProcessId () returned 0xe9c [0090.826] GetCurrentProcessId () returned 0xe9c [0090.826] GetCurrentProcessId () returned 0xe9c [0090.826] GetCurrentProcessId () returned 0xe9c [0090.826] GetCurrentProcessId () returned 0xe9c [0090.826] GetCurrentProcessId () returned 0xe9c [0090.826] GetCurrentProcessId () returned 0xe9c [0090.826] GetCurrentProcessId () returned 0xe9c [0090.826] GetCurrentProcessId () returned 0xe9c [0090.826] GetCurrentProcessId () returned 0xe9c [0090.827] GetCurrentProcessId () returned 0xe9c [0090.827] GetCurrentProcessId () returned 0xe9c [0090.827] GetCurrentProcessId () returned 0xe9c [0090.827] GetCurrentProcessId () returned 0xe9c [0090.827] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.828] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] GetCurrentProcessId () returned 0xe9c [0090.829] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.830] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] GetCurrentProcessId () returned 0xe9c [0090.831] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.832] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.833] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.834] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.835] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.841] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.842] GetCurrentProcessId () returned 0xe9c [0090.843] GetCurrentProcessId () returned 0xe9c [0090.843] GetCurrentProcessId () returned 0xe9c [0090.843] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.844] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.845] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.846] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.847] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.848] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.849] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.849] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.850] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.851] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.852] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.852] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.854] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.855] VirtualFree (lpAddress=0x37b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.857] VirtualAlloc (lpAddress=0x0, dwSize=0x145, flAllocationType=0x1000, flProtect=0x40) returned 0x37b0000 [0090.860] GetCurrentProcessId () returned 0xe9c [0090.861] GetCurrentProcessId () returned 0xe9c [0090.863] GetCurrentProcessId () returned 0xe9c [0090.863] GetCurrentProcessId () returned 0xe9c [0090.863] GetCurrentProcessId () returned 0xe9c [0090.863] GetCurrentProcessId () returned 0xe9c [0090.864] GetCurrentProcessId () returned 0xe9c [0090.864] GetCurrentProcessId () returned 0xe9c [0090.864] GetCurrentProcessId () returned 0xe9c [0090.864] GetCurrentProcessId () returned 0xe9c [0090.864] GetCurrentProcessId () returned 0xe9c [0090.865] GetCurrentProcessId () returned 0xe9c [0090.865] GetCurrentProcessId () returned 0xe9c [0090.865] GetCurrentProcessId () returned 0xe9c [0090.865] GetCurrentProcessId () returned 0xe9c [0090.865] GetCurrentProcessId () returned 0xe9c [0090.865] GetCurrentProcessId () returned 0xe9c [0090.865] GetCurrentProcessId () returned 0xe9c [0090.865] GetCurrentProcessId () returned 0xe9c [0090.865] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.867] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.868] GetCurrentProcessId () returned 0xe9c [0090.869] GetCurrentProcessId () returned 0xe9c [0090.869] GetCurrentProcessId () returned 0xe9c [0090.869] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.871] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] GetCurrentProcessId () returned 0xe9c [0090.873] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.874] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] GetCurrentProcessId () returned 0xe9c [0090.876] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.886] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.888] GetCurrentProcessId () returned 0xe9c [0090.888] GetCurrentProcessId () returned 0xe9c [0090.888] GetCurrentProcessId () returned 0xe9c [0090.888] GetCurrentProcessId () returned 0xe9c [0090.888] GetCurrentProcessId () returned 0xe9c [0090.888] GetCurrentProcessId () returned 0xe9c [0090.888] GetCurrentProcessId () returned 0xe9c [0090.888] GetCurrentProcessId () returned 0xe9c [0090.888] GetCurrentProcessId () returned 0xe9c [0090.888] GetCurrentProcessId () returned 0xe9c [0090.888] GetCurrentProcessId () returned 0xe9c [0090.889] GetCurrentProcessId () returned 0xe9c [0090.889] GetCurrentProcessId () returned 0xe9c [0090.889] GetCurrentProcessId () returned 0xe9c [0090.889] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.890] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] GetCurrentProcessId () returned 0xe9c [0090.891] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.892] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] GetCurrentProcessId () returned 0xe9c [0090.893] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.894] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] GetCurrentProcessId () returned 0xe9c [0090.895] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.896] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.897] GetCurrentProcessId () returned 0xe9c [0090.905] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.908] GetCurrentProcessId () returned 0xe9c [0090.908] GetCurrentProcessId () returned 0xe9c [0090.908] GetCurrentProcessId () returned 0xe9c [0090.908] GetCurrentProcessId () returned 0xe9c [0090.908] GetCurrentProcessId () returned 0xe9c [0090.908] GetCurrentProcessId () returned 0xe9c [0090.908] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.910] GetCurrentProcessId () returned 0xe9c [0090.911] GetCurrentProcessId () returned 0xe9c [0090.911] GetCurrentProcessId () returned 0xe9c [0090.911] GetCurrentProcessId () returned 0xe9c [0090.911] GetCurrentProcessId () returned 0xe9c [0090.911] GetCurrentProcessId () returned 0xe9c [0090.911] GetCurrentProcessId () returned 0xe9c [0090.911] GetCurrentProcessId () returned 0xe9c [0090.911] GetCurrentProcessId () returned 0xe9c [0090.911] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.911] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] GetCurrentProcessId () returned 0xe9c [0090.913] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.914] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.915] GetCurrentProcessId () returned 0xe9c [0090.915] GetCurrentProcessId () returned 0xe9c [0090.915] GetCurrentProcessId () returned 0xe9c [0090.915] GetCurrentProcessId () returned 0xe9c [0090.915] GetCurrentProcessId () returned 0xe9c [0090.915] GetCurrentProcessId () returned 0xe9c [0090.915] GetCurrentProcessId () returned 0xe9c [0090.915] GetCurrentProcessId () returned 0xe9c [0090.915] GetCurrentProcessId () returned 0xe9c [0090.915] GetCurrentProcessId () returned 0xe9c [0090.915] GetCurrentProcessId () returned 0xe9c [0090.916] GetCurrentProcessId () returned 0xe9c [0090.916] GetCurrentProcessId () returned 0xe9c [0090.916] GetCurrentProcessId () returned 0xe9c [0090.916] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.917] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] GetCurrentProcessId () returned 0xe9c [0090.919] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.920] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.921] GetCurrentProcessId () returned 0xe9c [0090.921] GetCurrentProcessId () returned 0xe9c [0090.921] GetCurrentProcessId () returned 0xe9c [0090.922] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.922] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.923] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.924] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.941] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0090.942] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.945] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.946] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0090.948] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.950] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0090.952] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.296] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0091.297] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0091.298] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.300] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0091.301] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.305] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0091.306] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.308] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0091.309] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.311] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0091.312] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.314] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0091.315] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.316] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37d0000 [0091.317] VirtualFree (lpAddress=0x37d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.331] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.333] VirtualAlloc (lpAddress=0x2798000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x2798000 [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.363] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.364] GetCurrentProcessId () returned 0xe9c [0091.365] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0091.770] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.771] GetCurrentProcessId () returned 0xe9c [0091.771] GetCurrentProcessId () returned 0xe9c [0091.771] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.772] GetCurrentProcessId () returned 0xe9c [0091.773] GetCurrentProcessId () returned 0xe9c [0091.773] GetCurrentProcessId () returned 0xe9c [0091.773] GetCurrentProcessId () returned 0xe9c [0091.773] GetCurrentProcessId () returned 0xe9c [0091.773] GetCurrentProcessId () returned 0xe9c [0091.773] GetCurrentProcessId () returned 0xe9c [0091.773] GetCurrentProcessId () returned 0xe9c [0091.773] GetCurrentProcessId () returned 0xe9c [0091.773] GetCurrentProcessId () returned 0xe9c [0091.773] GetCurrentProcessId () returned 0xe9c [0091.773] GetCurrentProcessId () returned 0xe9c [0091.773] GetCurrentProcessId () returned 0xe9c [0091.777] VirtualFree (lpAddress=0x2798000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0091.780] VirtualAlloc (lpAddress=0x2798000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x2798000 [0091.787] VirtualFree (lpAddress=0x2798000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0091.789] VirtualAlloc (lpAddress=0x0, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x1) returned 0x37c0000 [0091.790] VirtualAlloc (lpAddress=0x37c0000, dwSize=0x3fc000, flAllocationType=0x1000, flProtect=0x4) returned 0x37c0000 [0092.086] VirtualFree (lpAddress=0x37c0000, dwSize=0x3fc000, dwFreeType=0x4000) returned 1 [0092.199] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.211] GetCurrentProcessId () returned 0xe9c [0092.211] GetCurrentProcessId () returned 0xe9c [0092.211] GetCurrentProcessId () returned 0xe9c [0092.211] GetCurrentProcessId () returned 0xe9c [0092.211] GetCurrentProcessId () returned 0xe9c [0092.211] GetCurrentProcessId () returned 0xe9c [0092.211] GetCurrentProcessId () returned 0xe9c [0092.211] GetCurrentProcessId () returned 0xe9c [0092.211] GetCurrentProcessId () returned 0xe9c [0092.211] GetCurrentProcessId () returned 0xe9c [0092.211] GetCurrentProcessId () returned 0xe9c [0092.212] GetCurrentProcessId () returned 0xe9c [0092.212] GetCurrentProcessId () returned 0xe9c [0092.212] GetCurrentProcessId () returned 0xe9c [0092.212] GetCurrentProcessId () returned 0xe9c [0092.212] GetCurrentProcessId () returned 0xe9c [0092.212] GetCurrentProcessId () returned 0xe9c [0092.219] GetCurrentProcessId () returned 0xe9c [0092.219] GetCurrentProcessId () returned 0xe9c [0092.219] GetCurrentProcessId () returned 0xe9c [0092.219] GetCurrentProcessId () returned 0xe9c [0092.219] GetCurrentProcessId () returned 0xe9c [0092.219] GetCurrentProcessId () returned 0xe9c [0092.219] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] GetCurrentProcessId () returned 0xe9c [0092.220] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.222] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.223] GetCurrentProcessId () returned 0xe9c [0092.223] GetCurrentProcessId () returned 0xe9c [0092.223] GetCurrentProcessId () returned 0xe9c [0092.223] GetCurrentProcessId () returned 0xe9c [0092.223] GetCurrentProcessId () returned 0xe9c [0092.223] GetCurrentProcessId () returned 0xe9c [0092.223] GetCurrentProcessId () returned 0xe9c [0092.223] GetCurrentProcessId () returned 0xe9c [0092.223] GetCurrentProcessId () returned 0xe9c [0092.223] GetCurrentProcessId () returned 0xe9c [0092.223] GetCurrentProcessId () returned 0xe9c [0092.224] GetCurrentProcessId () returned 0xe9c [0092.224] GetCurrentProcessId () returned 0xe9c [0092.224] GetCurrentProcessId () returned 0xe9c [0092.224] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.225] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.226] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.227] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.228] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.229] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.230] GetCurrentProcessId () returned 0xe9c [0092.232] GetProcAddress (hModule=0x77b90000, lpProcName="NtContinue") returned 0x77c070d0 [0092.233] GetProcAddress (hModule=0x77b90000, lpProcName="NtRaiseException") returned 0x77c08190 [0092.233] GetProcAddress (hModule=0x77b90000, lpProcName="KiUserExceptionDispatcher") returned 0x77c08f50 [0092.234] GetProcAddress (hModule=0x77b90000, lpProcName="NtQuerySystemInformation") returned 0x77c07000 [0092.234] GetProcAddress (hModule=0x77b90000, lpProcName="NtAllocateVirtualMemory") returned 0x77c06e00 [0092.235] GetProcAddress (hModule=0x77b90000, lpProcName="NtFreeVirtualMemory") returned 0x77c06e80 [0092.235] GetProcAddress (hModule=0x77b90000, lpProcName="NtMapViewOfSection") returned 0x77c06f20 [0092.235] GetCurrentProcessId () returned 0xe9c [0092.235] GetCurrentProcessId () returned 0xe9c [0092.235] GetCurrentProcessId () returned 0xe9c [0092.235] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.236] GetCurrentProcessId () returned 0xe9c [0092.237] GetCurrentProcessId () returned 0xe9c [0092.237] GetCurrentProcessId () returned 0xe9c [0092.237] GetCurrentProcessId () returned 0xe9c [0092.237] GetCurrentProcessId () returned 0xe9c [0092.237] GetCurrentProcessId () returned 0xe9c [0092.237] GetCurrentProcessId () returned 0xe9c [0092.237] GetCurrentProcessId () returned 0xe9c [0092.237] GetCurrentProcessId () returned 0xe9c [0092.237] GetCurrentProcessId () returned 0xe9c [0092.237] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.238] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.239] GetCurrentProcessId () returned 0xe9c [0092.239] GetCurrentProcessId () returned 0xe9c [0092.239] GetCurrentProcessId () returned 0xe9c [0092.239] GetCurrentProcessId () returned 0xe9c [0092.239] GetCurrentProcessId () returned 0xe9c [0092.239] GetCurrentProcessId () returned 0xe9c [0092.239] GetCurrentProcessId () returned 0xe9c [0092.239] GetCurrentProcessId () returned 0xe9c [0092.239] GetCurrentProcessId () returned 0xe9c [0092.239] GetCurrentProcessId () returned 0xe9c [0092.239] GetCurrentProcessId () returned 0xe9c [0092.240] GetCurrentProcessId () returned 0xe9c [0092.240] GetCurrentProcessId () returned 0xe9c [0092.240] GetCurrentProcessId () returned 0xe9c [0092.240] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.241] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.242] GetCurrentProcessId () returned 0xe9c [0092.242] GetCurrentProcessId () returned 0xe9c [0092.242] GetCurrentProcessId () returned 0xe9c [0092.242] GetCurrentProcessId () returned 0xe9c [0092.242] GetCurrentProcessId () returned 0xe9c [0092.242] GetCurrentProcessId () returned 0xe9c [0092.242] GetCurrentProcessId () returned 0xe9c [0092.242] GetCurrentProcessId () returned 0xe9c [0092.242] GetCurrentProcessId () returned 0xe9c [0092.242] GetCurrentProcessId () returned 0xe9c [0092.242] GetCurrentProcessId () returned 0xe9c [0092.242] GetCurrentProcessId () returned 0xe9c [0092.242] GetCurrentProcessId () returned 0xe9c [0092.243] GetCurrentProcessId () returned 0xe9c [0092.243] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.244] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] GetCurrentProcessId () returned 0xe9c [0092.245] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.246] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.312] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.313] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.315] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.316] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.317] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.318] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.334] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.336] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.338] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.339] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.340] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.341] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.342] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.343] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.345] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.346] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.347] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.348] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.349] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.350] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.351] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.355] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.356] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.357] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.358] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x74f30000 [0092.359] GetProcAddress (hModule=0x74f30000, lpProcName="GetSystemInfo") returned 0x74f4a0f0 [0092.359] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x750d0000 [0092.360] GetProcAddress (hModule=0x750d0000, lpProcName="SendNotifyMessageA") returned 0x75159df0 [0092.360] LoadLibraryA (lpLibFileName="WTSAPI32.dll") returned 0x6ce20000 [0092.361] GetProcAddress (hModule=0x6ce20000, lpProcName="WTSSendMessageW") returned 0x6ce255d0 [0092.362] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.363] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualQuery") returned 0x74f47a90 [0092.363] LoadLibraryA (lpLibFileName="user32.dll") returned 0x750d0000 [0092.364] GetProcAddress (hModule=0x750d0000, lpProcName="GetProcessWindowStation") returned 0x75108b10 [0092.364] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.366] GetProcAddress (hModule=0x74f30000, lpProcName="LocalAlloc") returned 0x74f47a30 [0092.366] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.367] GetProcAddress (hModule=0x74f30000, lpProcName="LocalFree") returned 0x74f479a0 [0092.367] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.370] GetProcAddress (hModule=0x74f30000, lpProcName="GetModuleFileNameW") returned 0x74f49b00 [0092.370] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.371] GetProcAddress (hModule=0x74f30000, lpProcName="GetProcessAffinityMask") returned 0x74f49eb0 [0092.372] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.373] GetProcAddress (hModule=0x74f30000, lpProcName="SetProcessAffinityMask") returned 0x74f6ff40 [0092.373] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.374] GetProcAddress (hModule=0x74f30000, lpProcName="SetThreadAffinityMask") returned 0x74f4cfa0 [0092.374] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.375] GetProcAddress (hModule=0x74f30000, lpProcName="Sleep") returned 0x74f47990 [0092.377] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.378] GetProcAddress (hModule=0x74f30000, lpProcName="ExitProcess") returned 0x74f57b30 [0092.378] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.380] GetProcAddress (hModule=0x74f30000, lpProcName="FreeLibrary") returned 0x74f49f50 [0092.380] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.380] GetProcAddress (hModule=0x74f30000, lpProcName="LoadLibraryA") returned 0x74f54bf0 [0092.381] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.381] GetProcAddress (hModule=0x74f30000, lpProcName="GetModuleHandleA") returned 0x74f499f0 [0092.381] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74f30000 [0092.382] GetProcAddress (hModule=0x74f30000, lpProcName="GetProcAddress") returned 0x74f478b0 [0092.382] LoadLibraryA (lpLibFileName="user32.dll") returned 0x750d0000 [0092.383] GetProcAddress (hModule=0x750d0000, lpProcName="GetProcessWindowStation") returned 0x75108b10 [0092.383] LoadLibraryA (lpLibFileName="user32.dll") returned 0x750d0000 [0092.383] GetProcAddress (hModule=0x750d0000, lpProcName="GetUserObjectInformationW") returned 0x75108fa0 [0092.384] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.384] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.386] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.386] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.388] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.389] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.390] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.391] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.391] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.392] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.393] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.394] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.395] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.396] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.398] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.398] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.402] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.403] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.405] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.406] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.407] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.407] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.409] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.409] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.412] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.413] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.414] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.415] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.416] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.416] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.417] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.418] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.420] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.420] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.422] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.423] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.424] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.425] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.426] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.427] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.428] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.429] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.431] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.431] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.433] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.433] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.434] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.435] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.436] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.437] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.438] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.439] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.440] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.441] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.442] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.443] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.444] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.445] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.446] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.447] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.454] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.455] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.457] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.458] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.459] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.460] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.461] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.462] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.463] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.465] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.474] GetSystemTime (in: lpSystemTime=0x19feec | out: lpSystemTime=0x19feec*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x8, wMinute=0x28, wSecond=0x1, wMilliseconds=0x146)) [0092.474] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.475] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.479] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.480] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.481] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.482] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.483] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.484] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.485] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.486] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.488] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.489] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.491] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.492] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.512] ExpandEnvironmentStringsA (in: lpSrc="aspr_keys.ini", lpDst=0x19f6a0, nSize=0x400 | out: lpDst="aspr_keys.ini") returned 0xe [0092.512] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x19f9a0, nSize=0xff | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe")) returned 0x62 [0092.512] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\aspr_keys.ini", lpFindFileData=0x19f94c | out: lpFindFileData=0x19f94c*(dwFileAttributes=0xcc2128, ftCreationTime.dwLowDateTime=0x19faa8, ftCreationTime.dwHighDateTime=0xcc214c, ftLastAccessTime.dwLowDateTime=0xcc2153, ftLastAccessTime.dwHighDateTime=0x62, ftLastWriteTime.dwLowDateTime=0x19f9a0, ftLastWriteTime.dwHighDateTime=0x19fac0, nFileSizeHigh=0xd4c120, nFileSizeLow=0x27bc5b0, dwReserved0=0x19fed0, dwReserved1=0xcc25a2, cFileName="¸Å{\x02 ù\x19", cAlternateFileName="TÆ{\x02+")) returned 0xffffffff [0092.513] GetTempPathA (in: nBufferLength=0x3ff, lpBuffer=0x19fac8 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0092.513] FindFirstFileA (in: lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\aspr_keys.ini", lpFindFileData=0x19f94c | out: lpFindFileData=0x19f94c*(dwFileAttributes=0xd4c120, ftCreationTime.dwLowDateTime=0xd30000, ftCreationTime.dwHighDateTime=0xd4c920, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x24, ftLastWriteTime.dwLowDateTime=0x7ff, ftLastWriteTime.dwHighDateTime=0x19f9d8, nFileSizeHigh=0x24, nFileSizeLow=0x1, dwReserved0=0xa00000a, dwReserved1=0x0, cFileName="", cAlternateFileName="\x84ú\x19")) returned 0xffffffff [0092.513] GetCurrentProcessId () returned 0xe9c [0092.514] GetCurrentProcessId () returned 0xe9c [0092.516] GetCurrentProcessId () returned 0xe9c [0092.517] GetCurrentProcessId () returned 0xe9c [0092.518] GetCurrentProcessId () returned 0xe9c [0092.518] GetCurrentProcessId () returned 0xe9c [0092.518] GetCurrentProcessId () returned 0xe9c [0092.518] GetCurrentProcessId () returned 0xe9c [0092.519] GetCurrentProcessId () returned 0xe9c [0092.519] GetCurrentProcessId () returned 0xe9c [0092.519] GetCurrentProcessId () returned 0xe9c [0092.519] GetCurrentProcessId () returned 0xe9c [0092.519] GetCurrentProcessId () returned 0xe9c [0092.519] GetCurrentProcessId () returned 0xe9c [0092.519] GetCurrentProcessId () returned 0xe9c [0092.519] GetCurrentProcessId () returned 0xe9c [0092.519] GetCurrentProcessId () returned 0xe9c [0092.519] GetCurrentProcessId () returned 0xe9c [0092.519] GetCurrentProcessId () returned 0xe9c [0092.520] GetCurrentProcessId () returned 0xe9c [0092.520] GetCurrentProcessId () returned 0xe9c [0092.520] GetCurrentProcessId () returned 0xe9c [0092.520] GetCurrentProcessId () returned 0xe9c [0092.521] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.523] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.527] GetCurrentProcessId () returned 0xe9c [0092.527] GetCurrentProcessId () returned 0xe9c [0092.527] GetCurrentProcessId () returned 0xe9c [0092.527] GetCurrentProcessId () returned 0xe9c [0092.527] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.530] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] GetCurrentProcessId () returned 0xe9c [0092.532] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.535] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.536] GetCurrentProcessId () returned 0xe9c [0092.536] GetCurrentProcessId () returned 0xe9c [0092.536] GetCurrentProcessId () returned 0xe9c [0092.536] GetCurrentProcessId () returned 0xe9c [0092.536] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.539] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.540] GetCurrentProcessId () returned 0xe9c [0092.540] GetCurrentProcessId () returned 0xe9c [0092.541] GetCurrentProcessId () returned 0xe9c [0092.541] GetCurrentProcessId () returned 0xe9c [0092.541] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x37c0000 [0092.543] VirtualFree (lpAddress=0x37c0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.545] GetCurrentProcessId () returned 0xe9c [0092.545] GetCurrentProcessId () returned 0xe9c [0092.545] GetCurrentProcessId () returned 0xe9c [0092.545] GetCurrentProcessId () returned 0xe9c [0092.545] GetCurrentProcessId () returned 0xe9c [0092.546] GetCurrentProcessId () returned 0xe9c [0092.546] GetCurrentProcessId () returned 0xe9c [0092.546] GetCurrentProcessId () returned 0xe9c [0092.546] GetCurrentProcessId () returned 0xe9c [0092.546] GetCurrentProcessId () returned 0xe9c [0092.546] GetCurrentProcessId () returned 0xe9c [0092.546] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.548] VirtualFree (lpAddress=0x2930000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.553] VirtualFree (lpAddress=0x29e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.556] VirtualFree (lpAddress=0x2a90000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.558] VirtualFree (lpAddress=0x2b40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.561] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.562] GetCurrentProcessId () returned 0xe9c [0092.563] GetCurrentProcessId () returned 0xe9c [0092.563] GetCurrentProcessId () returned 0xe9c [0092.563] GetCurrentProcessId () returned 0xe9c [0092.563] GetCurrentProcessId () returned 0xe9c [0092.563] GetCurrentProcessId () returned 0xe9c [0092.563] GetCurrentProcessId () returned 0xe9c [0092.563] GetCurrentProcessId () returned 0xe9c [0092.563] GetCurrentProcessId () returned 0xe9c [0092.563] GetCurrentProcessId () returned 0xe9c [0092.563] GetCurrentProcessId () returned 0xe9c [0092.563] GetCurrentProcessId () returned 0xe9c [0092.563] GetCurrentProcessId () returned 0xe9c [0092.563] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2870000 [0092.565] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] GetCurrentProcessId () returned 0xe9c [0092.568] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2870000 [0092.569] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.570] GetCurrentProcessId () returned 0xe9c [0092.570] GetCurrentProcessId () returned 0xe9c [0092.570] GetCurrentProcessId () returned 0xe9c [0092.571] GetCurrentProcessId () returned 0xe9c [0092.571] GetCurrentProcessId () returned 0xe9c [0092.571] GetCurrentProcessId () returned 0xe9c [0092.571] GetCurrentProcessId () returned 0xe9c [0092.571] GetCurrentProcessId () returned 0xe9c [0092.571] GetCurrentProcessId () returned 0xe9c [0092.571] GetCurrentProcessId () returned 0xe9c [0092.571] GetCurrentProcessId () returned 0xe9c [0092.571] GetCurrentProcessId () returned 0xe9c [0092.571] GetCurrentProcessId () returned 0xe9c [0092.571] GetCurrentProcessId () returned 0xe9c [0092.571] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2870000 [0092.572] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.573] GetCurrentProcessId () returned 0xe9c [0092.573] GetCurrentProcessId () returned 0xe9c [0092.573] GetCurrentProcessId () returned 0xe9c [0092.573] GetCurrentProcessId () returned 0xe9c [0092.574] GetCurrentProcessId () returned 0xe9c [0092.574] GetCurrentProcessId () returned 0xe9c [0092.574] GetCurrentProcessId () returned 0xe9c [0092.574] GetCurrentProcessId () returned 0xe9c [0092.574] GetCurrentProcessId () returned 0xe9c [0092.574] GetCurrentProcessId () returned 0xe9c [0092.574] GetCurrentProcessId () returned 0xe9c [0092.574] GetCurrentProcessId () returned 0xe9c [0092.574] GetCurrentProcessId () returned 0xe9c [0092.574] GetCurrentProcessId () returned 0xe9c [0092.574] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2870000 [0092.575] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.577] GetCurrentProcessId () returned 0xe9c [0092.577] GetCurrentProcessId () returned 0xe9c [0092.577] GetCurrentProcessId () returned 0xe9c [0092.577] GetCurrentProcessId () returned 0xe9c [0092.577] GetCurrentProcessId () returned 0xe9c [0092.577] GetCurrentProcessId () returned 0xe9c [0092.578] GetCurrentProcessId () returned 0xe9c [0092.578] GetCurrentProcessId () returned 0xe9c [0092.578] GetCurrentProcessId () returned 0xe9c [0092.578] GetCurrentProcessId () returned 0xe9c [0092.578] GetCurrentProcessId () returned 0xe9c [0092.578] GetCurrentProcessId () returned 0xe9c [0092.578] GetCurrentProcessId () returned 0xe9c [0092.578] GetCurrentProcessId () returned 0xe9c [0092.578] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2870000 [0092.579] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] GetCurrentProcessId () returned 0xe9c [0092.580] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2870000 [0092.582] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] GetCurrentProcessId () returned 0xe9c [0092.583] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2870000 [0092.584] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.585] GetCurrentProcessId () returned 0xe9c [0092.585] GetCurrentProcessId () returned 0xe9c [0092.585] GetCurrentProcessId () returned 0xe9c [0092.585] GetCurrentProcessId () returned 0xe9c [0092.585] GetCurrentProcessId () returned 0xe9c [0092.585] GetCurrentProcessId () returned 0xe9c [0092.585] GetCurrentProcessId () returned 0xe9c [0092.585] GetCurrentProcessId () returned 0xe9c [0092.585] GetCurrentProcessId () returned 0xe9c [0092.586] GetCurrentProcessId () returned 0xe9c [0092.586] GetCurrentProcessId () returned 0xe9c [0092.586] GetCurrentProcessId () returned 0xe9c [0092.586] GetCurrentProcessId () returned 0xe9c [0092.586] GetCurrentProcessId () returned 0xe9c [0092.586] GetCurrentProcessId () returned 0xe9c [0092.586] GetCurrentProcessId () returned 0xe9c [0092.586] GetCurrentProcessId () returned 0xe9c [0092.586] GetCurrentProcessId () returned 0xe9c [0092.586] GetCurrentProcessId () returned 0xe9c [0092.586] GetCurrentProcessId () returned 0xe9c [0092.586] GetCurrentProcessId () returned 0xe9c [0092.589] GetCurrentProcessId () returned 0xe9c [0092.591] GetCurrentProcessId () returned 0xe9c [0092.592] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2870000 [0092.594] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.596] GetCurrentProcessId () returned 0xe9c [0092.596] GetCurrentProcessId () returned 0xe9c [0092.596] GetCurrentProcessId () returned 0xe9c [0092.596] GetCurrentProcessId () returned 0xe9c [0092.596] GetCurrentProcessId () returned 0xe9c [0092.596] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2870000 [0092.598] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.599] GetCurrentProcessId () returned 0xe9c [0092.599] GetCurrentProcessId () returned 0xe9c [0092.599] GetCurrentProcessId () returned 0xe9c [0092.599] GetCurrentProcessId () returned 0xe9c [0092.599] GetCurrentProcessId () returned 0xe9c [0092.599] GetCurrentProcessId () returned 0xe9c [0092.600] GetCurrentProcessId () returned 0xe9c [0092.600] GetCurrentProcessId () returned 0xe9c [0092.601] GetCurrentProcessId () returned 0xe9c [0092.601] GetCurrentProcessId () returned 0xe9c [0092.601] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2870000 [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] GetCurrentProcessId () returned 0xe9c [0092.602] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2930000 [0092.604] VirtualFree (lpAddress=0x2930000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.608] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2930000 [0092.610] VirtualFree (lpAddress=0x2930000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.611] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2930000 [0092.612] VirtualFree (lpAddress=0x2930000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.613] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2930000 [0092.614] VirtualFree (lpAddress=0x2930000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.615] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2930000 [0092.616] VirtualFree (lpAddress=0x2930000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.617] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2930000 [0092.618] VirtualFree (lpAddress=0x2930000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.619] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2930000 [0092.620] VirtualFree (lpAddress=0x2930000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.622] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.622] VirtualAlloc (lpAddress=0x0, dwSize=0x14, flAllocationType=0x1000, flProtect=0x40) returned 0x2870000 [0092.624] VirtualFree (lpAddress=0x2870000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.180] LocalAlloc (uFlags=0x0, uBytes=0xb0) returned 0xd4c120 [0093.224] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74f30000 [0093.225] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77b90000 [0093.242] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19ff00 | out: Wow64Process=0x19ff00*=1) returned 1 [0093.301] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x19faa4*=0x435000, NumberOfBytesToProtect=0x19fa9c, NewAccessProtection=0x40, OldAccessProtection=0x19fdcc | out: BaseAddress=0x19faa4*=0x435000, NumberOfBytesToProtect=0x19fa9c, OldAccessProtection=0x19fdcc*=0x80) returned 0x0 [0093.819] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x19faa4*=0x423000, NumberOfBytesToProtect=0x19fa9c, NewAccessProtection=0x40, OldAccessProtection=0x19fdcc | out: BaseAddress=0x19faa4*=0x423000, NumberOfBytesToProtect=0x19fa9c, OldAccessProtection=0x19fdcc*=0x80) returned 0x0 [0093.820] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x19faa4*=0x45a000, NumberOfBytesToProtect=0x19fa9c, NewAccessProtection=0x4, OldAccessProtection=0x19fdcc | out: BaseAddress=0x19faa4*=0x45a000, NumberOfBytesToProtect=0x19fa9c, OldAccessProtection=0x19fdcc*=0x80) returned 0x0 [0093.821] LocalAlloc (uFlags=0x0, uBytes=0x3e6c) returned 0xd4c1d8 [0096.413] LocalFree (hMem=0xd4c1d8) returned 0x0 [0096.413] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x74f30000 [0096.414] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.415] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.415] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.415] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.416] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.416] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.417] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.417] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.418] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.436] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x750d0000 [0096.436] GetModuleHandleA (lpModuleName="WTSAPI32.dll") returned 0x6ce20000 [0096.437] GetModuleHandleA (lpModuleName="KERNEL32.dll") returned 0x74f30000 [0096.438] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.439] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.439] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.440] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.441] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.441] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.442] GetModuleHandleA (lpModuleName="NTDLL") returned 0x77b90000 [0096.442] GetModuleHandleA (lpModuleName="USER32.dll") returned 0x750d0000 [0096.443] GetProcessAffinityMask (in: hProcess=0xffffffff, lpProcessAffinityMask=0x19fe90, lpSystemAffinityMask=0x19fec8 | out: lpProcessAffinityMask=0x19fe90, lpSystemAffinityMask=0x19fec8) returned 1 [0096.443] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x1) returned 0x1 [0096.443] Sleep (dwMilliseconds=0x0) [0096.446] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x1) returned 0x1 [0096.446] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x2) returned 0x0 [0096.448] Sleep (dwMilliseconds=0x0) [0096.449] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x0) returned 0x0 [0096.449] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x4) returned 0x0 [0096.449] Sleep (dwMilliseconds=0x0) [0096.450] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x0) returned 0x0 [0096.451] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x8) returned 0x0 [0096.451] Sleep (dwMilliseconds=0x0) [0096.452] SetThreadAffinityMask (hThread=0xfffffffe, dwThreadAffinityMask=0x0) returned 0x0 [0096.780] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f9ac | out: lpSystemTimeAsFileTime=0x19f9ac*(dwLowDateTime=0xadc0b245, dwHighDateTime=0x1d7fc8f)) [0097.002] GetCurrentProcessId () returned 0xe9c [0097.475] GetCurrentThreadId () returned 0x39c [0097.814] GetTickCount () returned 0xb5cbcb [0098.164] QueryPerformanceCounter (in: lpPerformanceCount=0x19f9a4 | out: lpPerformanceCount=0x19f9a4*=1201837435550) returned 1 [0098.540] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x38e0000 [0099.200] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0099.468] GetProcAddress (hModule=0x74f30000, lpProcName="FlsAlloc") returned 0x74f4a980 [0099.468] GetProcAddress (hModule=0x74f30000, lpProcName="FlsGetValue") returned 0x74f47570 [0099.469] GetProcAddress (hModule=0x74f30000, lpProcName="FlsSetValue") returned 0x74f49e30 [0099.470] GetProcAddress (hModule=0x74f30000, lpProcName="FlsFree") returned 0x74f54ff0 [0100.090] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0100.233] GetProcAddress (hModule=0x74f30000, lpProcName="EncodePointer") returned 0x77bef730 [0100.635] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0100.635] GetProcAddress (hModule=0x74f30000, lpProcName="EncodePointer") returned 0x77bef730 [0101.079] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0101.079] GetProcAddress (hModule=0x74f30000, lpProcName="EncodePointer") returned 0x77bef730 [0101.080] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0101.080] GetProcAddress (hModule=0x74f30000, lpProcName="EncodePointer") returned 0x77bef730 [0101.080] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0101.081] GetProcAddress (hModule=0x74f30000, lpProcName="EncodePointer") returned 0x77bef730 [0101.081] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0101.082] GetProcAddress (hModule=0x74f30000, lpProcName="EncodePointer") returned 0x77bef730 [0101.111] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0101.112] GetProcAddress (hModule=0x74f30000, lpProcName="EncodePointer") returned 0x77bef730 [0101.534] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0101.707] GetProcAddress (hModule=0x74f30000, lpProcName="DecodePointer") returned 0x77bed830 [0102.099] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x214) returned 0x38e05a8 [0102.099] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0102.100] GetProcAddress (hModule=0x74f30000, lpProcName="DecodePointer") returned 0x77bed830 [0102.609] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74f30000 [0102.685] GetProcAddress (hModule=0x74f30000, lpProcName="EncodePointer") returned 0x77bef730 [0102.686] GetProcAddress (hModule=0x74f30000, lpProcName="DecodePointer") returned 0x77bed830 [0103.675] GetCurrentThreadId () returned 0x39c [0103.817] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe\" " [0103.981] GetEnvironmentStringsW () returned 0xd4c1d8* [0104.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1293 [0104.030] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x50d) returned 0x38e07c8 [0104.030] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x38e07c8, cbMultiByte=1293, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1293 [0104.199] FreeEnvironmentStringsW (penv=0xd4c1d8) returned 1 [0104.412] GetStartupInfoA (in: lpStartupInfo=0x19f8fc | out: lpStartupInfo=0x19f8fc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0104.413] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x800) returned 0x38e0ce0 [0104.930] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0104.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0104.930] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0105.080] SetHandleCount (uNumber=0x20) returned 0x20 [0105.187] GetLastError () returned 0x0 [0105.296] SetLastError (dwErrCode=0x0) [0105.296] GetLastError () returned 0x0 [0105.297] SetLastError (dwErrCode=0x0) [0105.331] GetLastError () returned 0x0 [0105.331] SetLastError (dwErrCode=0x0) [0105.659] GetACP () returned 0x4e4 [0105.659] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x220) returned 0x38e14e8 [0105.659] GetLastError () returned 0x0 [0105.659] SetLastError (dwErrCode=0x0) [0105.970] IsValidCodePage (CodePage=0x4e4) returned 1 [0106.166] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f8dc | out: lpCPInfo=0x19f8dc) returned 1 [0106.271] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f3a8 | out: lpCPInfo=0x19f3a8) returned 1 [0106.313] GetLastError () returned 0x0 [0106.313] SetLastError (dwErrCode=0x0) [0106.426] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f338 | out: lpCharType=0x19f338) returned 1 [0106.426] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f7bc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0106.426] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f7bc, cbMultiByte=256, lpWideCharStr=0x19f128, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ１DĀ") returned 256 [0106.601] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ１DĀ", cchSrc=256, lpCharType=0x19f3bc | out: lpCharType=0x19f3bc) returned 1 [0106.601] GetLastError () returned 0x0 [0106.601] SetLastError (dwErrCode=0x0) [0106.809] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0106.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f7bc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0106.809] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f7bc, cbMultiByte=256, lpWideCharStr=0x19f0f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0106.844] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0107.026] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19eee8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0107.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x19f6bc, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿH\x9b¬\x7fôø\x19", lpUsedDefaultChar=0x0) returned 256 [0107.100] GetLastError () returned 0x0 [0107.100] SetLastError (dwErrCode=0x0) [0107.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f7bc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0107.100] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19f7bc, cbMultiByte=256, lpWideCharStr=0x19f118, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0107.100] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0107.100] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19ef08, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0107.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x19f5bc, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿH\x9b¬\x7fôø\x19", lpUsedDefaultChar=0x0) returned 256 [0107.653] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x45d528, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe")) returned 0x62 [0107.654] GetLastError () returned 0x0 [0107.654] SetLastError (dwErrCode=0x0) [0107.654] GetLastError () returned 0x0 [0107.654] SetLastError (dwErrCode=0x0) [0107.654] GetLastError () returned 0x0 [0107.654] SetLastError (dwErrCode=0x0) [0107.654] GetLastError () returned 0x0 [0107.654] SetLastError (dwErrCode=0x0) [0107.654] GetLastError () returned 0x0 [0107.654] SetLastError (dwErrCode=0x0) [0107.654] GetLastError () returned 0x0 [0107.655] SetLastError (dwErrCode=0x0) [0107.655] GetLastError () returned 0x0 [0107.655] SetLastError (dwErrCode=0x0) [0107.655] GetLastError () returned 0x0 [0107.655] SetLastError (dwErrCode=0x0) [0107.655] GetLastError () returned 0x0 [0107.655] SetLastError (dwErrCode=0x0) [0107.655] GetLastError () returned 0x0 [0107.655] SetLastError (dwErrCode=0x0) [0107.655] GetLastError () returned 0x0 [0107.655] SetLastError (dwErrCode=0x0) [0107.655] GetLastError () returned 0x0 [0107.655] SetLastError (dwErrCode=0x0) [0107.655] GetLastError () returned 0x0 [0107.655] SetLastError (dwErrCode=0x0) [0107.655] GetLastError () returned 0x0 [0107.655] SetLastError (dwErrCode=0x0) [0107.656] GetLastError () returned 0x0 [0107.656] SetLastError (dwErrCode=0x0) [0107.656] GetLastError () returned 0x0 [0107.656] SetLastError (dwErrCode=0x0) [0107.656] GetLastError () returned 0x0 [0107.656] SetLastError (dwErrCode=0x0) [0107.656] GetLastError () returned 0x0 [0107.656] SetLastError (dwErrCode=0x0) [0107.656] GetLastError () returned 0x0 [0107.656] SetLastError (dwErrCode=0x0) [0107.656] GetLastError () returned 0x0 [0107.656] SetLastError (dwErrCode=0x0) [0107.656] GetLastError () returned 0x0 [0107.656] SetLastError (dwErrCode=0x0) [0107.656] GetLastError () returned 0x0 [0107.656] SetLastError (dwErrCode=0x0) [0107.656] GetLastError () returned 0x0 [0107.656] SetLastError (dwErrCode=0x0) [0107.656] GetLastError () returned 0x0 [0107.656] SetLastError (dwErrCode=0x0) [0107.656] GetLastError () returned 0x0 [0107.657] SetLastError (dwErrCode=0x0) [0107.657] GetLastError () returned 0x0 [0107.657] SetLastError (dwErrCode=0x0) [0107.657] GetLastError () returned 0x0 [0107.657] SetLastError (dwErrCode=0x0) [0107.657] GetLastError () returned 0x0 [0107.657] SetLastError (dwErrCode=0x0) [0107.657] GetLastError () returned 0x0 [0107.657] SetLastError (dwErrCode=0x0) [0107.657] GetLastError () returned 0x0 [0107.657] SetLastError (dwErrCode=0x0) [0107.657] GetLastError () returned 0x0 [0107.657] SetLastError (dwErrCode=0x0) [0107.657] GetLastError () returned 0x0 [0107.657] SetLastError (dwErrCode=0x0) [0107.657] GetLastError () returned 0x0 [0107.658] SetLastError (dwErrCode=0x0) [0107.658] GetLastError () returned 0x0 [0107.658] SetLastError (dwErrCode=0x0) [0107.658] GetLastError () returned 0x0 [0107.658] SetLastError (dwErrCode=0x0) [0107.658] GetLastError () returned 0x0 [0107.658] SetLastError (dwErrCode=0x0) [0107.658] GetLastError () returned 0x0 [0107.658] SetLastError (dwErrCode=0x0) [0107.658] GetLastError () returned 0x0 [0107.658] SetLastError (dwErrCode=0x0) [0107.658] GetLastError () returned 0x0 [0107.658] SetLastError (dwErrCode=0x0) [0107.658] GetLastError () returned 0x0 [0107.658] SetLastError (dwErrCode=0x0) [0107.658] GetLastError () returned 0x0 [0107.658] SetLastError (dwErrCode=0x0) [0107.658] GetLastError () returned 0x0 [0107.658] SetLastError (dwErrCode=0x0) [0107.658] GetLastError () returned 0x0 [0107.659] SetLastError (dwErrCode=0x0) [0107.659] GetLastError () returned 0x0 [0107.659] SetLastError (dwErrCode=0x0) [0107.659] GetLastError () returned 0x0 [0107.659] SetLastError (dwErrCode=0x0) [0107.659] GetLastError () returned 0x0 [0107.659] SetLastError (dwErrCode=0x0) [0107.659] GetLastError () returned 0x0 [0107.659] SetLastError (dwErrCode=0x0) [0107.659] GetLastError () returned 0x0 [0107.659] SetLastError (dwErrCode=0x0) [0107.659] GetLastError () returned 0x0 [0107.659] SetLastError (dwErrCode=0x0) [0107.659] GetLastError () returned 0x0 [0107.659] SetLastError (dwErrCode=0x0) [0107.659] GetLastError () returned 0x0 [0107.659] SetLastError (dwErrCode=0x0) [0107.659] GetLastError () returned 0x0 [0107.659] SetLastError (dwErrCode=0x0) [0107.659] GetLastError () returned 0x0 [0107.660] SetLastError (dwErrCode=0x0) [0107.660] GetLastError () returned 0x0 [0107.660] SetLastError (dwErrCode=0x0) [0107.660] GetLastError () returned 0x0 [0107.660] SetLastError (dwErrCode=0x0) [0107.660] GetLastError () returned 0x0 [0107.660] SetLastError (dwErrCode=0x0) [0107.660] GetLastError () returned 0x0 [0107.660] SetLastError (dwErrCode=0x0) [0107.660] GetLastError () returned 0x0 [0107.660] SetLastError (dwErrCode=0x0) [0107.660] GetLastError () returned 0x0 [0107.660] SetLastError (dwErrCode=0x0) [0107.660] GetLastError () returned 0x0 [0107.660] SetLastError (dwErrCode=0x0) [0107.660] GetLastError () returned 0x0 [0107.660] SetLastError (dwErrCode=0x0) [0107.660] GetLastError () returned 0x0 [0107.661] SetLastError (dwErrCode=0x0) [0107.661] GetLastError () returned 0x0 [0107.661] SetLastError (dwErrCode=0x0) [0107.661] GetLastError () returned 0x0 [0107.661] SetLastError (dwErrCode=0x0) [0107.661] GetLastError () returned 0x0 [0107.661] SetLastError (dwErrCode=0x0) [0107.661] GetLastError () returned 0x0 [0107.661] SetLastError (dwErrCode=0x0) [0107.661] GetLastError () returned 0x0 [0107.661] SetLastError (dwErrCode=0x0) [0107.661] GetLastError () returned 0x0 [0107.661] SetLastError (dwErrCode=0x0) [0107.661] GetLastError () returned 0x0 [0107.661] SetLastError (dwErrCode=0x0) [0107.661] GetLastError () returned 0x0 [0107.661] SetLastError (dwErrCode=0x0) [0107.661] GetLastError () returned 0x0 [0107.661] SetLastError (dwErrCode=0x0) [0107.661] GetLastError () returned 0x0 [0107.661] SetLastError (dwErrCode=0x0) [0107.662] GetLastError () returned 0x0 [0107.662] SetLastError (dwErrCode=0x0) [0107.662] GetLastError () returned 0x0 [0107.662] SetLastError (dwErrCode=0x0) [0107.662] GetLastError () returned 0x0 [0107.662] SetLastError (dwErrCode=0x0) [0107.662] GetLastError () returned 0x0 [0107.662] SetLastError (dwErrCode=0x0) [0107.662] GetLastError () returned 0x0 [0107.662] SetLastError (dwErrCode=0x0) [0107.662] GetLastError () returned 0x0 [0107.662] SetLastError (dwErrCode=0x0) [0107.662] GetLastError () returned 0x0 [0107.662] SetLastError (dwErrCode=0x0) [0107.662] GetLastError () returned 0x0 [0107.662] SetLastError (dwErrCode=0x0) [0107.662] GetLastError () returned 0x0 [0107.662] SetLastError (dwErrCode=0x0) [0107.662] GetLastError () returned 0x0 [0107.662] SetLastError (dwErrCode=0x0) [0107.662] GetLastError () returned 0x0 [0107.662] SetLastError (dwErrCode=0x0) [0107.663] GetLastError () returned 0x0 [0107.663] SetLastError (dwErrCode=0x0) [0107.663] GetLastError () returned 0x0 [0107.663] SetLastError (dwErrCode=0x0) [0107.663] GetLastError () returned 0x0 [0107.663] SetLastError (dwErrCode=0x0) [0107.663] GetLastError () returned 0x0 [0107.663] SetLastError (dwErrCode=0x0) [0107.663] GetLastError () returned 0x0 [0107.663] SetLastError (dwErrCode=0x0) [0107.663] GetLastError () returned 0x0 [0107.663] SetLastError (dwErrCode=0x0) [0107.663] GetLastError () returned 0x0 [0107.663] SetLastError (dwErrCode=0x0) [0107.663] GetLastError () returned 0x0 [0107.663] SetLastError (dwErrCode=0x0) [0107.663] GetLastError () returned 0x0 [0107.663] SetLastError (dwErrCode=0x0) [0107.663] GetLastError () returned 0x0 [0107.663] SetLastError (dwErrCode=0x0) [0107.663] GetLastError () returned 0x0 [0107.664] SetLastError (dwErrCode=0x0) [0107.664] GetLastError () returned 0x0 [0107.664] SetLastError (dwErrCode=0x0) [0107.664] GetLastError () returned 0x0 [0107.664] SetLastError (dwErrCode=0x0) [0107.664] GetLastError () returned 0x0 [0107.664] SetLastError (dwErrCode=0x0) [0107.664] GetLastError () returned 0x0 [0107.664] SetLastError (dwErrCode=0x0) [0107.664] GetLastError () returned 0x0 [0107.664] SetLastError (dwErrCode=0x0) [0107.664] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x6b) returned 0x38e1710 [0107.664] GetLastError () returned 0x0 [0107.664] SetLastError (dwErrCode=0x0) [0107.664] GetLastError () returned 0x0 [0107.664] SetLastError (dwErrCode=0x0) [0107.664] GetLastError () returned 0x0 [0107.664] SetLastError (dwErrCode=0x0) [0107.664] GetLastError () returned 0x0 [0107.664] SetLastError (dwErrCode=0x0) [0107.664] GetLastError () returned 0x0 [0107.664] SetLastError (dwErrCode=0x0) [0107.665] GetLastError () returned 0x0 [0107.665] SetLastError (dwErrCode=0x0) [0107.665] GetLastError () returned 0x0 [0107.665] SetLastError (dwErrCode=0x0) [0107.665] GetLastError () returned 0x0 [0107.665] SetLastError (dwErrCode=0x0) [0107.665] GetLastError () returned 0x0 [0107.665] SetLastError (dwErrCode=0x0) [0107.665] GetLastError () returned 0x0 [0107.665] SetLastError (dwErrCode=0x0) [0107.665] GetLastError () returned 0x0 [0107.665] SetLastError (dwErrCode=0x0) [0107.665] GetLastError () returned 0x0 [0107.665] SetLastError (dwErrCode=0x0) [0107.665] GetLastError () returned 0x0 [0107.665] SetLastError (dwErrCode=0x0) [0107.665] GetLastError () returned 0x0 [0107.665] SetLastError (dwErrCode=0x0) [0107.665] GetLastError () returned 0x0 [0107.665] SetLastError (dwErrCode=0x0) [0107.665] GetLastError () returned 0x0 [0107.666] SetLastError (dwErrCode=0x0) [0107.666] GetLastError () returned 0x0 [0107.666] SetLastError (dwErrCode=0x0) [0107.666] GetLastError () returned 0x0 [0107.666] SetLastError (dwErrCode=0x0) [0107.666] GetLastError () returned 0x0 [0107.666] SetLastError (dwErrCode=0x0) [0107.666] GetLastError () returned 0x0 [0107.666] SetLastError (dwErrCode=0x0) [0107.666] GetLastError () returned 0x0 [0107.666] SetLastError (dwErrCode=0x0) [0107.666] GetLastError () returned 0x0 [0107.666] SetLastError (dwErrCode=0x0) [0107.666] GetLastError () returned 0x0 [0107.666] SetLastError (dwErrCode=0x0) [0107.666] GetLastError () returned 0x0 [0107.666] SetLastError (dwErrCode=0x0) [0107.666] GetLastError () returned 0x0 [0107.666] SetLastError (dwErrCode=0x0) [0107.666] GetLastError () returned 0x0 [0107.667] SetLastError (dwErrCode=0x0) [0107.667] GetLastError () returned 0x0 [0107.667] SetLastError (dwErrCode=0x0) [0107.667] GetLastError () returned 0x0 [0107.667] SetLastError (dwErrCode=0x0) [0107.667] GetLastError () returned 0x0 [0107.667] SetLastError (dwErrCode=0x0) [0107.667] GetLastError () returned 0x0 [0107.667] SetLastError (dwErrCode=0x0) [0107.667] GetLastError () returned 0x0 [0107.667] SetLastError (dwErrCode=0x0) [0107.667] GetLastError () returned 0x0 [0107.667] SetLastError (dwErrCode=0x0) [0107.667] GetLastError () returned 0x0 [0107.667] SetLastError (dwErrCode=0x0) [0107.667] GetLastError () returned 0x0 [0107.667] SetLastError (dwErrCode=0x0) [0107.667] GetLastError () returned 0x0 [0107.667] SetLastError (dwErrCode=0x0) [0107.667] GetLastError () returned 0x0 [0107.667] SetLastError (dwErrCode=0x0) [0107.667] GetLastError () returned 0x0 [0107.668] SetLastError (dwErrCode=0x0) [0107.668] GetLastError () returned 0x0 [0107.668] SetLastError (dwErrCode=0x0) [0107.668] GetLastError () returned 0x0 [0107.668] SetLastError (dwErrCode=0x0) [0107.668] GetLastError () returned 0x0 [0107.668] SetLastError (dwErrCode=0x0) [0107.668] GetLastError () returned 0x0 [0107.668] SetLastError (dwErrCode=0x0) [0107.668] GetLastError () returned 0x0 [0107.668] SetLastError (dwErrCode=0x0) [0107.668] GetLastError () returned 0x0 [0107.668] SetLastError (dwErrCode=0x0) [0107.668] GetLastError () returned 0x0 [0107.668] SetLastError (dwErrCode=0x0) [0107.668] GetLastError () returned 0x0 [0107.668] SetLastError (dwErrCode=0x0) [0107.668] GetLastError () returned 0x0 [0107.668] SetLastError (dwErrCode=0x0) [0107.668] GetLastError () returned 0x0 [0107.669] SetLastError (dwErrCode=0x0) [0107.669] GetLastError () returned 0x0 [0107.669] SetLastError (dwErrCode=0x0) [0107.669] GetLastError () returned 0x0 [0107.669] SetLastError (dwErrCode=0x0) [0107.669] GetLastError () returned 0x0 [0107.669] SetLastError (dwErrCode=0x0) [0107.669] GetLastError () returned 0x0 [0107.669] SetLastError (dwErrCode=0x0) [0107.669] GetLastError () returned 0x0 [0107.669] SetLastError (dwErrCode=0x0) [0107.669] GetLastError () returned 0x0 [0107.669] SetLastError (dwErrCode=0x0) [0107.669] GetLastError () returned 0x0 [0107.669] SetLastError (dwErrCode=0x0) [0107.669] GetLastError () returned 0x0 [0107.669] SetLastError (dwErrCode=0x0) [0107.669] GetLastError () returned 0x0 [0107.669] SetLastError (dwErrCode=0x0) [0107.669] GetLastError () returned 0x0 [0107.670] SetLastError (dwErrCode=0x0) [0107.670] GetLastError () returned 0x0 [0107.670] SetLastError (dwErrCode=0x0) [0107.670] GetLastError () returned 0x0 [0107.670] SetLastError (dwErrCode=0x0) [0107.670] GetLastError () returned 0x0 [0107.670] SetLastError (dwErrCode=0x0) [0107.670] GetLastError () returned 0x0 [0107.671] SetLastError (dwErrCode=0x0) [0107.671] GetLastError () returned 0x0 [0107.671] SetLastError (dwErrCode=0x0) [0107.671] GetLastError () returned 0x0 [0107.671] SetLastError (dwErrCode=0x0) [0107.671] GetLastError () returned 0x0 [0107.671] SetLastError (dwErrCode=0x0) [0107.671] GetLastError () returned 0x0 [0107.671] SetLastError (dwErrCode=0x0) [0107.671] GetLastError () returned 0x0 [0107.671] SetLastError (dwErrCode=0x0) [0107.671] GetLastError () returned 0x0 [0107.671] SetLastError (dwErrCode=0x0) [0107.672] GetLastError () returned 0x0 [0107.672] SetLastError (dwErrCode=0x0) [0107.672] GetLastError () returned 0x0 [0107.672] SetLastError (dwErrCode=0x0) [0107.672] GetLastError () returned 0x0 [0107.672] SetLastError (dwErrCode=0x0) [0107.672] GetLastError () returned 0x0 [0107.672] SetLastError (dwErrCode=0x0) [0107.672] GetLastError () returned 0x0 [0107.672] SetLastError (dwErrCode=0x0) [0107.672] GetLastError () returned 0x0 [0107.672] SetLastError (dwErrCode=0x0) [0107.672] GetLastError () returned 0x0 [0107.672] SetLastError (dwErrCode=0x0) [0107.672] GetLastError () returned 0x0 [0107.672] SetLastError (dwErrCode=0x0) [0107.672] GetLastError () returned 0x0 [0107.672] SetLastError (dwErrCode=0x0) [0107.672] GetLastError () returned 0x0 [0107.672] SetLastError (dwErrCode=0x0) [0107.672] GetLastError () returned 0x0 [0107.673] SetLastError (dwErrCode=0x0) [0107.673] GetLastError () returned 0x0 [0107.673] SetLastError (dwErrCode=0x0) [0107.673] GetLastError () returned 0x0 [0107.673] SetLastError (dwErrCode=0x0) [0107.673] GetLastError () returned 0x0 [0107.673] SetLastError (dwErrCode=0x0) [0107.673] GetLastError () returned 0x0 [0107.673] SetLastError (dwErrCode=0x0) [0107.673] GetLastError () returned 0x0 [0107.673] SetLastError (dwErrCode=0x0) [0107.673] GetLastError () returned 0x0 [0107.673] SetLastError (dwErrCode=0x0) [0107.673] GetLastError () returned 0x0 [0107.673] SetLastError (dwErrCode=0x0) [0107.673] GetLastError () returned 0x0 [0107.673] SetLastError (dwErrCode=0x0) [0107.673] GetLastError () returned 0x0 [0107.673] SetLastError (dwErrCode=0x0) [0107.673] GetLastError () returned 0x0 [0107.673] SetLastError (dwErrCode=0x0) [0107.673] GetLastError () returned 0x0 [0107.674] SetLastError (dwErrCode=0x0) [0107.674] GetLastError () returned 0x0 [0107.674] SetLastError (dwErrCode=0x0) [0107.674] GetLastError () returned 0x0 [0107.674] SetLastError (dwErrCode=0x0) [0107.674] GetLastError () returned 0x0 [0107.674] SetLastError (dwErrCode=0x0) [0107.674] GetLastError () returned 0x0 [0107.674] SetLastError (dwErrCode=0x0) [0107.674] GetLastError () returned 0x0 [0107.674] SetLastError (dwErrCode=0x0) [0107.674] GetLastError () returned 0x0 [0107.674] SetLastError (dwErrCode=0x0) [0107.674] GetLastError () returned 0x0 [0107.674] SetLastError (dwErrCode=0x0) [0107.674] GetLastError () returned 0x0 [0107.674] SetLastError (dwErrCode=0x0) [0107.674] GetLastError () returned 0x0 [0107.674] SetLastError (dwErrCode=0x0) [0107.674] GetLastError () returned 0x0 [0107.675] SetLastError (dwErrCode=0x0) [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x90) returned 0x38e1788 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x1f) returned 0x38e1820 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x2e) returned 0x38e1848 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x37) returned 0x38e1880 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x3c) returned 0x38e18c0 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x31) returned 0x38e1908 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x14) returned 0x38e1948 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x24) returned 0x38e1968 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0xd) returned 0x38e1998 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x1d) returned 0x38e19b0 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x31) returned 0x38e19d8 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x15) returned 0x38e1a18 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x17) returned 0x38e1a38 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0xe) returned 0x38e1a58 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x69) returned 0x38e1a70 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x3e) returned 0x38e1ae8 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x1b) returned 0x38e1b30 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x1d) returned 0x38e1b58 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x48) returned 0x38e1b80 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x12) returned 0x38e1bd0 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x18) returned 0x38e1bf0 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x1b) returned 0x38e1c10 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x24) returned 0x38e1c38 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x29) returned 0x38e1c68 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x1e) returned 0x38e1ca0 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x6b) returned 0x38e1cc8 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x17) returned 0x38e1d40 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0xf) returned 0x38e1d60 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x16) returned 0x38e1d78 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x2a) returned 0x38e1d98 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x29) returned 0x38e1dd0 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x12) returned 0x38e1e08 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x21) returned 0x38e1e28 [0107.675] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x16) returned 0x38e1e58 [0107.676] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x22) returned 0x38e1e78 [0107.676] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x12) returned 0x38e1ea8 [0107.683] HeapFree (in: hHeap=0x38e0000, dwFlags=0x0, lpMem=0x38e07c8 | out: hHeap=0x38e0000) returned 1 [0108.075] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x80) returned 0x38e1ec8 [0108.076] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x8, Size=0x800) returned 0x38e1f50 [0108.144] RtlSizeHeap (HeapHandle=0x38e0000, Flags=0x0, MemoryPointer=0x38e1ec8) returned 0x80 [0129.366] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x50) returned 0x38e07c8 [0133.380] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x2c) returned 0x38e0820 [0134.152] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x108) returned 0x38e0858 [0134.363] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x1c) returned 0x38e0968 [0134.490] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x50) returned 0x38e0990 [0134.629] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xc) returned 0x38e09e8 [0134.629] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xd) returned 0x38e0a00 [0134.663] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74f30000 [0134.664] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xc) returned 0x38e0a18 [0134.664] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x14) returned 0x38e0a30 [0134.817] CreateToolhelp32Snapshot (dwFlags=0x4, th32ProcessID=0x0) returned 0x124 [0134.865] Thread32First (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0134.867] GetCurrentProcessId () returned 0xe9c [0134.900] GetCurrentThreadId () returned 0x39c [0135.157] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.522] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.580] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.582] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.583] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.584] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.586] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.587] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.588] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.590] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.591] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.592] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.593] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.595] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.596] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.598] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.599] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.600] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.601] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.603] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.604] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.605] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.607] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.608] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.609] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.611] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.612] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.615] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.618] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.619] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.621] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.622] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.623] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.625] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.626] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.627] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.629] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.630] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.631] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.633] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.634] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.635] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.637] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.638] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.639] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.641] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.642] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.643] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.645] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.646] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.647] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.649] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.650] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.692] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.694] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.697] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.699] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.700] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.701] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.703] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.704] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.706] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.707] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.709] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.710] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.711] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.713] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.714] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.715] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.717] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.718] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.719] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.721] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.722] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.723] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.725] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.726] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.727] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.730] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.731] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.733] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.734] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.735] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.737] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.738] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.743] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.744] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.745] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.747] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.748] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.749] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.751] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.755] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.756] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.758] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.759] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.761] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.763] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.765] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.767] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.769] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.774] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.777] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.778] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.780] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.783] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.784] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.787] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.789] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.790] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.792] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.793] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.795] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.797] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.798] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.800] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.801] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.803] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.804] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.806] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.808] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.809] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.811] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.814] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.815] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.817] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.819] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.820] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.822] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.823] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.825] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.826] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.828] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.830] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.831] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.833] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.834] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.836] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.837] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.839] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.840] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.842] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.844] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.845] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.847] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.850] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.852] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.853] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.855] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.856] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.858] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.860] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.862] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.863] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.865] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.866] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.868] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.869] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.871] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.873] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.875] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.876] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.878] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.880] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.881] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.884] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.888] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.890] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.891] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.892] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.893] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.895] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.897] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.898] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.900] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.901] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.903] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.904] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.906] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.908] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.909] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.911] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.912] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.914] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.916] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.917] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.919] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0147.922] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.060] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.062] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.064] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.065] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.067] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.068] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.071] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.072] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.074] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.076] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.078] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.080] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.082] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.083] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.085] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.086] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.088] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.092] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.094] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.095] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.097] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.104] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.106] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.107] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.109] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.110] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.113] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.115] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.116] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.118] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.119] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.121] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.123] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.124] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.126] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.127] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.129] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.130] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.132] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.134] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.135] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.138] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.140] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.141] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.143] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.145] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.147] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.149] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.150] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.152] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.153] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.155] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.157] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.158] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.160] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.161] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.163] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.164] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.166] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.168] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.169] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.171] Thread32Next (hSnapshot=0x124, lpte=0x19f7fc) returned 1 [0148.448] OpenThread (dwDesiredAccess=0x2, bInheritHandle=0, dwThreadId=0xe0c) returned 0x0 [0148.825] OpenThread (dwDesiredAccess=0x2, bInheritHandle=0, dwThreadId=0xb74) returned 0x0 [0148.860] CloseHandle (hObject=0x124) returned 1 [0150.442] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xc) returned 0x38e0a50 [0150.578] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xa) returned 0x38e0a68 [0150.579] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77b90000 [0150.579] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xc) returned 0x38e0a80 [0150.579] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x12) returned 0x38e0a98 [0150.681] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x10) returned 0x38e0ab8 [0150.714] GetSystemInfo (in: lpSystemInfo=0x19f300 | out: lpSystemInfo=0x19f300*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0150.715] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0xaf0000 [0150.788] GetCurrentProcess () returned 0xffffffff [0150.788] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xaf0005, lpBuffer=0x19f2e4*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e4*, lpNumberOfBytesWritten=0x0) returned 1 [0150.791] GetCurrentProcess () returned 0xffffffff [0150.791] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xaf000f, lpBuffer=0x19f2e8*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e8*, lpNumberOfBytesWritten=0x0) returned 1 [0150.793] GetCurrentProcess () returned 0xffffffff [0150.793] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x77bcc880, lpBuffer=0x19f2e4*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e4*, lpNumberOfBytesWritten=0x0) returned 1 [0150.797] VirtualProtect (in: lpAddress=0xaf0000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x19f324 | out: lpflOldProtect=0x19f324*=0x40) returned 1 [0150.798] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x4) returned 0x38e0ad0 [0150.858] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xc) returned 0x38e0ae0 [0150.858] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x12) returned 0x38e0af8 [0150.859] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x10) returned 0x38e0b18 [0150.859] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0xb00000 [0150.860] GetCurrentProcess () returned 0xffffffff [0150.860] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xb00008, lpBuffer=0x19f2e4*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e4*, lpNumberOfBytesWritten=0x0) returned 1 [0150.862] GetCurrentProcess () returned 0xffffffff [0150.862] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xb00015, lpBuffer=0x19f2e8*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e8*, lpNumberOfBytesWritten=0x0) returned 1 [0150.864] GetCurrentProcess () returned 0xffffffff [0150.864] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x77c1bd60, lpBuffer=0x19f2e4*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e4*, lpNumberOfBytesWritten=0x0) returned 1 [0150.865] VirtualProtect (in: lpAddress=0xb00000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x19f324 | out: lpflOldProtect=0x19f324*=0x40) returned 1 [0150.866] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x8) returned 0x38e0b30 [0150.866] HeapFree (in: hHeap=0x38e0000, dwFlags=0x0, lpMem=0x38e0ad0 | out: hHeap=0x38e0000) returned 1 [0150.867] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xc) returned 0x38e0b40 [0150.867] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xb) returned 0x38e0b58 [0150.867] GetModuleHandleA (lpModuleName="user32.dll") returned 0x750d0000 [0150.868] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xc) returned 0x38e0b70 [0150.868] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xc) returned 0x38e0b88 [0150.869] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x10) returned 0x38e0ba0 [0150.869] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0xb10000 [0150.870] GetCurrentProcess () returned 0xffffffff [0150.870] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xb10005, lpBuffer=0x19f2e4*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e4*, lpNumberOfBytesWritten=0x0) returned 1 [0150.871] GetCurrentProcess () returned 0xffffffff [0150.871] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xb1000f, lpBuffer=0x19f2e8*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e8*, lpNumberOfBytesWritten=0x0) returned 1 [0150.873] GetCurrentProcess () returned 0xffffffff [0150.873] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x750ffd20, lpBuffer=0x19f2e4*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e4*, lpNumberOfBytesWritten=0x0) returned 1 [0150.874] VirtualProtect (in: lpAddress=0xb10000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x19f324 | out: lpflOldProtect=0x19f324*=0x40) returned 1 [0150.875] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x10) returned 0x38e04a0 [0150.880] HeapFree (in: hHeap=0x38e0000, dwFlags=0x0, lpMem=0x38e0b30 | out: hHeap=0x38e0000) returned 1 [0150.880] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xc) returned 0x38e5878 [0150.880] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xc) returned 0x38e5728 [0150.882] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x10) returned 0x38e56f8 [0150.882] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0xb30000 [0150.883] GetCurrentProcess () returned 0xffffffff [0150.883] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xb30005, lpBuffer=0x19f2e4*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e4*, lpNumberOfBytesWritten=0x0) returned 1 [0150.884] GetCurrentProcess () returned 0xffffffff [0150.884] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xb3000f, lpBuffer=0x19f2e8*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e8*, lpNumberOfBytesWritten=0x0) returned 1 [0150.886] GetCurrentProcess () returned 0xffffffff [0150.886] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x750ef120, lpBuffer=0x19f2e4*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e4*, lpNumberOfBytesWritten=0x0) returned 1 [0150.889] VirtualProtect (in: lpAddress=0xb30000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x19f324 | out: lpflOldProtect=0x19f324*=0x40) returned 1 [0150.890] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xc) returned 0x38e5710 [0150.890] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0xf) returned 0x38e5740 [0150.891] GetModuleHandleA (lpModuleName="kernelbase.dll") returned 0x76ad0000 [0150.893] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x10) returned 0x38e57a0 [0150.893] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0xb40000 [0150.895] GetCurrentProcess () returned 0xffffffff [0150.895] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xb40005, lpBuffer=0x19f2e4*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e4*, lpNumberOfBytesWritten=0x0) returned 1 [0150.897] GetCurrentProcess () returned 0xffffffff [0150.897] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xb4000f, lpBuffer=0x19f2e8*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e8*, lpNumberOfBytesWritten=0x0) returned 1 [0150.898] GetCurrentProcess () returned 0xffffffff [0150.898] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x76b9d140, lpBuffer=0x19f2e4*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e4*, lpNumberOfBytesWritten=0x0) returned 1 [0150.899] VirtualProtect (in: lpAddress=0xb40000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x19f324 | out: lpflOldProtect=0x19f324*=0x40) returned 1 [0150.900] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x20) returned 0x38e04b8 [0150.900] HeapFree (in: hHeap=0x38e0000, dwFlags=0x0, lpMem=0x38e04a0 | out: hHeap=0x38e0000) returned 1 [0150.901] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x10) returned 0x38e5758 [0150.901] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x3000, flProtect=0x40) returned 0xb50000 [0150.901] GetCurrentProcess () returned 0xffffffff [0150.901] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xb50005, lpBuffer=0x19f2e4*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e4*, lpNumberOfBytesWritten=0x0) returned 1 [0150.903] GetCurrentProcess () returned 0xffffffff [0150.903] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0xb5000f, lpBuffer=0x19f2e8*, nSize=0x6, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e8*, lpNumberOfBytesWritten=0x0) returned 1 [0150.904] GetCurrentProcess () returned 0xffffffff [0150.904] WriteProcessMemory (in: hProcess=0xffffffff, lpBaseAddress=0x76b8b7a0, lpBuffer=0x19f2e4*, nSize=0x5, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x19f2e4*, lpNumberOfBytesWritten=0x0) returned 1 [0150.917] VirtualProtect (in: lpAddress=0xb50000, dwSize=0x1000, flNewProtect=0x20, lpflOldProtect=0x19f324 | out: lpflOldProtect=0x19f324*=0x40) returned 1 [0150.953] CreateToolhelp32Snapshot (dwFlags=0x4, th32ProcessID=0x0) returned 0x124 [0150.999] Thread32First (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.000] GetCurrentProcessId () returned 0xe9c [0151.001] GetCurrentThreadId () returned 0x39c [0151.034] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.036] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.037] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.038] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.040] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.041] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.042] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.044] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.045] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.047] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.048] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.049] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.051] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.052] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.053] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.054] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.056] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.057] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.058] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.060] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.061] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.062] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.063] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.065] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.067] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.068] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.070] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.071] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.072] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.074] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.075] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.076] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.078] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.079] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.080] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.081] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.083] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.084] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.085] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.086] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.088] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.089] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.090] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.091] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.092] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.093] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.095] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.097] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.098] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.099] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.100] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.101] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.103] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.104] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.106] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.107] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.108] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.110] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.111] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.112] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.113] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.114] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.115] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.116] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.118] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.119] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.120] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.121] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.122] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.123] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.125] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.126] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.127] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.128] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.129] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.131] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.132] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.133] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.134] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.135] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.136] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.137] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.140] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.141] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.142] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.143] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.144] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.145] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.146] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.148] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.149] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.150] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.151] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.152] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.153] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.154] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.156] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.157] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.158] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.159] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.160] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.161] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.163] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.164] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.165] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.166] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.167] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.168] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.170] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.171] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.172] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.173] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.185] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.186] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.187] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.188] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.189] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.191] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.192] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.193] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.194] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.195] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.196] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.198] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.200] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.201] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.202] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.204] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.205] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.206] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.207] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.208] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.209] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.211] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.212] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.213] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.214] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.215] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.217] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.218] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.220] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.221] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.222] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.223] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.224] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.226] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.227] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.228] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.229] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.230] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.231] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.232] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.234] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.235] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.236] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.237] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.238] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.239] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.241] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.242] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.243] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.244] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.246] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.247] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.248] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.249] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.250] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.252] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.253] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.255] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.256] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.258] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.259] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.260] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.261] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.262] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.263] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.264] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.266] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.267] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.268] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.270] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.271] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.272] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.274] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.275] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.277] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.278] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.279] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.281] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.282] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.283] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.285] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.286] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.287] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.289] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.290] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.292] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.293] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.294] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.296] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.298] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.299] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.300] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.301] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.304] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.305] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.307] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.308] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.310] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.311] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.312] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.314] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.315] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.317] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.318] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.319] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.321] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.322] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.323] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.326] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.328] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.329] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.330] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.331] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.333] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.334] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.335] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.337] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.338] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.340] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.341] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.343] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.344] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.345] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.347] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.348] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.350] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.351] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.352] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.353] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.355] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.356] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.358] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.359] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.361] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.362] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.364] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.365] Thread32Next (hSnapshot=0x124, lpte=0x19f7f4) returned 1 [0151.960] CloseHandle (hObject=0x124) returned 1 [0151.961] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x77b90000 [0171.015] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x19faa4*=0x435000, NumberOfBytesToProtect=0x19fa9c, NewAccessProtection=0x20, OldAccessProtection=0x19fde4 | out: BaseAddress=0x19faa4*=0x435000, NumberOfBytesToProtect=0x19fa9c, OldAccessProtection=0x19fde4*=0x40) returned 0x0 [0171.241] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x19faa4*=0x423000, NumberOfBytesToProtect=0x19fa9c, NewAccessProtection=0x20, OldAccessProtection=0x19fde4 | out: BaseAddress=0x19faa4*=0x423000, NumberOfBytesToProtect=0x19fa9c, OldAccessProtection=0x19fde4*=0x40) returned 0x0 [0171.242] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x19faa4*=0x45a000, NumberOfBytesToProtect=0x19fa9c, NewAccessProtection=0x4, OldAccessProtection=0x19fde4 | out: BaseAddress=0x19faa4*=0x45a000, NumberOfBytesToProtect=0x19fa9c, OldAccessProtection=0x19fde4*=0x20) returned 0x0 [0171.277] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19ff50 | out: lpSystemTimeAsFileTime=0x19ff50*(dwLowDateTime=0xda280d9d, dwHighDateTime=0x1d7fc8f)) [0171.277] GetCurrentThreadId () returned 0x39c [0171.277] GetCurrentProcessId () returned 0xe9c [0171.277] QueryPerformanceCounter (in: lpPerformanceCount=0x19ff48 | out: lpPerformanceCount=0x19ff48*=1209148733806) returned 1 [0171.313] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0171.388] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76ad0000 [0171.460] GetProcAddress (hModule=0x76ad0000, lpProcName="InitializeCriticalSectionEx") returned 0x76b8d740 [0171.494] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x76ad0000 [0171.495] GetProcAddress (hModule=0x76ad0000, lpProcName="FlsAlloc") returned 0x76b94490 [0171.495] GetProcAddress (hModule=0x76ad0000, lpProcName="FlsSetValue") returned 0x76b8d7a0 [0171.670] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76ad0000 [0171.672] GetProcAddress (hModule=0x76ad0000, lpProcName="InitializeCriticalSectionEx") returned 0x76b8d740 [0171.708] GetProcessHeap () returned 0xd30000 [0171.748] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x76ad0000 [0171.749] GetProcAddress (hModule=0x76ad0000, lpProcName="FlsAlloc") returned 0x76b94490 [0171.819] GetLastError () returned 0x12 [0171.820] GetProcAddress (hModule=0x76ad0000, lpProcName="FlsGetValue") returned 0x76b7f350 [0171.820] GetProcAddress (hModule=0x76ad0000, lpProcName="FlsSetValue") returned 0x76b8d7a0 [0171.820] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x364) returned 0xd4c1d8 [0171.821] SetLastError (dwErrCode=0x12) [0171.855] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xe00) returned 0xd4c548 [0171.857] GetStartupInfoW (in: lpStartupInfo=0x19fe88 | out: lpStartupInfo=0x19fe88*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0171.857] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0171.857] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0171.857] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0171.857] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe\" " [0171.857] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe\" " [0171.892] GetACP () returned 0x4e4 [0171.892] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x220) returned 0xd3ef38 [0171.892] IsValidCodePage (CodePage=0x4e4) returned 1 [0171.892] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fea8 | out: lpCPInfo=0x19fea8) returned 1 [0171.927] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f770 | out: lpCPInfo=0x19f770) returned 1 [0171.997] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd84, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0171.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd84, cbMultiByte=256, lpWideCharStr=0x19f518, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0171.998] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x19f784 | out: lpCharType=0x19f784) returned 1 [0171.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd84, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0171.998] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd84, cbMultiByte=256, lpWideCharStr=0x19f4c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ宱AĀ") returned 256 [0171.998] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x76ad0000 [0171.999] GetProcAddress (hModule=0x76ad0000, lpProcName="LCMapStringEx") returned 0x76b795f0 [0171.999] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ宱AĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0171.999] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ宱AĀ", cchSrc=256, lpDestStr=0x19f2b8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0171.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x19fc84, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿµ…\x1e]Àþ\x19", lpUsedDefaultChar=0x0) returned 256 [0171.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd84, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0171.999] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd84, cbMultiByte=256, lpWideCharStr=0x19f4e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0171.999] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0171.999] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f2d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0171.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x19fb84, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿµ…\x1e]Àþ\x19", lpUsedDefaultChar=0x0) returned 256 [0172.130] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x80) returned 0xd3f7a8 [0172.188] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19fccc, nSize=0x105 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe")) returned 0x62 [0172.188] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x74f30000 [0172.251] GetProcAddress (hModule=0x74f30000, lpProcName="AreFileApisANSI") returned 0x74f4f300 [0172.252] AreFileApisANSI () returned 1 [0172.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 99 [0172.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe", cchWideChar=-1, lpMultiByteStr=0x434770, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\213fce24e326925749adebaff2d85e23bba2b616c872e2089b23fa231f18756e.exe", lpUsedDefaultChar=0x0) returned 99 [0172.252] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x6b) returned 0xd3f830 [0172.252] RtlInitializeSListHead (in: ListHead=0x434210 | out: ListHead=0x434210) [0172.312] GetLastError () returned 0x0 [0172.312] SetLastError (dwErrCode=0x0) [0172.312] GetEnvironmentStringsW () returned 0xd4d350* [0172.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1293 [0172.312] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x50d) returned 0xd4dd78 [0172.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0xd4dd78, cbMultiByte=1293, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1293 [0172.312] FreeEnvironmentStringsW (penv=0xd4d350) returned 1 [0172.312] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x90) returned 0xd3f8a8 [0172.312] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x1f) returned 0xd3a9a8 [0172.312] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x2e) returned 0xd40318 [0172.312] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x37) returned 0xd36c58 [0172.312] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x3c) returned 0xd445d0 [0172.312] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x31) returned 0xd44a00 [0172.312] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x14) returned 0xd3a190 [0172.312] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x24) returned 0xd3fcb8 [0172.312] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xd) returned 0xd44ca8 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x1d) returned 0xd3aca0 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x31) returned 0xd3f940 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x15) returned 0xd3a430 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x17) returned 0xd3a450 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xe) returned 0xd44cc0 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x69) returned 0xd4d350 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x3e) returned 0xd441e0 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x1b) returned 0xd3ab10 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x1d) returned 0xd3a9d0 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x48) returned 0xd3f980 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x12) returned 0xd4da98 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x18) returned 0xd4d918 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x1b) returned 0xd3aac0 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x24) returned 0xd436a8 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x29) returned 0xd40430 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x1e) returned 0xd3aae8 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x6b) returned 0xd4dbd0 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x17) returned 0xd4db38 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xf) returned 0xd44ac8 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x16) returned 0xd4d838 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x2a) returned 0xd40548 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x29) returned 0xd40388 [0172.313] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x12) returned 0xd4d9b8 [0172.314] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x21) returned 0xd3f440 [0172.314] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x16) returned 0xd4d9f8 [0172.314] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x22) returned 0xd3fe00 [0172.314] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x12) returned 0xd4d898 [0172.314] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4dd78 | out: hHeap=0xd30000) returned 1 [0172.350] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x800) returned 0xd4dc48 [0172.350] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0172.423] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4071b1) returned 0x0 [0172.459] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x8) returned 0xd44a40 [0172.460] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x76ad0000 [0172.461] GetProcAddress (hModule=0x76ad0000, lpProcName="CompareStringEx") returned 0x76b86140 [0172.461] GetProcAddress (hModule=0x76ad0000, lpProcName="EnumSystemLocalesEx") returned 0x76b979d0 [0172.461] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x76ad0000 [0172.462] GetProcAddress (hModule=0x76ad0000, lpProcName="GetDateFormatEx") returned 0x76be34d0 [0172.462] GetProcAddress (hModule=0x76ad0000, lpProcName="GetLocaleInfoEx") returned 0x76b76610 [0172.463] GetProcAddress (hModule=0x76ad0000, lpProcName="GetTimeFormatEx") returned 0x76be37a0 [0172.463] GetProcAddress (hModule=0x76ad0000, lpProcName="GetUserDefaultLocaleName") returned 0x76b6cd10 [0172.463] GetProcAddress (hModule=0x76ad0000, lpProcName="IsValidLocaleName") returned 0x76b94bf0 [0172.464] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x76ad0000 [0172.464] GetProcAddress (hModule=0x76ad0000, lpProcName="LCIDToLocaleName") returned 0x76b86fc0 [0172.464] GetProcAddress (hModule=0x76ad0000, lpProcName="LocaleNameToLCID") returned 0x76b87de0 [0172.465] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x20) returned 0xd3a9f8 [0172.465] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x2) returned 0xd3f9d0 [0172.465] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd3f9d0 | out: hHeap=0xd30000) returned 1 [0172.465] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x2) returned 0xd3f9d0 [0172.533] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x8) returned 0xd4e8e0 [0172.534] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x18) returned 0xd4dab8 [0172.534] GetLastError () returned 0x0 [0172.534] SetLastError (dwErrCode=0x0) [0172.534] GetLastError () returned 0x0 [0172.534] SetLastError (dwErrCode=0x0) [0172.534] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xb8) returned 0xd4eaa0 [0172.534] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6a6) returned 0xd4eb60 [0172.534] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4eb60 | out: hHeap=0xd30000) returned 1 [0172.534] GetLastError () returned 0x0 [0172.535] SetLastError (dwErrCode=0x0) [0172.535] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6) returned 0xd4e950 [0172.535] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x2) returned 0xd4e960 [0172.535] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x4) returned 0xd4e9f0 [0172.535] GetLastError () returned 0x0 [0172.535] SetLastError (dwErrCode=0x0) [0172.535] GetLastError () returned 0x0 [0172.535] SetLastError (dwErrCode=0x0) [0172.535] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xb8) returned 0xd4eb60 [0172.535] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6a6) returned 0xd4ec20 [0172.535] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ec20 | out: hHeap=0xd30000) returned 1 [0172.535] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e950 | out: hHeap=0xd30000) returned 1 [0172.535] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4eaa0 | out: hHeap=0xd30000) returned 1 [0172.535] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e9f0 | out: hHeap=0xd30000) returned 1 [0172.536] GetLastError () returned 0x0 [0172.536] SetLastError (dwErrCode=0x0) [0172.536] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6) returned 0xd4ea70 [0172.536] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x2) returned 0xd4ea50 [0172.536] GetLastError () returned 0x0 [0172.536] SetLastError (dwErrCode=0x0) [0172.536] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x200) returned 0xd4ec20 [0172.536] GetLastError () returned 0x0 [0172.536] SetLastError (dwErrCode=0x0) [0172.536] GetLastError () returned 0x0 [0172.536] SetLastError (dwErrCode=0x0) [0172.536] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x4) returned 0xd4e9d0 [0172.536] GetLastError () returned 0x0 [0172.536] SetLastError (dwErrCode=0x0) [0172.536] GetLastError () returned 0x0 [0172.536] SetLastError (dwErrCode=0x0) [0172.536] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xb8) returned 0xd4eaa0 [0172.536] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6a6) returned 0xd4ee28 [0172.536] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ee28 | out: hHeap=0xd30000) returned 1 [0172.537] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ea70 | out: hHeap=0xd30000) returned 1 [0172.537] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4eb60 | out: hHeap=0xd30000) returned 1 [0172.537] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e9d0 | out: hHeap=0xd30000) returned 1 [0172.537] GetLastError () returned 0x0 [0172.537] SetLastError (dwErrCode=0x0) [0172.537] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6) returned 0xd4e910 [0172.537] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ea50 | out: hHeap=0xd30000) returned 1 [0172.537] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e960 | out: hHeap=0xd30000) returned 1 [0172.537] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x8) returned 0xd4e960 [0172.564] FreeConsole () returned 1 [0172.564] GetSystemInfo (in: lpSystemInfo=0x19fe70 | out: lpSystemInfo=0x19fe70*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0172.564] GetLastError () returned 0x0 [0172.564] SetLastError (dwErrCode=0x0) [0172.564] GetLastError () returned 0x0 [0172.564] SetLastError (dwErrCode=0x0) [0172.564] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x1000) returned 0xd4ee28 [0172.608] SendMessageCallbackA (hWnd=0x0, Msg=0x4, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.609] GetLastError () returned 0x578 [0172.609] SetLastError (dwErrCode=0x578) [0172.609] SendMessageCallbackA (hWnd=0x0, Msg=0x5, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.609] GetLastError () returned 0x578 [0172.609] SetLastError (dwErrCode=0x578) [0172.609] SendMessageCallbackA (hWnd=0x0, Msg=0x6, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.610] GetLastError () returned 0x578 [0172.610] SetLastError (dwErrCode=0x578) [0172.610] SendMessageCallbackA (hWnd=0x0, Msg=0x7, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.610] GetLastError () returned 0x578 [0172.610] SetLastError (dwErrCode=0x578) [0172.610] SendMessageCallbackA (hWnd=0x0, Msg=0x8, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.610] GetLastError () returned 0x578 [0172.610] SetLastError (dwErrCode=0x578) [0172.610] SendMessageCallbackA (hWnd=0x0, Msg=0x9, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.611] GetLastError () returned 0x578 [0172.611] SetLastError (dwErrCode=0x578) [0172.611] SendMessageCallbackA (hWnd=0x0, Msg=0xa, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.611] GetLastError () returned 0x578 [0172.611] SetLastError (dwErrCode=0x578) [0172.611] SendMessageCallbackA (hWnd=0x0, Msg=0xb, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.611] GetLastError () returned 0x578 [0172.611] SetLastError (dwErrCode=0x578) [0172.611] SendMessageCallbackA (hWnd=0x0, Msg=0xc, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.611] GetLastError () returned 0x578 [0172.611] SetLastError (dwErrCode=0x578) [0172.612] SendMessageCallbackA (hWnd=0x0, Msg=0xd, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.612] GetLastError () returned 0x578 [0172.612] SetLastError (dwErrCode=0x578) [0172.612] SendMessageCallbackA (hWnd=0x0, Msg=0xe, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.612] GetLastError () returned 0x578 [0172.612] SetLastError (dwErrCode=0x578) [0172.612] SendMessageCallbackA (hWnd=0x0, Msg=0xf, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.612] GetLastError () returned 0x578 [0172.612] SetLastError (dwErrCode=0x578) [0172.612] SendMessageCallbackA (hWnd=0x0, Msg=0x10, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.612] GetLastError () returned 0x578 [0172.612] SetLastError (dwErrCode=0x578) [0172.612] SendMessageCallbackA (hWnd=0x0, Msg=0x11, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.613] GetLastError () returned 0x578 [0172.613] SetLastError (dwErrCode=0x578) [0172.613] SendMessageCallbackA (hWnd=0x0, Msg=0x12, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.613] GetLastError () returned 0x578 [0172.613] SetLastError (dwErrCode=0x578) [0172.613] SendMessageCallbackA (hWnd=0x0, Msg=0x13, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.613] GetLastError () returned 0x578 [0172.613] SetLastError (dwErrCode=0x578) [0172.613] SendMessageCallbackA (hWnd=0x0, Msg=0x14, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.613] GetLastError () returned 0x578 [0172.613] SetLastError (dwErrCode=0x578) [0172.614] SendMessageCallbackA (hWnd=0x0, Msg=0x15, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.614] GetLastError () returned 0x578 [0172.614] SetLastError (dwErrCode=0x578) [0172.614] SendMessageCallbackA (hWnd=0x0, Msg=0x16, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.614] GetLastError () returned 0x578 [0172.614] SetLastError (dwErrCode=0x578) [0172.614] SendMessageCallbackA (hWnd=0x0, Msg=0x17, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.614] GetLastError () returned 0x578 [0172.614] SetLastError (dwErrCode=0x578) [0172.614] SendMessageCallbackA (hWnd=0x0, Msg=0x18, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.616] GetLastError () returned 0x578 [0172.616] SetLastError (dwErrCode=0x578) [0172.616] SendMessageCallbackA (hWnd=0x0, Msg=0x19, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.616] GetLastError () returned 0x578 [0172.616] SetLastError (dwErrCode=0x578) [0172.616] SendMessageCallbackA (hWnd=0x0, Msg=0x1a, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.616] GetLastError () returned 0x578 [0172.616] SetLastError (dwErrCode=0x578) [0172.616] SendMessageCallbackA (hWnd=0x0, Msg=0x1b, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.662] GetLastError () returned 0x578 [0172.663] SetLastError (dwErrCode=0x578) [0172.663] SendMessageCallbackA (hWnd=0x0, Msg=0x1c, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.663] GetLastError () returned 0x578 [0172.663] SetLastError (dwErrCode=0x578) [0172.663] SendMessageCallbackA (hWnd=0x0, Msg=0x1d, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.663] GetLastError () returned 0x578 [0172.663] SetLastError (dwErrCode=0x578) [0172.663] SendMessageCallbackA (hWnd=0x0, Msg=0x1e, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.663] GetLastError () returned 0x578 [0172.663] SetLastError (dwErrCode=0x578) [0172.663] SendMessageCallbackA (hWnd=0x0, Msg=0x1f, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.663] GetLastError () returned 0x578 [0172.663] SetLastError (dwErrCode=0x578) [0172.663] SendMessageCallbackA (hWnd=0x0, Msg=0x20, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.663] GetLastError () returned 0x578 [0172.663] SetLastError (dwErrCode=0x578) [0172.663] SendMessageCallbackA (hWnd=0x0, Msg=0x21, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.664] GetLastError () returned 0x578 [0172.664] SetLastError (dwErrCode=0x578) [0172.664] SendMessageCallbackA (hWnd=0x0, Msg=0x22, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.664] GetLastError () returned 0x578 [0172.664] SetLastError (dwErrCode=0x578) [0172.664] SendMessageCallbackA (hWnd=0x0, Msg=0x23, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.664] GetLastError () returned 0x578 [0172.664] SetLastError (dwErrCode=0x578) [0172.664] SendMessageCallbackA (hWnd=0x0, Msg=0x24, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.664] GetLastError () returned 0x578 [0172.664] SetLastError (dwErrCode=0x578) [0172.664] SendMessageCallbackA (hWnd=0x0, Msg=0x25, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.664] GetLastError () returned 0x578 [0172.664] SetLastError (dwErrCode=0x578) [0172.664] SendMessageCallbackA (hWnd=0x0, Msg=0x26, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.664] GetLastError () returned 0x578 [0172.665] SetLastError (dwErrCode=0x578) [0172.665] SendMessageCallbackA (hWnd=0x0, Msg=0x27, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.723] GetLastError () returned 0x578 [0172.723] SetLastError (dwErrCode=0x578) [0172.723] SendMessageCallbackA (hWnd=0x0, Msg=0x28, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.723] GetLastError () returned 0x578 [0172.723] SetLastError (dwErrCode=0x578) [0172.724] SendMessageCallbackA (hWnd=0x0, Msg=0x29, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.724] GetLastError () returned 0x578 [0172.724] SetLastError (dwErrCode=0x578) [0172.724] SendMessageCallbackA (hWnd=0x0, Msg=0x2a, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.724] GetLastError () returned 0x578 [0172.724] SetLastError (dwErrCode=0x578) [0172.724] SendMessageCallbackA (hWnd=0x0, Msg=0x2b, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.724] GetLastError () returned 0x578 [0172.724] SetLastError (dwErrCode=0x578) [0172.724] SendMessageCallbackA (hWnd=0x0, Msg=0x2c, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.724] GetLastError () returned 0x578 [0172.724] SetLastError (dwErrCode=0x578) [0172.724] SendMessageCallbackA (hWnd=0x0, Msg=0x2d, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.724] GetLastError () returned 0x578 [0172.724] SetLastError (dwErrCode=0x578) [0172.724] SendMessageCallbackA (hWnd=0x0, Msg=0x2e, wParam=0x0, lParam=0x0, lpResultCallBack=0x0, dwData=0x0) returned 0 [0172.725] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x8) returned 0xd4ea20 [0172.725] GetLastError () returned 0x578 [0172.725] SetLastError (dwErrCode=0x578) [0172.725] GetLastError () returned 0x578 [0172.725] SetLastError (dwErrCode=0x578) [0172.725] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xb8) returned 0xd4eb60 [0172.725] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6a6) returned 0xd4fe30 [0172.726] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4fe30 | out: hHeap=0xd30000) returned 1 [0172.779] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e910 | out: hHeap=0xd30000) returned 1 [0172.779] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4eaa0 | out: hHeap=0xd30000) returned 1 [0172.779] GetLastError () returned 0x578 [0172.779] SetLastError (dwErrCode=0x578) [0172.779] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6) returned 0xd4ea10 [0172.780] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x2) returned 0xd4e990 [0172.780] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x4) returned 0xd4e900 [0172.780] GetLastError () returned 0x578 [0172.780] SetLastError (dwErrCode=0x578) [0172.780] GetLastError () returned 0x578 [0172.780] SetLastError (dwErrCode=0x578) [0172.780] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xb8) returned 0xd4eaa0 [0172.780] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6a6) returned 0xd4fe30 [0172.780] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4fe30 | out: hHeap=0xd30000) returned 1 [0172.781] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ea10 | out: hHeap=0xd30000) returned 1 [0172.781] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4eb60 | out: hHeap=0xd30000) returned 1 [0172.781] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e900 | out: hHeap=0xd30000) returned 1 [0172.781] GetLastError () returned 0x578 [0172.781] SetLastError (dwErrCode=0x578) [0172.781] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6) returned 0xd4e930 [0172.781] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x2) returned 0xd4e9f0 [0172.781] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x4) returned 0xd4ea80 [0172.781] GetLastError () returned 0x578 [0172.781] SetLastError (dwErrCode=0x578) [0172.781] GetLastError () returned 0x578 [0172.782] SetLastError (dwErrCode=0x578) [0172.782] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xb8) returned 0xd4eb60 [0172.782] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6a6) returned 0xd4fe30 [0172.782] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4fe30 | out: hHeap=0xd30000) returned 1 [0172.782] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e930 | out: hHeap=0xd30000) returned 1 [0172.782] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4eaa0 | out: hHeap=0xd30000) returned 1 [0172.782] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ea80 | out: hHeap=0xd30000) returned 1 [0172.782] GetLastError () returned 0x578 [0172.782] SetLastError (dwErrCode=0x578) [0172.783] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6) returned 0xd4ea30 [0172.783] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e9f0 | out: hHeap=0xd30000) returned 1 [0172.783] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e990 | out: hHeap=0xd30000) returned 1 [0172.783] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x8) returned 0xd4e940 [0172.783] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x18) returned 0xd4dad8 [0172.783] GetLastError () returned 0x578 [0172.783] SetLastError (dwErrCode=0x578) [0172.783] GetLastError () returned 0x578 [0172.783] SetLastError (dwErrCode=0x578) [0172.783] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xb8) returned 0xd4eaa0 [0172.783] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6a6) returned 0xd4fe30 [0172.784] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4fe30 | out: hHeap=0xd30000) returned 1 [0172.784] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ea30 | out: hHeap=0xd30000) returned 1 [0172.784] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4eb60 | out: hHeap=0xd30000) returned 1 [0172.784] GetLastError () returned 0x578 [0172.784] SetLastError (dwErrCode=0x578) [0172.784] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6) returned 0xd4e8d0 [0172.784] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x2) returned 0xd4ea50 [0172.784] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x4) returned 0xd4e9a0 [0172.784] GetLastError () returned 0x578 [0172.784] SetLastError (dwErrCode=0x578) [0172.784] GetLastError () returned 0x578 [0172.784] SetLastError (dwErrCode=0x578) [0172.785] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xb8) returned 0xd4eb60 [0172.785] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6a6) returned 0xd4fe30 [0172.785] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4fe30 | out: hHeap=0xd30000) returned 1 [0172.785] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e8d0 | out: hHeap=0xd30000) returned 1 [0172.785] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4eaa0 | out: hHeap=0xd30000) returned 1 [0172.785] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e9a0 | out: hHeap=0xd30000) returned 1 [0172.785] GetLastError () returned 0x578 [0172.785] SetLastError (dwErrCode=0x578) [0172.785] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6) returned 0xd4ea90 [0172.785] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x2) returned 0xd4e8f0 [0172.786] GetLastError () returned 0x578 [0172.786] SetLastError (dwErrCode=0x578) [0172.786] GetLastError () returned 0x578 [0172.786] SetLastError (dwErrCode=0x578) [0172.786] GetLastError () returned 0x578 [0172.786] SetLastError (dwErrCode=0x578) [0172.786] GetLastError () returned 0x578 [0172.786] SetLastError (dwErrCode=0x578) [0172.786] GetLastError () returned 0x578 [0172.786] SetLastError (dwErrCode=0x578) [0172.786] GetLastError () returned 0x578 [0172.786] SetLastError (dwErrCode=0x578) [0172.786] GetLastError () returned 0x578 [0172.786] SetLastError (dwErrCode=0x578) [0172.786] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x1) returned 0xd4ea80 [0172.786] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x6) returned 0xd4e980 [0172.786] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x5) returned 0xd4ea60 [0172.786] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0x4) returned 0xd4e970 [0172.786] GetLastError () returned 0x578 [0172.786] SetLastError (dwErrCode=0x578) [0172.786] GetLastError () returned 0x578 [0172.787] SetLastError (dwErrCode=0x578) [0172.787] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x8, Size=0xb8) returned 0xd4eaa0 [0172.787] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6a6) returned 0xd4fe30 [0172.787] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4fe30 | out: hHeap=0xd30000) returned 1 [0172.787] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ea90 | out: hHeap=0xd30000) returned 1 [0172.787] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4eb60 | out: hHeap=0xd30000) returned 1 [0172.787] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e970 | out: hHeap=0xd30000) returned 1 [0172.787] GetLastError () returned 0x578 [0172.787] SetLastError (dwErrCode=0x578) [0172.787] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x6) returned 0xd4e8c0 [0172.788] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e8f0 | out: hHeap=0xd30000) returned 1 [0172.788] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ea50 | out: hHeap=0xd30000) returned 1 [0172.788] RtlAllocateHeap (HeapHandle=0xd30000, Flags=0x0, Size=0x8) returned 0xd4e920 [0172.873] GetLastError () returned 0x578 [0172.874] GetProcAddress (hModule=0x76ad0000, lpProcName="FlsGetValue") returned 0x76b7f350 [0172.874] SetLastError (dwErrCode=0x578) [0172.875] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74f30000 [0172.927] GetProcAddress (hModule=0x74f30000, lpProcName="VirtualProtect") returned 0x74f47a50 [0172.927] VirtualProtect (in: lpAddress=0x19f6f0, dwSize=0x77e, flNewProtect=0x40, lpflOldProtect=0xc3b10 | out: lpflOldProtect=0xc3b10*=0x4) returned 1 [0172.965] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0173.739] GetThreadUILanguage () returned 0xc0409 [0173.739] GetThreadLocale () returned 0x409 [0173.774] GetUserDefaultLCID () returned 0x409 [0173.775] GetUserDefaultLCID () returned 0x409 [0173.775] GetSystemDefaultLCID () returned 0x409 [0173.775] GetSystemDefaultLCID () returned 0x409 [0173.775] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x18) returned 0x38e04e0 [0173.776] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x4) returned 0x38e0b30 [0173.776] RtlAllocateHeap (HeapHandle=0x38e0000, Flags=0x0, Size=0x19400) returned 0xe30048 [0173.780] LockResource (hResData=0xe30048) returned 0xe30048 [0173.780] SizeofResource (hModule=0x400000, hResInfo=0x38e04e4) returned 0x19400 [0173.785] CreateProcessW (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xc39dc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xc3b18 | out: lpCommandLine=0x0, lpProcessInformation=0xc3b18*(hProcess=0x128, hThread=0x124, dwProcessId=0xdb0, dwThreadId=0xfa4)) returned 1 [0174.143] GetThreadContext (in: hThread=0x124, lpContext=0xc3710 | out: lpContext=0xc3710*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x3f1000, Edx=0x0, Ecx=0x0, Eax=0x9aeb7c, Ebp=0x0, Eip=0x77c08fe0, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0174.144] ReadProcessMemory (in: hProcess=0x128, lpBaseAddress=0x3f1008, lpBuffer=0xc3b00, nSize=0x4, lpNumberOfBytesRead=0x0 | out: lpBuffer=0xc3b00*, lpNumberOfBytesRead=0x0) returned 1 [0174.145] VirtualAlloc (lpAddress=0x0, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x40) returned 0xf30000 [0174.147] VirtualAllocEx (hProcess=0x128, lpAddress=0x400000, dwSize=0x20000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0174.151] WriteProcessMemory (in: hProcess=0x128, lpBaseAddress=0x400000, lpBuffer=0xf30000*, nSize=0x20000, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0xf30000*, lpNumberOfBytesWritten=0x0) returned 1 [0174.167] VirtualProtectEx (in: hProcess=0x128, lpAddress=0x400000, dwSize=0x200, flNewProtect=0x2, lpflOldProtect=0xc3a9c | out: lpflOldProtect=0xc3a9c*=0x40) returned 1 [0174.168] VirtualProtectEx (in: hProcess=0x128, lpAddress=0x402000, dwSize=0x18974, flNewProtect=0x20, lpflOldProtect=0xc3a9c | out: lpflOldProtect=0xc3a9c*=0x40) returned 1 [0174.172] VirtualProtectEx (in: hProcess=0x128, lpAddress=0x41c000, dwSize=0x4c6, flNewProtect=0x2, lpflOldProtect=0xc3a9c | out: lpflOldProtect=0xc3a9c*=0x40) returned 1 [0174.173] VirtualProtectEx (in: hProcess=0x128, lpAddress=0x41e000, dwSize=0xc, flNewProtect=0x2, lpflOldProtect=0xc3a9c | out: lpflOldProtect=0xc3a9c*=0x40) returned 1 [0174.174] VirtualFree (lpAddress=0xf30000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.179] WriteProcessMemory (in: hProcess=0x128, lpBaseAddress=0x3f1008, lpBuffer=0xc3b30*, nSize=0x4, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0xc3b30*, lpNumberOfBytesWritten=0x0) returned 1 [0174.187] SetThreadContext (hThread=0x124, lpContext=0xc3710*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x3f1000, Edx=0x0, Ecx=0x0, Eax=0x41a96e, Ebp=0x0, Eip=0x77c08fe0, SegCs=0x23, EFlags=0x202, Esp=0x19fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0174.191] ResumeThread (hThread=0x124) returned 0x1 [0174.452] CloseHandle (hObject=0x128) returned 1 [0174.452] CloseHandle (hObject=0x124) returned 1 [0174.453] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0174.454] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0174.532] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ea80 | out: hHeap=0xd30000) returned 1 [0174.532] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e980 | out: hHeap=0xd30000) returned 1 [0174.532] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ea60 | out: hHeap=0xd30000) returned 1 [0174.532] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4dad8 | out: hHeap=0xd30000) returned 1 [0174.532] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e920 | out: hHeap=0xd30000) returned 1 [0174.532] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ea20 | out: hHeap=0xd30000) returned 1 [0174.532] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e940 | out: hHeap=0xd30000) returned 1 [0174.532] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ec20 | out: hHeap=0xd30000) returned 1 [0174.533] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4dab8 | out: hHeap=0xd30000) returned 1 [0174.533] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e960 | out: hHeap=0xd30000) returned 1 [0174.533] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e8e0 | out: hHeap=0xd30000) returned 1 [0174.533] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd3f9d0 | out: hHeap=0xd30000) returned 1 [0174.533] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd3a9f8 | out: hHeap=0xd30000) returned 1 [0174.533] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd44a40 | out: hHeap=0xd30000) returned 1 [0174.534] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd3f7a8 | out: hHeap=0xd30000) returned 1 [0174.534] GetLastError () returned 0x578 [0174.535] SetLastError (dwErrCode=0x578) [0174.535] GetLastError () returned 0x578 [0174.535] SetLastError (dwErrCode=0x578) [0174.535] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4ee28 | out: hHeap=0xd30000) returned 1 [0174.536] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4dc48 | out: hHeap=0xd30000) returned 1 [0174.536] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x77320000 [0174.923] GetProcAddress (hModule=0x77320000, lpProcName="AppPolicyGetProcessTerminationMethod") returned 0x0 [0174.923] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x19fee4 | out: phModule=0x19fee4) returned 0 [0174.924] ExitProcess (uExitCode=0x0) [0174.924] HeapFree (in: hHeap=0x38e0000, dwFlags=0x0, lpMem=0x38e05a8 | out: hHeap=0x38e0000) returned 1 [0174.924] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4e8c0 | out: hHeap=0xd30000) returned 1 [0174.925] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4eaa0 | out: hHeap=0xd30000) returned 1 [0174.925] HeapFree (in: hHeap=0xd30000, dwFlags=0x0, lpMem=0xd4c1d8 | out: hHeap=0xd30000) returned 1 Thread: id = 2 os_tid = 0xe0c Thread: id = 3 os_tid = 0xb74 Process: id = "2" image_name = "applaunch.exe" filename = "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\applaunch.exe" page_root = "0x6df97000" os_pid = "0xdb0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xe9c" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1242 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1243 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1244 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1245 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1246 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 1247 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 1248 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 1249 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1250 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1251 start_va = 0x9a0000 end_va = 0x9b7fff monitored = 0 entry_point = 0x9aeb7c region_type = mapped_file name = "applaunch.exe" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\applaunch.exe") Region: id = 1252 start_va = 0x77b90000 end_va = 0x77d0afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1253 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1254 start_va = 0xfffb0000 end_va = 0xfffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000fffb0000" filename = "" Region: id = 1255 start_va = 0xfffe0000 end_va = 0x7ffd504cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000fffe0000" filename = "" Region: id = 1256 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1257 start_va = 0x7ffd50691000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffd50691000" filename = "" Region: id = 1259 start_va = 0x400000 end_va = 0x41ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1260 start_va = 0x5d0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 1261 start_va = 0x6edd0000 end_va = 0x6ee1ffff monitored = 0 entry_point = 0x6ede8180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1262 start_va = 0x6ee20000 end_va = 0x6ee99fff monitored = 0 entry_point = 0x6ee33290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1263 start_va = 0x74f30000 end_va = 0x7500ffff monitored = 0 entry_point = 0x74f43980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1264 start_va = 0x6eea0000 end_va = 0x6eea7fff monitored = 0 entry_point = 0x6eea17c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1265 start_va = 0x420000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1266 start_va = 0x6cda0000 end_va = 0x6cdf8fff monitored = 1 entry_point = 0x6cdb0780 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 1267 start_va = 0x74f30000 end_va = 0x7500ffff monitored = 0 entry_point = 0x74f43980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1268 start_va = 0x76ad0000 end_va = 0x76c4dfff monitored = 0 entry_point = 0x76b81b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1269 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1270 start_va = 0xffeb0000 end_va = 0xfffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000ffeb0000" filename = "" Region: id = 1271 start_va = 0x5e0000 end_va = 0x69dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1272 start_va = 0x6a0000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 1274 start_va = 0x7fff0000 end_va = 0x7fffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1275 start_va = 0x80000000 end_va = 0x8000ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000080000000" filename = "" Region: id = 1276 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1277 start_va = 0x77b10000 end_va = 0x77b8afff monitored = 0 entry_point = 0x77b2e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1278 start_va = 0x74a10000 end_va = 0x74acdfff monitored = 0 entry_point = 0x74a45630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1279 start_va = 0x420000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1280 start_va = 0x490000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 1281 start_va = 0x6a0000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 1282 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 1283 start_va = 0x76c50000 end_va = 0x76c93fff monitored = 0 entry_point = 0x76c69d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1284 start_va = 0x74e80000 end_va = 0x74f2cfff monitored = 0 entry_point = 0x74e94f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1285 start_va = 0x748c0000 end_va = 0x748ddfff monitored = 0 entry_point = 0x748cb640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1286 start_va = 0x748b0000 end_va = 0x748b9fff monitored = 0 entry_point = 0x748b2a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1287 start_va = 0x77680000 end_va = 0x776d7fff monitored = 0 entry_point = 0x776c25c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 1288 start_va = 0x9c0000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 1289 start_va = 0x6cd20000 end_va = 0x6cd98fff monitored = 1 entry_point = 0x6cd2f82a region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 1290 start_va = 0x77590000 end_va = 0x775d4fff monitored = 0 entry_point = 0x775ade90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1291 start_va = 0x752b0000 end_va = 0x7546cfff monitored = 0 entry_point = 0x75392a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 1292 start_va = 0x77440000 end_va = 0x7758efff monitored = 0 entry_point = 0x774f6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1293 start_va = 0x750d0000 end_va = 0x75216fff monitored = 0 entry_point = 0x750e1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1294 start_va = 0x1d0000 end_va = 0x1f9fff monitored = 0 entry_point = 0x1d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1295 start_va = 0xb50000 end_va = 0xcd7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b50000" filename = "" Region: id = 1296 start_va = 0x75660000 end_va = 0x7568afff monitored = 0 entry_point = 0x75665680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1297 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1298 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1299 start_va = 0xce0000 end_va = 0xe60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ce0000" filename = "" Region: id = 1300 start_va = 0xe70000 end_va = 0x226ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e70000" filename = "" Region: id = 1301 start_va = 0x77320000 end_va = 0x7732bfff monitored = 0 entry_point = 0x77323930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 1302 start_va = 0x6ce10000 end_va = 0x6ce17fff monitored = 0 entry_point = 0x6ce117b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1303 start_va = 0x6c660000 end_va = 0x6cd10fff monitored = 1 entry_point = 0x6c675d20 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 1304 start_va = 0x6c560000 end_va = 0x6c654fff monitored = 0 entry_point = 0x6c5b4160 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 1305 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1306 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1307 start_va = 0x460000 end_va = 0x46ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 1308 start_va = 0x470000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 1309 start_va = 0x480000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1310 start_va = 0x590000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 1311 start_va = 0x5a0000 end_va = 0x5affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 1312 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 1313 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 1314 start_va = 0x7a0000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 1315 start_va = 0x7a0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 1316 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000810000" filename = "" Region: id = 1317 start_va = 0x7a0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 1318 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 1319 start_va = 0x840000 end_va = 0x93ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 1320 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 1321 start_va = 0x2270000 end_va = 0x426ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002270000" filename = "" Region: id = 1322 start_va = 0x9c0000 end_va = 0xa5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009c0000" filename = "" Region: id = 1323 start_va = 0xb40000 end_va = 0xb4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 1324 start_va = 0x940000 end_va = 0x97ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000940000" filename = "" Region: id = 1325 start_va = 0x4270000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 1326 start_va = 0x4370000 end_va = 0x46a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1327 start_va = 0x6b330000 end_va = 0x6c557fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll") Region: id = 1328 start_va = 0x74ad0000 end_va = 0x74bbafff monitored = 0 entry_point = 0x74b0d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1329 start_va = 0xa60000 end_va = 0xaf0fff monitored = 0 entry_point = 0xa98cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1330 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 1331 start_va = 0x6a980000 end_va = 0x6b32bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll") Region: id = 1332 start_va = 0x6a260000 end_va = 0x6a971fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll") Region: id = 1333 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1334 start_va = 0x6a1e0000 end_va = 0x6a25dfff monitored = 1 entry_point = 0x6a1e1140 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 1335 start_va = 0x74d80000 end_va = 0x74e11fff monitored = 0 entry_point = 0x74db8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1336 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000820000" filename = "" Region: id = 1337 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 1338 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 1339 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 1340 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 1341 start_va = 0x515c0000 end_va = 0x51ba7fff monitored = 1 entry_point = 0x51b930d6 region_type = mapped_file name = "system.servicemodel.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.ServiceModel.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.servicemodel\\v4.0_4.0.0.0__b77a5c561934e089\\system.servicemodel.dll") Region: id = 1342 start_va = 0xa60000 end_va = 0xa9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a60000" filename = "" Region: id = 1343 start_va = 0x46b0000 end_va = 0x4c97fff monitored = 1 entry_point = 0x4c830d6 region_type = mapped_file name = "system.servicemodel.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.ServiceModel.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.servicemodel\\v4.0_4.0.0.0__b77a5c561934e089\\system.servicemodel.dll") Region: id = 1344 start_va = 0x980000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000980000" filename = "" Region: id = 1345 start_va = 0x990000 end_va = 0x99ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000990000" filename = "" Region: id = 1346 start_va = 0xaa0000 end_va = 0xaaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000aa0000" filename = "" Region: id = 1347 start_va = 0xab0000 end_va = 0xabffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ab0000" filename = "" Region: id = 1348 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1349 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1350 start_va = 0x6a1c0000 end_va = 0x6a1ddfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "smdiagnostics.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\SMDiagnostics\\607f34b8be4f2014b99872617699b357\\SMDiagnostics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\smdiagnostics\\607f34b8be4f2014b99872617699b357\\smdiagnostics.ni.dll") Region: id = 1351 start_va = 0x70770000 end_va = 0x70782fff monitored = 0 entry_point = 0x70779950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 1352 start_va = 0x70740000 end_va = 0x7076efff monitored = 0 entry_point = 0x707595e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 1353 start_va = 0x74560000 end_va = 0x7457afff monitored = 0 entry_point = 0x74569050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 1354 start_va = 0xac0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ac0000" filename = "" Region: id = 1355 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1356 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1357 start_va = 0x50ea0000 end_va = 0x50fa3fff monitored = 1 entry_point = 0x50f9f3aa region_type = mapped_file name = "system.identitymodel.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IdentityModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.IdentityModel.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.identitymodel\\v4.0_4.0.0.0__b77a5c561934e089\\system.identitymodel.dll") Region: id = 1358 start_va = 0x4ca0000 end_va = 0x4da3fff monitored = 1 entry_point = 0x4d9f3aa region_type = mapped_file name = "system.identitymodel.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.IdentityModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.IdentityModel.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.identitymodel\\v4.0_4.0.0.0__b77a5c561934e089\\system.identitymodel.dll") Region: id = 1359 start_va = 0xad0000 end_va = 0xadffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 1360 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1361 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1362 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1363 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1364 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1365 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1366 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1367 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1368 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1369 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1370 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1371 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1372 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1373 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1374 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1375 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1376 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1377 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1378 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1379 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1380 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1381 start_va = 0x69f10000 end_va = 0x6a1b7fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.runtime.serialization.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Runteb92aa12#\\43ca3f2fcd379964cef1dc5898cb9248\\System.Runtime.Serialization.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.runteb92aa12#\\43ca3f2fcd379964cef1dc5898cb9248\\system.runtime.serialization.ni.dll") Region: id = 1382 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1383 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1384 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1385 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1386 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1387 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1388 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1389 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1390 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1391 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1392 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1393 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1394 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1395 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1396 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1397 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1398 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1399 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1400 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1401 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1402 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1403 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1404 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1405 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1406 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1407 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1408 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1409 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1410 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1411 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1412 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1413 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1414 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1415 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1416 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1417 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1418 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1419 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1420 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1421 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1422 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1423 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1424 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1425 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1426 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1427 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1428 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1429 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1430 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1431 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1432 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1433 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1434 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1435 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1436 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1437 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1438 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1439 start_va = 0x697f0000 end_va = 0x69f05fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.xml.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\1f87b5140145c221b5201351fffc52d8\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\1f87b5140145c221b5201351fffc52d8\\system.xml.ni.dll") Region: id = 1440 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1441 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1442 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1443 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1444 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1445 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1446 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1447 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1448 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1449 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1450 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1451 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1452 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1453 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1454 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1455 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1456 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1457 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1458 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1459 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1460 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1461 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1462 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1463 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1464 start_va = 0x69720000 end_va = 0x697e2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.servicemodel.internals.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Servd1dec626#\\80366b2f53761589c602827eb7cee9f2\\System.ServiceModel.Internals.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.servd1dec626#\\80366b2f53761589c602827eb7cee9f2\\system.servicemodel.internals.ni.dll") Region: id = 1465 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1466 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1467 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1468 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1469 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1470 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1471 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1472 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1473 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1474 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1475 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1476 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1477 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1478 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1479 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1480 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1481 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1482 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1483 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1484 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1485 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1486 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1487 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1488 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1489 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1490 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1491 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1492 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1493 start_va = 0x69630000 end_va = 0x6971efff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.configuration.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\1b51e779650e38bb712f3e535efcf132\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\1b51e779650e38bb712f3e535efcf132\\system.configuration.ni.dll") Region: id = 1494 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1495 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1496 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1497 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1498 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1499 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1500 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1501 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1502 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 1503 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1504 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1505 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1506 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1507 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1508 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1509 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1510 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1511 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1512 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1513 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1514 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1515 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1516 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1517 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1518 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1519 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1520 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1521 start_va = 0xae0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ae0000" filename = "" Region: id = 1522 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1523 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1524 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1525 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1526 start_va = 0x69580000 end_va = 0x6962dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.transactions.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\8a03e2886313defa91cef9f385480f4e\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.transactions\\8a03e2886313defa91cef9f385480f4e\\system.transactions.ni.dll") Region: id = 1527 start_va = 0x69530000 end_va = 0x6957afff monitored = 1 entry_point = 0x6954f53e region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1528 start_va = 0x4db0000 end_va = 0x4dfafff monitored = 1 entry_point = 0x4dcf53e region_type = mapped_file name = "system.transactions.dll" filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll") Region: id = 1529 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1530 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1531 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1532 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1533 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1534 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1535 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1536 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1537 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1538 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1539 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1540 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1541 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1542 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1543 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1544 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1545 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1546 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1547 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1548 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1549 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1550 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1551 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1552 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1553 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1554 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1555 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1556 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1557 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1558 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1559 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1560 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1561 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1562 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1563 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1564 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1565 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1566 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1567 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1568 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1569 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1570 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1571 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1572 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1573 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1574 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1575 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1576 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1577 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1578 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1579 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1580 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1581 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1582 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1583 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1584 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1585 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1586 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1587 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1588 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1589 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1590 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1591 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1592 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1593 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1594 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1595 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1596 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1597 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1598 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1599 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1600 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1601 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1602 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1603 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1604 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1605 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1606 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1607 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1608 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1609 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1610 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1611 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1612 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1613 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1614 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1615 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1616 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1617 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1618 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1619 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1620 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1621 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1622 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1623 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1624 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1625 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1626 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1627 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1628 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1629 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1630 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1631 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1632 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1633 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1634 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1635 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1636 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1637 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 1638 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 1639 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1640 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1641 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1642 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1643 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1644 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1645 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1646 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1647 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1648 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1649 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1650 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1651 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1652 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1653 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1654 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1655 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1656 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1657 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1658 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1659 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1660 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1661 start_va = 0xb00000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b00000" filename = "" Region: id = 1662 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1663 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1664 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1665 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1666 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1667 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1668 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1669 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1670 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1671 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1672 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1673 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1674 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1675 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1676 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 1677 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1678 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1679 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1680 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1681 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1682 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1683 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1684 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1685 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1686 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1687 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1688 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1689 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1690 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1691 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1692 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1693 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1694 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1695 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1696 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1697 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1698 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1699 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1700 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1701 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1702 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1703 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1704 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1705 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1706 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1707 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1708 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 1709 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 1710 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1711 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1712 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1713 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1714 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1715 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1716 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1717 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1718 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1719 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1720 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1721 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1722 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1723 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1724 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1725 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1726 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1727 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1728 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1729 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1730 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1731 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1732 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1733 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1734 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1735 start_va = 0xaf0000 end_va = 0xafffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 1736 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1737 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1738 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1739 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1740 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1741 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1742 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1743 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1744 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1745 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1746 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1747 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1748 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1749 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1750 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1751 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1752 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1753 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1754 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 1755 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1756 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1757 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1758 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1759 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1760 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1761 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1762 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1763 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1764 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1765 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1766 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1767 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1768 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1769 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1770 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1771 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1772 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1773 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1774 start_va = 0xb20000 end_va = 0xb2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b20000" filename = "" Region: id = 1775 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1776 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1777 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1778 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1779 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1780 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1781 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1782 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1783 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1784 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1785 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1786 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1787 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1788 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1789 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1790 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1791 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1792 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1793 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1794 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1795 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1796 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1797 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1798 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1799 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1800 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1801 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1802 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1803 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1804 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1805 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1806 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1807 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1808 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1809 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1810 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1811 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1812 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1813 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1814 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1815 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1816 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1817 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1818 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1819 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1820 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1821 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1822 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1823 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1824 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1825 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1826 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1827 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1828 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1829 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1830 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1831 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1832 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1833 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1834 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1835 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1836 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1837 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1838 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1839 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1840 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1841 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1842 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1843 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1844 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1845 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1846 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1847 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1848 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1849 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1850 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1851 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1852 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1853 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1854 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1855 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1856 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1857 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1858 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1859 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1860 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1861 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1862 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1863 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1864 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1865 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1866 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1867 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1868 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1869 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1870 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1871 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1872 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1873 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1874 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1875 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1876 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1877 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1878 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1879 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1880 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1881 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1882 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1883 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1884 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1885 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1886 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1887 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1888 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1889 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1890 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1891 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1892 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1893 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1894 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1895 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1896 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1897 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1898 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1899 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1900 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1901 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1902 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1903 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1904 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1905 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1906 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1907 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1908 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1909 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1910 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1911 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1912 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1913 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1914 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1915 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1916 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1917 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1918 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1919 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1920 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1921 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1922 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1923 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1924 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1925 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1926 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1927 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1928 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1929 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1930 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1931 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1932 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1933 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 1934 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1935 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1936 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1937 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1938 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1939 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1940 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1941 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1942 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1943 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1944 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1945 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1946 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1947 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1948 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1949 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1950 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1951 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1952 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1953 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1954 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1955 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1956 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1957 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1958 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1959 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1960 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1961 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1962 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1963 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1964 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1965 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1966 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1967 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1968 start_va = 0xb10000 end_va = 0xb1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b10000" filename = "" Region: id = 1969 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1970 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1971 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1972 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1973 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1974 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1975 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1976 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1977 start_va = 0xb30000 end_va = 0xb3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b30000" filename = "" Region: id = 1978 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1979 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1980 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1981 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1982 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1983 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1984 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1985 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1986 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1987 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1988 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1989 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1990 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1991 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1992 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1993 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1994 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1995 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1996 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1997 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1998 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 1999 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2000 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2001 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2002 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2003 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2004 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2005 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2006 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2007 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2008 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2009 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2010 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2011 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2012 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2013 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2014 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2015 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2016 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2017 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2018 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2019 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2020 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2021 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2022 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2023 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2024 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2025 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2026 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2027 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2028 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2029 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2030 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2031 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2032 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2033 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2034 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2035 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2036 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2037 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2038 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2039 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2040 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2041 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2042 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2043 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2044 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2045 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2046 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2047 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2048 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2049 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2050 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2051 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2052 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2053 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2054 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2055 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2056 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2057 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2058 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2059 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2060 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2061 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2062 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2063 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2064 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2065 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2066 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2067 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2068 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2069 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2070 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2071 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2072 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2073 start_va = 0x4db0000 end_va = 0x4e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2074 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2075 start_va = 0x4e00000 end_va = 0x4e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 2076 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2077 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2078 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2079 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2080 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2081 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2082 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2083 start_va = 0x4db0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004db0000" filename = "" Region: id = 2084 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2085 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2086 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2087 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2088 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2089 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2090 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2091 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2092 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2093 start_va = 0x4dc0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dc0000" filename = "" Region: id = 2094 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2095 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2096 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2097 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2098 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2099 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2100 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2101 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2102 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2103 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2104 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2105 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2106 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2107 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2108 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2109 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2110 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2111 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2112 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2113 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2114 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2115 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2116 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2117 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2118 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2119 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2120 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2121 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2122 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2123 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2124 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2125 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2126 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2127 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2128 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2129 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2130 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2131 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2132 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2133 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2134 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2135 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2136 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2137 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2138 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2139 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2140 start_va = 0x4e30000 end_va = 0x4e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e30000" filename = "" Region: id = 2141 start_va = 0x4e40000 end_va = 0x4e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e40000" filename = "" Region: id = 2142 start_va = 0x4e50000 end_va = 0x4e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Region: id = 2143 start_va = 0x4e60000 end_va = 0x4e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e60000" filename = "" Region: id = 2144 start_va = 0x4e70000 end_va = 0x4e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 2145 start_va = 0x4e80000 end_va = 0x4e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 2146 start_va = 0x4e90000 end_va = 0x4e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e90000" filename = "" Region: id = 2147 start_va = 0x4ea0000 end_va = 0x4eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 2148 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2149 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2150 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2151 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2152 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2153 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2154 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2155 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2156 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2157 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2158 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2159 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2160 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2161 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2162 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2163 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2164 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2165 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2166 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2167 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2168 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2169 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2170 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2171 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2172 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2173 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2174 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2175 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2176 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2177 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2178 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2179 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2180 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2181 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2182 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2183 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2184 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2185 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2186 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2187 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2188 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2189 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2190 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2191 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2192 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2193 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2194 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2195 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2196 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2197 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2198 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2199 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2200 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2201 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2202 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2203 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2204 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2205 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2206 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2207 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2208 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2209 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2210 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2211 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2212 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2213 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2214 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2215 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2216 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2217 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2218 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2219 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2220 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2221 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2222 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2223 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2224 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2225 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2226 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2227 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2228 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2229 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2230 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2231 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2232 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2233 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2234 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2235 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2236 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2237 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2238 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2239 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2240 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2241 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2242 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2243 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2244 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2245 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2246 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2247 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2248 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2249 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2250 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2251 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2252 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2253 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2254 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2255 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2256 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2257 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2258 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2259 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2260 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2261 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2262 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2263 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2264 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2265 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2266 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2267 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2268 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2269 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2270 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2271 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2272 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2273 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2274 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2275 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2276 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2277 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2278 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2279 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2280 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2281 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2282 start_va = 0x4dd0000 end_va = 0x4ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 2283 start_va = 0xffe60000 end_va = 0xffeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000ffe60000" filename = "" Region: id = 2284 start_va = 0xffe50000 end_va = 0xffe5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000ffe50000" filename = "" Region: id = 2285 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2286 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2287 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2288 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2289 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2290 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2291 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2292 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2293 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2294 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2295 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2296 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2297 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2298 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2299 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2300 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2301 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2302 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2303 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2304 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2305 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2306 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2307 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2308 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2309 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2310 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2311 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2312 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2313 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2314 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2315 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2316 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2317 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2318 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2319 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2320 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2321 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2322 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2323 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2324 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2325 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2326 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2327 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2328 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2329 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2330 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2331 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2332 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2333 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2334 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2335 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2336 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2337 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2338 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2339 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2340 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2341 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2342 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2343 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2344 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2345 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2346 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2347 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2348 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2349 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2350 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2351 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2352 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2353 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2354 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2355 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2356 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2357 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2358 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2359 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2360 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2361 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2362 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2363 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2364 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2365 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2366 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2367 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2368 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2369 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2370 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2371 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2372 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2373 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2374 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2375 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2376 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2377 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2378 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2379 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2380 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2381 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2382 start_va = 0x4de0000 end_va = 0x4deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 2383 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2384 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2385 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2386 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2387 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2388 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2389 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2390 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2391 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2392 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2393 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2394 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2395 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2396 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2397 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2398 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2399 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2400 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2401 start_va = 0x4df0000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004df0000" filename = "" Region: id = 2402 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2403 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2404 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2405 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2406 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2407 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2408 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2409 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2410 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2411 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2412 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2413 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2414 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2415 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2416 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2417 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2418 start_va = 0x773e0000 end_va = 0x7743efff monitored = 0 entry_point = 0x773e4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 2419 start_va = 0x723a0000 end_va = 0x723eefff monitored = 0 entry_point = 0x723ad850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 2420 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2421 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2422 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2423 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2424 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2425 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2426 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2427 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2428 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2429 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2430 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2431 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2432 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2433 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2434 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2435 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2436 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2437 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2438 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2439 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2440 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2441 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2442 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2443 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2444 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2445 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2446 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2447 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2448 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2449 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2450 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2451 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2452 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2453 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2454 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2455 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2456 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2457 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2458 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2459 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2460 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2461 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2462 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2463 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2464 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2465 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2466 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2467 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2468 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2469 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2470 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2471 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2472 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2473 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2474 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2475 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2476 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2477 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2478 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2479 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2480 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2481 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2482 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2483 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2484 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2485 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2486 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2487 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2488 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2489 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2490 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2491 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2492 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2493 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2494 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2495 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2496 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2497 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2498 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2499 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2500 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2501 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2502 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2503 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2504 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2505 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2506 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2507 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2508 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2509 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2510 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2511 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2512 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2513 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2514 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2515 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2516 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2517 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2518 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2519 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2520 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2521 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2522 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2523 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2524 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2525 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2526 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2527 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2528 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2529 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2530 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2531 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2532 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2533 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2534 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2535 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2536 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2537 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2538 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2539 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2540 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2541 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2542 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2543 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2544 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2545 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2546 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2547 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2548 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2549 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2550 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2551 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2552 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2553 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2554 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2555 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2556 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2557 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2558 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2559 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2560 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2561 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2562 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2563 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2564 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2565 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2566 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2567 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2568 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2569 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2570 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2571 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2572 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2573 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2574 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2575 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2576 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2577 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2578 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2579 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2580 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2581 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2582 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2583 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2584 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2585 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2586 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2587 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2588 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2589 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2590 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2591 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2592 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2593 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2594 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2595 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2596 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2597 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2598 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2599 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2600 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2601 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2602 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2603 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2604 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2605 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2606 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2607 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2608 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2609 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2610 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2611 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2612 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2613 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2614 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2615 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2616 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2617 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2618 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2619 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2620 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2621 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2622 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2623 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2624 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2625 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2626 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2627 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2628 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2629 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2630 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2631 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2632 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2633 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2634 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2635 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2636 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2637 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2638 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2639 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2640 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2641 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2642 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2643 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2644 start_va = 0x4e10000 end_va = 0x4e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e10000" filename = "" Region: id = 2645 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2646 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2647 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2648 start_va = 0x4eb0000 end_va = 0x4ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004eb0000" filename = "" Region: id = 2649 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2650 start_va = 0x4e30000 end_va = 0x4e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e30000" filename = "" Region: id = 2651 start_va = 0x4e40000 end_va = 0x4e4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e40000" filename = "" Region: id = 2652 start_va = 0x4e50000 end_va = 0x4e5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e50000" filename = "" Region: id = 2653 start_va = 0x4e60000 end_va = 0x4e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e60000" filename = "" Region: id = 2654 start_va = 0x4e70000 end_va = 0x4e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 2655 start_va = 0x4e80000 end_va = 0x4e8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e80000" filename = "" Region: id = 2656 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2657 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2658 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2659 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2660 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2661 start_va = 0x4e30000 end_va = 0x4e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e30000" filename = "" Region: id = 2662 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2663 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2664 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2665 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2666 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2667 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2668 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2669 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2670 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2671 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2672 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2673 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2674 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2675 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2676 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2677 start_va = 0x4e30000 end_va = 0x4e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e30000" filename = "" Region: id = 2678 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2679 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2680 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2681 start_va = 0x4e20000 end_va = 0x4e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e20000" filename = "" Region: id = 2682 start_va = 0x75690000 end_va = 0x76a8efff monitored = 0 entry_point = 0x7584b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 2683 start_va = 0x76a90000 end_va = 0x76ac6fff monitored = 0 entry_point = 0x76a93b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 2684 start_va = 0x76e20000 end_va = 0x77318fff monitored = 0 entry_point = 0x77027610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 2685 start_va = 0x775e0000 end_va = 0x7766cfff monitored = 0 entry_point = 0x77629b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 2686 start_va = 0x74e20000 end_va = 0x74e63fff monitored = 0 entry_point = 0x74e27410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 2687 start_va = 0x77670000 end_va = 0x7767efff monitored = 0 entry_point = 0x77672e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 2688 start_va = 0x4e20000 end_va = 0x4e20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004e20000" filename = "" Region: id = 2689 start_va = 0x6eeb0000 end_va = 0x6eeb9fff monitored = 0 entry_point = 0x6eeb3200 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\SysWOW64\\secur32.dll" (normalized: "c:\\windows\\syswow64\\secur32.dll") Region: id = 2690 start_va = 0x69410000 end_va = 0x6952bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.management.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\d2f554a0c84513cd793fdcd77a86dab1\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\d2f554a0c84513cd793fdcd77a86dab1\\system.management.ni.dll") Region: id = 2691 start_va = 0x4e30000 end_va = 0x4e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e30000" filename = "" Region: id = 2692 start_va = 0x4ec0000 end_va = 0x4fbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ec0000" filename = "" Region: id = 2693 start_va = 0x4fc0000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004fc0000" filename = "" Region: id = 2694 start_va = 0x5000000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 2695 start_va = 0x5100000 end_va = 0x513ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2696 start_va = 0x5140000 end_va = 0x523ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005140000" filename = "" Region: id = 2697 start_va = 0x6ce20000 end_va = 0x6ce29fff monitored = 1 entry_point = 0x6ce239f9 region_type = mapped_file name = "wminet_utils.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll") Region: id = 2698 start_va = 0x4e70000 end_va = 0x4e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 2699 start_va = 0x4e70000 end_va = 0x4e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 2700 start_va = 0x4e70000 end_va = 0x4e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e70000" filename = "" Region: id = 2701 start_va = 0x4e70000 end_va = 0x4e70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004e70000" filename = "" Region: id = 2702 start_va = 0x75220000 end_va = 0x752a3fff monitored = 0 entry_point = 0x75246220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 2703 start_va = 0x4e90000 end_va = 0x4e90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004e90000" filename = "" Region: id = 2704 start_va = 0x693f0000 end_va = 0x6940bfff monitored = 0 entry_point = 0x693faa90 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll") Region: id = 2705 start_va = 0x69380000 end_va = 0x693e6fff monitored = 0 entry_point = 0x6939b610 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 2706 start_va = 0x6ce00000 end_va = 0x6ce0cfff monitored = 0 entry_point = 0x6ce03520 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 3070 start_va = 0x69360000 end_va = 0x69370fff monitored = 0 entry_point = 0x69368fa0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 3071 start_va = 0x692a0000 end_va = 0x6935efff monitored = 0 entry_point = 0x692d1e80 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 3164 start_va = 0x69110000 end_va = 0x69293fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.csharp.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.CSharp\\4b4bc9f75377aaea11113089f0188e82\\Microsoft.CSharp.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.csharp\\4b4bc9f75377aaea11113089f0188e82\\microsoft.csharp.ni.dll") Region: id = 3165 start_va = 0x68f80000 end_va = 0x6910cfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\system.drawing.ni.dll") Region: id = 3166 start_va = 0x68320000 end_va = 0x68f78fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8cd2187094ba6cade0ca0fab4f932654\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\8cd2187094ba6cade0ca0fab4f932654\\system.windows.forms.ni.dll") Region: id = 3167 start_va = 0x681b0000 end_va = 0x6831afff monitored = 0 entry_point = 0x6821e360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 3168 start_va = 0x5240000 end_va = 0x53cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 3169 start_va = 0x70970000 end_va = 0x709e4fff monitored = 0 entry_point = 0x709a9a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 3170 start_va = 0x5240000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 3171 start_va = 0x53c0000 end_va = 0x53cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053c0000" filename = "" Region: id = 3173 start_va = 0x5240000 end_va = 0x527ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005240000" filename = "" Region: id = 3174 start_va = 0x52a0000 end_va = 0x52affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052a0000" filename = "" Region: id = 3175 start_va = 0x52b0000 end_va = 0x53affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052b0000" filename = "" Region: id = 3176 start_va = 0x74c60000 end_va = 0x74d7efff monitored = 0 entry_point = 0x74ca5980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 3242 start_va = 0x53d0000 end_va = 0x540ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053d0000" filename = "" Region: id = 3243 start_va = 0x5410000 end_va = 0x550ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005410000" filename = "" Region: id = 3244 start_va = 0x5280000 end_va = 0x5283fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005280000" filename = "" Region: id = 3245 start_va = 0x68150000 end_va = 0x681affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.dynamic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dynamic\\f7209dae192c8b5254852d8a975aed4e\\System.Dynamic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dynamic\\f7209dae192c8b5254852d8a975aed4e\\system.dynamic.ni.dll") Region: id = 3246 start_va = 0x5510000 end_va = 0x560ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005510000" filename = "" Region: id = 3247 start_va = 0x5290000 end_va = 0x5290fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3248 start_va = 0x5290000 end_va = 0x5298fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3249 start_va = 0x5290000 end_va = 0x5290fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3250 start_va = 0x5290000 end_va = 0x5298fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3251 start_va = 0x5290000 end_va = 0x5290fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 3252 start_va = 0x5290000 end_va = 0x5298fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 3253 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 3254 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 3255 start_va = 0x53b0000 end_va = 0x53bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053b0000" filename = "" Region: id = 3256 start_va = 0x5610000 end_va = 0x561ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 3257 start_va = 0x5620000 end_va = 0x562ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005620000" filename = "" Region: id = 3258 start_va = 0x5630000 end_va = 0x563ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005630000" filename = "" Region: id = 3259 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 3260 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 3261 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 3262 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 3263 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 3264 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 3265 start_va = 0x53b0000 end_va = 0x53bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053b0000" filename = "" Region: id = 3266 start_va = 0x5610000 end_va = 0x561ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005610000" filename = "" Region: id = 3267 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 3268 start_va = 0x5620000 end_va = 0x5630fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005620000" filename = "" Region: id = 3269 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 3270 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 3271 start_va = 0x5290000 end_va = 0x529ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005290000" filename = "" Region: id = 3272 start_va = 0x53b0000 end_va = 0x53bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053b0000" filename = "" Region: id = 3273 start_va = 0x53b0000 end_va = 0x53bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053b0000" filename = "" Region: id = 3274 start_va = 0x53b0000 end_va = 0x53bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053b0000" filename = "" Region: id = 3275 start_va = 0x53b0000 end_va = 0x53bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053b0000" filename = "" Region: id = 3276 start_va = 0x5640000 end_va = 0x564ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005640000" filename = "" Region: id = 3277 start_va = 0x53b0000 end_va = 0x53bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053b0000" filename = "" Region: id = 3278 start_va = 0x53b0000 end_va = 0x53bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000053b0000" filename = "" Region: id = 3279 start_va = 0x5640000 end_va = 0x564ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005640000" filename = "" Region: id = 3280 start_va = 0x5640000 end_va = 0x564ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005640000" filename = "" Region: id = 3281 start_va = 0x5640000 end_va = 0x564ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005640000" filename = "" Region: id = 3282 start_va = 0x5650000 end_va = 0x565ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005650000" filename = "" Region: id = 3283 start_va = 0x5660000 end_va = 0x566ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005660000" filename = "" Region: id = 3284 start_va = 0x5640000 end_va = 0x564ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005640000" filename = "" Region: id = 3285 start_va = 0x5640000 end_va = 0x5709fff monitored = 0 entry_point = 0x56421f0 region_type = mapped_file name = "iexplore.exe" filename = "\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe") Region: id = 3286 start_va = 0x5710000 end_va = 0x5711fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005710000" filename = "" Region: id = 3287 start_va = 0x5720000 end_va = 0x5720fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005720000" filename = "" Region: id = 3288 start_va = 0x5730000 end_va = 0x5731fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iexplore.exe.mui" filename = "\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui") Region: id = 3289 start_va = 0x5640000 end_va = 0x5709fff monitored = 0 entry_point = 0x56421f0 region_type = mapped_file name = "iexplore.exe" filename = "\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe") Region: id = 3290 start_va = 0x5730000 end_va = 0x5731fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "iexplore.exe.mui" filename = "\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui") Region: id = 3291 start_va = 0x5640000 end_va = 0x5644fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll") Region: id = 3292 start_va = 0x5650000 end_va = 0x565ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui") Region: id = 3293 start_va = 0x5660000 end_va = 0x566ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005660000" filename = "" Region: id = 3294 start_va = 0x5670000 end_va = 0x567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 3295 start_va = 0x5670000 end_va = 0x567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 3296 start_va = 0x5670000 end_va = 0x567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 3297 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3298 start_va = 0x5670000 end_va = 0x567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 3299 start_va = 0x5670000 end_va = 0x567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 3654 start_va = 0x5670000 end_va = 0x5672fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005670000" filename = "" Region: id = 3655 start_va = 0x5670000 end_va = 0x567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 3657 start_va = 0x5670000 end_va = 0x567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 3659 start_va = 0x5670000 end_va = 0x5672fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005670000" filename = "" Region: id = 3660 start_va = 0x5670000 end_va = 0x567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 3661 start_va = 0x5730000 end_va = 0x5c21fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005730000" filename = "" Region: id = 3662 start_va = 0x5670000 end_va = 0x567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 3663 start_va = 0x5670000 end_va = 0x567ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005670000" filename = "" Region: id = 3664 start_va = 0x5c30000 end_va = 0x6121fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c30000" filename = "" Region: id = 3665 start_va = 0x6130000 end_va = 0x6621fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000006130000" filename = "" Region: id = 3666 start_va = 0x67fd0000 end_va = 0x68142fff monitored = 0 entry_point = 0x6807d220 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 3667 start_va = 0x6630000 end_va = 0x672ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006630000" filename = "" Region: id = 3668 start_va = 0x6730000 end_va = 0x67d3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006730000" filename = "" Region: id = 3670 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3671 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3672 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3673 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3674 start_va = 0x5690000 end_va = 0x569ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005690000" filename = "" Region: id = 3675 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3676 start_va = 0x5730000 end_va = 0x582ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005730000" filename = "" Region: id = 3687 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3688 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3689 start_va = 0x5690000 end_va = 0x569ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005690000" filename = "" Region: id = 3690 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3691 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3692 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3693 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3694 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3695 start_va = 0x5680000 end_va = 0x568ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005680000" filename = "" Region: id = 3696 start_va = 0x5680000 end_va = 0x5690fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005680000" filename = "" Region: id = 3697 start_va = 0x67f20000 end_va = 0x67fc4fff monitored = 0 entry_point = 0x67f3ac50 region_type = mapped_file name = "rasapi32.dll" filename = "\\Windows\\SysWOW64\\rasapi32.dll" (normalized: "c:\\windows\\syswow64\\rasapi32.dll") Region: id = 3698 start_va = 0x67ef0000 end_va = 0x67f12fff monitored = 0 entry_point = 0x67ef5570 region_type = mapped_file name = "rasman.dll" filename = "\\Windows\\SysWOW64\\rasman.dll" (normalized: "c:\\windows\\syswow64\\rasman.dll") Region: id = 3699 start_va = 0x67ee0000 end_va = 0x67eeffff monitored = 0 entry_point = 0x67ee3820 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\SysWOW64\\rtutils.dll" (normalized: "c:\\windows\\syswow64\\rtutils.dll") Region: id = 3700 start_va = 0x5830000 end_va = 0x590ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 3701 start_va = 0x56a0000 end_va = 0x56dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056a0000" filename = "" Region: id = 3702 start_va = 0x5910000 end_va = 0x5a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005910000" filename = "" Region: id = 3703 start_va = 0x70a00000 end_va = 0x70a9afff monitored = 0 entry_point = 0x70a3f7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 3704 start_va = 0x70aa0000 end_va = 0x70ab1fff monitored = 0 entry_point = 0x70aa4510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 3705 start_va = 0x722a0000 end_va = 0x722cefff monitored = 0 entry_point = 0x722abb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 3706 start_va = 0x749e0000 end_va = 0x749e6fff monitored = 0 entry_point = 0x749e1e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 3707 start_va = 0x72220000 end_va = 0x72232fff monitored = 0 entry_point = 0x722225d0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc6.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc6.dll") Region: id = 3708 start_va = 0x72200000 end_va = 0x72213fff monitored = 0 entry_point = 0x72203c10 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\SysWOW64\\dhcpcsvc.dll" (normalized: "c:\\windows\\syswow64\\dhcpcsvc.dll") Region: id = 3709 start_va = 0x5a10000 end_va = 0x5a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a10000" filename = "" Region: id = 3710 start_va = 0x5a50000 end_va = 0x5b4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a50000" filename = "" Region: id = 3711 start_va = 0x56e0000 end_va = 0x56effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000056e0000" filename = "" Region: id = 3712 start_va = 0x722d0000 end_va = 0x72353fff monitored = 0 entry_point = 0x722f6530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 3713 start_va = 0x709f0000 end_va = 0x709f7fff monitored = 0 entry_point = 0x709f1fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 3714 start_va = 0x72290000 end_va = 0x72297fff monitored = 0 entry_point = 0x72291920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 3715 start_va = 0x72240000 end_va = 0x72286fff monitored = 0 entry_point = 0x722558d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 3716 start_va = 0x70820000 end_va = 0x70883fff monitored = 0 entry_point = 0x7083afd0 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 3717 start_va = 0x76ca0000 end_va = 0x76e17fff monitored = 0 entry_point = 0x76cf8a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 3718 start_va = 0x74e70000 end_va = 0x74e7dfff monitored = 0 entry_point = 0x74e75410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 3719 start_va = 0x56f0000 end_va = 0x56f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000056f0000" filename = "" Region: id = 3720 start_va = 0x70810000 end_va = 0x7081ffff monitored = 0 entry_point = 0x70814600 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll") Region: id = 3721 start_va = 0x707f0000 end_va = 0x7080ffff monitored = 0 entry_point = 0x707fd120 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 3722 start_va = 0x707c0000 end_va = 0x707ebfff monitored = 0 entry_point = 0x707dbb10 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll") Region: id = 3723 start_va = 0x707a0000 end_va = 0x707b9fff monitored = 0 entry_point = 0x707afa70 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll") Region: id = 3724 start_va = 0x5b50000 end_va = 0x5b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b50000" filename = "" Region: id = 3725 start_va = 0x5b90000 end_va = 0x5c8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b90000" filename = "" Region: id = 3726 start_va = 0x5c90000 end_va = 0x5ccffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c90000" filename = "" Region: id = 3727 start_va = 0x5cd0000 end_va = 0x5dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005cd0000" filename = "" Region: id = 3728 start_va = 0x72850000 end_va = 0x7299afff monitored = 0 entry_point = 0x728b1660 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 3729 start_va = 0x56f0000 end_va = 0x56f3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 3730 start_va = 0x5dd0000 end_va = 0x5de2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db") Region: id = 3731 start_va = 0x5700000 end_va = 0x5700fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005700000" filename = "" Region: id = 3732 start_va = 0x74810000 end_va = 0x748a1fff monitored = 0 entry_point = 0x74850380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 3733 start_va = 0x67e70000 end_va = 0x67edffff monitored = 0 entry_point = 0x67e9d4e0 region_type = mapped_file name = "dlnashext.dll" filename = "\\Windows\\SysWOW64\\dlnashext.dll" (normalized: "c:\\windows\\syswow64\\dlnashext.dll") Region: id = 3734 start_va = 0x67e10000 end_va = 0x67e66fff monitored = 0 entry_point = 0x67e57e90 region_type = mapped_file name = "playtodevice.dll" filename = "\\Windows\\SysWOW64\\PlayToDevice.dll" (normalized: "c:\\windows\\syswow64\\playtodevice.dll") Region: id = 3735 start_va = 0x5df0000 end_va = 0x5e2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005df0000" filename = "" Region: id = 3736 start_va = 0x5e30000 end_va = 0x5f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e30000" filename = "" Region: id = 3737 start_va = 0x5f30000 end_va = 0x5f6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f30000" filename = "" Region: id = 3738 start_va = 0x5f70000 end_va = 0x606ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f70000" filename = "" Region: id = 3739 start_va = 0x71ec0000 end_va = 0x71edafff monitored = 0 entry_point = 0x71ed36d0 region_type = mapped_file name = "devdispitemprovider.dll" filename = "\\Windows\\SysWOW64\\DevDispItemProvider.dll" (normalized: "c:\\windows\\syswow64\\devdispitemprovider.dll") Region: id = 3740 start_va = 0x72ca0000 end_va = 0x72cf4fff monitored = 0 entry_point = 0x72cc2ee0 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\SysWOW64\\MMDevAPI.dll" (normalized: "c:\\windows\\syswow64\\mmdevapi.dll") Region: id = 3741 start_va = 0x729a0000 end_va = 0x729c1fff monitored = 0 entry_point = 0x729a91f0 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 3742 start_va = 0x67c20000 end_va = 0x67e07fff monitored = 0 entry_point = 0x67ca04c0 region_type = mapped_file name = "wpdshext.dll" filename = "\\Windows\\SysWOW64\\wpdshext.dll" (normalized: "c:\\windows\\syswow64\\wpdshext.dll") Region: id = 3743 start_va = 0x56f0000 end_va = 0x56f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000056f0000" filename = "" Region: id = 3744 start_va = 0x741a0000 end_va = 0x743bbfff monitored = 0 entry_point = 0x7436bc40 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll") Region: id = 3745 start_va = 0x6070000 end_va = 0x6073fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3746 start_va = 0x6080000 end_va = 0x60c4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 3747 start_va = 0x60d0000 end_va = 0x60d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 3748 start_va = 0x6730000 end_va = 0x67bdfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 3749 start_va = 0x67c0000 end_va = 0x6bbafff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000067c0000" filename = "" Region: id = 3750 start_va = 0x70ce0000 end_va = 0x70e5dfff monitored = 0 entry_point = 0x70d5c630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 3751 start_va = 0x72420000 end_va = 0x726eafff monitored = 0 entry_point = 0x7265c4c0 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 3752 start_va = 0x6bc0000 end_va = 0x6dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006bc0000" filename = "" Region: id = 3753 start_va = 0x60e0000 end_va = 0x60e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000060e0000" filename = "" Region: id = 3754 start_va = 0xffdd0000 end_va = 0xffe4dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Thread: id = 4 os_tid = 0xfa4 [0179.939] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0179.943] RoInitialize () returned 0x1 [0179.943] RoUninitialize () returned 0x0 [0185.091] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe.Config", nBufferLength=0x105, lpBuffer=0x19e5d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe.Config", lpFilePart=0x0) returned 0x42 [0185.092] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe.Config", nBufferLength=0x105, lpBuffer=0x19e578, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe.Config", lpFilePart=0x0) returned 0x42 [0185.104] GetCurrentProcess () returned 0xffffffff [0185.104] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e930 | out: TokenHandle=0x19e930*=0x268) returned 1 [0185.109] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19e40c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0185.111] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19e930 | out: lpFileInformation=0x19e930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0185.113] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0185.114] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19e930 | out: lpFileInformation=0x19e930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0185.115] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19e368, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0185.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e85c) returned 1 [0185.116] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x270 [0185.116] GetFileType (hFile=0x270) returned 0x1 [0185.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e858) returned 1 [0185.117] GetFileType (hFile=0x270) returned 0x1 [0185.131] GetFileSize (in: hFile=0x270, lpFileSizeHigh=0x19e924 | out: lpFileSizeHigh=0x19e924*=0x0) returned 0x8c8f [0185.132] ReadFile (in: hFile=0x270, lpBuffer=0x228475c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e8e0, lpOverlapped=0x0 | out: lpBuffer=0x228475c*, lpNumberOfBytesRead=0x19e8e0*=0x1000, lpOverlapped=0x0) returned 1 [0185.146] ReadFile (in: hFile=0x270, lpBuffer=0x228475c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e77c, lpOverlapped=0x0 | out: lpBuffer=0x228475c*, lpNumberOfBytesRead=0x19e77c*=0x1000, lpOverlapped=0x0) returned 1 [0185.150] ReadFile (in: hFile=0x270, lpBuffer=0x228475c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e630, lpOverlapped=0x0 | out: lpBuffer=0x228475c*, lpNumberOfBytesRead=0x19e630*=0x1000, lpOverlapped=0x0) returned 1 [0185.150] ReadFile (in: hFile=0x270, lpBuffer=0x228475c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e630, lpOverlapped=0x0 | out: lpBuffer=0x228475c*, lpNumberOfBytesRead=0x19e630*=0x1000, lpOverlapped=0x0) returned 1 [0185.151] ReadFile (in: hFile=0x270, lpBuffer=0x228475c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e630, lpOverlapped=0x0 | out: lpBuffer=0x228475c*, lpNumberOfBytesRead=0x19e630*=0x1000, lpOverlapped=0x0) returned 1 [0185.151] ReadFile (in: hFile=0x270, lpBuffer=0x228475c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e568, lpOverlapped=0x0 | out: lpBuffer=0x228475c*, lpNumberOfBytesRead=0x19e568*=0x1000, lpOverlapped=0x0) returned 1 [0185.154] ReadFile (in: hFile=0x270, lpBuffer=0x228475c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e6e4, lpOverlapped=0x0 | out: lpBuffer=0x228475c*, lpNumberOfBytesRead=0x19e6e4*=0x1000, lpOverlapped=0x0) returned 1 [0185.172] ReadFile (in: hFile=0x270, lpBuffer=0x228475c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e5f8, lpOverlapped=0x0 | out: lpBuffer=0x228475c*, lpNumberOfBytesRead=0x19e5f8*=0x1000, lpOverlapped=0x0) returned 1 [0185.172] ReadFile (in: hFile=0x270, lpBuffer=0x228475c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e5f8, lpOverlapped=0x0 | out: lpBuffer=0x228475c*, lpNumberOfBytesRead=0x19e5f8*=0xc8f, lpOverlapped=0x0) returned 1 [0185.172] ReadFile (in: hFile=0x270, lpBuffer=0x228475c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e6b8, lpOverlapped=0x0 | out: lpBuffer=0x228475c*, lpNumberOfBytesRead=0x19e6b8*=0x0, lpOverlapped=0x0) returned 1 [0185.172] CloseHandle (hObject=0x270) returned 1 [0185.173] GetCurrentProcess () returned 0xffffffff [0185.173] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea58 | out: TokenHandle=0x19ea58*=0x270) returned 1 [0185.174] GetCurrentProcess () returned 0xffffffff [0185.174] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea58 | out: TokenHandle=0x19ea58*=0x274) returned 1 [0185.174] GetCurrentProcess () returned 0xffffffff [0185.174] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e930 | out: TokenHandle=0x19e930*=0x278) returned 1 [0185.175] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\applaunch.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19e930 | out: lpFileInformation=0x19e930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ebcd76, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97a89f7e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97a89f7e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x119)) returned 1 [0185.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe.Config", nBufferLength=0x105, lpBuffer=0x19e3d8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe.Config", lpFilePart=0x0) returned 0x42 [0185.175] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\applaunch.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19e930 | out: lpFileInformation=0x19e930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ebcd76, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97a89f7e, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97a89f7e, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x119)) returned 1 [0185.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe.Config", nBufferLength=0x105, lpBuffer=0x19e368, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe.Config", lpFilePart=0x0) returned 0x42 [0185.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e85c) returned 1 [0185.175] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\applaunch.exe.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x27c [0185.175] GetFileType (hFile=0x27c) returned 0x1 [0185.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e858) returned 1 [0185.175] GetFileType (hFile=0x27c) returned 0x1 [0185.176] GetFileSize (in: hFile=0x27c, lpFileSizeHigh=0x19e924 | out: lpFileSizeHigh=0x19e924*=0x0) returned 0x119 [0185.176] ReadFile (in: hFile=0x27c, lpBuffer=0x229cc70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e8e0, lpOverlapped=0x0 | out: lpBuffer=0x229cc70*, lpNumberOfBytesRead=0x19e8e0*=0x119, lpOverlapped=0x0) returned 1 [0185.176] ReadFile (in: hFile=0x27c, lpBuffer=0x229cc70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e7a4, lpOverlapped=0x0 | out: lpBuffer=0x229cc70*, lpNumberOfBytesRead=0x19e7a4*=0x0, lpOverlapped=0x0) returned 1 [0185.176] CloseHandle (hObject=0x27c) returned 1 [0185.176] GetCurrentProcess () returned 0xffffffff [0185.176] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea58 | out: TokenHandle=0x19ea58*=0x27c) returned 1 [0185.177] GetCurrentProcess () returned 0xffffffff [0185.177] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ea58 | out: TokenHandle=0x19ea58*=0x280) returned 1 [0185.190] GetCurrentProcess () returned 0xffffffff [0185.190] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e81c | out: TokenHandle=0x19e81c*=0x284) returned 1 [0185.241] GetCurrentProcess () returned 0xffffffff [0185.241] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e830 | out: TokenHandle=0x19e830*=0x288) returned 1 [0185.307] GetCurrentProcess () returned 0xffffffff [0185.307] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e048 | out: TokenHandle=0x19e048*=0x28c) returned 1 [0185.322] GetCurrentProcess () returned 0xffffffff [0185.322] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e05c | out: TokenHandle=0x19e05c*=0x290) returned 1 [0187.769] GetCurrentProcess () returned 0xffffffff [0187.769] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef30 | out: TokenHandle=0x19ef30*=0x294) returned 1 [0187.777] GetCurrentProcess () returned 0xffffffff [0187.777] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ef44 | out: TokenHandle=0x19ef44*=0x298) returned 1 [0188.414] GetCurrentPackageId () returned 0x3d54 [0190.013] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e80c | out: phkResult=0x19e80c*=0x0) returned 0x2 [0190.014] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\XML", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e80c | out: phkResult=0x19e80c*=0x0) returned 0x2 [0190.609] EtwEventRegister (in: ProviderId=0x23136d8, EnableCallback=0x4e00616, CallbackContext=0x0, RegHandle=0x23136b4 | out: RegHandle=0x23136b4) returned 0x0 [0191.359] CoCreateGuid (in: pguid=0x19f060 | out: pguid=0x19f060*(Data1=0x89183b81, Data2=0x73a0, Data3=0x4b42, Data4=([0]=0xb5, [1]=0xcb, [2]=0x99, [3]=0x11, [4]=0xb, [5]=0xec, [6]=0x8, [7]=0x8b))) returned 0x0 [0191.494] CoCreateGuid (in: pguid=0x19ef90 | out: pguid=0x19ef90*(Data1=0xb77d7fdf, Data2=0x6115, Data3=0x41a8, Data4=([0]=0x95, [1]=0x45, [2]=0x2a, [3]=0xfe, [4]=0xa, [5]=0x95, [6]=0x57, [7]=0xdb))) returned 0x0 [0191.629] CoCreateGuid (in: pguid=0x19ee08 | out: pguid=0x19ee08*(Data1=0xe0b003c2, Data2=0xb78, Data3=0x4954, Data4=([0]=0x9e, [1]=0xa, [2]=0x59, [3]=0xe4, [4]=0x83, [5]=0x44, [6]=0xd9, [7]=0x2b))) returned 0x0 [0191.936] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19eb18 | out: lpWSAData=0x19eb18) returned 0 [0191.944] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x2c4 [0192.293] setsockopt (s=0x2c4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0192.294] closesocket (s=0x2c4) returned 0 [0192.294] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x0) returned 0x2c4 [0192.297] setsockopt (s=0x2c4, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0192.297] closesocket (s=0x2c4) returned 0 [0192.305] GetCurrentProcess () returned 0xffffffff [0192.305] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e8cc | out: TokenHandle=0x19e8cc*=0x2c4) returned 1 [0192.309] GetCurrentProcess () returned 0xffffffff [0192.309] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e8e0 | out: TokenHandle=0x19e8e0*=0x2c8) returned 1 [0192.323] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x2cc [0192.326] WSAConnect (in: s=0x2cc, name=0x231e06c*(sa_family=2, sin_port=0xad0d, sin_addr="103.246.144.29"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0192.386] setsockopt (s=0x2cc, level=65535, optname=4098, optval="", optlen=4) returned 0 [0192.386] setsockopt (s=0x2cc, level=65535, optname=4097, optval="", optlen=4) returned 0 [0192.479] setsockopt (s=0x2cc, level=6, optname=1, optval="\x01", optlen=4) returned 0 [0192.495] setsockopt (s=0x2cc, level=65535, optname=4101, optval="&t\x1b", optlen=4) returned 0 [0192.496] send (s=0x2cc, buf=0x231694c*, len=41, flags=0) returned 41 [0192.529] setsockopt (s=0x2cc, level=65535, optname=4102, optval="Ûs\x1b", optlen=4) returned 0 [0192.530] recv (in: s=0x2cc, buf=0x233e48c, len=1, flags=0 | out: buf=0x233e48c*) returned 1 [0193.036] send (s=0x2cc, buf=0x233ee2f*, len=206, flags=0) returned 206 [0193.070] recv (in: s=0x2cc, buf=0x23402a4, len=8192, flags=0 | out: buf=0x23402a4*) returned 142 [0198.567] CoCreateGuid (in: pguid=0x19f05c | out: pguid=0x19f05c*(Data1=0xebfad5ca, Data2=0x99d2, Data3=0x4e9b, Data4=([0]=0x9b, [1]=0x41, [2]=0x51, [3]=0x65, [4]=0xf6, [5]=0xd, [6]=0xc6, [7]=0x96))) returned 0x0 [0198.585] CoCreateGuid (in: pguid=0x19ef8c | out: pguid=0x19ef8c*(Data1=0x9dd93063, Data2=0x3555, Data3=0x456f, Data4=([0]=0x93, [1]=0x14, [2]=0x25, [3]=0x6d, [4]=0x59, [5]=0xad, [6]=0x54, [7]=0x1d))) returned 0x0 [0198.599] send (s=0x2cc, buf=0x233ee2f*, len=154, flags=0) returned 154 [0198.599] recv (in: s=0x2cc, buf=0x23402a4, len=8192, flags=0 | out: buf=0x23402a4*) returned 3698 [0198.723] GetCurrentProcess () returned 0xffffffff [0198.724] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e7e0 | out: TokenHandle=0x19e7e0*=0x2d0) returned 1 [0198.726] GetCurrentProcess () returned 0xffffffff [0198.726] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e7f4 | out: TokenHandle=0x19e7f4*=0x2d4) returned 1 [0198.768] EtwEventRegister (in: ProviderId=0x2353454, EnableCallback=0x4e00666, CallbackContext=0x0, RegHandle=0x2353430 | out: RegHandle=0x2353430) returned 0x0 [0198.772] EtwEventSetInformation (RegHandle=0x4fb0d0, InformationClass=0x25, EventInformation=0x2, InformationLength=0x23533f4) returned 0x0 [0205.184] CoTaskMemAlloc (cb=0x20c) returned 0x544238 [0205.184] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x544238 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0205.193] CoTaskMemFree (pv=0x544238) [0205.193] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19ed9c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0205.193] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YaAddon", nBufferLength=0x105, lpBuffer=0x19ee30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YaAddon", lpFilePart=0x0) returned 0x32 [0205.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f28c) returned 1 [0205.194] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YaAddon" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yaaddon"), fInfoLevelId=0x0, lpFileInformation=0x19f308 | out: lpFileInformation=0x19f308*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0205.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f288) returned 1 [0205.195] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YaAddon", nBufferLength=0x105, lpBuffer=0x19ee34, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YaAddon", lpFilePart=0x0) returned 0x32 [0205.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f21c) returned 1 [0205.195] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YaAddon" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yaaddon"), fInfoLevelId=0x0, lpFileInformation=0x19f298 | out: lpFileInformation=0x19f298*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0205.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f218) returned 1 [0205.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f21c) returned 1 [0205.195] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YaAddon" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yaaddon"), fInfoLevelId=0x0, lpFileInformation=0x19f298 | out: lpFileInformation=0x19f298*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0205.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f218) returned 1 [0205.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f21c) returned 1 [0205.195] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex"), fInfoLevelId=0x0, lpFileInformation=0x19f298 | out: lpFileInformation=0x19f298*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0205.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f218) returned 1 [0205.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f21c) returned 1 [0205.196] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local"), fInfoLevelId=0x0, lpFileInformation=0x19f298 | out: lpFileInformation=0x19f298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4252734, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0205.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f218) returned 1 [0205.196] CreateDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex"), lpSecurityAttributes=0x0) returned 1 [0205.199] CreateDirectoryW (lpPathName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YaAddon" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\yandex\\yaaddon"), lpSecurityAttributes=0x0) returned 1 [0205.486] CoTaskMemAlloc (cb=0x804) returned 0x544a40 [0205.486] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x544a40, nSize=0x19f37c | out: lpNameBuffer="XC64ZB\\RDhJ0CNFevzX", nSize=0x19f37c) returned 0x1 [0205.488] CoTaskMemFree (pv=0x544a40) [0205.489] GetUserNameW (in: lpBuffer=0x19f110, pcbBuffer=0x19f388 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19f388) returned 1 [0205.707] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x354 [0205.709] CoGetObjectContext (in: riid=0x237d3f8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ebd8 | out: ppv=0x19ebd8*=0x4d0cbc) returned 0x0 [0205.743] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19de64, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0205.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x19e368, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0205.745] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6ce20000 [0205.901] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x19e39c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 13 [0205.901] GetProcAddress (hModule=0x6ce20000, lpProcName="ResetSecurity") returned 0x6ce226fe [0205.915] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x19e39c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity\x04D\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 11 [0205.915] GetProcAddress (hModule=0x6ce20000, lpProcName="SetSecurity") returned 0x6ce22740 [0205.921] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x19e398, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 18 [0205.922] GetProcAddress (hModule=0x6ce20000, lpProcName="BlessIWbemServices") returned 0x6ce21e89 [0205.929] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x19e390, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObjectD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 24 [0205.930] GetProcAddress (hModule=0x6ce20000, lpProcName="BlessIWbemServicesObject") returned 0x6ce21edb [0205.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x19e398, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 17 [0205.936] GetProcAddress (hModule=0x6ce20000, lpProcName="GetPropertyHandle") returned 0x6ce223d4 [0205.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x19e398, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 18 [0205.939] GetProcAddress (hModule=0x6ce20000, lpProcName="WritePropertyValue") returned 0x6ce22837 [0205.942] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x19e3a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 5 [0205.942] GetProcAddress (hModule=0x6ce20000, lpProcName="Clone") returned 0x6ce21f2d [0205.946] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x19e398, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey\x04D\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 15 [0205.946] GetProcAddress (hModule=0x6ce20000, lpProcName="VerifyClientKey") returned 0x6ce227d4 [0205.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x19e398, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet\x04D\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 15 [0205.949] GetProcAddress (hModule=0x6ce20000, lpProcName="GetQualifierSet") returned 0x6ce22435 [0205.950] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x19e3a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get\x04D\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 3 [0205.950] GetProcAddress (hModule=0x6ce20000, lpProcName="Get") returned 0x6ce222f4 [0205.956] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x19e3a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put\x04D\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 3 [0205.956] GetProcAddress (hModule=0x6ce20000, lpProcName="Put") returned 0x6ce224de [0205.959] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x19e3a4, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 6 [0205.959] GetProcAddress (hModule=0x6ce20000, lpProcName="Delete") returned 0x6ce22151 [0205.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x19e3a0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNamesD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 8 [0205.962] GetProcAddress (hModule=0x6ce20000, lpProcName="GetNames") returned 0x6ce223a2 [0205.969] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x19e398, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumerationD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 16 [0205.969] GetProcAddress (hModule=0x6ce20000, lpProcName="BeginEnumeration") returned 0x6ce21e63 [0205.976] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x19e3a4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 4 [0205.976] GetProcAddress (hModule=0x6ce20000, lpProcName="Next") returned 0x6ce224a3 [0205.979] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x19e39c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumerationMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 14 [0205.979] GetProcAddress (hModule=0x6ce20000, lpProcName="EndEnumeration") returned 0x6ce221e2 [0205.982] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x19e390, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet\x04D\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 23 [0205.982] GetProcAddress (hModule=0x6ce20000, lpProcName="GetPropertyQualifierSet") returned 0x6ce2241f [0205.983] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x19e3a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 5 [0205.984] GetProcAddress (hModule=0x6ce20000, lpProcName="Clone") returned 0x6ce21f2d [0205.984] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x19e39c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 13 [0205.984] GetProcAddress (hModule=0x6ce20000, lpProcName="GetObjectText") returned 0x6ce223be [0205.985] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x19e398, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 17 [0205.985] GetProcAddress (hModule=0x6ce20000, lpProcName="SpawnDerivedClass") returned 0x6ce22786 [0205.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x19e39c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 13 [0205.987] GetProcAddress (hModule=0x6ce20000, lpProcName="SpawnInstance") returned 0x6ce2279c [0205.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x19e3a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 9 [0205.988] GetProcAddress (hModule=0x6ce20000, lpProcName="CompareTo") returned 0x6ce21fad [0205.988] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x19e398, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 17 [0205.989] GetProcAddress (hModule=0x6ce20000, lpProcName="GetPropertyOrigin") returned 0x6ce22409 [0205.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x19e39c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFromD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 12 [0205.990] GetProcAddress (hModule=0x6ce20000, lpProcName="InheritsFrom") returned 0x6ce22448 [0205.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x19e3a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 9 [0205.990] GetProcAddress (hModule=0x6ce20000, lpProcName="GetMethod") returned 0x6ce2235a [0205.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x19e3a0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 9 [0205.991] GetProcAddress (hModule=0x6ce20000, lpProcName="PutMethod") returned 0x6ce225fa [0205.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x19e39c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethodD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 12 [0205.993] GetProcAddress (hModule=0x6ce20000, lpProcName="DeleteMethod") returned 0x6ce22164 [0205.993] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x19e394, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumerationMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 22 [0205.994] GetProcAddress (hModule=0x6ce20000, lpProcName="BeginMethodEnumeration") returned 0x6ce21e76 [0205.994] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x19e3a0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 10 [0205.994] GetProcAddress (hModule=0x6ce20000, lpProcName="NextMethod") returned 0x6ce224c2 [0205.995] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x19e394, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumerationD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 20 [0205.995] GetProcAddress (hModule=0x6ce20000, lpProcName="EndMethodEnumeration") returned 0x6ce221f2 [0205.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x19e394, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 21 [0205.997] GetProcAddress (hModule=0x6ce20000, lpProcName="GetMethodQualifierSet") returned 0x6ce2238c [0205.997] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x19e398, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin\x04D\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 15 [0205.997] GetProcAddress (hModule=0x6ce20000, lpProcName="GetMethodOrigin") returned 0x6ce22376 [0205.998] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x19e398, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 16 [0205.998] GetProcAddress (hModule=0x6ce20000, lpProcName="QualifierSet_Get") returned 0x6ce2264c [0205.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x19e398, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_PutD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 16 [0205.999] GetProcAddress (hModule=0x6ce20000, lpProcName="QualifierSet_Put") returned 0x6ce2269a [0206.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x19e394, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete\x04D\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 19 [0206.001] GetProcAddress (hModule=0x6ce20000, lpProcName="QualifierSet_Delete") returned 0x6ce22629 [0206.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x19e394, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 21 [0206.002] GetProcAddress (hModule=0x6ce20000, lpProcName="QualifierSet_GetNames") returned 0x6ce22668 [0206.003] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x19e38c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 29 [0206.003] GetProcAddress (hModule=0x6ce20000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6ce22616 [0206.004] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x19e398, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 17 [0206.004] GetProcAddress (hModule=0x6ce20000, lpProcName="QualifierSet_Next") returned 0x6ce2267e [0206.005] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x19e38c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration\x04D\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 27 [0206.005] GetProcAddress (hModule=0x6ce20000, lpProcName="QualifierSet_EndEnumeration") returned 0x6ce2263c [0206.006] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x19e390, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType\x04D\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 23 [0206.006] GetProcAddress (hModule=0x6ce20000, lpProcName="GetCurrentApartmentType") returned 0x6ce22435 [0206.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x19e394, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStubD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 20 [0206.007] GetProcAddress (hModule=0x6ce20000, lpProcName="GetDemultiplexedStub") returned 0x6ce22313 [0206.008] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x19e394, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 21 [0206.009] GetProcAddress (hModule=0x6ce20000, lpProcName="CreateInstanceEnumWmi") returned 0x6ce220db [0206.011] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x19e398, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmiMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 18 [0206.012] GetProcAddress (hModule=0x6ce20000, lpProcName="CreateClassEnumWmi") returned 0x6ce22065 [0206.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x19e39c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmiD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 12 [0206.012] GetProcAddress (hModule=0x6ce20000, lpProcName="ExecQueryWmi") returned 0x6ce2227b [0206.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x19e390, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmiD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 24 [0206.020] GetProcAddress (hModule=0x6ce20000, lpProcName="ExecNotificationQueryWmi") returned 0x6ce22202 [0206.020] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x19e39c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmiMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 14 [0206.020] GetProcAddress (hModule=0x6ce20000, lpProcName="PutInstanceWmi") returned 0x6ce2257a [0206.021] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x19e39c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi\x04D\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 11 [0206.021] GetProcAddress (hModule=0x6ce20000, lpProcName="PutClassWmi") returned 0x6ce224fa [0206.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x19e390, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObjectD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 24 [0206.022] GetProcAddress (hModule=0x6ce20000, lpProcName="CloneEnumWbemClassObject") returned 0x6ce21f40 [0206.023] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x19e398, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmiD\x1aMiÏÓ&\x9a «fl`æ\x19", lpUsedDefaultChar=0x0) returned 16 [0206.023] GetProcAddress (hModule=0x6ce20000, lpProcName="ConnectServerWmi") returned 0x6ce21fc3 [0206.025] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x237d3e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19ebd4 | out: ppvObject=0x19ebd4*=0x0) returned 0x80004002 [0206.026] IUnknown:Release (This=0x4d0cbc) returned 0x0 [0206.043] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x19e82c | out: lpiid=0x19e82c) returned 0x0 [0206.046] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19e540 | out: ppv=0x19e540*=0x544d60) returned 0x0 [0206.918] WbemDefPath:IUnknown:QueryInterface (in: This=0x544d60, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e758 | out: ppvObject=0x19e758*=0x0) returned 0x80004002 [0206.918] WbemDefPath:IClassFactory:CreateInstance (in: This=0x544d60, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e76c | out: ppvObject=0x19e76c*=0x524340) returned 0x0 [0206.919] WbemDefPath:IUnknown:Release (This=0x544d60) returned 0x0 [0206.919] WbemDefPath:IUnknown:QueryInterface (in: This=0x524340, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e38c | out: ppvObject=0x19e38c*=0x524340) returned 0x0 [0206.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x524340, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e348 | out: ppvObject=0x19e348*=0x0) returned 0x80004002 [0206.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x524340, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19df3c | out: ppvObject=0x19df3c*=0x0) returned 0x80004002 [0206.925] WbemDefPath:IUnknown:AddRef (This=0x524340) returned 0x3 [0206.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x524340, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19dca4 | out: ppvObject=0x19dca4*=0x0) returned 0x80004002 [0206.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x524340, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19dc54 | out: ppvObject=0x19dc54*=0x0) returned 0x80004002 [0206.925] WbemDefPath:IUnknown:QueryInterface (in: This=0x524340, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19dc60 | out: ppvObject=0x19dc60*=0x548250) returned 0x0 [0206.925] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x548250, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19dc68 | out: pCid=0x19dc68*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0206.926] WbemDefPath:IUnknown:Release (This=0x548250) returned 0x3 [0206.926] CoGetContextToken (in: pToken=0x19dcc0 | out: pToken=0x19dcc0) returned 0x0 [0206.926] CoGetContextToken (in: pToken=0x19e0c8 | out: pToken=0x19e0c8) returned 0x0 [0206.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x524340, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e158 | out: ppvObject=0x19e158*=0x0) returned 0x80004002 [0206.927] WbemDefPath:IUnknown:Release (This=0x524340) returned 0x2 [0206.927] WbemDefPath:IUnknown:Release (This=0x524340) returned 0x1 [0206.927] CoGetContextToken (in: pToken=0x19ea50 | out: pToken=0x19ea50) returned 0x0 [0206.927] CoGetContextToken (in: pToken=0x19e9b0 | out: pToken=0x19e9b0) returned 0x0 [0206.927] WbemDefPath:IUnknown:QueryInterface (in: This=0x524340, riid=0x19ea80*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19ea7c | out: ppvObject=0x19ea7c*=0x524340) returned 0x0 [0206.927] WbemDefPath:IUnknown:AddRef (This=0x524340) returned 0x3 [0206.927] WbemDefPath:IUnknown:Release (This=0x524340) returned 0x2 [0206.930] WbemDefPath:IWbemPath:SetText (This=0x524340, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0206.931] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f2fc | out: puCount=0x19f2fc*=0x2) returned 0x0 [0206.931] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f2f8*=0x0, pszText=0x0 | out: puBuffLength=0x19f2f8*=0xf, pszText=0x0) returned 0x0 [0206.932] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f2f8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f2f8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0206.933] CoGetObjectContext (in: riid=0x237d3f8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f288 | out: ppv=0x19f288*=0x4d0cbc) returned 0x0 [0206.934] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f280 | out: pAptType=0x19f280*=1) returned 0x0 [0206.934] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x237d3e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x0) returned 0x80004002 [0206.934] IUnknown:Release (This=0x4d0cbc) returned 0x0 [0206.934] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x19f194 | out: lpiid=0x19f194) returned 0x0 [0206.935] CoGetClassObject (in: rclsid=0x55079c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eea8 | out: ppv=0x19eea8*=0x5484a8) returned 0x0 [0207.098] WbemLocator:IUnknown:QueryInterface (in: This=0x5484a8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19f0c0 | out: ppvObject=0x19f0c0*=0x0) returned 0x80004002 [0207.098] WbemLocator:IClassFactory:CreateInstance (in: This=0x5484a8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0d4 | out: ppvObject=0x19f0d4*=0x544d80) returned 0x0 [0207.098] WbemLocator:IUnknown:Release (This=0x5484a8) returned 0x0 [0207.098] WbemLocator:IUnknown:QueryInterface (in: This=0x544d80, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ecf4 | out: ppvObject=0x19ecf4*=0x544d80) returned 0x0 [0207.098] WbemLocator:IUnknown:QueryInterface (in: This=0x544d80, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ecb0 | out: ppvObject=0x19ecb0*=0x0) returned 0x80004002 [0207.098] WbemLocator:IUnknown:QueryInterface (in: This=0x544d80, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e8a4 | out: ppvObject=0x19e8a4*=0x0) returned 0x80004002 [0207.098] WbemLocator:IUnknown:AddRef (This=0x544d80) returned 0x3 [0207.098] WbemLocator:IUnknown:QueryInterface (in: This=0x544d80, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x0) returned 0x80004002 [0207.098] WbemLocator:IUnknown:QueryInterface (in: This=0x544d80, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e5bc | out: ppvObject=0x19e5bc*=0x0) returned 0x80004002 [0207.098] WbemLocator:IUnknown:QueryInterface (in: This=0x544d80, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5c8 | out: ppvObject=0x19e5c8*=0x0) returned 0x80004002 [0207.098] CoGetContextToken (in: pToken=0x19e628 | out: pToken=0x19e628) returned 0x0 [0207.099] CoGetObjectContext (in: riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5484ac | out: ppv=0x5484ac*=0x4d0cb0) returned 0x0 [0207.099] CoGetContextToken (in: pToken=0x19ea30 | out: pToken=0x19ea30) returned 0x0 [0207.099] WbemLocator:IUnknown:QueryInterface (in: This=0x544d80, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eac0 | out: ppvObject=0x19eac0*=0x0) returned 0x80004002 [0207.099] WbemLocator:IUnknown:Release (This=0x544d80) returned 0x2 [0207.099] WbemLocator:IUnknown:Release (This=0x544d80) returned 0x1 [0207.099] CoGetContextToken (in: pToken=0x19f0a0 | out: pToken=0x19f0a0) returned 0x0 [0207.099] CoGetContextToken (in: pToken=0x19f000 | out: pToken=0x19f000) returned 0x0 [0207.099] WbemLocator:IUnknown:QueryInterface (in: This=0x544d80, riid=0x19f0d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19f0cc | out: ppvObject=0x19f0cc*=0x544d80) returned 0x0 [0207.100] WbemLocator:IUnknown:AddRef (This=0x544d80) returned 0x3 [0207.100] WbemLocator:IUnknown:Release (This=0x544d80) returned 0x2 [0207.102] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f264 | out: puCount=0x19f264*=0x2) returned 0x0 [0207.102] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=8, puBuffLength=0x19f260*=0x0, pszText=0x0 | out: puBuffLength=0x19f260*=0xf, pszText=0x0) returned 0x0 [0207.102] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=8, puBuffLength=0x19f260*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f260*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0207.102] CoCreateInstance (in: rclsid=0x6ce21284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ce212e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x19f13c | out: ppv=0x19f13c*=0x544df0) returned 0x0 [0207.103] WbemLocator:IWbemLocator:ConnectServer (in: This=0x544df0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x19f1d0 | out: ppNamespace=0x19f1d0*=0x4e11b0) returned 0x0 [0210.690] WbemLocator:IUnknown:QueryInterface (in: This=0x4e11b0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f06c | out: ppvObject=0x19f06c*=0x4e5a9c) returned 0x0 [0210.691] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4e5a9c, pProxy=0x4e11b0, pAuthnSvc=0x19f0bc, pAuthzSvc=0x19f0b8, pServerPrincName=0x19f0b0, pAuthnLevel=0x19f0b4, pImpLevel=0x19f0a4, pAuthInfo=0x19f0a8, pCapabilites=0x19f0ac | out: pAuthnSvc=0x19f0bc*=0xa, pAuthzSvc=0x19f0b8*=0x0, pServerPrincName=0x19f0b0, pAuthnLevel=0x19f0b4*=0x6, pImpLevel=0x19f0a4*=0x2, pAuthInfo=0x19f0a8, pCapabilites=0x19f0ac*=0x1) returned 0x0 [0210.691] WbemLocator:IUnknown:Release (This=0x4e5a9c) returned 0x1 [0210.691] WbemLocator:IUnknown:QueryInterface (in: This=0x4e11b0, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f060 | out: ppvObject=0x19f060*=0x4e5ac0) returned 0x0 [0210.691] WbemLocator:IUnknown:QueryInterface (in: This=0x4e11b0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f05c | out: ppvObject=0x19f05c*=0x4e5a9c) returned 0x0 [0210.691] WbemLocator:IClientSecurity:SetBlanket (This=0x4e5a9c, pProxy=0x4e11b0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0210.691] WbemLocator:IUnknown:Release (This=0x4e5a9c) returned 0x2 [0210.691] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x1 [0210.691] CoTaskMemFree (pv=0x5509d0) [0210.691] WbemLocator:IUnknown:Release (This=0x544df0) returned 0x0 [0210.691] WbemLocator:IUnknown:QueryInterface (in: This=0x4e11b0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec5c | out: ppvObject=0x19ec5c*=0x4e5ac0) returned 0x0 [0210.692] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec18 | out: ppvObject=0x19ec18*=0x0) returned 0x80004002 [0210.692] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea34 | out: ppvObject=0x19ea34*=0x0) returned 0x80004002 [0210.692] WbemLocator:IUnknown:QueryInterface (in: This=0x4e11b0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e80c | out: ppvObject=0x19e80c*=0x0) returned 0x80004002 [0210.693] WbemLocator:IUnknown:AddRef (This=0x4e5ac0) returned 0x3 [0210.693] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e574 | out: ppvObject=0x19e574*=0x0) returned 0x80004002 [0210.693] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e524 | out: ppvObject=0x19e524*=0x0) returned 0x80004002 [0210.693] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e530 | out: ppvObject=0x19e530*=0x4e5a1c) returned 0x0 [0210.693] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e5a1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e538 | out: pCid=0x19e538*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0210.693] WbemLocator:IUnknown:Release (This=0x4e5a1c) returned 0x3 [0210.693] CoGetContextToken (in: pToken=0x19e590 | out: pToken=0x19e590) returned 0x0 [0210.693] CoGetContextToken (in: pToken=0x19e998 | out: pToken=0x19e998) returned 0x0 [0210.693] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea28 | out: ppvObject=0x19ea28*=0x4e5aa4) returned 0x0 [0210.693] WbemLocator:IRpcOptions:Query (in: This=0x4e5aa4, pPrx=0x4e5ac0, dwProperty=2, pdwValue=0x19ea50 | out: pdwValue=0x19ea50) returned 0x80004002 [0210.693] WbemLocator:IUnknown:Release (This=0x4e5aa4) returned 0x3 [0210.693] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x2 [0210.693] CoGetContextToken (in: pToken=0x19ef70 | out: pToken=0x19ef70) returned 0x0 [0210.693] CoGetContextToken (in: pToken=0x19eed0 | out: pToken=0x19eed0) returned 0x0 [0210.694] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x19efa0*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19ef9c | out: ppvObject=0x19ef9c*=0x4e11b0) returned 0x0 [0210.694] WbemLocator:IUnknown:AddRef (This=0x4e11b0) returned 0x4 [0210.694] WbemLocator:IUnknown:Release (This=0x4e11b0) returned 0x3 [0210.694] WbemLocator:IUnknown:Release (This=0x4e11b0) returned 0x2 [0210.704] SysStringLen (param_1=0x0) returned 0x0 [0210.705] CoGetContextToken (in: pToken=0x19ef68 | out: pToken=0x19ef68) returned 0x0 [0210.705] WbemLocator:IUnknown:AddRef (This=0x4e5ac0) returned 0x3 [0210.705] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19edfc | out: ppvObject=0x19edfc*=0x4e5ac0) returned 0x0 [0210.706] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x3 [0210.706] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x2 [0210.706] CoGetContextToken (in: pToken=0x19f060 | out: pToken=0x19f060) returned 0x0 [0210.706] WbemLocator:IUnknown:AddRef (This=0x4e11b0) returned 0x3 [0210.707] IWbemServices:ExecQuery (in: This=0x4e11b0, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_DiskDrive", lFlags=16, pCtx=0x0, ppEnum=0x19f26c | out: ppEnum=0x19f26c*=0x535c48) returned 0x0 [0210.713] IUnknown:QueryInterface (in: This=0x535c48, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0d0 | out: ppvObject=0x19f0d0*=0x535c4c) returned 0x0 [0210.713] IClientSecurity:QueryBlanket (in: This=0x535c4c, pProxy=0x535c48, pAuthnSvc=0x19f120, pAuthzSvc=0x19f11c, pServerPrincName=0x19f114, pAuthnLevel=0x19f118, pImpLevel=0x19f108, pAuthInfo=0x19f10c, pCapabilites=0x19f110 | out: pAuthnSvc=0x19f120*=0xa, pAuthzSvc=0x19f11c*=0x0, pServerPrincName=0x19f114, pAuthnLevel=0x19f118*=0x6, pImpLevel=0x19f108*=0x2, pAuthInfo=0x19f10c, pCapabilites=0x19f110*=0x1) returned 0x0 [0210.713] IUnknown:Release (This=0x535c4c) returned 0x1 [0210.713] IUnknown:QueryInterface (in: This=0x535c48, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0c4 | out: ppvObject=0x19f0c4*=0x4e6bc0) returned 0x0 [0210.713] IUnknown:QueryInterface (in: This=0x535c48, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0c0 | out: ppvObject=0x19f0c0*=0x535c4c) returned 0x0 [0210.713] IClientSecurity:SetBlanket (This=0x535c4c, pProxy=0x535c48, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0210.717] IUnknown:Release (This=0x535c4c) returned 0x2 [0210.717] WbemLocator:IUnknown:Release (This=0x4e6bc0) returned 0x1 [0210.717] CoTaskMemFree (pv=0x550a00) [0210.717] IUnknown:QueryInterface (in: This=0x535c48, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ecbc | out: ppvObject=0x19ecbc*=0x4e6bc0) returned 0x0 [0210.718] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec78 | out: ppvObject=0x19ec78*=0x0) returned 0x80004002 [0210.718] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea94 | out: ppvObject=0x19ea94*=0x0) returned 0x80004002 [0210.718] IUnknown:QueryInterface (in: This=0x535c48, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e86c | out: ppvObject=0x19e86c*=0x0) returned 0x80004002 [0210.718] WbemLocator:IUnknown:AddRef (This=0x4e6bc0) returned 0x3 [0210.718] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e5d4 | out: ppvObject=0x19e5d4*=0x0) returned 0x80004002 [0210.719] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e584 | out: ppvObject=0x19e584*=0x0) returned 0x80004002 [0210.719] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e590 | out: ppvObject=0x19e590*=0x4e6b1c) returned 0x0 [0210.719] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6b1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e598 | out: pCid=0x19e598*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0210.719] WbemLocator:IUnknown:Release (This=0x4e6b1c) returned 0x3 [0210.719] CoGetContextToken (in: pToken=0x19e5f0 | out: pToken=0x19e5f0) returned 0x0 [0210.719] CoGetContextToken (in: pToken=0x19e9f8 | out: pToken=0x19e9f8) returned 0x0 [0210.719] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea88 | out: ppvObject=0x19ea88*=0x4e6ba4) returned 0x0 [0210.719] WbemLocator:IRpcOptions:Query (in: This=0x4e6ba4, pPrx=0x4e6bc0, dwProperty=2, pdwValue=0x19eab0 | out: pdwValue=0x19eab0) returned 0x80004002 [0210.719] WbemLocator:IUnknown:Release (This=0x4e6ba4) returned 0x3 [0210.719] WbemLocator:IUnknown:Release (This=0x4e6bc0) returned 0x2 [0210.719] CoGetContextToken (in: pToken=0x19efd0 | out: pToken=0x19efd0) returned 0x0 [0210.719] CoGetContextToken (in: pToken=0x19ef30 | out: pToken=0x19ef30) returned 0x0 [0210.719] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x19f000*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19effc | out: ppvObject=0x19effc*=0x535c48) returned 0x0 [0210.719] IUnknown:AddRef (This=0x535c48) returned 0x4 [0210.719] IUnknown:Release (This=0x535c48) returned 0x3 [0210.719] IUnknown:Release (This=0x535c48) returned 0x2 [0210.719] WbemLocator:IUnknown:Release (This=0x4e11b0) returned 0x2 [0210.719] SysStringLen (param_1=0x0) returned 0x0 [0210.719] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f2b8 | out: puCount=0x19f2b8*=0x2) returned 0x0 [0210.719] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f2b4*=0x0, pszText=0x0 | out: puBuffLength=0x19f2b4*=0xf, pszText=0x0) returned 0x0 [0210.720] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f2b4*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f2b4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0210.720] CoGetContextToken (in: pToken=0x19f108 | out: pToken=0x19f108) returned 0x0 [0210.720] IUnknown:AddRef (This=0x535c48) returned 0x3 [0210.720] IEnumWbemClassObject:Clone (in: This=0x535c48, ppEnum=0x19f2c4 | out: ppEnum=0x19f2c4*=0x4f14a8) returned 0x0 [0210.721] IUnknown:QueryInterface (in: This=0x4f14a8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f188 | out: ppvObject=0x19f188*=0x4f14ac) returned 0x0 [0210.721] IClientSecurity:QueryBlanket (in: This=0x4f14ac, pProxy=0x4f14a8, pAuthnSvc=0x19f1d8, pAuthzSvc=0x19f1d4, pServerPrincName=0x19f1cc, pAuthnLevel=0x19f1d0, pImpLevel=0x19f1c0, pAuthInfo=0x19f1c4, pCapabilites=0x19f1c8 | out: pAuthnSvc=0x19f1d8*=0xa, pAuthzSvc=0x19f1d4*=0x0, pServerPrincName=0x19f1cc, pAuthnLevel=0x19f1d0*=0x6, pImpLevel=0x19f1c0*=0x2, pAuthInfo=0x19f1c4, pCapabilites=0x19f1c8*=0x1) returned 0x0 [0210.721] IUnknown:Release (This=0x4f14ac) returned 0x1 [0210.721] IUnknown:QueryInterface (in: This=0x4f14a8, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f17c | out: ppvObject=0x19f17c*=0x4e6dc0) returned 0x0 [0210.721] IUnknown:QueryInterface (in: This=0x4f14a8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f178 | out: ppvObject=0x19f178*=0x4f14ac) returned 0x0 [0210.721] IClientSecurity:SetBlanket (This=0x4f14ac, pProxy=0x4f14a8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0210.722] IUnknown:Release (This=0x4f14ac) returned 0x2 [0210.722] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x1 [0210.722] CoTaskMemFree (pv=0x572620) [0210.723] IUnknown:QueryInterface (in: This=0x4f14a8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed64 | out: ppvObject=0x19ed64*=0x4e6dc0) returned 0x0 [0210.723] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ed20 | out: ppvObject=0x19ed20*=0x0) returned 0x80004002 [0210.723] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eb3c | out: ppvObject=0x19eb3c*=0x0) returned 0x80004002 [0210.723] IUnknown:QueryInterface (in: This=0x4f14a8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e914 | out: ppvObject=0x19e914*=0x0) returned 0x80004002 [0210.723] WbemLocator:IUnknown:AddRef (This=0x4e6dc0) returned 0x3 [0210.723] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e67c | out: ppvObject=0x19e67c*=0x0) returned 0x80004002 [0210.724] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e62c | out: ppvObject=0x19e62c*=0x0) returned 0x80004002 [0210.724] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e638 | out: ppvObject=0x19e638*=0x4e6d1c) returned 0x0 [0210.724] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6d1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e640 | out: pCid=0x19e640*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0210.724] WbemLocator:IUnknown:Release (This=0x4e6d1c) returned 0x3 [0210.724] CoGetContextToken (in: pToken=0x19e698 | out: pToken=0x19e698) returned 0x0 [0210.724] CoGetContextToken (in: pToken=0x19eaa0 | out: pToken=0x19eaa0) returned 0x0 [0210.724] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eb30 | out: ppvObject=0x19eb30*=0x4e6da4) returned 0x0 [0210.724] WbemLocator:IRpcOptions:Query (in: This=0x4e6da4, pPrx=0x4e6dc0, dwProperty=2, pdwValue=0x19eb58 | out: pdwValue=0x19eb58) returned 0x80004002 [0210.724] WbemLocator:IUnknown:Release (This=0x4e6da4) returned 0x3 [0210.724] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x2 [0210.724] CoGetContextToken (in: pToken=0x19f078 | out: pToken=0x19f078) returned 0x0 [0210.724] CoGetContextToken (in: pToken=0x19efd8 | out: pToken=0x19efd8) returned 0x0 [0210.724] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x19f0a8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f0a4 | out: ppvObject=0x19f0a4*=0x4f14a8) returned 0x0 [0210.724] IUnknown:AddRef (This=0x4f14a8) returned 0x4 [0210.724] IUnknown:Release (This=0x4f14a8) returned 0x3 [0210.724] IUnknown:Release (This=0x4f14a8) returned 0x2 [0210.724] IUnknown:Release (This=0x535c48) returned 0x2 [0210.724] SysStringLen (param_1=0x0) returned 0x0 [0210.725] IEnumWbemClassObject:Reset (This=0x4f14a8) returned 0x0 [0210.806] CoTaskMemAlloc (cb=0x4) returned 0x544db0 [0210.807] IEnumWbemClassObject:Next (in: This=0x4f14a8, lTimeout=-1, uCount=0x1, apObjects=0x544db0, puReturned=0x2380b7c | out: apObjects=0x544db0*=0x4fe590, puReturned=0x2380b7c*=0x1) returned 0x0 [0210.947] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e928 | out: ppvObject=0x19e928*=0x4fe590) returned 0x0 [0210.948] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e8e4 | out: ppvObject=0x19e8e4*=0x0) returned 0x80004002 [0210.948] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e704 | out: ppvObject=0x19e704*=0x0) returned 0x80004002 [0210.948] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e4dc | out: ppvObject=0x19e4dc*=0x0) returned 0x80004002 [0210.948] IUnknown:AddRef (This=0x4fe590) returned 0x3 [0210.948] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e244 | out: ppvObject=0x19e244*=0x0) returned 0x80004002 [0210.948] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e1f4 | out: ppvObject=0x19e1f4*=0x0) returned 0x80004002 [0210.948] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e200 | out: ppvObject=0x19e200*=0x4fe594) returned 0x0 [0210.948] IMarshal:GetUnmarshalClass (in: This=0x4fe594, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e208 | out: pCid=0x19e208*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0210.948] IUnknown:Release (This=0x4fe594) returned 0x3 [0210.948] CoGetContextToken (in: pToken=0x19e260 | out: pToken=0x19e260) returned 0x0 [0210.948] CoGetContextToken (in: pToken=0x19e668 | out: pToken=0x19e668) returned 0x0 [0210.948] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6f8 | out: ppvObject=0x19e6f8*=0x0) returned 0x80004002 [0210.948] IUnknown:Release (This=0x4fe590) returned 0x2 [0210.949] CoGetContextToken (in: pToken=0x19ec38 | out: pToken=0x19ec38) returned 0x0 [0210.949] CoGetContextToken (in: pToken=0x19eb98 | out: pToken=0x19eb98) returned 0x0 [0210.949] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x19ec68*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ec64 | out: ppvObject=0x19ec64*=0x4fe590) returned 0x0 [0210.949] IUnknown:AddRef (This=0x4fe590) returned 0x4 [0210.949] IUnknown:Release (This=0x4fe590) returned 0x3 [0210.949] IUnknown:Release (This=0x4fe590) returned 0x2 [0210.949] CoTaskMemFree (pv=0x544db0) [0210.949] CoGetContextToken (in: pToken=0x19efa0 | out: pToken=0x19efa0) returned 0x0 [0210.949] IUnknown:AddRef (This=0x4fe590) returned 0x3 [0210.951] IWbemClassObject:Get (in: This=0x4fe590, wszName="__GENUS", lFlags=0, pVal=0x19f2b4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f334*=0, plFlavor=0x19f330*=0 | out: pVal=0x19f2b4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f334*=3, plFlavor=0x19f330*=64) returned 0x0 [0210.952] IWbemClassObject:Get (in: This=0x4fe590, wszName="__PATH", lFlags=0, pVal=0x19f298*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f31c*=0, plFlavor=0x19f318*=0 | out: pVal=0x19f298*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\"", varVal2=0x0), pType=0x19f31c*=8, plFlavor=0x19f318*=64) returned 0x0 [0210.952] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\"") returned 0x88 [0210.952] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\"") returned 0x88 [0210.952] CoGetObjectContext (in: riid=0x237d3f8*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f2c4 | out: ppv=0x19f2c4*=0x4d0cbc) returned 0x0 [0210.952] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f2bc | out: pAptType=0x19f2bc*=1) returned 0x0 [0210.953] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x237d3e0*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f2c0 | out: ppvObject=0x19f2c0*=0x0) returned 0x80004002 [0210.953] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0210.954] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ec30 | out: ppv=0x19ec30*=0x544ca0) returned 0x0 [0210.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x544ca0, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ee48 | out: ppvObject=0x19ee48*=0x0) returned 0x80004002 [0210.954] WbemDefPath:IClassFactory:CreateInstance (in: This=0x544ca0, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee5c | out: ppvObject=0x19ee5c*=0x524260) returned 0x0 [0210.954] WbemDefPath:IUnknown:Release (This=0x544ca0) returned 0x0 [0210.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea7c | out: ppvObject=0x19ea7c*=0x524260) returned 0x0 [0210.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ea38 | out: ppvObject=0x19ea38*=0x0) returned 0x80004002 [0210.954] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e62c | out: ppvObject=0x19e62c*=0x0) returned 0x80004002 [0210.955] WbemDefPath:IUnknown:AddRef (This=0x524260) returned 0x3 [0210.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e394 | out: ppvObject=0x19e394*=0x0) returned 0x80004002 [0210.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e344 | out: ppvObject=0x19e344*=0x0) returned 0x80004002 [0210.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e350 | out: ppvObject=0x19e350*=0x5487c0) returned 0x0 [0210.955] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5487c0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e358 | out: pCid=0x19e358*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0210.955] WbemDefPath:IUnknown:Release (This=0x5487c0) returned 0x3 [0210.955] CoGetContextToken (in: pToken=0x19e3b0 | out: pToken=0x19e3b0) returned 0x0 [0210.955] CoGetContextToken (in: pToken=0x19e7b8 | out: pToken=0x19e7b8) returned 0x0 [0210.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e848 | out: ppvObject=0x19e848*=0x0) returned 0x80004002 [0210.955] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x2 [0210.955] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x1 [0210.955] CoGetContextToken (in: pToken=0x19f140 | out: pToken=0x19f140) returned 0x0 [0210.955] CoGetContextToken (in: pToken=0x19f0a0 | out: pToken=0x19f0a0) returned 0x0 [0210.955] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x19f170*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f16c | out: ppvObject=0x19f16c*=0x524260) returned 0x0 [0210.955] WbemDefPath:IUnknown:AddRef (This=0x524260) returned 0x3 [0210.955] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x2 [0210.955] WbemDefPath:IWbemPath:SetText (This=0x524260, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_DiskDrive.DeviceID=\"\\\\\\\\.\\\\PHYSICALDRIVE0\"") returned 0x0 [0210.956] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f2f0 | out: puCount=0x19f2f0*=0x2) returned 0x0 [0210.956] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f2ec*=0x0, pszText=0x0 | out: puBuffLength=0x19f2ec*=0xf, pszText=0x0) returned 0x0 [0210.956] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f2ec*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f2ec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0210.956] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f2bc | out: puCount=0x19f2bc*=0x2) returned 0x0 [0210.956] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f2b8*=0x0, pszText=0x0 | out: puBuffLength=0x19f2b8*=0xf, pszText=0x0) returned 0x0 [0210.957] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f2b8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f2b8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0210.957] IWbemClassObject:Get (in: This=0x4fe590, wszName="SerialNumber", lFlags=0, pVal=0x19f2b8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2381434*=0, plFlavor=0x2381438*=0 | out: pVal=0x19f2b8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="46NF1MS67", varVal2=0x0), pType=0x2381434*=8, plFlavor=0x2381438*=0) returned 0x0 [0210.957] SysStringByteLen (bstr="46NF1MS67") returned 0x12 [0210.957] SysStringByteLen (bstr="46NF1MS67") returned 0x12 [0210.957] IWbemClassObject:Get (in: This=0x4fe590, wszName="SerialNumber", lFlags=0, pVal=0x19f2c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2381434*=8, plFlavor=0x2381438*=0 | out: pVal=0x19f2c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="46NF1MS67", varVal2=0x0), pType=0x2381434*=8, plFlavor=0x2381438*=0) returned 0x0 [0210.957] SysStringByteLen (bstr="46NF1MS67") returned 0x12 [0210.957] SysStringByteLen (bstr="46NF1MS67") returned 0x12 [0210.959] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0210.959] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x1 [0210.959] IUnknown:Release (This=0x4f14a8) returned 0x0 [0210.960] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0 [0210.960] WbemLocator:IUnknown:Release (This=0x4e6bc0) returned 0x1 [0210.960] IUnknown:Release (This=0x535c48) returned 0x0 [0210.974] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19f358 | out: pfEnabled=0x19f358) returned 0x0 [0211.002] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe", nBufferLength=0x105, lpBuffer=0x19edf0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe", lpFilePart=0x0) returned 0x3b [0212.881] GdiplusStartup (in: token=0x4e18f80, input=0x19e808, output=0x19e858 | out: token=0x4e18f80, output=0x19e858) returned 0x0 [0212.912] GdipCreateFromHWND (hwnd=0x0, graphics=0x19f2f4) returned 0x0 [0213.034] GdipGetDC (graphics=0x53c1f08, hdc=0x19f304) returned 0x0 [0213.045] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gdi32", cchWideChar=5, lpMultiByteStr=0x19f2a4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gdi32Îë\x04ÏÓ&\x9a «flhö\x19", lpUsedDefaultChar=0x0) returned 5 [0213.046] LoadLibraryA (lpLibFileName="gdi32") returned 0x77440000 [0213.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDeviceCaps", cchWideChar=13, lpMultiByteStr=0x19f29c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDeviceCapsÏë\x04ÏÓ&\x9a «flhö\x19", lpUsedDefaultChar=0x0) returned 13 [0213.053] GetProcAddress (hModule=0x77440000, lpProcName="GetDeviceCaps") returned 0x774c0fe0 [0213.062] GetDeviceCaps (hdc=0xa0100d0, index=10) returned 900 [0213.062] GetDeviceCaps (hdc=0xa0100d0, index=117) returned 900 [0213.686] GdipReleaseDC (graphics=0x53c1f08, hdc=0xa0100d0) returned 0x0 [0213.687] GdipDeleteGraphics (graphics=0x53c1f08) returned 0x0 [0213.692] GetSystemMetrics (nIndex=80) returned 1 [0213.718] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x4e007ce, dwData=0x0) returned 1 [0213.725] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19f0b4 | out: lpmi=0x19f0b4) returned 1 [0213.727] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x2a0106a2 [0213.731] GetDeviceCaps (hdc=0x2a0106a2, index=12) returned 32 [0213.731] GetDeviceCaps (hdc=0x2a0106a2, index=14) returned 1 [0213.734] DeleteDC (hdc=0x2a0106a2) returned 1 [0213.740] GetProcessWindowStation () returned 0xd0 [0213.740] GetUserObjectInformationA (in: hObj=0xd0, nIndex=1, pvInfo=0x2398518, nLength=0xc, lpnLengthNeeded=0x19f294 | out: pvInfo=0x2398518, lpnLengthNeeded=0x19f294) returned 1 [0213.760] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x3fc [0214.112] CoCreateGuid (in: pguid=0x19e3a8 | out: pguid=0x19e3a8*(Data1=0x79fdeea5, Data2=0x89fa, Data3=0x4faa, Data4=([0]=0x89, [1]=0xe, [2]=0x2c, [3]=0xcd, [4]=0x28, [5]=0x42, [6]=0xa0, [7]=0xcf))) returned 0x0 [0214.197] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x19f078 | out: pTimeZoneInformation=0x19f078) returned 0x1 [0214.198] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f15c | out: phkResult=0x19f15c*=0x428) returned 0x0 [0214.199] RegQueryValueExW (in: hKey=0x428, lpValueName="TZI", lpReserved=0x0, lpType=0x19f178, lpData=0x0, lpcbData=0x19f174*=0x0 | out: lpType=0x19f178*=0x3, lpData=0x0, lpcbData=0x19f174*=0x2c) returned 0x0 [0214.199] RegQueryValueExW (in: hKey=0x428, lpValueName="TZI", lpReserved=0x0, lpType=0x19f178, lpData=0x2411e1c, lpcbData=0x19f174*=0x2c | out: lpType=0x19f178*=0x3, lpData=0x2411e1c*, lpcbData=0x19f174*=0x2c) returned 0x0 [0214.200] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x19efb0 | out: phkResult=0x19efb0*=0x0) returned 0x2 [0214.202] RegQueryValueExW (in: hKey=0x428, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19f150, lpData=0x0, lpcbData=0x19f14c*=0x0 | out: lpType=0x19f150*=0x1, lpData=0x0, lpcbData=0x19f14c*=0x20) returned 0x0 [0214.202] RegQueryValueExW (in: hKey=0x428, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x19f150, lpData=0x2412240, lpcbData=0x19f14c*=0x20 | out: lpType=0x19f150*=0x1, lpData="@tzres.dll,-320", lpcbData=0x19f14c*=0x20) returned 0x0 [0214.202] RegQueryValueExW (in: hKey=0x428, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19f150, lpData=0x0, lpcbData=0x19f14c*=0x0 | out: lpType=0x19f150*=0x1, lpData=0x0, lpcbData=0x19f14c*=0x20) returned 0x0 [0214.202] RegQueryValueExW (in: hKey=0x428, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x19f150, lpData=0x2412298, lpcbData=0x19f14c*=0x20 | out: lpType=0x19f150*=0x1, lpData="@tzres.dll,-322", lpcbData=0x19f14c*=0x20) returned 0x0 [0214.202] RegQueryValueExW (in: hKey=0x428, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19f150, lpData=0x0, lpcbData=0x19f14c*=0x0 | out: lpType=0x19f150*=0x1, lpData=0x0, lpcbData=0x19f14c*=0x20) returned 0x0 [0214.202] RegQueryValueExW (in: hKey=0x428, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x19f150, lpData=0x24122f0, lpcbData=0x19f14c*=0x20 | out: lpType=0x19f150*=0x1, lpData="@tzres.dll,-321", lpcbData=0x19f14c*=0x20) returned 0x0 [0214.203] CoTaskMemAlloc (cb=0x20c) returned 0x509770 [0214.203] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x509770 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0214.204] CoTaskMemFree (pv=0x509770) [0214.205] CoTaskMemAlloc (cb=0x20c) returned 0x509770 [0214.205] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19f16c, pwszFileMUIPath=0x509770, pcchFileMUIPath=0x19f170, pululEnumerator=0x19f164 | out: pwszLanguage=0x0, pcchLanguage=0x19f16c, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19f170, pululEnumerator=0x19f164) returned 1 [0214.234] CoTaskMemFree (pv=0x0) [0214.234] CoTaskMemFree (pv=0x509770) [0214.235] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5290001 [0214.246] CoTaskMemAlloc (cb=0x3ec) returned 0x5890d0 [0214.246] LoadStringW (in: hInstance=0x5290001, uID=0x140, lpBuffer=0x5890d0, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0214.247] CoTaskMemFree (pv=0x5890d0) [0214.247] FreeLibrary (hLibModule=0x5290001) returned 1 [0214.248] CoTaskMemAlloc (cb=0x20c) returned 0x509770 [0214.248] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x509770 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0214.248] CoTaskMemFree (pv=0x509770) [0214.248] CoTaskMemAlloc (cb=0x20c) returned 0x509770 [0214.248] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19f16c, pwszFileMUIPath=0x509770, pcchFileMUIPath=0x19f170, pululEnumerator=0x19f164 | out: pwszLanguage=0x0, pcchLanguage=0x19f16c, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19f170, pululEnumerator=0x19f164) returned 1 [0214.251] CoTaskMemFree (pv=0x0) [0214.251] CoTaskMemFree (pv=0x509770) [0214.251] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5290001 [0214.254] CoTaskMemAlloc (cb=0x3ec) returned 0x5890d0 [0214.254] LoadStringW (in: hInstance=0x5290001, uID=0x142, lpBuffer=0x5890d0, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0214.254] CoTaskMemFree (pv=0x5890d0) [0214.254] FreeLibrary (hLibModule=0x5290001) returned 1 [0214.255] CoTaskMemAlloc (cb=0x20c) returned 0x509770 [0214.255] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x509770 | out: pszPath="C:\\Windows\\system32") returned 0x0 [0214.256] CoTaskMemFree (pv=0x509770) [0214.256] CoTaskMemAlloc (cb=0x20c) returned 0x509770 [0214.256] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\Windows\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x19f16c, pwszFileMUIPath=0x509770, pcchFileMUIPath=0x19f170, pululEnumerator=0x19f164 | out: pwszLanguage=0x0, pcchLanguage=0x19f16c, pwszFileMUIPath="C:\\Windows\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x19f170, pululEnumerator=0x19f164) returned 1 [0214.259] CoTaskMemFree (pv=0x0) [0214.259] CoTaskMemFree (pv=0x509770) [0214.259] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x5290001 [0214.274] CoTaskMemAlloc (cb=0x3ec) returned 0x5890d0 [0214.274] LoadStringW (in: hInstance=0x5290001, uID=0x141, lpBuffer=0x5890d0, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0214.274] CoTaskMemFree (pv=0x5890d0) [0214.274] FreeLibrary (hLibModule=0x5290001) returned 1 [0214.275] RegCloseKey (hKey=0x428) returned 0x0 [0214.277] GetUserNameW (in: lpBuffer=0x19f118, pcbBuffer=0x19f390 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19f390) returned 1 [0214.284] GetCurrentProcess () returned 0xffffffff [0214.285] GetCurrentThread () returned 0xfffffffe [0214.285] GetCurrentProcess () returned 0xffffffff [0214.285] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19f34c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19f34c*=0x428) returned 1 [0214.285] GetCurrentThreadId () returned 0xfa4 [0214.286] OleInitialize (pvReserved=0x0) returned 0x80010106 [0214.288] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0214.297] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74f30000 [0214.297] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="IsWow64Process", cchWideChar=14, lpMultiByteStr=0x19f2f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IsWow64ProcessukÏÓ&\x9a «flhö\x19", lpUsedDefaultChar=0x0) returned 14 [0214.297] GetProcAddress (hModule=0x74f30000, lpProcName="IsWow64Process") returned 0x74f49f10 [0214.297] GetCurrentProcess () returned 0xffffffff [0214.297] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19f358 | out: Wow64Process=0x19f358*=1) returned 1 [0214.301] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2f4 | out: phkResult=0x19f2f4*=0x434) returned 0x0 [0214.301] RegQueryValueExW (in: hKey=0x434, lpValueName="ProductName", lpReserved=0x0, lpType=0x19f314, lpData=0x0, lpcbData=0x19f310*=0x0 | out: lpType=0x19f314*=0x1, lpData=0x0, lpcbData=0x19f310*=0x1e) returned 0x0 [0214.301] RegQueryValueExW (in: hKey=0x434, lpValueName="ProductName", lpReserved=0x0, lpType=0x19f314, lpData=0x24163a8, lpcbData=0x19f310*=0x1e | out: lpType=0x19f314*=0x1, lpData="Windows 10 Pro", lpcbData=0x19f310*=0x1e) returned 0x0 [0214.301] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2f4 | out: phkResult=0x19f2f4*=0x42c) returned 0x0 [0214.302] RegQueryValueExW (in: hKey=0x42c, lpValueName="CSDVersion", lpReserved=0x0, lpType=0x19f314, lpData=0x0, lpcbData=0x19f310*=0x0 | out: lpType=0x19f314*=0x0, lpData=0x0, lpcbData=0x19f310*=0x0) returned 0x2 [0214.447] CoCreateGuid (in: pguid=0x19efa4 | out: pguid=0x19efa4*(Data1=0x10a5695e, Data2=0x3808, Data3=0x4a75, Data4=([0]=0xb9, [1]=0x33, [2]=0x45, [3]=0x4f, [4]=0x23, [5]=0xe8, [6]=0x58, [7]=0x3e))) returned 0x0 [0214.448] CoCreateGuid (in: pguid=0x19eed4 | out: pguid=0x19eed4*(Data1=0x7413ac53, Data2=0xa2b, Data3=0x4804, Data4=([0]=0xa3, [1]=0xaa, [2]=0x4c, [3]=0x46, [4]=0x2d, [5]=0x51, [6]=0x1d, [7]=0x99))) returned 0x0 [0214.611] send (s=0x2cc, buf=0x2435a66*, len=719, flags=0) returned 719 [0214.611] recv (in: s=0x2cc, buf=0x23402a4, len=8192, flags=0 | out: buf=0x23402a4*) returned 125 [0214.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f224) returned 1 [0214.718] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19ed2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0214.719] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", nBufferLength=0x105, lpBuffer=0x19ed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpFilePart=0x0) returned 0x1e [0214.719] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*.txt", lpFindFileData=0x19ef4c | out: lpFindFileData=0x19ef4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0214.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e4) returned 1 [0214.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1f0) returned 1 [0214.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f224) returned 1 [0214.720] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19ed2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0214.720] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", nBufferLength=0x105, lpBuffer=0x19ed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpFilePart=0x0) returned 0x1e [0214.720] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*.doc*", lpFindFileData=0x19ef4c | out: lpFindFileData=0x19ef4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0214.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e4) returned 1 [0214.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1f0) returned 1 [0214.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f224) returned 1 [0214.721] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19ed2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0214.721] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", nBufferLength=0x105, lpBuffer=0x19ed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpFilePart=0x0) returned 0x1e [0214.721] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*key*", lpFindFileData=0x19ef4c | out: lpFindFileData=0x19ef4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0214.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e4) returned 1 [0214.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1f0) returned 1 [0214.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f224) returned 1 [0214.721] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19ed2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0214.721] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", nBufferLength=0x105, lpBuffer=0x19ed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpFilePart=0x0) returned 0x1e [0214.722] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*wallet*", lpFindFileData=0x19ef4c | out: lpFindFileData=0x19ef4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0214.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e4) returned 1 [0214.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1f0) returned 1 [0214.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f224) returned 1 [0214.722] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop", nBufferLength=0x105, lpBuffer=0x19ed2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop", lpFilePart=0x0) returned 0x1d [0214.722] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", nBufferLength=0x105, lpBuffer=0x19ed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpFilePart=0x0) returned 0x1e [0214.722] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\*seed*", lpFindFileData=0x19ef4c | out: lpFindFileData=0x19ef4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0214.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e4) returned 1 [0214.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1f0) returned 1 [0214.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f224) returned 1 [0214.723] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19ed2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.723] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\", nBufferLength=0x105, lpBuffer=0x19ed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\", lpFilePart=0x0) returned 0x20 [0214.723] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*.txt", lpFindFileData=0x19ef4c | out: lpFindFileData=0x19ef4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0214.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e4) returned 1 [0214.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1f0) returned 1 [0214.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f224) returned 1 [0214.723] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19ed2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.724] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\", nBufferLength=0x105, lpBuffer=0x19ed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\", lpFilePart=0x0) returned 0x20 [0214.724] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*.doc*", lpFindFileData=0x19ef4c | out: lpFindFileData=0x19ef4c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71128f60, ftCreationTime.dwHighDateTime=0x1d7df92, ftLastAccessTime.dwLowDateTime=0x78869400, ftLastAccessTime.dwHighDateTime=0x1d7dfd6, ftLastWriteTime.dwLowDateTime=0x78869400, ftLastWriteTime.dwHighDateTime=0x1d7dfd6, nFileSizeHigh=0x0, nFileSizeLow=0x33b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="031fI.docx", cAlternateFileName="031FI~1.DOC")) returned 0x58d518 [0214.724] FindNextFileW (in: hFindFile=0x58d518, lpFindFileData=0x19ef5c | out: lpFindFileData=0x19ef5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e05250, ftCreationTime.dwHighDateTime=0x1d7ac08, ftLastAccessTime.dwLowDateTime=0x4de61700, ftLastAccessTime.dwHighDateTime=0x1d7ca9d, ftLastWriteTime.dwLowDateTime=0x4de61700, ftLastWriteTime.dwHighDateTime=0x1d7ca9d, nFileSizeHigh=0x0, nFileSizeLow=0x9ff1, dwReserved0=0x0, dwReserved1=0x0, cFileName="4s_Ki_KH8PK2U7oIT2yY.docx", cAlternateFileName="4S_KI_~1.DOC")) returned 1 [0214.724] FindNextFileW (in: hFindFile=0x58d518, lpFindFileData=0x19ef5c | out: lpFindFileData=0x19ef5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x562075f0, ftCreationTime.dwHighDateTime=0x1d7996a, ftLastAccessTime.dwLowDateTime=0x67afb810, ftLastAccessTime.dwHighDateTime=0x1d7bce9, ftLastWriteTime.dwLowDateTime=0x67afb810, ftLastWriteTime.dwHighDateTime=0x1d7bce9, nFileSizeHigh=0x0, nFileSizeLow=0x18721, dwReserved0=0x0, dwReserved1=0x0, cFileName="66hIA9d.docx", cAlternateFileName="66HIA9~1.DOC")) returned 1 [0214.725] FindNextFileW (in: hFindFile=0x58d518, lpFindFileData=0x19ef5c | out: lpFindFileData=0x19ef5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe013eca0, ftCreationTime.dwHighDateTime=0x1d7e32b, ftLastAccessTime.dwLowDateTime=0x88b9c8f0, ftLastAccessTime.dwHighDateTime=0x1d7e3e2, ftLastWriteTime.dwLowDateTime=0x88b9c8f0, ftLastWriteTime.dwHighDateTime=0x1d7e3e2, nFileSizeHigh=0x0, nFileSizeLow=0x16577, dwReserved0=0x0, dwReserved1=0x0, cFileName="D llQpZjo2_VlnF3V.docx", cAlternateFileName="DLLQPZ~1.DOC")) returned 1 [0214.725] FindNextFileW (in: hFindFile=0x58d518, lpFindFileData=0x19ef5c | out: lpFindFileData=0x19ef5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9265d680, ftCreationTime.dwHighDateTime=0x1d76c75, ftLastAccessTime.dwLowDateTime=0xb09641a0, ftLastAccessTime.dwHighDateTime=0x1d78f28, ftLastWriteTime.dwLowDateTime=0xb09641a0, ftLastWriteTime.dwHighDateTime=0x1d78f28, nFileSizeHigh=0x0, nFileSizeLow=0x12445, dwReserved0=0x0, dwReserved1=0x0, cFileName="NR_hHMnBOg9X.docx", cAlternateFileName="NR_HHM~1.DOC")) returned 1 [0214.725] FindNextFileW (in: hFindFile=0x58d518, lpFindFileData=0x19ef5c | out: lpFindFileData=0x19ef5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8357e4a0, ftCreationTime.dwHighDateTime=0x1d7d99c, ftLastAccessTime.dwLowDateTime=0xaee52c00, ftLastAccessTime.dwHighDateTime=0x1d7e337, ftLastWriteTime.dwLowDateTime=0xaee52c00, ftLastWriteTime.dwHighDateTime=0x1d7e337, nFileSizeHigh=0x0, nFileSizeLow=0x7227, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLaL9DVQ8 bzl_.doc", cAlternateFileName="OLAL9D~1.DOC")) returned 1 [0214.725] FindNextFileW (in: hFindFile=0x58d518, lpFindFileData=0x19ef5c | out: lpFindFileData=0x19ef5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.725] FindClose (in: hFindFile=0x58d518 | out: hFindFile=0x58d518) returned 1 [0214.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e4) returned 1 [0214.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1f0) returned 1 [0214.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f224) returned 1 [0214.725] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19ed2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.725] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\", nBufferLength=0x105, lpBuffer=0x19ed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\", lpFilePart=0x0) returned 0x20 [0214.726] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*key*", lpFindFileData=0x19ef4c | out: lpFindFileData=0x19ef4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0214.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e4) returned 1 [0214.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1f0) returned 1 [0214.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f224) returned 1 [0214.726] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19ed2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.726] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\", nBufferLength=0x105, lpBuffer=0x19ed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\", lpFilePart=0x0) returned 0x20 [0214.726] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*wallet*", lpFindFileData=0x19ef4c | out: lpFindFileData=0x19ef4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0214.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e4) returned 1 [0214.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1f0) returned 1 [0214.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f224) returned 1 [0214.727] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19ed2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.727] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\", nBufferLength=0x105, lpBuffer=0x19ed00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\", lpFilePart=0x0) returned 0x20 [0214.727] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\*seed*", lpFindFileData=0x19ef4c | out: lpFindFileData=0x19ef4c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0214.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e4) returned 1 [0214.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1f0) returned 1 [0214.727] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx", nBufferLength=0x105, lpBuffer=0x19edc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx", lpFilePart=0x0) returned 0x2a [0214.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f270) returned 1 [0214.727] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\031fi.docx"), fInfoLevelId=0x0, lpFileInformation=0x243b614 | out: lpFileInformation=0x243b614*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71128f60, ftCreationTime.dwHighDateTime=0x1d7df92, ftLastAccessTime.dwLowDateTime=0x78869400, ftLastAccessTime.dwHighDateTime=0x1d7dfd6, ftLastWriteTime.dwLowDateTime=0x78869400, ftLastWriteTime.dwHighDateTime=0x1d7dfd6, nFileSizeHigh=0x0, nFileSizeLow=0x33b3)) returned 1 [0214.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f26c) returned 1 [0214.728] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx", nBufferLength=0x105, lpBuffer=0x19ed94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx", lpFilePart=0x0) returned 0x2a [0214.728] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19edb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.728] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\.", nBufferLength=0x105, lpBuffer=0x19ed44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.728] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx", nBufferLength=0x105, lpBuffer=0x19ed44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx", lpFilePart=0x0) returned 0x2a [0214.731] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx", nBufferLength=0x105, lpBuffer=0x19edb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx", lpFilePart=0x0) returned 0x2a [0214.738] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx", nBufferLength=0x105, lpBuffer=0x19ed84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx", lpFilePart=0x0) returned 0x2a [0214.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1e4) returned 1 [0214.738] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\031fi.docx"), fInfoLevelId=0x0, lpFileInformation=0x19f260 | out: lpFileInformation=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71128f60, ftCreationTime.dwHighDateTime=0x1d7df92, ftLastAccessTime.dwLowDateTime=0x78869400, ftLastAccessTime.dwHighDateTime=0x1d7dfd6, ftLastWriteTime.dwLowDateTime=0x78869400, ftLastWriteTime.dwHighDateTime=0x1d7dfd6, nFileSizeHigh=0x0, nFileSizeLow=0x33b3)) returned 1 [0214.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e0) returned 1 [0214.738] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx", nBufferLength=0x105, lpBuffer=0x19ecb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx", lpFilePart=0x0) returned 0x2a [0214.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1ac) returned 1 [0214.738] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\031fI.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\031fi.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x438 [0214.738] GetFileType (hFile=0x438) returned 0x1 [0214.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1a8) returned 1 [0214.739] GetFileType (hFile=0x438) returned 0x1 [0214.744] ReadFile (in: hFile=0x438, lpBuffer=0x243d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x243d190*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.745] ReadFile (in: hFile=0x438, lpBuffer=0x243d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x243d190*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.746] ReadFile (in: hFile=0x438, lpBuffer=0x243d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x243d190*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.746] ReadFile (in: hFile=0x438, lpBuffer=0x243d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x243d190*, lpNumberOfBytesRead=0x19f220*=0x3b3, lpOverlapped=0x0) returned 1 [0214.746] ReadFile (in: hFile=0x438, lpBuffer=0x243d190, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x243d190*, lpNumberOfBytesRead=0x19f220*=0x0, lpOverlapped=0x0) returned 1 [0214.747] CloseHandle (hObject=0x438) returned 1 [0214.747] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx", nBufferLength=0x105, lpBuffer=0x19edc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx", lpFilePart=0x0) returned 0x39 [0214.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f270) returned 1 [0214.747] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\4s_ki_kh8pk2u7oit2yy.docx"), fInfoLevelId=0x0, lpFileInformation=0x245044c | out: lpFileInformation=0x245044c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e05250, ftCreationTime.dwHighDateTime=0x1d7ac08, ftLastAccessTime.dwLowDateTime=0x4de61700, ftLastAccessTime.dwHighDateTime=0x1d7ca9d, ftLastWriteTime.dwLowDateTime=0x4de61700, ftLastWriteTime.dwHighDateTime=0x1d7ca9d, nFileSizeHigh=0x0, nFileSizeLow=0x9ff1)) returned 1 [0214.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f26c) returned 1 [0214.748] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx", nBufferLength=0x105, lpBuffer=0x19ed94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx", lpFilePart=0x0) returned 0x39 [0214.748] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19edb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.748] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\.", nBufferLength=0x105, lpBuffer=0x19ed44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.748] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx", nBufferLength=0x105, lpBuffer=0x19ed44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx", lpFilePart=0x0) returned 0x39 [0214.748] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx", nBufferLength=0x105, lpBuffer=0x19edb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx", lpFilePart=0x0) returned 0x39 [0214.748] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx", nBufferLength=0x105, lpBuffer=0x19ed84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx", lpFilePart=0x0) returned 0x39 [0214.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1e4) returned 1 [0214.748] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\4s_ki_kh8pk2u7oit2yy.docx"), fInfoLevelId=0x0, lpFileInformation=0x19f260 | out: lpFileInformation=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e05250, ftCreationTime.dwHighDateTime=0x1d7ac08, ftLastAccessTime.dwLowDateTime=0x4de61700, ftLastAccessTime.dwHighDateTime=0x1d7ca9d, ftLastWriteTime.dwLowDateTime=0x4de61700, ftLastWriteTime.dwHighDateTime=0x1d7ca9d, nFileSizeHigh=0x0, nFileSizeLow=0x9ff1)) returned 1 [0214.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e0) returned 1 [0214.748] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx", nBufferLength=0x105, lpBuffer=0x19ecb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx", lpFilePart=0x0) returned 0x39 [0214.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1ac) returned 1 [0214.748] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\4s_Ki_KH8PK2U7oIT2yY.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\4s_ki_kh8pk2u7oit2yy.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x438 [0214.748] GetFileType (hFile=0x438) returned 0x1 [0214.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1a8) returned 1 [0214.749] GetFileType (hFile=0x438) returned 0x1 [0214.749] ReadFile (in: hFile=0x438, lpBuffer=0x2451da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2451da4*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.750] ReadFile (in: hFile=0x438, lpBuffer=0x2451da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2451da4*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.750] ReadFile (in: hFile=0x438, lpBuffer=0x2451da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2451da4*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.751] ReadFile (in: hFile=0x438, lpBuffer=0x2451da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2451da4*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.751] ReadFile (in: hFile=0x438, lpBuffer=0x2451da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2451da4*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.751] ReadFile (in: hFile=0x438, lpBuffer=0x2451da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2451da4*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.756] ReadFile (in: hFile=0x438, lpBuffer=0x2451da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2451da4*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.757] ReadFile (in: hFile=0x438, lpBuffer=0x2451da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2451da4*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.757] ReadFile (in: hFile=0x438, lpBuffer=0x2451da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2451da4*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.757] ReadFile (in: hFile=0x438, lpBuffer=0x2451da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2451da4*, lpNumberOfBytesRead=0x19f220*=0xff1, lpOverlapped=0x0) returned 1 [0214.758] ReadFile (in: hFile=0x438, lpBuffer=0x2451535, nNumberOfBytesToRead=0xf, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2451535*, lpNumberOfBytesRead=0x19f220*=0x0, lpOverlapped=0x0) returned 1 [0214.758] ReadFile (in: hFile=0x438, lpBuffer=0x2451da4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2451da4*, lpNumberOfBytesRead=0x19f220*=0x0, lpOverlapped=0x0) returned 1 [0214.771] CloseHandle (hObject=0x438) returned 1 [0214.771] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx", nBufferLength=0x105, lpBuffer=0x19edc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx", lpFilePart=0x0) returned 0x2c [0214.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f270) returned 1 [0214.772] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\66hia9d.docx"), fInfoLevelId=0x0, lpFileInformation=0x2488784 | out: lpFileInformation=0x2488784*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x562075f0, ftCreationTime.dwHighDateTime=0x1d7996a, ftLastAccessTime.dwLowDateTime=0x67afb810, ftLastAccessTime.dwHighDateTime=0x1d7bce9, ftLastWriteTime.dwLowDateTime=0x67afb810, ftLastWriteTime.dwHighDateTime=0x1d7bce9, nFileSizeHigh=0x0, nFileSizeLow=0x18721)) returned 1 [0214.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f26c) returned 1 [0214.772] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx", nBufferLength=0x105, lpBuffer=0x19ed94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx", lpFilePart=0x0) returned 0x2c [0214.772] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19edb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.776] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\.", nBufferLength=0x105, lpBuffer=0x19ed44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.776] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx", nBufferLength=0x105, lpBuffer=0x19ed44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx", lpFilePart=0x0) returned 0x2c [0214.777] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx", nBufferLength=0x105, lpBuffer=0x19edb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx", lpFilePart=0x0) returned 0x2c [0214.777] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx", nBufferLength=0x105, lpBuffer=0x19ed84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx", lpFilePart=0x0) returned 0x2c [0214.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1e4) returned 1 [0214.777] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\66hia9d.docx"), fInfoLevelId=0x0, lpFileInformation=0x19f260 | out: lpFileInformation=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x562075f0, ftCreationTime.dwHighDateTime=0x1d7996a, ftLastAccessTime.dwLowDateTime=0x67afb810, ftLastAccessTime.dwHighDateTime=0x1d7bce9, ftLastWriteTime.dwLowDateTime=0x67afb810, ftLastWriteTime.dwHighDateTime=0x1d7bce9, nFileSizeHigh=0x0, nFileSizeLow=0x18721)) returned 1 [0214.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e0) returned 1 [0214.777] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx", nBufferLength=0x105, lpBuffer=0x19ecb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx", lpFilePart=0x0) returned 0x2c [0214.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1ac) returned 1 [0214.777] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\66hIA9d.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\66hia9d.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x268 [0214.777] GetFileType (hFile=0x268) returned 0x1 [0214.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1a8) returned 1 [0214.777] GetFileType (hFile=0x268) returned 0x1 [0214.778] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.778] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.778] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.779] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.780] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.780] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.781] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.781] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.782] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.782] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.783] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.783] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.784] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.784] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.784] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.785] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.785] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.785] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.786] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.787] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.787] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.787] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.788] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.788] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.788] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x721, lpOverlapped=0x0) returned 1 [0214.789] ReadFile (in: hFile=0x268, lpBuffer=0x24896ad, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24896ad*, lpNumberOfBytesRead=0x19f220*=0x0, lpOverlapped=0x0) returned 1 [0214.789] ReadFile (in: hFile=0x268, lpBuffer=0x2489fec, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x2489fec*, lpNumberOfBytesRead=0x19f220*=0x0, lpOverlapped=0x0) returned 1 [0214.794] CloseHandle (hObject=0x268) returned 1 [0214.795] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx", nBufferLength=0x105, lpBuffer=0x19edc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx", lpFilePart=0x0) returned 0x36 [0214.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f270) returned 1 [0214.795] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\d llqpzjo2_vlnf3v.docx"), fInfoLevelId=0x0, lpFileInformation=0x24be068 | out: lpFileInformation=0x24be068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe013eca0, ftCreationTime.dwHighDateTime=0x1d7e32b, ftLastAccessTime.dwLowDateTime=0x88b9c8f0, ftLastAccessTime.dwHighDateTime=0x1d7e3e2, ftLastWriteTime.dwLowDateTime=0x88b9c8f0, ftLastWriteTime.dwHighDateTime=0x1d7e3e2, nFileSizeHigh=0x0, nFileSizeLow=0x16577)) returned 1 [0214.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f26c) returned 1 [0214.823] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx", nBufferLength=0x105, lpBuffer=0x19ed94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx", lpFilePart=0x0) returned 0x36 [0214.823] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19edb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.823] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\.", nBufferLength=0x105, lpBuffer=0x19ed44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.823] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx", nBufferLength=0x105, lpBuffer=0x19ed44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx", lpFilePart=0x0) returned 0x36 [0214.824] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx", nBufferLength=0x105, lpBuffer=0x19edb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx", lpFilePart=0x0) returned 0x36 [0214.824] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx", nBufferLength=0x105, lpBuffer=0x19ed84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx", lpFilePart=0x0) returned 0x36 [0214.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1e4) returned 1 [0214.824] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\d llqpzjo2_vlnf3v.docx"), fInfoLevelId=0x0, lpFileInformation=0x19f260 | out: lpFileInformation=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe013eca0, ftCreationTime.dwHighDateTime=0x1d7e32b, ftLastAccessTime.dwLowDateTime=0x88b9c8f0, ftLastAccessTime.dwHighDateTime=0x1d7e3e2, ftLastWriteTime.dwLowDateTime=0x88b9c8f0, ftLastWriteTime.dwHighDateTime=0x1d7e3e2, nFileSizeHigh=0x0, nFileSizeLow=0x16577)) returned 1 [0214.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e0) returned 1 [0214.824] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx", nBufferLength=0x105, lpBuffer=0x19ecb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx", lpFilePart=0x0) returned 0x36 [0214.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1ac) returned 1 [0214.824] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\D llQpZjo2_VlnF3V.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\d llqpzjo2_vlnf3v.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x268 [0214.825] GetFileType (hFile=0x268) returned 0x1 [0214.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1a8) returned 1 [0214.825] GetFileType (hFile=0x268) returned 0x1 [0214.825] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.826] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.827] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.828] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.828] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.829] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.829] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.830] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.831] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.831] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.832] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.832] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.833] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.833] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.834] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.834] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.835] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.836] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.836] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.836] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.837] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.837] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.837] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x577, lpOverlapped=0x0) returned 1 [0214.837] ReadFile (in: hFile=0x268, lpBuffer=0x24beeaf, nNumberOfBytesToRead=0x289, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24beeaf*, lpNumberOfBytesRead=0x19f220*=0x0, lpOverlapped=0x0) returned 1 [0214.837] ReadFile (in: hFile=0x268, lpBuffer=0x24bf998, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24bf998*, lpNumberOfBytesRead=0x19f220*=0x0, lpOverlapped=0x0) returned 1 [0214.843] CloseHandle (hObject=0x268) returned 1 [0214.844] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx", nBufferLength=0x105, lpBuffer=0x19edc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx", lpFilePart=0x0) returned 0x31 [0214.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f270) returned 1 [0214.844] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nr_hhmnbog9x.docx"), fInfoLevelId=0x0, lpFileInformation=0x24efb6c | out: lpFileInformation=0x24efb6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9265d680, ftCreationTime.dwHighDateTime=0x1d76c75, ftLastAccessTime.dwLowDateTime=0xb09641a0, ftLastAccessTime.dwHighDateTime=0x1d78f28, ftLastWriteTime.dwLowDateTime=0xb09641a0, ftLastWriteTime.dwHighDateTime=0x1d78f28, nFileSizeHigh=0x0, nFileSizeLow=0x12445)) returned 1 [0214.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f26c) returned 1 [0214.844] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx", nBufferLength=0x105, lpBuffer=0x19ed94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx", lpFilePart=0x0) returned 0x31 [0214.844] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19edb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.844] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\.", nBufferLength=0x105, lpBuffer=0x19ed44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0214.844] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx", nBufferLength=0x105, lpBuffer=0x19ed44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx", lpFilePart=0x0) returned 0x31 [0214.844] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx", nBufferLength=0x105, lpBuffer=0x19edb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx", lpFilePart=0x0) returned 0x31 [0214.845] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx", nBufferLength=0x105, lpBuffer=0x19ed84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx", lpFilePart=0x0) returned 0x31 [0214.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1e4) returned 1 [0214.845] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nr_hhmnbog9x.docx"), fInfoLevelId=0x0, lpFileInformation=0x19f260 | out: lpFileInformation=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9265d680, ftCreationTime.dwHighDateTime=0x1d76c75, ftLastAccessTime.dwLowDateTime=0xb09641a0, ftLastAccessTime.dwHighDateTime=0x1d78f28, ftLastWriteTime.dwLowDateTime=0xb09641a0, ftLastWriteTime.dwHighDateTime=0x1d78f28, nFileSizeHigh=0x0, nFileSizeLow=0x12445)) returned 1 [0214.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e0) returned 1 [0214.845] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx", nBufferLength=0x105, lpBuffer=0x19ecb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx", lpFilePart=0x0) returned 0x31 [0214.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1ac) returned 1 [0214.845] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\NR_hHMnBOg9X.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\nr_hhmnbog9x.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x268 [0214.845] GetFileType (hFile=0x268) returned 0x1 [0214.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1a8) returned 1 [0214.845] GetFileType (hFile=0x268) returned 0x1 [0214.846] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.847] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.847] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.847] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.848] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.848] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.849] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.849] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.850] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.850] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.850] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.850] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.851] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.851] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.852] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.853] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.853] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.853] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0214.853] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x445, lpOverlapped=0x0) returned 1 [0214.854] ReadFile (in: hFile=0x268, lpBuffer=0x24f0809, nNumberOfBytesToRead=0x3bb, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f0809*, lpNumberOfBytesRead=0x19f220*=0x0, lpOverlapped=0x0) returned 1 [0214.854] ReadFile (in: hFile=0x268, lpBuffer=0x24f1424, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x24f1424*, lpNumberOfBytesRead=0x19f220*=0x0, lpOverlapped=0x0) returned 1 [0215.039] CloseHandle (hObject=0x268) returned 1 [0215.039] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc", nBufferLength=0x105, lpBuffer=0x19edc4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc", lpFilePart=0x0) returned 0x32 [0215.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f270) returned 1 [0215.039] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\olal9dvq8 bzl_.doc"), fInfoLevelId=0x0, lpFileInformation=0x252bd28 | out: lpFileInformation=0x252bd28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8357e4a0, ftCreationTime.dwHighDateTime=0x1d7d99c, ftLastAccessTime.dwLowDateTime=0xaee52c00, ftLastAccessTime.dwHighDateTime=0x1d7e337, ftLastWriteTime.dwLowDateTime=0xaee52c00, ftLastWriteTime.dwHighDateTime=0x1d7e337, nFileSizeHigh=0x0, nFileSizeLow=0x7227)) returned 1 [0215.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f26c) returned 1 [0215.039] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc", nBufferLength=0x105, lpBuffer=0x19ed94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc", lpFilePart=0x0) returned 0x32 [0215.039] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents", nBufferLength=0x105, lpBuffer=0x19edb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0215.040] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\.", nBufferLength=0x105, lpBuffer=0x19ed44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents", lpFilePart=0x0) returned 0x1f [0215.040] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc", nBufferLength=0x105, lpBuffer=0x19ed44, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc", lpFilePart=0x0) returned 0x32 [0215.040] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc", nBufferLength=0x105, lpBuffer=0x19edb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc", lpFilePart=0x0) returned 0x32 [0215.040] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc", nBufferLength=0x105, lpBuffer=0x19ed84, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc", lpFilePart=0x0) returned 0x32 [0215.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1e4) returned 1 [0215.040] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\olal9dvq8 bzl_.doc"), fInfoLevelId=0x0, lpFileInformation=0x19f260 | out: lpFileInformation=0x19f260*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8357e4a0, ftCreationTime.dwHighDateTime=0x1d7d99c, ftLastAccessTime.dwLowDateTime=0xaee52c00, ftLastAccessTime.dwHighDateTime=0x1d7e337, ftLastWriteTime.dwLowDateTime=0xaee52c00, ftLastWriteTime.dwHighDateTime=0x1d7e337, nFileSizeHigh=0x0, nFileSizeLow=0x7227)) returned 1 [0215.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1e0) returned 1 [0215.040] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc", nBufferLength=0x105, lpBuffer=0x19ecb8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc", lpFilePart=0x0) returned 0x32 [0215.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1ac) returned 1 [0215.040] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\OLaL9DVQ8 bzl_.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\documents\\olal9dvq8 bzl_.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x268 [0215.040] GetFileType (hFile=0x268) returned 0x1 [0215.040] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1a8) returned 1 [0215.040] GetFileType (hFile=0x268) returned 0x1 [0215.041] ReadFile (in: hFile=0x268, lpBuffer=0x252d608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x252d608*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0215.041] ReadFile (in: hFile=0x268, lpBuffer=0x252d608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x252d608*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0215.042] ReadFile (in: hFile=0x268, lpBuffer=0x252d608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x252d608*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0215.042] ReadFile (in: hFile=0x268, lpBuffer=0x252d608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x252d608*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0215.042] ReadFile (in: hFile=0x268, lpBuffer=0x252d608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x252d608*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0215.042] ReadFile (in: hFile=0x268, lpBuffer=0x252d608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x252d608*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0215.043] ReadFile (in: hFile=0x268, lpBuffer=0x252d608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x252d608*, lpNumberOfBytesRead=0x19f220*=0x1000, lpOverlapped=0x0) returned 1 [0215.043] ReadFile (in: hFile=0x268, lpBuffer=0x252d608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x252d608*, lpNumberOfBytesRead=0x19f220*=0x227, lpOverlapped=0x0) returned 1 [0215.043] ReadFile (in: hFile=0x268, lpBuffer=0x252d608, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19f220, lpOverlapped=0x0 | out: lpBuffer=0x252d608*, lpNumberOfBytesRead=0x19f220*=0x0, lpOverlapped=0x0) returned 1 [0215.045] CloseHandle (hObject=0x268) returned 1 [0215.047] CoCreateGuid (in: pguid=0x19efd4 | out: pguid=0x19efd4*(Data1=0xfabdae08, Data2=0xc217, Data3=0x478c, Data4=([0]=0x90, [1]=0xb1, [2]=0x2, [3]=0x74, [4]=0xb, [5]=0xe4, [6]=0xae, [7]=0x0))) returned 0x0 [0215.047] CoCreateGuid (in: pguid=0x19ef04 | out: pguid=0x19ef04*(Data1=0x48f7c09b, Data2=0xa629, Data3=0x4006, Data4=([0]=0x92, [1]=0x81, [2]=0xea, [3]=0xf1, [4]=0x27, [5]=0xbe, [6]=0x83, [7]=0x3f))) returned 0x0 [0215.083] send (s=0x2cc, buf=0x3393fe6*, len=65536, flags=0) returned 65536 [0215.084] send (s=0x2cc, buf=0x33a3fe6*, len=65536, flags=0) returned 65536 [0215.477] send (s=0x2cc, buf=0x33b3fe6*, len=65536, flags=0) returned 65536 [0215.688] send (s=0x2cc, buf=0x33c3fe6*, len=65536, flags=0) returned 65536 [0215.753] send (s=0x2cc, buf=0x33d3fe6*, len=65536, flags=0) returned 65536 [0215.816] send (s=0x2cc, buf=0x33e3fe6*, len=23108, flags=0) returned 23108 [0215.998] recv (in: s=0x2cc, buf=0x23402a4, len=8192, flags=0 | out: buf=0x23402a4*) returned 128 [0216.051] CoTaskMemAlloc (cb=0x20c) returned 0x4ceda8 [0216.051] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x4ceda8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0216.052] CoTaskMemFree (pv=0x4ceda8) [0216.053] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19ecf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0216.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1c8) returned 1 [0216.064] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19ecd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0216.064] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x19eca4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x26 [0216.064] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\*", lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb8e6fbcd, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb8e6fbcd, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.065] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb8e6fbcd, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb8e6fbcd, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.065] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b412bc0, ftCreationTime.dwHighDateTime=0x1d7dcbe, ftLastAccessTime.dwLowDateTime=0xa24fb5a0, ftLastAccessTime.dwHighDateTime=0x1d7df8b, ftLastWriteTime.dwLowDateTime=0xa24fb5a0, ftLastWriteTime.dwHighDateTime=0x1d7df8b, nFileSizeHigh=0x0, nFileSizeLow=0xc9be, dwReserved0=0x0, dwReserved1=0x0, cFileName="1-H1la56hEMhcGsi.docx", cAlternateFileName="1-H1LA~1.DOC")) returned 1 [0216.065] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ed854b0, ftCreationTime.dwHighDateTime=0x1d7e094, ftLastAccessTime.dwLowDateTime=0x757fd3a0, ftLastAccessTime.dwHighDateTime=0x1d7e3bb, ftLastWriteTime.dwLowDateTime=0x757fd3a0, ftLastWriteTime.dwHighDateTime=0x1d7e3bb, nFileSizeHigh=0x0, nFileSizeLow=0x87f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="2yIx8.flv", cAlternateFileName="")) returned 1 [0216.065] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7227f830, ftCreationTime.dwHighDateTime=0x1d7e48e, ftLastAccessTime.dwLowDateTime=0x503e1d90, ftLastAccessTime.dwHighDateTime=0x1d7e4c4, ftLastWriteTime.dwLowDateTime=0x503e1d90, ftLastWriteTime.dwHighDateTime=0x1d7e4c4, nFileSizeHigh=0x0, nFileSizeLow=0x62ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="30sBUvEugghd8XAobRK.wav", cAlternateFileName="30SBUV~1.WAV")) returned 1 [0216.066] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49588400, ftCreationTime.dwHighDateTime=0x1d7e214, ftLastAccessTime.dwLowDateTime=0x8d1357d0, ftLastAccessTime.dwHighDateTime=0x1d7e4ce, ftLastWriteTime.dwLowDateTime=0x8d1357d0, ftLastWriteTime.dwHighDateTime=0x1d7e4ce, nFileSizeHigh=0x0, nFileSizeLow=0x4e90, dwReserved0=0x0, dwReserved1=0x0, cFileName="9q6SWoE.jpg", cAlternateFileName="")) returned 1 [0216.066] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0216.066] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac176420, ftCreationTime.dwHighDateTime=0x1d7e436, ftLastAccessTime.dwLowDateTime=0x62f0d360, ftLastAccessTime.dwHighDateTime=0x1d7e70d, ftLastWriteTime.dwLowDateTime=0x62f0d360, ftLastWriteTime.dwHighDateTime=0x1d7e70d, nFileSizeHigh=0x0, nFileSizeLow=0xb901, dwReserved0=0x0, dwReserved1=0x0, cFileName="bY_yr3RPq.png", cAlternateFileName="BY_YR3~1.PNG")) returned 1 [0216.066] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x996578b0, ftCreationTime.dwHighDateTime=0x1d7de6b, ftLastAccessTime.dwLowDateTime=0xc2256000, ftLastAccessTime.dwHighDateTime=0x1d7e1f7, ftLastWriteTime.dwLowDateTime=0xc2256000, ftLastWriteTime.dwHighDateTime=0x1d7e1f7, nFileSizeHigh=0x0, nFileSizeLow=0x127f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cDdvQ9ZOm-Zm.bmp", cAlternateFileName="CDDVQ9~1.BMP")) returned 1 [0216.066] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x674c650, ftCreationTime.dwHighDateTime=0x1d7d8b7, ftLastAccessTime.dwLowDateTime=0x66078640, ftLastAccessTime.dwHighDateTime=0x1d7e72e, ftLastWriteTime.dwLowDateTime=0x66078640, ftLastWriteTime.dwHighDateTime=0x1d7e72e, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="cRscO.avi", cAlternateFileName="")) returned 1 [0216.067] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4cb6850, ftCreationTime.dwHighDateTime=0x1d7d745, ftLastAccessTime.dwLowDateTime=0xe4494d10, ftLastAccessTime.dwHighDateTime=0x1d7dd45, ftLastWriteTime.dwLowDateTime=0xe4494d10, ftLastWriteTime.dwHighDateTime=0x1d7dd45, nFileSizeHigh=0x0, nFileSizeLow=0x14f85, dwReserved0=0x0, dwReserved1=0x0, cFileName="fw0kIsaXaz8jjAbR.pptx", cAlternateFileName="FW0KIS~1.PPT")) returned 1 [0216.067] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc07c0650, ftCreationTime.dwHighDateTime=0x1d7d7f2, ftLastAccessTime.dwLowDateTime=0x55b14500, ftLastAccessTime.dwHighDateTime=0x1d7d816, ftLastWriteTime.dwLowDateTime=0x55b14500, ftLastWriteTime.dwHighDateTime=0x1d7d816, nFileSizeHigh=0x0, nFileSizeLow=0x168a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="H6QBauyFp7j.ots", cAlternateFileName="H6QBAU~1.OTS")) returned 1 [0216.067] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14e8aa30, ftCreationTime.dwHighDateTime=0x1d7e5e6, ftLastAccessTime.dwLowDateTime=0x3b8c4b30, ftLastAccessTime.dwHighDateTime=0x1d7e693, ftLastWriteTime.dwLowDateTime=0x3b8c4b30, ftLastWriteTime.dwHighDateTime=0x1d7e693, nFileSizeHigh=0x0, nFileSizeLow=0x17ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="IxHsDWh8AE.mp4", cAlternateFileName="IXHSDW~1.MP4")) returned 1 [0216.067] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca6110, ftCreationTime.dwHighDateTime=0x1d7e208, ftLastAccessTime.dwLowDateTime=0x2336a740, ftLastAccessTime.dwHighDateTime=0x1d7e677, ftLastWriteTime.dwLowDateTime=0x2336a740, ftLastWriteTime.dwHighDateTime=0x1d7e677, nFileSizeHigh=0x0, nFileSizeLow=0xd1c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="j AgwaWn7xt9ivFa.png", cAlternateFileName="JAGWAW~1.PNG")) returned 1 [0216.067] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94dcb970, ftCreationTime.dwHighDateTime=0x1d7e122, ftLastAccessTime.dwLowDateTime=0xaf0310b0, ftLastAccessTime.dwHighDateTime=0x1d7e2e9, ftLastWriteTime.dwLowDateTime=0xaf0310b0, ftLastWriteTime.dwHighDateTime=0x1d7e2e9, nFileSizeHigh=0x0, nFileSizeLow=0x13e81, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kf4 rl.ots", cAlternateFileName="KF4RL~1.OTS")) returned 1 [0216.068] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49efd140, ftCreationTime.dwHighDateTime=0x1d7dadd, ftLastAccessTime.dwLowDateTime=0x1ba4fce0, ftLastAccessTime.dwHighDateTime=0x1d7dfae, ftLastWriteTime.dwLowDateTime=0x1ba4fce0, ftLastWriteTime.dwHighDateTime=0x1d7dfae, nFileSizeHigh=0x0, nFileSizeLow=0x1a0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkbUvJnLOZIjXqVWYv.xls", cAlternateFileName="KKBUVJ~1.XLS")) returned 1 [0216.068] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cc1e570, ftCreationTime.dwHighDateTime=0x1d7dcf1, ftLastAccessTime.dwLowDateTime=0x1f0e66b0, ftLastAccessTime.dwHighDateTime=0x1d7deea, ftLastWriteTime.dwLowDateTime=0x1f0e66b0, ftLastWriteTime.dwHighDateTime=0x1d7deea, nFileSizeHigh=0x0, nFileSizeLow=0x11db1, dwReserved0=0x0, dwReserved1=0x0, cFileName="kkx-Aq-L4HXH.gif", cAlternateFileName="KKX-AQ~1.GIF")) returned 1 [0216.068] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7916b0, ftCreationTime.dwHighDateTime=0x1d7df02, ftLastAccessTime.dwLowDateTime=0x4aaa410, ftLastAccessTime.dwHighDateTime=0x1d7e380, ftLastWriteTime.dwLowDateTime=0x4aaa410, ftLastWriteTime.dwHighDateTime=0x1d7e380, nFileSizeHigh=0x0, nFileSizeLow=0x18645, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kum5Sx rv7KeyHbFS.odt", cAlternateFileName="KUM5SX~1.ODT")) returned 1 [0216.068] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c384740, ftCreationTime.dwHighDateTime=0x1d7da04, ftLastAccessTime.dwLowDateTime=0xce49feb0, ftLastAccessTime.dwHighDateTime=0x1d7ddf9, ftLastWriteTime.dwLowDateTime=0xce49feb0, ftLastWriteTime.dwHighDateTime=0x1d7ddf9, nFileSizeHigh=0x0, nFileSizeLow=0x1525, dwReserved0=0x0, dwReserved1=0x0, cFileName="l7Ku9_hTJOQWZ4.avi", cAlternateFileName="L7KU9_~1.AVI")) returned 1 [0216.068] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce732370, ftCreationTime.dwHighDateTime=0x1d7e4fd, ftLastAccessTime.dwLowDateTime=0x87253ff0, ftLastAccessTime.dwHighDateTime=0x1d7e587, ftLastWriteTime.dwLowDateTime=0x87253ff0, ftLastWriteTime.dwHighDateTime=0x1d7e587, nFileSizeHigh=0x0, nFileSizeLow=0x171f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="l_cM9x5fYddcJ2DVZd.ppt", cAlternateFileName="L_CM9X~1.PPT")) returned 1 [0216.069] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa92f1c4e, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa92f1c4e, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0216.069] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcba6ba50, ftCreationTime.dwHighDateTime=0x1d7e3bb, ftLastAccessTime.dwLowDateTime=0x7ee174d0, ftLastAccessTime.dwHighDateTime=0x1d7e6db, ftLastWriteTime.dwLowDateTime=0x7ee174d0, ftLastWriteTime.dwHighDateTime=0x1d7e6db, nFileSizeHigh=0x0, nFileSizeLow=0x14bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mY6X2BzGyH.ods", cAlternateFileName="MY6X2B~1.ODS")) returned 1 [0216.069] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f66d30, ftCreationTime.dwHighDateTime=0x1d7d9b0, ftLastAccessTime.dwLowDateTime=0x947b1480, ftLastAccessTime.dwHighDateTime=0x1d7e51f, ftLastWriteTime.dwLowDateTime=0x947b1480, ftLastWriteTime.dwHighDateTime=0x1d7e51f, nFileSizeHigh=0x0, nFileSizeLow=0x5852, dwReserved0=0x0, dwReserved1=0x0, cFileName="R6AdX.png", cAlternateFileName="")) returned 1 [0216.069] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x257f59c0, ftCreationTime.dwHighDateTime=0x1d7e1cc, ftLastAccessTime.dwLowDateTime=0xf84f8500, ftLastAccessTime.dwHighDateTime=0x1d7e61d, ftLastWriteTime.dwLowDateTime=0xf84f8500, ftLastWriteTime.dwHighDateTime=0x1d7e61d, nFileSizeHigh=0x0, nFileSizeLow=0xf36d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmed3jthylp_0D.m4a", cAlternateFileName="RMED3J~1.M4A")) returned 1 [0216.069] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3fbecd0, ftCreationTime.dwHighDateTime=0x1d7d9ea, ftLastAccessTime.dwLowDateTime=0xef411380, ftLastAccessTime.dwHighDateTime=0x1d7dff5, ftLastWriteTime.dwLowDateTime=0xef411380, ftLastWriteTime.dwHighDateTime=0x1d7dff5, nFileSizeHigh=0x0, nFileSizeLow=0x694a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSXSglPz04u7M.bmp", cAlternateFileName="SSXSGL~1.BMP")) returned 1 [0216.070] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb76ee0, ftCreationTime.dwHighDateTime=0x1d7e3dc, ftLastAccessTime.dwLowDateTime=0x45968110, ftLastAccessTime.dwHighDateTime=0x1d7e745, ftLastWriteTime.dwLowDateTime=0x45968110, ftLastWriteTime.dwHighDateTime=0x1d7e745, nFileSizeHigh=0x0, nFileSizeLow=0xcd20, dwReserved0=0x0, dwReserved1=0x0, cFileName="UdEtEC10rb_j2.docx", cAlternateFileName="UDETEC~1.DOC")) returned 1 [0216.070] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d443260, ftCreationTime.dwHighDateTime=0x1d7e179, ftLastAccessTime.dwLowDateTime=0x50468100, ftLastAccessTime.dwHighDateTime=0x1d7e740, ftLastWriteTime.dwLowDateTime=0x50468100, ftLastWriteTime.dwHighDateTime=0x1d7e740, nFileSizeHigh=0x0, nFileSizeLow=0x109af, dwReserved0=0x0, dwReserved1=0x0, cFileName="v hR.gif", cAlternateFileName="VHR~1.GIF")) returned 1 [0216.070] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8247f5b0, ftCreationTime.dwHighDateTime=0x1d7dbd5, ftLastAccessTime.dwLowDateTime=0x2adc1620, ftLastAccessTime.dwHighDateTime=0x1d7e21b, ftLastWriteTime.dwLowDateTime=0x2adc1620, ftLastWriteTime.dwHighDateTime=0x1d7e21b, nFileSizeHigh=0x0, nFileSizeLow=0x13302, dwReserved0=0x0, dwReserved1=0x0, cFileName="V7ji.pdf", cAlternateFileName="")) returned 1 [0216.070] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac53cc20, ftCreationTime.dwHighDateTime=0x1d7e15d, ftLastAccessTime.dwLowDateTime=0x7b084fd0, ftLastAccessTime.dwHighDateTime=0x1d7e60b, ftLastWriteTime.dwLowDateTime=0x7b084fd0, ftLastWriteTime.dwHighDateTime=0x1d7e60b, nFileSizeHigh=0x0, nFileSizeLow=0x185f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="YdDFR7f1Y.jpg", cAlternateFileName="YDDFR7~1.JPG")) returned 1 [0216.070] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae58d30, ftCreationTime.dwHighDateTime=0x1d7e458, ftLastAccessTime.dwLowDateTime=0xc1d5e660, ftLastAccessTime.dwHighDateTime=0x1d7e4ea, ftLastWriteTime.dwLowDateTime=0xc1d5e660, ftLastWriteTime.dwHighDateTime=0x1d7e4ea, nFileSizeHigh=0x0, nFileSizeLow=0xd951, dwReserved0=0x0, dwReserved1=0x0, cFileName="YIXVWRTWxqk.avi", cAlternateFileName="YIXVWR~1.AVI")) returned 1 [0216.080] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae58d30, ftCreationTime.dwHighDateTime=0x1d7e458, ftLastAccessTime.dwLowDateTime=0xc1d5e660, ftLastAccessTime.dwHighDateTime=0x1d7e4ea, ftLastWriteTime.dwLowDateTime=0xc1d5e660, ftLastWriteTime.dwHighDateTime=0x1d7e4ea, nFileSizeHigh=0x0, nFileSizeLow=0xd951, dwReserved0=0x0, dwReserved1=0x0, cFileName="YIXVWRTWxqk.avi", cAlternateFileName="YIXVWR~1.AVI")) returned 0 [0216.080] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f188) returned 1 [0216.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f194) returned 1 [0216.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x19ecf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x2b [0216.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0216.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x19ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x2b [0216.080] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x19ec94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x2c [0216.080] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x19eee0 | out: lpFindFileData=0x19eee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.081] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.082] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0216.082] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0216.082] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0216.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0216.082] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\.", nBufferLength=0x105, lpBuffer=0x19ec74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x2b [0216.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0216.082] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x19ec3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x2b [0216.082] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x19ec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x2c [0216.083] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.083] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.083] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0216.083] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.083] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0216.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0216.083] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x38 [0216.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.084] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x38 [0216.084] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x39 [0216.084] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.084] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.084] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NativeCache", cAlternateFileName="NATIVE~1")) returned 1 [0216.084] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42a37b71, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42a37b71, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42a37b71, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NativeCache", cAlternateFileName="NATIVE~1")) returned 0 [0216.085] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.085] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x38 [0216.085] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x19ecf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2f [0216.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0216.085] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x19ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2f [0216.085] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x19ec94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x30 [0216.085] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x19eee0 | out: lpFindFileData=0x19eee0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.086] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.086] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0216.086] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e898ff, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e898ff, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e898ff, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0216.086] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0216.086] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816a7a21, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x816a7a21, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x816a7a21, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0216.087] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92f1c4e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0216.087] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0216.087] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0216.087] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0216.087] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f7a98f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa45e20df, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa45e20df, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0216.088] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x661c6965, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0216.088] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0216.088] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563371fc, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x5635d3c1, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x5635d3c1, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling", cAlternateFileName="")) returned 1 [0216.088] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0216.088] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b78b76, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4984c62, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa4984c62, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0216.088] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0216.089] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0216.089] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 1 [0216.089] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 0 [0216.089] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0216.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0216.089] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\.", nBufferLength=0x105, lpBuffer=0x19ec74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2f [0216.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0216.089] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x19ec3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x2f [0216.090] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x19ec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x30 [0216.090] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.090] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.090] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddIns", cAlternateFileName="")) returned 1 [0216.091] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e898ff, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e898ff, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e898ff, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0216.091] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0216.091] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816a7a21, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x816a7a21, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x816a7a21, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0216.091] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92f1c4e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel", cAlternateFileName="")) returned 1 [0216.091] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0216.091] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMC", cAlternateFileName="")) returned 1 [0216.091] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0216.092] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f7a98f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa45e20df, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa45e20df, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0216.092] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x661c6965, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x661c6965, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0216.092] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Protect", cAlternateFileName="")) returned 1 [0216.092] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563371fc, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x5635d3c1, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x5635d3c1, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling", cAlternateFileName="")) returned 1 [0216.092] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0216.092] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b78b76, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4984c62, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa4984c62, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0216.092] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0216.093] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0216.093] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word", cAlternateFileName="")) returned 1 [0216.093] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.093] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0216.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0216.093] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x36 [0216.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.094] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x36 [0216.094] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x37 [0216.094] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.094] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.094] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e1db4, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x811e1db4, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x811e1db4, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.094] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.095] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x36 [0216.095] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", lpFilePart=0x0) returned 0x3c [0216.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.095] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", lpFilePart=0x0) returned 0x3c [0216.095] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography\\", lpFilePart=0x0) returned 0x3d [0216.095] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e898ff, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e898ff, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e9aa3d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.096] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e898ff, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e898ff, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e9aa3d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.097] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e9aa3d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e9aa3d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e9aa3d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 1 [0216.097] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80e9aa3d, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80e9aa3d, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80e9aa3d, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 0 [0216.097] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.097] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Bibliography", lpFilePart=0x0) returned 0x3c [0216.097] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x3b [0216.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.097] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x3b [0216.097] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3c [0216.098] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.098] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.098] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44687ae6, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x44687ae6, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.098] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.098] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x3b [0216.099] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x48 [0216.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.099] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x48 [0216.099] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpFilePart=0x0) returned 0x49 [0216.099] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816a7a21, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x816a7a21, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x81712f94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.100] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x816a7a21, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x816a7a21, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x81712f94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.100] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81712f94, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x81712f94, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x81712f94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0216.100] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81712f94, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x81712f94, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x81712f94, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0216.100] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.100] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x48 [0216.100] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x35 [0216.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.101] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x35 [0216.101] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel\\", lpFilePart=0x0) returned 0x36 [0216.101] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92f1c4e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x934f7bb4, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.101] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92f1c4e, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x934f7bb4, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.101] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934f7bb4, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x934f7bb4, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x934f7bb4, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0216.101] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934f7bb4, ftCreationTime.dwHighDateTime=0x1d7b063, ftLastAccessTime.dwLowDateTime=0x934f7bb4, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x934f7bb4, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0216.102] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.102] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x35 [0216.102] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x41 [0216.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.103] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x41 [0216.103] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x42 [0216.103] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.103] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.103] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x6654de95, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x6654de95, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0216.103] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0216.104] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 0 [0216.104] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x41 [0216.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x33 [0216.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x33 [0216.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC\\", lpFilePart=0x0) returned 0x34 [0216.104] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.105] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.106] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3704a98f, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x3704a98f, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x3704a98f, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.106] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.106] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x33 [0216.106] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x37 [0216.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.106] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x37 [0216.106] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x38 [0216.107] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.113] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.113] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0216.115] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f3fb46a, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x6f3fb46a, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x6f3fb46a, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0216.115] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x37 [0216.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x36 [0216.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x36 [0216.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x37 [0216.116] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f7a98f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa45e20df, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa45e20df, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.117] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80f7a98f, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa45e20df, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa45e20df, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.117] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80f81d62, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x80f81d62, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x80f83167, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x9362, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1 [0216.117] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa45e20df, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4689310, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa4689310, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0216.117] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa45e20df, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4689310, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa4689310, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 0 [0216.118] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.118] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x36 [0216.118] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x37 [0216.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.118] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x37 [0216.118] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x38 [0216.118] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x661c6965, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x877953e5, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.119] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x661c6965, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x661c6965, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x877953e5, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.120] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6abbe5b6, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x6abbe5b6, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x6acd6e90, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.srs", cAlternateFileName="")) returned 1 [0216.120] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x877953e5, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x877953e5, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x87797b5c, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x956, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.xml", cAlternateFileName="")) returned 1 [0216.120] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.120] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.121] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x37 [0216.121] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x37 [0216.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.121] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x37 [0216.121] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x38 [0216.121] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50866c1c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.122] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x50866c1c, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x50866c1c, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.122] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xa55c36e7, ftLastWriteTime.dwHighDateTime=0x1d7a941, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0216.122] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x50866c1c, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xde7dde0f, ftLastAccessTime.dwHighDateTime=0x1d7b055, ftLastWriteTime.dwLowDateTime=0xde7dde0f, ftLastWriteTime.dwHighDateTime=0x1d7b055, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-1560258661-3990802383-1811730007-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0216.122] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44792966, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x44792966, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xa563624b, ftLastWriteTime.dwHighDateTime=0x1d7a941, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0216.122] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.123] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.123] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x37 [0216.123] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", lpFilePart=0x0) returned 0x38 [0216.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.123] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", lpFilePart=0x0) returned 0x38 [0216.123] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling\\", lpFilePart=0x0) returned 0x39 [0216.123] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563371fc, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x5635d3c1, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x5635d3c1, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.124] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x563371fc, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x5635d3c1, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x5635d3c1, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.124] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5635d3c1, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x567d5b26, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x567d5b26, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0216.124] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5635d3c1, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x567d5b26, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x567d5b26, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0216.124] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.125] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Spelling", lpFilePart=0x0) returned 0x38 [0216.125] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x42 [0216.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.125] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x42 [0216.125] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x43 [0216.125] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.125] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.126] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 1 [0216.126] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x5ec61c93, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5ec61c93, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5ec61c93, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 0 [0216.126] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.126] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x42 [0216.126] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x39 [0216.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.126] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x39 [0216.126] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\", lpFilePart=0x0) returned 0x3a [0216.126] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b78b76, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4984c62, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa4984c62, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.129] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80b78b76, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4984c62, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa4984c62, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.129] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d61fa7, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x96d61fa7, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0x96d61fa7, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LiveContent", cAlternateFileName="LIVECO~1")) returned 1 [0216.130] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4614163, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0xa4614163, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa46a67ce, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x4641, dwReserved0=0x0, dwReserved1=0x0, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0216.130] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.130] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.131] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x39 [0216.131] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", lpFilePart=0x0) returned 0x35 [0216.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.131] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", lpFilePart=0x0) returned 0x35 [0216.131] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x36 [0216.131] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.132] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.132] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb898985, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.132] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.132] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Vault", lpFilePart=0x0) returned 0x35 [0216.132] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x37 [0216.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.132] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x37 [0216.132] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\", lpFilePart=0x0) returned 0x38 [0216.132] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xaeb77be3, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaeb77be3, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.132] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xaeb77be3, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaeb77be3, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.133] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43708645, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x43708645, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x43708645, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0216.133] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x4347fe61, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2b1d2cc3, ftLastAccessTime.dwHighDateTime=0x1d70504, ftLastWriteTime.dwLowDateTime=0x2b1d8e71, ftLastWriteTime.dwHighDateTime=0x1d70504, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0216.133] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0216.133] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0216.133] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xf4cc4323, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xf4cc4323, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0216.133] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x8c427141, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x8c473662, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0216.134] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0216.134] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3ced6473, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0216.134] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeb77be3, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xaebea315, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaebea315, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0216.134] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeb77be3, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xaebea315, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xaebea315, ftLastWriteTime.dwHighDateTime=0x1d7006b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0216.134] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows", lpFilePart=0x0) returned 0x37 [0216.134] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x34 [0216.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.135] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x34 [0216.135] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word\\", lpFilePart=0x0) returned 0x35 [0216.135] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.135] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.135] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x811e4423, ftCreationTime.dwHighDateTime=0x1d705ee, ftLastAccessTime.dwLowDateTime=0x31c6a486, ftLastAccessTime.dwHighDateTime=0x1d7b063, ftLastWriteTime.dwLowDateTime=0x31c6a486, ftLastWriteTime.dwHighDateTime=0x1d7b063, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.135] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.135] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x34 [0216.135] CoTaskMemAlloc (cb=0x20c) returned 0x4ceda8 [0216.135] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x4ceda8 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0216.136] CoTaskMemFree (pv=0x4ceda8) [0216.136] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19ecf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0216.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1c8) returned 1 [0216.136] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x19ecd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFilePart=0x0) returned 0x23 [0216.136] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x19eca4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", lpFilePart=0x0) returned 0x24 [0216.136] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\*", lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.136] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.136] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveSync", cAlternateFileName="ACTIVE~1")) returned 1 [0216.136] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0216.136] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2397496d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0216.137] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0216.137] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xb1dfb94f, ftCreationTime.dwHighDateTime=0x1d7006b, ftLastAccessTime.dwLowDateTime=0xb1dfb94f, ftLastAccessTime.dwHighDateTime=0x1d7006b, ftLastWriteTime.dwLowDateTime=0xf3693fe1, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x461a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0216.137] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0216.137] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4252734, ftCreationTime.dwHighDateTime=0x1d70460, ftLastAccessTime.dwLowDateTime=0x4252734, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4252734, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1 [0216.137] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42cc0372, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x217bac55, ftLastAccessTime.dwHighDateTime=0x1d70503, ftLastWriteTime.dwLowDateTime=0x217bac55, ftLastWriteTime.dwHighDateTime=0x1d70503, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0216.137] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73f4dcd0, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73f4dcd0, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73f4dcd0, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1 [0216.137] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc699b5c, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xdc699b5c, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xdc699b5c, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1 [0216.138] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xd9f33f4a, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xd9f33f4a, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0216.138] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3d39b021, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0216.138] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40a64b1d, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40a64b1d, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40a64b1d, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1 [0216.138] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0216.138] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee5f28e7, ftCreationTime.dwHighDateTime=0x1d7fc8f, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yandex", cAlternateFileName="")) returned 1 [0216.139] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ef00 | out: lpFindFileData=0x19ef00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.139] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f188) returned 1 [0216.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f194) returned 1 [0216.139] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x105, lpBuffer=0x19ecf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x2e [0216.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0216.139] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x105, lpBuffer=0x19ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x2e [0216.139] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\", nBufferLength=0x105, lpBuffer=0x19ec94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\", lpFilePart=0x0) returned 0x2f [0216.139] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\*", lpFindFileData=0x19eee0 | out: lpFindFileData=0x19eee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.139] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.139] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.140] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0216.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0216.140] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\.", nBufferLength=0x105, lpBuffer=0x19ec74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x2e [0216.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0216.140] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", nBufferLength=0x105, lpBuffer=0x19ec3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync", lpFilePart=0x0) returned 0x2e [0216.140] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\", nBufferLength=0x105, lpBuffer=0x19ec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\", lpFilePart=0x0) returned 0x2f [0216.140] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\ActiveSync\\*", lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.140] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.140] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7c3f133, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0x7c3f133, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0x7c3f133, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.140] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0216.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0216.141] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x19ecf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x34 [0216.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0216.141] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x19ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x34 [0216.141] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data\\", nBufferLength=0x105, lpBuffer=0x19ec94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data\\", lpFilePart=0x0) returned 0x35 [0216.141] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Application Data\\*", lpFindFileData=0x19eee0 | out: lpFindFileData=0x19eee0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0216.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f17c) returned 1 [0216.479] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x105, lpBuffer=0x19ecf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x29 [0216.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0216.480] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x105, lpBuffer=0x19ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x29 [0216.480] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\", nBufferLength=0x105, lpBuffer=0x19ec94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\", lpFilePart=0x0) returned 0x2a [0216.480] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\*", lpFindFileData=0x19eee0 | out: lpFindFileData=0x19eee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2397496d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.480] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2397496d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.480] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3bbf8cb3, ftLastAccessTime.dwHighDateTime=0x1d7e768, ftLastWriteTime.dwLowDateTime=0x3bbf8cb3, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0216.480] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unistore", cAlternateFileName="")) returned 1 [0216.481] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7c627099, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0x7c627099, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0216.481] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7c627099, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0x7c627099, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 0 [0216.481] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0216.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0216.484] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\.", nBufferLength=0x105, lpBuffer=0x19ec74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x29 [0216.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0216.484] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", nBufferLength=0x105, lpBuffer=0x19ec3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms", lpFilePart=0x0) returned 0x29 [0216.484] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\", nBufferLength=0x105, lpBuffer=0x19ec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\", lpFilePart=0x0) returned 0x2a [0216.484] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\*", lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2397496d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.485] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2397496d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x241f3052, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.485] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x3bbf8cb3, ftLastAccessTime.dwHighDateTime=0x1d7e768, ftLastWriteTime.dwLowDateTime=0x3bbf8cb3, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0216.485] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unistore", cAlternateFileName="")) returned 1 [0216.485] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7c627099, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0x7c627099, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnistoreDB", cAlternateFileName="UNISTO~1")) returned 1 [0216.485] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.485] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0216.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0216.485] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", lpFilePart=0x0) returned 0x2e [0216.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.486] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", lpFilePart=0x0) returned 0x2e [0216.486] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp\\", lpFilePart=0x0) returned 0x2f [0216.486] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0xa716f6df, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xa7170a68, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.486] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x241f3052, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0xa716f6df, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xa7170a68, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.486] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b315521, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0xa7170a68, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xa7170a68, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarCache.dat", cAlternateFileName="CALEND~1.DAT")) returned 1 [0216.486] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.486] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.486] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Temp", lpFilePart=0x0) returned 0x2e [0216.486] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", lpFilePart=0x0) returned 0x32 [0216.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.486] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", lpFilePart=0x0) returned 0x32 [0216.487] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore\\", lpFilePart=0x0) returned 0x33 [0216.487] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.488] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.488] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23c4973c, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23c4973c, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x23c4973c, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0216.488] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.488] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\Unistore", lpFilePart=0x0) returned 0x32 [0216.488] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", lpFilePart=0x0) returned 0x34 [0216.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.488] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", lpFilePart=0x0) returned 0x34 [0216.488] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\", lpFilePart=0x0) returned 0x35 [0216.488] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7c627099, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0x7c627099, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.488] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2397496d, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x7c627099, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0x7c627099, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.489] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x23a0d188, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x23a0d188, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x7c611181, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x600000, dwReserved0=0x0, dwReserved1=0x0, cFileName="store.vol", cAlternateFileName="")) returned 1 [0216.489] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c627099, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0x7c627099, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0x7c673f47, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tmp.edb", cAlternateFileName="")) returned 1 [0216.489] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239e71ab, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239e71ab, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xa710a195, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USS.chk", cAlternateFileName="")) returned 1 [0216.489] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x7c5eda5f, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USS.log", cAlternateFileName="")) returned 1 [0216.489] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USSres00001.jrs", cAlternateFileName="USSRES~1.JRS")) returned 1 [0216.489] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239c0dc2, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x239c0dc2, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x239c0dc2, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USSres00002.jrs", cAlternateFileName="USSRES~2.JRS")) returned 1 [0216.489] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2399ab8b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2399ab8b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0xdd289e64, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x300000, dwReserved0=0x0, dwReserved1=0x0, cFileName="USStmp.log", cAlternateFileName="")) returned 1 [0216.489] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.489] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.490] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comms\\UnistoreDB", lpFilePart=0x0) returned 0x34 [0216.490] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x19ecf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", lpFilePart=0x0) returned 0x2b [0216.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0216.490] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x19ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History", lpFilePart=0x0) returned 0x2b [0216.490] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History\\", nBufferLength=0x105, lpBuffer=0x19ec94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History\\", lpFilePart=0x0) returned 0x2c [0216.490] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\History\\*", lpFindFileData=0x19eee0 | out: lpFindFileData=0x19eee0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0216.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f17c) returned 1 [0216.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x19ecf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x2d [0216.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0216.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x19ecc0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x2d [0216.492] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x19ec94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x2e [0216.492] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x19eee0 | out: lpFindFileData=0x19eee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.492] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0", cAlternateFileName="")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0_32", cAlternateFileName="CLR_V4~1.0_3")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xe08cb400, ftLastAccessTime.dwHighDateTime=0x1d7b055, ftLastWriteTime.dwLowDateTime=0xe08cb400, ftLastWriteTime.dwHighDateTime=0x1d7b055, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc2158c6f, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc2158c6f, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc25071d6, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc25071d6, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameDVR", cAlternateFileName="")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallAgent", cAlternateFileName="INSTAL~1")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xbc5b00e6, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xbc5b00e6, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x84c1ec39, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84c1ec39, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a11bc67, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a11cf49, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a11cf49, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1 [0216.493] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0216.494] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0216.494] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0216.494] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0216.494] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19eef0 | out: lpFindFileData=0x19eef0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0216.494] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0216.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0216.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\.", nBufferLength=0x105, lpBuffer=0x19ec74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x2d [0216.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0216.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x19ec3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x2d [0216.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x19ec10, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x2e [0216.494] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0", cAlternateFileName="")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLR_v4.0_32", cAlternateFileName="CLR_V4~1.0_3")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xe08cb400, ftLastAccessTime.dwHighDateTime=0x1d7b055, ftLastWriteTime.dwLowDateTime=0xe08cb400, ftLastWriteTime.dwHighDateTime=0x1d7b055, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc2158c6f, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc2158c6f, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc25071d6, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc25071d6, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameDVR", cAlternateFileName="")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3cefc6a2, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization", cAlternateFileName="INPUTP~1")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5b61023, ftCreationTime.dwHighDateTime=0x1d7045f, ftLastAccessTime.dwLowDateTime=0xf5b61023, ftLastAccessTime.dwHighDateTime=0x1d7045f, ftLastWriteTime.dwLowDateTime=0xf5b61023, ftLastWriteTime.dwHighDateTime=0x1d7045f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InstallAgent", cAlternateFileName="INSTAL~1")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4137bbef, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xbc5b00e6, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xbc5b00e6, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x40f9be3f, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x40f9be3f, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x40f9be3f, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0216.495] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5781bc17, ftCreationTime.dwHighDateTime=0x1d7046d, ftLastAccessTime.dwLowDateTime=0x696efe32, ftLastAccessTime.dwHighDateTime=0x1d7046d, ftLastWriteTime.dwLowDateTime=0x696efe32, ftLastWriteTime.dwHighDateTime=0x1d7046d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0216.496] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87b49234, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x84c1ec39, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84c1ec39, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0216.496] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a11bc67, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a11cf49, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a11cf49, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1 [0216.496] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x42ce6642, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x42ce6642, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1 [0216.496] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb898985, ftCreationTime.dwHighDateTime=0x1d70071, ftLastAccessTime.dwLowDateTime=0xb898985, ftLastAccessTime.dwHighDateTime=0x1d70071, ftLastWriteTime.dwLowDateTime=0xb9574d8, ftLastWriteTime.dwHighDateTime=0x1d70071, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0216.496] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0216.496] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x87ca06a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0x87ca06a1, ftLastAccessTime.dwHighDateTime=0x1d7006c, ftLastWriteTime.dwLowDateTime=0x87ca06a1, ftLastWriteTime.dwHighDateTime=0x1d7006c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0216.496] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d0c63cd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x377dee7, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0216.496] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee6c | out: lpFindFileData=0x19ee6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.496] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0216.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0216.497] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", lpFilePart=0x0) returned 0x36 [0216.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.497] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", lpFilePart=0x0) returned 0x36 [0216.497] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\", lpFilePart=0x0) returned 0x37 [0216.497] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.497] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.499] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0216.499] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b2eec3b, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x5b2eec3b, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x5b2eec3b, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 0 [0216.499] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.499] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0", lpFilePart=0x0) returned 0x36 [0216.499] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", lpFilePart=0x0) returned 0x39 [0216.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.499] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", lpFilePart=0x0) returned 0x39 [0216.499] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\", lpFilePart=0x0) returned 0x3a [0216.500] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.500] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.500] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 1 [0216.500] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x73c78cc8, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x73c78cc8, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x73c78cc8, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsageLogs", cAlternateFileName="USAGEL~1")) returned 0 [0216.501] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.501] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\CLR_v4.0_32", lpFilePart=0x0) returned 0x39 [0216.501] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x39 [0216.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.501] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x39 [0216.501] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x3a [0216.501] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xe08cb400, ftLastAccessTime.dwHighDateTime=0x1d7b055, ftLastWriteTime.dwLowDateTime=0xe08cb400, ftLastWriteTime.dwHighDateTime=0x1d7b055, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.502] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x44687ae6, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xe08cb400, ftLastAccessTime.dwHighDateTime=0x1d7b055, ftLastWriteTime.dwLowDateTime=0xe08cb400, ftLastWriteTime.dwHighDateTime=0x1d7b055, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.502] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x508b12b7, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xe08cb400, ftLastAccessTime.dwHighDateTime=0x1d7b055, ftLastWriteTime.dwLowDateTime=0xe08cc733, ftLastWriteTime.dwHighDateTime=0x1d7b055, nFileSizeHigh=0x0, nFileSizeLow=0x2ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DFBE70A7E5CC19A398EBF1B96859CE5D", cAlternateFileName="DFBE70~1")) returned 1 [0216.502] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.502] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.502] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x39 [0216.502] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x33 [0216.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.502] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x33 [0216.503] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x34 [0216.503] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc2158c6f, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc2158c6f, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.503] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x42ce6642, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc2158c6f, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc2158c6f, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.503] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2158c6f, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xc2158c6f, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc3c9ba2f, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0216.503] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xc1f99e32, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xc1fb5f8b, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc1fb5f8b, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1 [0216.503] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xc1f99e32, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xc1fb5f8b, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc1fb5f8b, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0 [0216.503] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.503] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x33 [0216.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x39 [0216.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x39 [0216.504] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x3a [0216.504] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc25071d6, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc25071d6, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.504] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x430ec4ba, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc25071d6, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc25071d6, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.504] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc24c18e3, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xc24c18e3, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc24c18e3, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4EEI1ECZ", cAlternateFileName="")) returned 1 [0216.504] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc24c18e3, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xc24c18e3, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc24c18e3, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6886OHKL", cAlternateFileName="")) returned 1 [0216.504] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xc1fa26b0, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xc1fa26b0, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc1fa26b0, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="container.dat", cAlternateFileName="CONTAI~1.DAT")) returned 1 [0216.504] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc24c04fe, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xc24c04fe, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc24c04fe, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LBUDRY5E", cAlternateFileName="")) returned 1 [0216.504] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc24c04fe, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xc24c04fe, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc24c04fe, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="O6QHQCQH", cAlternateFileName="")) returned 1 [0216.505] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xc24c04fe, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xc24c04fe, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc24c04fe, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="O6QHQCQH", cAlternateFileName="")) returned 0 [0216.505] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.505] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x39 [0216.505] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x33 [0216.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.505] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x33 [0216.505] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS\\", lpFilePart=0x0) returned 0x34 [0216.505] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.506] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a17d745, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a184b86, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.506] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a184b86, ftCreationTime.dwHighDateTime=0x1d70699, ftLastAccessTime.dwLowDateTime=0x3a184b86, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a4e76b4, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1 [0216.507] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0216.507] FindClose (in: hFindFile=0x543ee0 | out: hFindFile=0x543ee0) returned 1 [0216.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.507] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS\\.", nBufferLength=0x105, lpBuffer=0x19ebe0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x33 [0216.507] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", nBufferLength=0x105, lpBuffer=0x19ec5c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", lpFilePart=0x0) returned 0x35 [0216.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.507] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", nBufferLength=0x105, lpBuffer=0x19ec2c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR", lpFilePart=0x0) returned 0x35 [0216.507] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR\\", nBufferLength=0x105, lpBuffer=0x19ec00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR\\", lpFilePart=0x0) returned 0x36 [0216.507] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\GameDVR\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.508] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x809248a1, ftCreationTime.dwHighDateTime=0x1d7006c, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xc7db342, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0216.508] FindNextFileW (in: hFindFile=0x543ee0, lpFindFileData=0x19ee5c | out: lpFindFileData=0x19ee5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7db342, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xc7db342, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0x212d1b5b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xd23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KnownGameList.bin", cAlternateFileName="KNOWNG~1.BIN")) returned 1 [0216.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0216.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0216.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0216.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0216.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0216.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0216.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0216.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0216.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0216.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0216.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0216.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0216.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.624] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.BingNews_8wekyb3d8bbwe\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e8b2b66, ftCreationTime.dwHighDateTime=0x1d70074, ftLastAccessTime.dwLowDateTime=0x2ec6c618, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x2ec6c618, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0216.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0216.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0216.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0216.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.299] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.WindowsAlarms_8wekyb3d8bbwe\\*", lpFindFileData=0x19ee4c | out: lpFindFileData=0x19ee4c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xec6e67c2, ftCreationTime.dwHighDateTime=0x1d70070, ftLastAccessTime.dwLowDateTime=0xec922b53, ftLastAccessTime.dwHighDateTime=0x1d70070, ftLastWriteTime.dwLowDateTime=0xeda459b8, ftLastWriteTime.dwHighDateTime=0x1d70070, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0217.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0217.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0217.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0217.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0217.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0217.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0217.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0217.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0217.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0217.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0217.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0217.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0217.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0217.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0217.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0217.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0217.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0217.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0217.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0217.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f17c) returned 1 [0217.972] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer", nBufferLength=0x105, lpBuffer=0x19ecf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TileDataLayer", lpFilePart=0x0) returned 0x31 [0217.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0217.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0217.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0217.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0217.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0217.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0217.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0217.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0217.974] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x19eee0 | out: lpFindFileData=0x19eee0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5599aefd, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x5599aefd, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x5599aefd, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x543ee0 [0217.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0217.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0217.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0217.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0217.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0217.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b8) returned 1 [0217.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0217.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f184) returned 1 [0217.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f134) returned 1 [0217.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f4) returned 1 [0217.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f100) returned 1 [0217.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f124) returned 1 [0217.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0e4) returned 1 [0217.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f0f0) returned 1 [0218.085] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.086] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Battle.net", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net") returned 0x2f [0218.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.086] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net", lpFilePart=0x0) returned 0x2e [0218.086] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net\\", lpFilePart=0x0) returned 0x2f [0218.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.089] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.089] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chromium\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data") returned 0x37 [0218.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.089] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", lpFilePart=0x0) returned 0x36 [0218.089] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\", lpFilePart=0x0) returned 0x37 [0218.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.092] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.092] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Google\\Chrome\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x3c [0218.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.092] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x3b [0218.092] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x3c [0218.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.094] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.094] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Google(x86)\\Chrome\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data") returned 0x41 [0218.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.094] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data", lpFilePart=0x0) returned 0x40 [0218.094] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x41 [0218.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.096] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.096] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Opera Software\\", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\") returned 0x36 [0218.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.096] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", lpFilePart=0x0) returned 0x35 [0218.096] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", lpFilePart=0x0) returned 0x35 [0218.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.098] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.098] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data") returned 0x45 [0218.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.099] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpFilePart=0x0) returned 0x44 [0218.099] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data\\", lpFilePart=0x0) returned 0x45 [0218.099] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.101] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.101] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Iridium\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data") returned 0x36 [0218.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.101] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", lpFilePart=0x0) returned 0x35 [0218.101] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data\\", lpFilePart=0x0) returned 0x36 [0218.101] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.103] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.104] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\7Star\\7Star\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data") returned 0x3a [0218.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", lpFilePart=0x0) returned 0x39 [0218.104] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\", lpFilePart=0x0) returned 0x3a [0218.104] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.106] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.106] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CentBrowser\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data") returned 0x3a [0218.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.106] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", lpFilePart=0x0) returned 0x39 [0218.106] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\", lpFilePart=0x0) returned 0x3a [0218.107] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.128] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.129] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chedot\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data") returned 0x35 [0218.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.129] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", lpFilePart=0x0) returned 0x34 [0218.129] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\", lpFilePart=0x0) returned 0x35 [0218.129] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.131] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.131] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Vivaldi\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data") returned 0x36 [0218.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.131] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", lpFilePart=0x0) returned 0x35 [0218.132] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\", lpFilePart=0x0) returned 0x36 [0218.133] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.136] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.136] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Kometa\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data") returned 0x35 [0218.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.136] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", lpFilePart=0x0) returned 0x34 [0218.136] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\", lpFilePart=0x0) returned 0x35 [0218.137] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.139] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.139] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Elements Browser\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data") returned 0x3f [0218.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.139] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", lpFilePart=0x0) returned 0x3e [0218.139] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\", lpFilePart=0x0) returned 0x3f [0218.139] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.141] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.141] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Epic Privacy Browser\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data") returned 0x43 [0218.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.142] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", lpFilePart=0x0) returned 0x42 [0218.142] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\", lpFilePart=0x0) returned 0x43 [0218.142] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.144] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.144] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data") returned 0x3d [0218.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.144] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpFilePart=0x0) returned 0x3c [0218.144] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\", lpFilePart=0x0) returned 0x3d [0218.144] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.146] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.146] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer") returned 0x58 [0218.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpFilePart=0x0) returned 0x57 [0218.147] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer\\", lpFilePart=0x0) returned 0x58 [0218.147] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.149] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.149] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data") returned 0x43 [0218.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.149] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpFilePart=0x0) returned 0x42 [0218.149] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data\\", lpFilePart=0x0) returned 0x43 [0218.149] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.151] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.152] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Coowon\\Coowon\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data") returned 0x3c [0218.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.152] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", lpFilePart=0x0) returned 0x3b [0218.152] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data\\", lpFilePart=0x0) returned 0x3c [0218.152] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.154] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.154] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\liebao\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data") returned 0x35 [0218.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.154] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", lpFilePart=0x0) returned 0x34 [0218.154] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data\\", lpFilePart=0x0) returned 0x35 [0218.155] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.157] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.157] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\QIP Surf\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data") returned 0x37 [0218.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.157] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", lpFilePart=0x0) returned 0x36 [0218.157] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\", lpFilePart=0x0) returned 0x37 [0218.157] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.159] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.159] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Orbitum\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data") returned 0x36 [0218.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.159] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", lpFilePart=0x0) returned 0x35 [0218.159] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\", lpFilePart=0x0) returned 0x36 [0218.160] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.179] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.179] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Comodo\\Dragon\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data") returned 0x3c [0218.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.179] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", lpFilePart=0x0) returned 0x3b [0218.180] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\", lpFilePart=0x0) returned 0x3c [0218.180] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.182] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.182] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Amigo\\User\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data") returned 0x39 [0218.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.182] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data", lpFilePart=0x0) returned 0x38 [0218.182] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data\\", lpFilePart=0x0) returned 0x39 [0218.183] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.184] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.185] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Torch\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data") returned 0x34 [0218.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.185] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", lpFilePart=0x0) returned 0x33 [0218.211] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\", lpFilePart=0x0) returned 0x34 [0218.211] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.225] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.225] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data") returned 0x43 [0218.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.226] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpFilePart=0x0) returned 0x42 [0218.226] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\", lpFilePart=0x0) returned 0x43 [0218.226] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.228] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.228] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Comodo\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data") returned 0x35 [0218.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.228] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data", lpFilePart=0x0) returned 0x34 [0218.228] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data\\", lpFilePart=0x0) returned 0x35 [0218.228] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.234] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.234] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\360Browser\\Browser\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data") returned 0x41 [0218.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.234] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data", lpFilePart=0x0) returned 0x40 [0218.234] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\", lpFilePart=0x0) returned 0x41 [0218.234] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.248] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.248] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Maxthon3\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data") returned 0x37 [0218.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.248] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data", lpFilePart=0x0) returned 0x36 [0218.248] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data\\", lpFilePart=0x0) returned 0x37 [0218.248] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.257] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.258] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\K-Melon\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data") returned 0x36 [0218.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.258] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data", lpFilePart=0x0) returned 0x35 [0218.258] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data\\", lpFilePart=0x0) returned 0x36 [0218.258] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.261] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.261] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data") returned 0x3e [0218.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.261] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpFilePart=0x0) returned 0x3d [0218.261] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\", lpFilePart=0x0) returned 0x3e [0218.262] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.265] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.266] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Nichrome\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data") returned 0x37 [0218.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.266] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data", lpFilePart=0x0) returned 0x36 [0218.266] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\", lpFilePart=0x0) returned 0x37 [0218.266] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.269] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.270] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CocCoc\\Browser\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data") returned 0x3d [0218.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.270] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", lpFilePart=0x0) returned 0x3c [0218.270] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\", lpFilePart=0x0) returned 0x3d [0218.271] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.274] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.274] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Uran\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data") returned 0x33 [0218.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.274] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data", lpFilePart=0x0) returned 0x32 [0218.274] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data\\", lpFilePart=0x0) returned 0x33 [0218.274] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.277] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.277] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chromodo\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data") returned 0x37 [0218.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.277] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data", lpFilePart=0x0) returned 0x36 [0218.277] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data\\", lpFilePart=0x0) returned 0x37 [0218.277] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.280] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.280] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Mail.Ru\\Atom\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data") returned 0x3b [0218.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.280] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data", lpFilePart=0x0) returned 0x3a [0218.280] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data\\", lpFilePart=0x0) returned 0x3b [0218.280] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.282] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.282] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data") returned 0x4a [0218.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.283] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpFilePart=0x0) returned 0x49 [0218.283] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\", lpFilePart=0x0) returned 0x4a [0218.283] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.285] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.285] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Microsoft\\Edge\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data") returned 0x3d [0218.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.285] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", lpFilePart=0x0) returned 0x3c [0218.285] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\", lpFilePart=0x0) returned 0x3d [0218.285] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.288] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.289] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience") returned 0x51 [0218.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.289] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", lpFilePart=0x0) returned 0x50 [0218.289] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience\\", lpFilePart=0x0) returned 0x51 [0218.289] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.291] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.291] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Steam", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam") returned 0x2a [0218.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.291] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam", lpFilePart=0x0) returned 0x29 [0218.291] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam\\", lpFilePart=0x0) returned 0x2a [0218.291] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.293] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.294] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CryptoTab Browser\\User Data", lpDst=0x19f118, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data") returned 0x40 [0218.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1b4) returned 1 [0218.294] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data", lpFilePart=0x0) returned 0x3f [0218.294] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec90, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\", lpFilePart=0x0) returned 0x40 [0218.294] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\*", lpFindFileData=0x19eedc | out: lpFindFileData=0x19eedc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f178) returned 1 [0218.336] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0218.336] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Armory", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory") returned 0x2d [0218.336] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory", nBufferLength=0x105, lpBuffer=0x19ede8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory", lpFilePart=0x0) returned 0x2c [0218.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f29c) returned 1 [0218.337] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory", nBufferLength=0x105, lpBuffer=0x19eda4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory", lpFilePart=0x0) returned 0x2c [0218.337] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory\\", nBufferLength=0x105, lpBuffer=0x19ed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory\\", lpFilePart=0x0) returned 0x2d [0218.337] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Armory\\*.wallet", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f260) returned 1 [0218.340] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0218.340] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\atomic", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic") returned 0x2d [0218.340] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic", nBufferLength=0x105, lpBuffer=0x19ede8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic", lpFilePart=0x0) returned 0x2c [0218.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f29c) returned 1 [0218.340] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic", nBufferLength=0x105, lpBuffer=0x19eda4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic", lpFilePart=0x0) returned 0x2c [0218.341] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic\\", nBufferLength=0x105, lpBuffer=0x19ed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic\\", lpFilePart=0x0) returned 0x2d [0218.341] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\atomic\\*", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f260) returned 1 [0218.342] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0218.343] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Binance", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance") returned 0x2e [0218.343] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance", nBufferLength=0x105, lpBuffer=0x19ede8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance", lpFilePart=0x0) returned 0x2d [0218.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f29c) returned 1 [0218.343] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance", nBufferLength=0x105, lpBuffer=0x19eda4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance", lpFilePart=0x0) returned 0x2d [0218.343] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\", nBufferLength=0x105, lpBuffer=0x19ed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\", lpFilePart=0x0) returned 0x2e [0218.343] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Binance\\*app-store*", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f260) returned 1 [0218.345] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0218.345] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Coinomi", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Coinomi") returned 0x2e [0218.345] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Coinomi", nBufferLength=0x105, lpBuffer=0x19ede8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Coinomi", lpFilePart=0x0) returned 0x2d [0218.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f29c) returned 1 [0218.345] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Coinomi", nBufferLength=0x105, lpBuffer=0x19eda4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Coinomi", lpFilePart=0x0) returned 0x2d [0218.345] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Coinomi\\", nBufferLength=0x105, lpBuffer=0x19ed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Coinomi\\", lpFilePart=0x0) returned 0x2e [0218.345] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Coinomi\\*", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f260) returned 1 [0218.346] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0218.346] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Electrum\\wallets", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets") returned 0x37 [0218.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets", nBufferLength=0x105, lpBuffer=0x19ede8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets", lpFilePart=0x0) returned 0x36 [0218.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f29c) returned 1 [0218.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets", nBufferLength=0x105, lpBuffer=0x19eda4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets", lpFilePart=0x0) returned 0x36 [0218.347] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets\\", nBufferLength=0x105, lpBuffer=0x19ed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets\\", lpFilePart=0x0) returned 0x37 [0218.347] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Electrum\\wallets\\*", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f260) returned 1 [0218.348] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0218.348] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Ethereum\\wallets", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets") returned 0x37 [0218.348] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets", nBufferLength=0x105, lpBuffer=0x19ede8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets", lpFilePart=0x0) returned 0x36 [0218.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f29c) returned 1 [0218.349] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets", nBufferLength=0x105, lpBuffer=0x19eda4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets", lpFilePart=0x0) returned 0x36 [0218.349] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets\\", nBufferLength=0x105, lpBuffer=0x19ed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets\\", lpFilePart=0x0) returned 0x37 [0218.349] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Ethereum\\wallets\\*", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f260) returned 1 [0218.352] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0218.352] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Exodus\\exodus.wallet", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet") returned 0x3b [0218.352] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet", nBufferLength=0x105, lpBuffer=0x19ede8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet", lpFilePart=0x0) returned 0x3a [0218.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f29c) returned 1 [0218.352] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet", nBufferLength=0x105, lpBuffer=0x19eda4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet", lpFilePart=0x0) returned 0x3a [0218.352] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet\\", nBufferLength=0x105, lpBuffer=0x19ed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet\\", lpFilePart=0x0) returned 0x3b [0218.352] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\exodus.wallet\\*", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f260) returned 1 [0218.354] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0218.354] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Exodus", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus") returned 0x2d [0218.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus", nBufferLength=0x105, lpBuffer=0x19ede8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus", lpFilePart=0x0) returned 0x2c [0218.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f29c) returned 1 [0218.354] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus", nBufferLength=0x105, lpBuffer=0x19eda4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus", lpFilePart=0x0) returned 0x2c [0218.355] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\", nBufferLength=0x105, lpBuffer=0x19ed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\", lpFilePart=0x0) returned 0x2d [0218.355] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Exodus\\*.json", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f260) returned 1 [0218.356] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0218.356] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Guarda", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda") returned 0x2d [0218.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda", nBufferLength=0x105, lpBuffer=0x19ede8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda", lpFilePart=0x0) returned 0x2c [0218.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f29c) returned 1 [0218.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda", nBufferLength=0x105, lpBuffer=0x19eda4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda", lpFilePart=0x0) returned 0x2c [0218.357] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda\\", nBufferLength=0x105, lpBuffer=0x19ed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda\\", lpFilePart=0x0) returned 0x2d [0218.357] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Guarda\\*", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f260) returned 1 [0218.358] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0218.358] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\com.liberty.jaxx", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx") returned 0x37 [0218.359] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx", nBufferLength=0x105, lpBuffer=0x19ede8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx", lpFilePart=0x0) returned 0x36 [0218.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f29c) returned 1 [0218.359] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx", nBufferLength=0x105, lpBuffer=0x19eda4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx", lpFilePart=0x0) returned 0x36 [0218.359] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx\\", nBufferLength=0x105, lpBuffer=0x19ed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx\\", lpFilePart=0x0) returned 0x37 [0218.359] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\com.liberty.jaxx\\*", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f260) returned 1 [0218.361] ExpandEnvironmentStringsW (in: lpSrc="%userprofile%", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.361] ExpandEnvironmentStringsW (in: lpSrc="%userprofile%\\Documents\\Monero\\wallets", lpDst=0x19f1a4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets") returned 0x2f [0218.361] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets", nBufferLength=0x105, lpBuffer=0x19ede8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets", lpFilePart=0x0) returned 0x2e [0218.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f29c) returned 1 [0218.361] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets", nBufferLength=0x105, lpBuffer=0x19eda4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets", lpFilePart=0x0) returned 0x2e [0218.361] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets\\", nBufferLength=0x105, lpBuffer=0x19ed78, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets\\", lpFilePart=0x0) returned 0x2f [0218.361] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Documents\\Monero\\wallets\\*", lpFindFileData=0x19efc4 | out: lpFindFileData=0x19efc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f260) returned 1 [0218.364] CoCreateGuid (in: pguid=0x19efcc | out: pguid=0x19efcc*(Data1=0xd71a273d, Data2=0x2a33, Data3=0x49af, Data4=([0]=0x86, [1]=0xb9, [2]=0x5, [3]=0xce, [4]=0xb8, [5]=0xf6, [6]=0x70, [7]=0x1))) returned 0x0 [0218.364] CoCreateGuid (in: pguid=0x19eefc | out: pguid=0x19eefc*(Data1=0x847edd4c, Data2=0xf89d, Data3=0x4100, Data4=([0]=0xab, [1]=0x4a, [2]=0x8a, [3]=0x3, [4]=0x18, [5]=0x65, [6]=0xe7, [7]=0xbc))) returned 0x0 [0218.365] send (s=0x2cc, buf=0x3393fe7*, len=162, flags=0) returned 162 [0218.366] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 128 [0218.434] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.435] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Battle.net", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net") returned 0x2f [0218.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.435] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net", lpFilePart=0x0) returned 0x2e [0218.435] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net\\", lpFilePart=0x0) returned 0x2f [0218.435] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Battle.net\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.437] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.437] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chromium\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data") returned 0x37 [0218.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.438] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data", lpFilePart=0x0) returned 0x36 [0218.438] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\", lpFilePart=0x0) returned 0x37 [0218.439] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.441] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.441] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Google\\Chrome\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data") returned 0x3c [0218.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.442] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x3b [0218.442] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x3c [0218.442] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.444] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.444] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Google(x86)\\Chrome\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data") returned 0x41 [0218.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.444] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data", lpFilePart=0x0) returned 0x40 [0218.444] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x41 [0218.444] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google(x86)\\Chrome\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.446] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.446] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Opera Software\\", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\") returned 0x36 [0218.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.447] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", lpFilePart=0x0) returned 0x35 [0218.447] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\", lpFilePart=0x0) returned 0x35 [0218.447] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.449] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.449] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data") returned 0x45 [0218.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.449] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpFilePart=0x0) returned 0x44 [0218.449] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data\\", lpFilePart=0x0) returned 0x45 [0218.450] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.451] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.452] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Iridium\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data") returned 0x36 [0218.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.452] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data", lpFilePart=0x0) returned 0x35 [0218.452] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data\\", lpFilePart=0x0) returned 0x36 [0218.452] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Iridium\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.454] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.454] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\7Star\\7Star\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data") returned 0x3a [0218.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data", lpFilePart=0x0) returned 0x39 [0218.454] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\", lpFilePart=0x0) returned 0x3a [0218.455] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.456] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.456] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CentBrowser\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data") returned 0x3a [0218.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.457] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data", lpFilePart=0x0) returned 0x39 [0218.457] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\", lpFilePart=0x0) returned 0x3a [0218.457] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.459] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.459] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chedot\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data") returned 0x35 [0218.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.459] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data", lpFilePart=0x0) returned 0x34 [0218.459] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\", lpFilePart=0x0) returned 0x35 [0218.459] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.464] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.464] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Vivaldi\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data") returned 0x36 [0218.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.464] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data", lpFilePart=0x0) returned 0x35 [0218.464] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\", lpFilePart=0x0) returned 0x36 [0218.464] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.466] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.467] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Kometa\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data") returned 0x35 [0218.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data", lpFilePart=0x0) returned 0x34 [0218.467] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\", lpFilePart=0x0) returned 0x35 [0218.467] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.469] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.469] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Elements Browser\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data") returned 0x3f [0218.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.470] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data", lpFilePart=0x0) returned 0x3e [0218.470] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\", lpFilePart=0x0) returned 0x3f [0218.470] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.471] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.471] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Epic Privacy Browser\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data") returned 0x43 [0218.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.472] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data", lpFilePart=0x0) returned 0x42 [0218.472] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\", lpFilePart=0x0) returned 0x43 [0218.472] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.474] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.474] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data") returned 0x3d [0218.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.474] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpFilePart=0x0) returned 0x3c [0218.474] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\", lpFilePart=0x0) returned 0x3d [0218.474] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.476] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.476] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer") returned 0x58 [0218.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.477] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpFilePart=0x0) returned 0x57 [0218.477] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer\\", lpFilePart=0x0) returned 0x58 [0218.477] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.478] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.478] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data") returned 0x43 [0218.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.479] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpFilePart=0x0) returned 0x42 [0218.479] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data\\", lpFilePart=0x0) returned 0x43 [0218.479] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.481] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.481] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Coowon\\Coowon\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data") returned 0x3c [0218.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.481] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data", lpFilePart=0x0) returned 0x3b [0218.481] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data\\", lpFilePart=0x0) returned 0x3c [0218.481] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Coowon\\Coowon\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.482] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.483] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\liebao\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data") returned 0x35 [0218.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.483] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data", lpFilePart=0x0) returned 0x34 [0218.483] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data\\", lpFilePart=0x0) returned 0x35 [0218.483] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\liebao\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.485] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.485] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\QIP Surf\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data") returned 0x37 [0218.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.485] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data", lpFilePart=0x0) returned 0x36 [0218.485] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\", lpFilePart=0x0) returned 0x37 [0218.485] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.486] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.486] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Orbitum\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data") returned 0x36 [0218.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.487] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data", lpFilePart=0x0) returned 0x35 [0218.487] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\", lpFilePart=0x0) returned 0x36 [0218.487] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.488] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.489] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Comodo\\Dragon\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data") returned 0x3c [0218.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.489] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data", lpFilePart=0x0) returned 0x3b [0218.489] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\", lpFilePart=0x0) returned 0x3c [0218.489] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.491] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.491] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Amigo\\User\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data") returned 0x39 [0218.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.491] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data", lpFilePart=0x0) returned 0x38 [0218.491] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data\\", lpFilePart=0x0) returned 0x39 [0218.491] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.493] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.493] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Torch\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data") returned 0x34 [0218.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.493] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data", lpFilePart=0x0) returned 0x33 [0218.494] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\", lpFilePart=0x0) returned 0x34 [0218.494] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.495] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.495] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data") returned 0x43 [0218.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.495] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpFilePart=0x0) returned 0x42 [0218.495] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\", lpFilePart=0x0) returned 0x43 [0218.496] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.497] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.497] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Comodo\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data") returned 0x35 [0218.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.497] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data", lpFilePart=0x0) returned 0x34 [0218.497] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data\\", lpFilePart=0x0) returned 0x35 [0218.497] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.499] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.499] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\360Browser\\Browser\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data") returned 0x41 [0218.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.501] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data", lpFilePart=0x0) returned 0x40 [0218.501] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\", lpFilePart=0x0) returned 0x41 [0218.501] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.502] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.502] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Maxthon3\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data") returned 0x37 [0218.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.503] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data", lpFilePart=0x0) returned 0x36 [0218.503] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data\\", lpFilePart=0x0) returned 0x37 [0218.503] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon3\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.504] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.504] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\K-Melon\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data") returned 0x36 [0218.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.505] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data", lpFilePart=0x0) returned 0x35 [0218.505] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data\\", lpFilePart=0x0) returned 0x36 [0218.505] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\K-Melon\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.506] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.506] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data") returned 0x3e [0218.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.507] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpFilePart=0x0) returned 0x3d [0218.507] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\", lpFilePart=0x0) returned 0x3e [0218.507] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.508] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.508] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Nichrome\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data") returned 0x37 [0218.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.508] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data", lpFilePart=0x0) returned 0x36 [0218.508] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\", lpFilePart=0x0) returned 0x37 [0218.508] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.510] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.510] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CocCoc\\Browser\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data") returned 0x3d [0218.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.510] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data", lpFilePart=0x0) returned 0x3c [0218.510] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\", lpFilePart=0x0) returned 0x3d [0218.510] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.512] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.512] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Uran\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data") returned 0x33 [0218.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.512] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data", lpFilePart=0x0) returned 0x32 [0218.512] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data\\", lpFilePart=0x0) returned 0x33 [0218.513] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Uran\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.514] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.514] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Chromodo\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data") returned 0x37 [0218.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.514] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data", lpFilePart=0x0) returned 0x36 [0218.514] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data\\", lpFilePart=0x0) returned 0x37 [0218.514] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromodo\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.516] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.516] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Mail.Ru\\Atom\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data") returned 0x3b [0218.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.516] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data", lpFilePart=0x0) returned 0x3a [0218.516] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data\\", lpFilePart=0x0) returned 0x3b [0218.516] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Mail.Ru\\Atom\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.517] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.517] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data") returned 0x4a [0218.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.518] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpFilePart=0x0) returned 0x49 [0218.518] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\", lpFilePart=0x0) returned 0x4a [0218.518] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.519] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.519] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Microsoft\\Edge\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data") returned 0x3d [0218.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.519] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data", lpFilePart=0x0) returned 0x3c [0218.519] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\", lpFilePart=0x0) returned 0x3d [0218.519] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.520] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.520] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience") returned 0x51 [0218.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.520] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience", lpFilePart=0x0) returned 0x50 [0218.520] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience\\", lpFilePart=0x0) returned 0x51 [0218.521] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\NVIDIA Corporation\\NVIDIA GeForce Experience\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.522] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.522] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\Steam", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam") returned 0x2a [0218.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.522] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam", lpFilePart=0x0) returned 0x29 [0218.522] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam\\", lpFilePart=0x0) returned 0x2a [0218.522] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Steam\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.523] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.523] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Local\\CryptoTab Browser\\User Data", lpDst=0x19f104, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data") returned 0x40 [0218.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f1a0) returned 1 [0218.523] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data", nBufferLength=0x105, lpBuffer=0x19eca8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data", lpFilePart=0x0) returned 0x3f [0218.523] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\", nBufferLength=0x105, lpBuffer=0x19ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\", lpFilePart=0x0) returned 0x40 [0218.524] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\*", lpFindFileData=0x19eec8 | out: lpFindFileData=0x19eec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f164) returned 1 [0218.565] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.565] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Mozilla\\Firefox", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox") returned 0x36 [0218.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f218) returned 1 [0218.565] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x19ed20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x35 [0218.565] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x19ecf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x36 [0218.566] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x19ef40 | out: lpFindFileData=0x19ef40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1dc) returned 1 [0218.567] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.567] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Waterfox", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox") returned 0x2f [0218.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f218) returned 1 [0218.567] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox", nBufferLength=0x105, lpBuffer=0x19ed20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox", lpFilePart=0x0) returned 0x2e [0218.568] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\", nBufferLength=0x105, lpBuffer=0x19ecf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\", lpFilePart=0x0) returned 0x2f [0218.568] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\*", lpFindFileData=0x19ef40 | out: lpFindFileData=0x19ef40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1dc) returned 1 [0218.570] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.570] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\K-Meleon", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon") returned 0x2f [0218.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f218) returned 1 [0218.570] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon", nBufferLength=0x105, lpBuffer=0x19ed20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon", lpFilePart=0x0) returned 0x2e [0218.570] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\", nBufferLength=0x105, lpBuffer=0x19ecf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\", lpFilePart=0x0) returned 0x2f [0218.570] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\*", lpFindFileData=0x19ef40 | out: lpFindFileData=0x19ef40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1dc) returned 1 [0218.572] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.572] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Thunderbird", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird") returned 0x32 [0218.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f218) returned 1 [0218.572] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird", nBufferLength=0x105, lpBuffer=0x19ed20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird", lpFilePart=0x0) returned 0x31 [0218.572] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\", nBufferLength=0x105, lpBuffer=0x19ecf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\", lpFilePart=0x0) returned 0x32 [0218.572] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\*", lpFindFileData=0x19ef40 | out: lpFindFileData=0x19ef40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1dc) returned 1 [0218.573] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.573] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Comodo\\IceDragon", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon") returned 0x37 [0218.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f218) returned 1 [0218.574] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon", nBufferLength=0x105, lpBuffer=0x19ed20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon", lpFilePart=0x0) returned 0x36 [0218.574] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\", nBufferLength=0x105, lpBuffer=0x19ecf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\", lpFilePart=0x0) returned 0x37 [0218.574] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Comodo\\IceDragon\\*", lpFindFileData=0x19ef40 | out: lpFindFileData=0x19ef40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1dc) returned 1 [0218.575] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.575] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\8pecxstudios\\Cyberfox", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox") returned 0x3c [0218.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f218) returned 1 [0218.575] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox", nBufferLength=0x105, lpBuffer=0x19ed20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox", lpFilePart=0x0) returned 0x3b [0218.575] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\", nBufferLength=0x105, lpBuffer=0x19ecf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\", lpFilePart=0x0) returned 0x3c [0218.575] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\*", lpFindFileData=0x19ef40 | out: lpFindFileData=0x19ef40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1dc) returned 1 [0218.576] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.576] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw") returned 0x44 [0218.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f218) returned 1 [0218.577] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw", nBufferLength=0x105, lpBuffer=0x19ed20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw", lpFilePart=0x0) returned 0x43 [0218.577] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw\\", nBufferLength=0x105, lpBuffer=0x19ecf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw\\", lpFilePart=0x0) returned 0x44 [0218.577] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHaw\\*", lpFindFileData=0x19ef40 | out: lpFindFileData=0x19ef40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1dc) returned 1 [0218.578] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX") returned 0x16 [0218.578] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Moonchild Productions\\Pale Moon", lpDst=0x19f17c, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon") returned 0x46 [0218.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f218) returned 1 [0218.578] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon", nBufferLength=0x105, lpBuffer=0x19ed20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon", lpFilePart=0x0) returned 0x45 [0218.578] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\", nBufferLength=0x105, lpBuffer=0x19ecf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\", lpFilePart=0x0) returned 0x46 [0218.578] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\*", lpFindFileData=0x19ef40 | out: lpFindFileData=0x19ef40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1dc) returned 1 [0218.581] CoCreateGuid (in: pguid=0x19efd0 | out: pguid=0x19efd0*(Data1=0x2d4e3db4, Data2=0xb7cc, Data3=0x4bc3, Data4=([0]=0x82, [1]=0x28, [2]=0xe0, [3]=0xb9, [4]=0x5, [5]=0x20, [6]=0x75, [7]=0x36))) returned 0x0 [0218.581] CoCreateGuid (in: pguid=0x19ef00 | out: pguid=0x19ef00*(Data1=0xe77358, Data2=0x871e, Data3=0x4d9c, Data4=([0]=0xb9, [1]=0xa2, [2]=0xd7, [3]=0x9e, [4]=0x25, [5]=0xde, [6]=0x65, [7]=0xd3))) returned 0x0 [0218.581] send (s=0x2cc, buf=0x3393fe7*, len=171, flags=0) returned 171 [0218.582] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 128 [0218.630] ExpandEnvironmentStringsW (in: lpSrc="%appdata%", lpDst=0x19f0d4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x26 [0218.630] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\discord\\Local Storage\\leveldb", lpDst=0x19f0d4, nSize=0x64 | out: lpDst="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb") returned 0x44 [0218.630] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb", nBufferLength=0x105, lpBuffer=0x19ed4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb", lpFilePart=0x0) returned 0x43 [0218.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f200) returned 1 [0218.631] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb", nBufferLength=0x105, lpBuffer=0x19ed08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb", lpFilePart=0x0) returned 0x43 [0218.631] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", nBufferLength=0x105, lpBuffer=0x19ecdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", lpFilePart=0x0) returned 0x44 [0218.631] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\*.log", lpFindFileData=0x19ef28 | out: lpFindFileData=0x19ef28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1c4) returned 1 [0218.632] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb", nBufferLength=0x105, lpBuffer=0x19ed4c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb", lpFilePart=0x0) returned 0x43 [0218.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f200) returned 1 [0218.633] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb", nBufferLength=0x105, lpBuffer=0x19ed08, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb", lpFilePart=0x0) returned 0x43 [0218.633] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", nBufferLength=0x105, lpBuffer=0x19ecdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\", lpFilePart=0x0) returned 0x44 [0218.633] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\discord\\Local Storage\\leveldb\\*.ldb", lpFindFileData=0x19ef28 | out: lpFindFileData=0x19ef28*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0218.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f1c4) returned 1 [0218.638] CoCreateGuid (in: pguid=0x19efd0 | out: pguid=0x19efd0*(Data1=0x93701eb9, Data2=0x5f2c, Data3=0x4aec, Data4=([0]=0xba, [1]=0x28, [2]=0x85, [3]=0xd5, [4]=0x30, [5]=0x67, [6]=0xdb, [7]=0x1b))) returned 0x0 [0218.638] CoCreateGuid (in: pguid=0x19ef00 | out: pguid=0x19ef00*(Data1=0x8186ae24, Data2=0xa3da, Data3=0x438f, Data4=([0]=0x80, [1]=0xf0, [2]=0xdc, [3]=0xa9, [4]=0x87, [5]=0x61, [6]=0xb7, [7]=0x49))) returned 0x0 [0218.639] send (s=0x2cc, buf=0x3393fe7*, len=205, flags=0) returned 205 [0218.639] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 128 [0218.663] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\WOW6432Node\\Clients\\StartMenuInternet", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c8 | out: phkResult=0x19f2c8*=0x294) returned 0x0 [0218.664] RegQueryInfoKeyW (in: hKey=0x294, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19f2f0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19f2ec, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19f2f0*=0x1, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19f2ec*=0x1, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0218.665] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x0, lpName=0x23d6f10, lpcchName=0x19f30c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEXPLORE.EXE", lpcchName=0x19f30c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0218.665] RegOpenKeyExW (in: hKey=0x294, lpSubKey="IEXPLORE.EXE", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c8 | out: phkResult=0x19f2c8*=0x270) returned 0x0 [0218.665] RegQueryValueExW (in: hKey=0x270, lpValueName=0x0, lpReserved=0x0, lpType=0x19f2e8, lpData=0x0, lpcbData=0x19f2e4*=0x0 | out: lpType=0x19f2e8*=0x1, lpData=0x0, lpcbData=0x19f2e4*=0x24) returned 0x0 [0218.665] RegQueryValueExW (in: hKey=0x270, lpValueName=0x0, lpReserved=0x0, lpType=0x19f2e8, lpData=0x23d723c, lpcbData=0x19f2e4*=0x24 | out: lpType=0x19f2e8*=0x1, lpData="Internet Explorer", lpcbData=0x19f2e4*=0x24) returned 0x0 [0218.665] RegOpenKeyExW (in: hKey=0x270, lpSubKey="shell\\open\\command", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c8 | out: phkResult=0x19f2c8*=0x2d0) returned 0x0 [0218.665] RegQueryValueExW (in: hKey=0x2d0, lpValueName=0x0, lpReserved=0x0, lpType=0x19f2e8, lpData=0x0, lpcbData=0x19f2e4*=0x0 | out: lpType=0x19f2e8*=0x1, lpData=0x0, lpcbData=0x19f2e4*=0x60) returned 0x0 [0218.666] RegQueryValueExW (in: hKey=0x2d0, lpValueName=0x0, lpReserved=0x0, lpType=0x19f2e8, lpData=0x23d7424, lpcbData=0x19f2e4*=0x60 | out: lpType=0x19f2e8*=0x1, lpData="C:\\Program Files\\Internet Explorer\\iexplore.exe", lpcbData=0x19f2e4*=0x60) returned 0x0 [0218.666] GetFullPathNameW (in: lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe", nBufferLength=0x105, lpBuffer=0x19edc4, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\Internet Explorer\\iexplore.exe", lpFilePart=0x0) returned 0x2f [0218.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f224) returned 1 [0218.666] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), fInfoLevelId=0x0, lpFileInformation=0x19f2a0 | out: lpFileInformation=0x19f2a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33517c70, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x33517c70, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x33517c70, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc74c0)) returned 1 [0218.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f220) returned 1 [0218.668] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Program Files\\Internet Explorer\\iexplore.exe", lpdwHandle=0x19f314 | out: lpdwHandle=0x19f314) returned 0xba4 [0218.825] GetFileVersionInfoW (in: lptstrFilename="C:\\Program Files\\Internet Explorer\\iexplore.exe", dwHandle=0x0, dwLen=0xba4, lpData=0x23d75cc | out: lpData=0x23d75cc) returned 1 [0218.833] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19f2e8, puLen=0x19f2e4 | out: lplpBuffer=0x19f2e8*=0x23d7b98, puLen=0x19f2e4) returned 1 [0218.835] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x19f268, puLen=0x19f264 | out: lplpBuffer=0x19f268*=0x23d7684, puLen=0x19f264) returned 1 [0218.835] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x19f268, puLen=0x19f264 | out: lplpBuffer=0x19f268*=0x23d76d8, puLen=0x19f264) returned 1 [0218.835] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x19f268, puLen=0x19f264 | out: lplpBuffer=0x19f268*=0x23d771c, puLen=0x19f264) returned 1 [0218.835] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x19f268, puLen=0x19f264 | out: lplpBuffer=0x19f268*=0x23d778c, puLen=0x19f264) returned 1 [0218.835] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x19f268, puLen=0x19f264 | out: lplpBuffer=0x19f268*=0x23d77c4, puLen=0x19f264) returned 1 [0218.836] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x19f268, puLen=0x19f264 | out: lplpBuffer=0x19f268*=0x23d7848, puLen=0x19f264) returned 1 [0218.836] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x19f268, puLen=0x19f264 | out: lplpBuffer=0x19f268*=0x23d788c, puLen=0x19f264) returned 1 [0218.836] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x19f268, puLen=0x19f264 | out: lplpBuffer=0x19f268*=0x23d78d4, puLen=0x19f264) returned 1 [0218.836] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x19f268, puLen=0x19f264 | out: lplpBuffer=0x19f268*=0x0, puLen=0x19f264) returned 0 [0218.836] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x19f268, puLen=0x19f264 | out: lplpBuffer=0x19f268*=0x0, puLen=0x19f264) returned 0 [0218.836] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x19f268, puLen=0x19f264 | out: lplpBuffer=0x19f268*=0x0, puLen=0x19f264) returned 0 [0218.836] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x19f268, puLen=0x19f264 | out: lplpBuffer=0x19f268*=0x0, puLen=0x19f264) returned 0 [0218.836] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x19f25c, puLen=0x19f258 | out: lplpBuffer=0x19f25c*=0x23d7b98, puLen=0x19f258) returned 1 [0218.836] VerLanguageNameW (in: wLang=0x409, szLang=0x19efec, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0218.899] VerQueryValueW (in: pBlock=0x23d75cc, lpSubBlock="\\", lplpBuffer=0x19f26c, puLen=0x19f268 | out: lplpBuffer=0x19f26c*=0x23d75f4, puLen=0x19f268) returned 1 [0218.904] CoCreateGuid (in: pguid=0x19efd4 | out: pguid=0x19efd4*(Data1=0x3610589f, Data2=0x8bd4, Data3=0x4958, Data4=([0]=0xa7, [1]=0x17, [2]=0x2, [3]=0xc6, [4]=0x9c, [5]=0xf3, [6]=0x45, [7]=0x34))) returned 0x0 [0218.904] CoCreateGuid (in: pguid=0x19ef04 | out: pguid=0x19ef04*(Data1=0xdd519666, Data2=0x8eaa, Data3=0x4389, Data4=([0]=0xb4, [1]=0x54, [2]=0xc9, [3]=0x50, [4]=0x8e, [5]=0x45, [6]=0x48, [7]=0x19))) returned 0x0 [0218.926] send (s=0x2cc, buf=0x3393fe7*, len=306, flags=0) returned 306 [0218.927] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 128 [0218.983] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0218.983] GetKeyboardLayoutList (in: nBuff=1, lpList=0x23dd108 | out: lpList=0x23dd108) returned 1 [0218.999] CoCreateGuid (in: pguid=0x19efd4 | out: pguid=0x19efd4*(Data1=0xdf96ed5c, Data2=0x14b5, Data3=0x4e45, Data4=([0]=0x95, [1]=0x5e, [2]=0x24, [3]=0x75, [4]=0x5e, [5]=0xc2, [6]=0xc3, [7]=0x51))) returned 0x0 [0218.999] CoCreateGuid (in: pguid=0x19ef04 | out: pguid=0x19ef04*(Data1=0x908c1f2c, Data2=0x8d0c, Data3=0x4dc1, Data4=([0]=0xbb, [1]=0xe7, [2]=0x2e, [3]=0xd2, [4]=0xe, [5]=0xc5, [6]=0xc3, [7]=0x35))) returned 0x0 [0218.999] send (s=0x2cc, buf=0x22f8843*, len=205, flags=0) returned 205 [0219.000] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 125 [0219.035] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f288 | out: ppv=0x19f288*=0x4d0cbc) returned 0x0 [0219.035] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f280 | out: pAptType=0x19f280*=1) returned 0x0 [0219.035] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x0) returned 0x80004002 [0219.035] IUnknown:Release (This=0x4d0cbc) returned 0x0 [0219.036] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ebf0 | out: ppv=0x19ebf0*=0x544db0) returned 0x0 [0219.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x544db0, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ee08 | out: ppvObject=0x19ee08*=0x0) returned 0x80004002 [0219.037] WbemDefPath:IClassFactory:CreateInstance (in: This=0x544db0, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee1c | out: ppvObject=0x19ee1c*=0x5247a0) returned 0x0 [0219.037] WbemDefPath:IUnknown:Release (This=0x544db0) returned 0x0 [0219.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x5247a0) returned 0x0 [0219.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e9f8 | out: ppvObject=0x19e9f8*=0x0) returned 0x80004002 [0219.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e5ec | out: ppvObject=0x19e5ec*=0x0) returned 0x80004002 [0219.037] WbemDefPath:IUnknown:AddRef (This=0x5247a0) returned 0x3 [0219.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e354 | out: ppvObject=0x19e354*=0x0) returned 0x80004002 [0219.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e304 | out: ppvObject=0x19e304*=0x0) returned 0x80004002 [0219.037] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e310 | out: ppvObject=0x19e310*=0x574e90) returned 0x0 [0219.038] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x574e90, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e318 | out: pCid=0x19e318*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.038] WbemDefPath:IUnknown:Release (This=0x574e90) returned 0x3 [0219.038] CoGetContextToken (in: pToken=0x19e370 | out: pToken=0x19e370) returned 0x0 [0219.038] CoGetContextToken (in: pToken=0x19e778 | out: pToken=0x19e778) returned 0x0 [0219.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x0) returned 0x80004002 [0219.038] WbemDefPath:IUnknown:Release (This=0x5247a0) returned 0x2 [0219.038] WbemDefPath:IUnknown:Release (This=0x5247a0) returned 0x1 [0219.038] CoGetContextToken (in: pToken=0x19f100 | out: pToken=0x19f100) returned 0x0 [0219.038] CoGetContextToken (in: pToken=0x19f060 | out: pToken=0x19f060) returned 0x0 [0219.038] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x19f130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f12c | out: ppvObject=0x19f12c*=0x5247a0) returned 0x0 [0219.038] WbemDefPath:IUnknown:AddRef (This=0x5247a0) returned 0x3 [0219.038] WbemDefPath:IUnknown:Release (This=0x5247a0) returned 0x2 [0219.038] WbemDefPath:IWbemPath:SetText (This=0x5247a0, uMode=0x4, pszPath="ROOT\\SecurityCenter") returned 0x0 [0219.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5247a0, puCount=0x19f2b0 | out: puCount=0x19f2b0*=0x2) returned 0x0 [0219.038] WbemDefPath:IWbemPath:GetText (in: This=0x5247a0, lFlags=4, puBuffLength=0x19f2ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f2ac*=0x18, pszText=0x0) returned 0x0 [0219.038] WbemDefPath:IWbemPath:GetText (in: This=0x5247a0, lFlags=4, puBuffLength=0x19f2ac*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19f2ac*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0219.038] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5247a0, puCount=0x19f29c | out: puCount=0x19f29c*=0x2) returned 0x0 [0219.039] WbemDefPath:IWbemPath:GetText (in: This=0x5247a0, lFlags=4, puBuffLength=0x19f298*=0x0, pszText=0x0 | out: puBuffLength=0x19f298*=0x18, pszText=0x0) returned 0x0 [0219.039] WbemDefPath:IWbemPath:GetText (in: This=0x5247a0, lFlags=4, puBuffLength=0x19f298*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19f298*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0219.039] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f230 | out: ppv=0x19f230*=0x4d0cbc) returned 0x0 [0219.039] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f228 | out: pAptType=0x19f228*=1) returned 0x0 [0219.039] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f22c | out: ppvObject=0x19f22c*=0x0) returned 0x80004002 [0219.039] IUnknown:Release (This=0x4d0cbc) returned 0x0 [0219.040] CoGetClassObject (in: rclsid=0x55079c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ee50 | out: ppv=0x19ee50*=0x574860) returned 0x0 [0219.040] WbemLocator:IUnknown:QueryInterface (in: This=0x574860, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19f068 | out: ppvObject=0x19f068*=0x0) returned 0x80004002 [0219.040] WbemLocator:IClassFactory:CreateInstance (in: This=0x574860, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f07c | out: ppvObject=0x19f07c*=0x544d60) returned 0x0 [0219.040] WbemLocator:IUnknown:Release (This=0x574860) returned 0x0 [0219.040] WbemLocator:IUnknown:QueryInterface (in: This=0x544d60, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec9c | out: ppvObject=0x19ec9c*=0x544d60) returned 0x0 [0219.040] WbemLocator:IUnknown:QueryInterface (in: This=0x544d60, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec58 | out: ppvObject=0x19ec58*=0x0) returned 0x80004002 [0219.040] WbemLocator:IUnknown:QueryInterface (in: This=0x544d60, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002 [0219.040] WbemLocator:IUnknown:AddRef (This=0x544d60) returned 0x3 [0219.040] WbemLocator:IUnknown:QueryInterface (in: This=0x544d60, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e5b4 | out: ppvObject=0x19e5b4*=0x0) returned 0x80004002 [0219.040] WbemLocator:IUnknown:QueryInterface (in: This=0x544d60, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e564 | out: ppvObject=0x19e564*=0x0) returned 0x80004002 [0219.041] WbemLocator:IUnknown:QueryInterface (in: This=0x544d60, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e570 | out: ppvObject=0x19e570*=0x0) returned 0x80004002 [0219.041] CoGetContextToken (in: pToken=0x19e5d0 | out: pToken=0x19e5d0) returned 0x0 [0219.041] CoGetObjectContext (in: riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x574864 | out: ppv=0x574864*=0x4d0cb0) returned 0x0 [0219.041] CoGetContextToken (in: pToken=0x19e9d8 | out: pToken=0x19e9d8) returned 0x0 [0219.041] WbemLocator:IUnknown:QueryInterface (in: This=0x544d60, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea68 | out: ppvObject=0x19ea68*=0x0) returned 0x80004002 [0219.041] WbemLocator:IUnknown:Release (This=0x544d60) returned 0x2 [0219.041] WbemLocator:IUnknown:Release (This=0x544d60) returned 0x1 [0219.041] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0219.041] CoGetContextToken (in: pToken=0x19efa8 | out: pToken=0x19efa8) returned 0x0 [0219.041] WbemLocator:IUnknown:QueryInterface (in: This=0x544d60, riid=0x19f078*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19f074 | out: ppvObject=0x19f074*=0x544d60) returned 0x0 [0219.041] WbemLocator:IUnknown:AddRef (This=0x544d60) returned 0x3 [0219.041] WbemLocator:IUnknown:Release (This=0x544d60) returned 0x2 [0219.041] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5247a0, puCount=0x19f20c | out: puCount=0x19f20c*=0x2) returned 0x0 [0219.041] WbemDefPath:IWbemPath:GetText (in: This=0x5247a0, lFlags=8, puBuffLength=0x19f208*=0x0, pszText=0x0 | out: puBuffLength=0x19f208*=0x18, pszText=0x0) returned 0x0 [0219.041] WbemDefPath:IWbemPath:GetText (in: This=0x5247a0, lFlags=8, puBuffLength=0x19f208*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19f208*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0219.041] CoCreateInstance (in: rclsid=0x6ce21284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ce212e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x19f0d0 | out: ppv=0x19f0d0*=0x544ca0) returned 0x0 [0219.042] WbemLocator:IWbemLocator:ConnectServer (in: This=0x544ca0, strNetworkResource="\\\\.\\ROOT\\SecurityCenter", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x19f178 | out: ppNamespace=0x19f178*=0x579178) returned 0x0 [0219.071] WbemLocator:IUnknown:QueryInterface (in: This=0x579178, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f000 | out: ppvObject=0x19f000*=0x4e6c9c) returned 0x0 [0219.071] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4e6c9c, pProxy=0x579178, pAuthnSvc=0x19f050, pAuthzSvc=0x19f04c, pServerPrincName=0x19f044, pAuthnLevel=0x19f048, pImpLevel=0x19f038, pAuthInfo=0x19f03c, pCapabilites=0x19f040 | out: pAuthnSvc=0x19f050*=0xa, pAuthzSvc=0x19f04c*=0x0, pServerPrincName=0x19f044, pAuthnLevel=0x19f048*=0x6, pImpLevel=0x19f038*=0x2, pAuthInfo=0x19f03c, pCapabilites=0x19f040*=0x1) returned 0x0 [0219.071] WbemLocator:IUnknown:Release (This=0x4e6c9c) returned 0x1 [0219.071] WbemLocator:IUnknown:QueryInterface (in: This=0x579178, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eff4 | out: ppvObject=0x19eff4*=0x4e6cc0) returned 0x0 [0219.071] WbemLocator:IUnknown:QueryInterface (in: This=0x579178, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eff0 | out: ppvObject=0x19eff0*=0x4e6c9c) returned 0x0 [0219.071] WbemLocator:IClientSecurity:SetBlanket (This=0x4e6c9c, pProxy=0x579178, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.072] WbemLocator:IUnknown:Release (This=0x4e6c9c) returned 0x2 [0219.072] WbemLocator:IUnknown:Release (This=0x4e6cc0) returned 0x1 [0219.072] CoTaskMemFree (pv=0x550a30) [0219.072] WbemLocator:IUnknown:Release (This=0x544ca0) returned 0x0 [0219.072] WbemLocator:IUnknown:QueryInterface (in: This=0x579178, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebf0 | out: ppvObject=0x19ebf0*=0x4e6cc0) returned 0x0 [0219.072] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6cc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ebac | out: ppvObject=0x19ebac*=0x0) returned 0x80004002 [0219.073] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6cc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e9cc | out: ppvObject=0x19e9cc*=0x0) returned 0x80004002 [0219.073] WbemLocator:IUnknown:QueryInterface (in: This=0x579178, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e7a4 | out: ppvObject=0x19e7a4*=0x0) returned 0x80004002 [0219.073] WbemLocator:IUnknown:AddRef (This=0x4e6cc0) returned 0x3 [0219.073] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6cc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e50c | out: ppvObject=0x19e50c*=0x0) returned 0x80004002 [0219.074] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6cc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e4bc | out: ppvObject=0x19e4bc*=0x0) returned 0x80004002 [0219.074] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6cc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e4c8 | out: ppvObject=0x19e4c8*=0x4e6c1c) returned 0x0 [0219.074] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6c1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e4d0 | out: pCid=0x19e4d0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.074] WbemLocator:IUnknown:Release (This=0x4e6c1c) returned 0x3 [0219.074] CoGetContextToken (in: pToken=0x19e528 | out: pToken=0x19e528) returned 0x0 [0219.074] CoGetContextToken (in: pToken=0x19e930 | out: pToken=0x19e930) returned 0x0 [0219.074] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6cc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9c0 | out: ppvObject=0x19e9c0*=0x4e6ca4) returned 0x0 [0219.074] WbemLocator:IRpcOptions:Query (in: This=0x4e6ca4, pPrx=0x4e6cc0, dwProperty=2, pdwValue=0x19e9e8 | out: pdwValue=0x19e9e8) returned 0x80004002 [0219.074] WbemLocator:IUnknown:Release (This=0x4e6ca4) returned 0x3 [0219.074] WbemLocator:IUnknown:Release (This=0x4e6cc0) returned 0x2 [0219.074] CoGetContextToken (in: pToken=0x19ef00 | out: pToken=0x19ef00) returned 0x0 [0219.074] CoGetContextToken (in: pToken=0x19ee60 | out: pToken=0x19ee60) returned 0x0 [0219.074] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6cc0, riid=0x19ef30*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19ef2c | out: ppvObject=0x19ef2c*=0x579178) returned 0x0 [0219.074] WbemLocator:IUnknown:AddRef (This=0x579178) returned 0x4 [0219.074] WbemLocator:IUnknown:Release (This=0x579178) returned 0x3 [0219.074] WbemLocator:IUnknown:Release (This=0x579178) returned 0x2 [0219.075] SysStringLen (param_1=0x0) returned 0x0 [0219.075] CoGetContextToken (in: pToken=0x19ef10 | out: pToken=0x19ef10) returned 0x0 [0219.075] WbemLocator:IUnknown:AddRef (This=0x4e6cc0) returned 0x3 [0219.075] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6cc0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eda4 | out: ppvObject=0x19eda4*=0x4e6cc0) returned 0x0 [0219.075] WbemLocator:IUnknown:Release (This=0x4e6cc0) returned 0x3 [0219.075] WbemLocator:IUnknown:Release (This=0x4e6cc0) returned 0x2 [0219.075] CoGetContextToken (in: pToken=0x19f008 | out: pToken=0x19f008) returned 0x0 [0219.075] WbemLocator:IUnknown:AddRef (This=0x579178) returned 0x3 [0219.075] IWbemServices:ExecQuery (in: This=0x579178, strQueryLanguage="WQL", strQuery="SELECT * FROM AntivirusProduct", lFlags=16, pCtx=0x0, ppEnum=0x19f214 | out: ppEnum=0x19f214*=0x58cdc0) returned 0x0 [0219.077] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f078 | out: ppvObject=0x19f078*=0x58cdc4) returned 0x0 [0219.077] IClientSecurity:QueryBlanket (in: This=0x58cdc4, pProxy=0x58cdc0, pAuthnSvc=0x19f0c8, pAuthzSvc=0x19f0c4, pServerPrincName=0x19f0bc, pAuthnLevel=0x19f0c0, pImpLevel=0x19f0b0, pAuthInfo=0x19f0b4, pCapabilites=0x19f0b8 | out: pAuthnSvc=0x19f0c8*=0xa, pAuthzSvc=0x19f0c4*=0x0, pServerPrincName=0x19f0bc, pAuthnLevel=0x19f0c0*=0x6, pImpLevel=0x19f0b0*=0x2, pAuthInfo=0x19f0b4, pCapabilites=0x19f0b8*=0x1) returned 0x0 [0219.077] IUnknown:Release (This=0x58cdc4) returned 0x1 [0219.077] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f06c | out: ppvObject=0x19f06c*=0x4e6bc0) returned 0x0 [0219.077] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f068 | out: ppvObject=0x19f068*=0x58cdc4) returned 0x0 [0219.077] IClientSecurity:SetBlanket (This=0x58cdc4, pProxy=0x58cdc0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.108] IUnknown:Release (This=0x58cdc4) returned 0x2 [0219.108] WbemLocator:IUnknown:Release (This=0x4e6bc0) returned 0x1 [0219.108] CoTaskMemFree (pv=0x525578) [0219.109] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec64 | out: ppvObject=0x19ec64*=0x4e6bc0) returned 0x0 [0219.109] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec20 | out: ppvObject=0x19ec20*=0x0) returned 0x80004002 [0219.109] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x0) returned 0x80004002 [0219.110] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e814 | out: ppvObject=0x19e814*=0x0) returned 0x80004002 [0219.110] WbemLocator:IUnknown:AddRef (This=0x4e6bc0) returned 0x3 [0219.110] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e57c | out: ppvObject=0x19e57c*=0x0) returned 0x80004002 [0219.111] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e52c | out: ppvObject=0x19e52c*=0x0) returned 0x80004002 [0219.111] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e538 | out: ppvObject=0x19e538*=0x4e6b1c) returned 0x0 [0219.111] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6b1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e540 | out: pCid=0x19e540*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.111] WbemLocator:IUnknown:Release (This=0x4e6b1c) returned 0x3 [0219.111] CoGetContextToken (in: pToken=0x19e598 | out: pToken=0x19e598) returned 0x0 [0219.111] CoGetContextToken (in: pToken=0x19e9a0 | out: pToken=0x19e9a0) returned 0x0 [0219.111] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea30 | out: ppvObject=0x19ea30*=0x4e6ba4) returned 0x0 [0219.111] WbemLocator:IRpcOptions:Query (in: This=0x4e6ba4, pPrx=0x4e6bc0, dwProperty=2, pdwValue=0x19ea58 | out: pdwValue=0x19ea58) returned 0x80004002 [0219.111] WbemLocator:IUnknown:Release (This=0x4e6ba4) returned 0x3 [0219.111] WbemLocator:IUnknown:Release (This=0x4e6bc0) returned 0x2 [0219.111] CoGetContextToken (in: pToken=0x19ef78 | out: pToken=0x19ef78) returned 0x0 [0219.111] CoGetContextToken (in: pToken=0x19eed8 | out: pToken=0x19eed8) returned 0x0 [0219.111] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x19efa8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19efa4 | out: ppvObject=0x19efa4*=0x58cdc0) returned 0x0 [0219.111] IUnknown:AddRef (This=0x58cdc0) returned 0x4 [0219.111] IUnknown:Release (This=0x58cdc0) returned 0x3 [0219.111] IUnknown:Release (This=0x58cdc0) returned 0x2 [0219.112] WbemLocator:IUnknown:Release (This=0x579178) returned 0x2 [0219.112] SysStringLen (param_1=0x0) returned 0x0 [0219.112] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5247a0, puCount=0x19f260 | out: puCount=0x19f260*=0x2) returned 0x0 [0219.112] WbemDefPath:IWbemPath:GetText (in: This=0x5247a0, lFlags=4, puBuffLength=0x19f25c*=0x0, pszText=0x0 | out: puBuffLength=0x19f25c*=0x18, pszText=0x0) returned 0x0 [0219.112] WbemDefPath:IWbemPath:GetText (in: This=0x5247a0, lFlags=4, puBuffLength=0x19f25c*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19f25c*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0219.112] CoGetContextToken (in: pToken=0x19f0b0 | out: pToken=0x19f0b0) returned 0x0 [0219.112] IUnknown:AddRef (This=0x58cdc0) returned 0x3 [0219.112] IEnumWbemClassObject:Clone (in: This=0x58cdc0, ppEnum=0x19f26c | out: ppEnum=0x19f26c*=0x58ccf8) returned 0x0 [0219.113] IUnknown:QueryInterface (in: This=0x58ccf8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f130 | out: ppvObject=0x19f130*=0x58ccfc) returned 0x0 [0219.113] IClientSecurity:QueryBlanket (in: This=0x58ccfc, pProxy=0x58ccf8, pAuthnSvc=0x19f180, pAuthzSvc=0x19f17c, pServerPrincName=0x19f174, pAuthnLevel=0x19f178, pImpLevel=0x19f168, pAuthInfo=0x19f16c, pCapabilites=0x19f170 | out: pAuthnSvc=0x19f180*=0xa, pAuthzSvc=0x19f17c*=0x0, pServerPrincName=0x19f174, pAuthnLevel=0x19f178*=0x6, pImpLevel=0x19f168*=0x2, pAuthInfo=0x19f16c, pCapabilites=0x19f170*=0x1) returned 0x0 [0219.113] IUnknown:Release (This=0x58ccfc) returned 0x1 [0219.113] IUnknown:QueryInterface (in: This=0x58ccf8, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f124 | out: ppvObject=0x19f124*=0x4e6fc0) returned 0x0 [0219.114] IUnknown:QueryInterface (in: This=0x58ccf8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f120 | out: ppvObject=0x19f120*=0x58ccfc) returned 0x0 [0219.114] IClientSecurity:SetBlanket (This=0x58ccfc, pProxy=0x58ccf8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.116] IUnknown:Release (This=0x58ccfc) returned 0x2 [0219.117] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0219.117] CoTaskMemFree (pv=0x50f770) [0219.117] IUnknown:QueryInterface (in: This=0x58ccf8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x4e6fc0) returned 0x0 [0219.117] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ecc8 | out: ppvObject=0x19ecc8*=0x0) returned 0x80004002 [0219.117] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002 [0219.118] IUnknown:QueryInterface (in: This=0x58ccf8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e8bc | out: ppvObject=0x19e8bc*=0x0) returned 0x80004002 [0219.118] WbemLocator:IUnknown:AddRef (This=0x4e6fc0) returned 0x3 [0219.118] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e624 | out: ppvObject=0x19e624*=0x0) returned 0x80004002 [0219.118] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e5d4 | out: ppvObject=0x19e5d4*=0x0) returned 0x80004002 [0219.118] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5e0 | out: ppvObject=0x19e5e0*=0x4e6f1c) returned 0x0 [0219.118] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6f1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e5e8 | out: pCid=0x19e5e8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.118] WbemLocator:IUnknown:Release (This=0x4e6f1c) returned 0x3 [0219.118] CoGetContextToken (in: pToken=0x19e640 | out: pToken=0x19e640) returned 0x0 [0219.119] CoGetContextToken (in: pToken=0x19ea48 | out: pToken=0x19ea48) returned 0x0 [0219.119] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ead8 | out: ppvObject=0x19ead8*=0x4e6fa4) returned 0x0 [0219.119] WbemLocator:IRpcOptions:Query (in: This=0x4e6fa4, pPrx=0x4e6fc0, dwProperty=2, pdwValue=0x19eb00 | out: pdwValue=0x19eb00) returned 0x80004002 [0219.119] WbemLocator:IUnknown:Release (This=0x4e6fa4) returned 0x3 [0219.119] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x2 [0219.119] CoGetContextToken (in: pToken=0x19f020 | out: pToken=0x19f020) returned 0x0 [0219.119] CoGetContextToken (in: pToken=0x19ef80 | out: pToken=0x19ef80) returned 0x0 [0219.119] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x19f050*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f04c | out: ppvObject=0x19f04c*=0x58ccf8) returned 0x0 [0219.119] IUnknown:AddRef (This=0x58ccf8) returned 0x4 [0219.119] IUnknown:Release (This=0x58ccf8) returned 0x3 [0219.119] IUnknown:Release (This=0x58ccf8) returned 0x2 [0219.119] IUnknown:Release (This=0x58cdc0) returned 0x2 [0219.119] SysStringLen (param_1=0x0) returned 0x0 [0219.119] IEnumWbemClassObject:Reset (This=0x58ccf8) returned 0x0 [0219.120] CoTaskMemAlloc (cb=0x4) returned 0x5553aa0 [0219.120] IEnumWbemClassObject:Next (in: This=0x58ccf8, lTimeout=-1, uCount=0x1, apObjects=0x5553aa0, puReturned=0x23df7dc | out: apObjects=0x5553aa0*=0x0, puReturned=0x23df7dc*=0x0) returned 0x1 [0219.121] CoTaskMemFree (pv=0x5553aa0) [0219.121] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0219.121] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0219.121] IUnknown:Release (This=0x58ccf8) returned 0x0 [0219.122] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0219.122] WbemLocator:IUnknown:Release (This=0x4e6bc0) returned 0x1 [0219.122] IUnknown:Release (This=0x58cdc0) returned 0x0 [0219.123] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f288 | out: ppv=0x19f288*=0x4d0cbc) returned 0x0 [0219.123] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f280 | out: pAptType=0x19f280*=1) returned 0x0 [0219.123] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x0) returned 0x80004002 [0219.123] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.124] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ebf0 | out: ppv=0x19ebf0*=0x544d70) returned 0x0 [0219.124] WbemDefPath:IUnknown:QueryInterface (in: This=0x544d70, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ee08 | out: ppvObject=0x19ee08*=0x0) returned 0x80004002 [0219.125] WbemDefPath:IClassFactory:CreateInstance (in: This=0x544d70, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee1c | out: ppvObject=0x19ee1c*=0x524260) returned 0x0 [0219.125] WbemDefPath:IUnknown:Release (This=0x544d70) returned 0x0 [0219.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x524260) returned 0x0 [0219.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e9f8 | out: ppvObject=0x19e9f8*=0x0) returned 0x80004002 [0219.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e5ec | out: ppvObject=0x19e5ec*=0x0) returned 0x80004002 [0219.125] WbemDefPath:IUnknown:AddRef (This=0x524260) returned 0x3 [0219.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e354 | out: ppvObject=0x19e354*=0x0) returned 0x80004002 [0219.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e304 | out: ppvObject=0x19e304*=0x0) returned 0x80004002 [0219.125] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e310 | out: ppvObject=0x19e310*=0x548778) returned 0x0 [0219.125] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x548778, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e318 | out: pCid=0x19e318*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.125] WbemDefPath:IUnknown:Release (This=0x548778) returned 0x3 [0219.125] CoGetContextToken (in: pToken=0x19e370 | out: pToken=0x19e370) returned 0x0 [0219.125] CoGetContextToken (in: pToken=0x19e778 | out: pToken=0x19e778) returned 0x0 [0219.126] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x0) returned 0x80004002 [0219.126] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x2 [0219.126] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x1 [0219.126] CoGetContextToken (in: pToken=0x19f100 | out: pToken=0x19f100) returned 0x0 [0219.126] CoGetContextToken (in: pToken=0x19f060 | out: pToken=0x19f060) returned 0x0 [0219.126] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x19f130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f12c | out: ppvObject=0x19f12c*=0x524260) returned 0x0 [0219.126] WbemDefPath:IUnknown:AddRef (This=0x524260) returned 0x3 [0219.126] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x2 [0219.126] WbemDefPath:IWbemPath:SetText (This=0x524260, uMode=0x4, pszPath="ROOT\\SecurityCenter") returned 0x0 [0219.126] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524260, puCount=0x19f2b0 | out: puCount=0x19f2b0*=0x2) returned 0x0 [0219.126] WbemDefPath:IWbemPath:GetText (in: This=0x524260, lFlags=4, puBuffLength=0x19f2ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f2ac*=0x18, pszText=0x0) returned 0x0 [0219.126] WbemDefPath:IWbemPath:GetText (in: This=0x524260, lFlags=4, puBuffLength=0x19f2ac*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19f2ac*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0219.126] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524260, puCount=0x19f29c | out: puCount=0x19f29c*=0x2) returned 0x0 [0219.126] WbemDefPath:IWbemPath:GetText (in: This=0x524260, lFlags=4, puBuffLength=0x19f298*=0x0, pszText=0x0 | out: puBuffLength=0x19f298*=0x18, pszText=0x0) returned 0x0 [0219.126] WbemDefPath:IWbemPath:GetText (in: This=0x524260, lFlags=4, puBuffLength=0x19f298*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19f298*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0219.126] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f230 | out: ppv=0x19f230*=0x4d0cbc) returned 0x0 [0219.127] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f228 | out: pAptType=0x19f228*=1) returned 0x0 [0219.127] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f22c | out: ppvObject=0x19f22c*=0x0) returned 0x80004002 [0219.127] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.127] CoGetClassObject (in: rclsid=0x55079c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ee50 | out: ppv=0x19ee50*=0x548748) returned 0x0 [0219.127] WbemLocator:IUnknown:QueryInterface (in: This=0x548748, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19f068 | out: ppvObject=0x19f068*=0x0) returned 0x80004002 [0219.128] WbemLocator:IClassFactory:CreateInstance (in: This=0x548748, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f07c | out: ppvObject=0x19f07c*=0x544d70) returned 0x0 [0219.128] WbemLocator:IUnknown:Release (This=0x548748) returned 0x0 [0219.128] WbemLocator:IUnknown:QueryInterface (in: This=0x544d70, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec9c | out: ppvObject=0x19ec9c*=0x544d70) returned 0x0 [0219.128] WbemLocator:IUnknown:QueryInterface (in: This=0x544d70, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec58 | out: ppvObject=0x19ec58*=0x0) returned 0x80004002 [0219.128] WbemLocator:IUnknown:QueryInterface (in: This=0x544d70, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002 [0219.128] WbemLocator:IUnknown:AddRef (This=0x544d70) returned 0x3 [0219.128] WbemLocator:IUnknown:QueryInterface (in: This=0x544d70, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e5b4 | out: ppvObject=0x19e5b4*=0x0) returned 0x80004002 [0219.128] WbemLocator:IUnknown:QueryInterface (in: This=0x544d70, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e564 | out: ppvObject=0x19e564*=0x0) returned 0x80004002 [0219.128] WbemLocator:IUnknown:QueryInterface (in: This=0x544d70, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e570 | out: ppvObject=0x19e570*=0x0) returned 0x80004002 [0219.128] CoGetContextToken (in: pToken=0x19e5d0 | out: pToken=0x19e5d0) returned 0x0 [0219.128] CoGetContextToken (in: pToken=0x19e9d8 | out: pToken=0x19e9d8) returned 0x0 [0219.128] WbemLocator:IUnknown:QueryInterface (in: This=0x544d70, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea68 | out: ppvObject=0x19ea68*=0x0) returned 0x80004002 [0219.128] WbemLocator:IUnknown:Release (This=0x544d70) returned 0x2 [0219.128] WbemLocator:IUnknown:Release (This=0x544d70) returned 0x1 [0219.129] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0219.129] CoGetContextToken (in: pToken=0x19efa8 | out: pToken=0x19efa8) returned 0x0 [0219.129] WbemLocator:IUnknown:QueryInterface (in: This=0x544d70, riid=0x19f078*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19f074 | out: ppvObject=0x19f074*=0x544d70) returned 0x0 [0219.129] WbemLocator:IUnknown:AddRef (This=0x544d70) returned 0x3 [0219.129] WbemLocator:IUnknown:Release (This=0x544d70) returned 0x2 [0219.131] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524260, puCount=0x19f20c | out: puCount=0x19f20c*=0x2) returned 0x0 [0219.131] WbemDefPath:IWbemPath:GetText (in: This=0x524260, lFlags=8, puBuffLength=0x19f208*=0x0, pszText=0x0 | out: puBuffLength=0x19f208*=0x18, pszText=0x0) returned 0x0 [0219.131] WbemDefPath:IWbemPath:GetText (in: This=0x524260, lFlags=8, puBuffLength=0x19f208*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19f208*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0219.131] CoCreateInstance (in: rclsid=0x6ce21284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ce212e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x19f0d0 | out: ppv=0x19f0d0*=0x544ca0) returned 0x0 [0219.131] WbemLocator:IWbemLocator:ConnectServer (in: This=0x544ca0, strNetworkResource="\\\\.\\ROOT\\SecurityCenter", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x19f178 | out: ppNamespace=0x19f178*=0x579308) returned 0x0 [0219.156] WbemLocator:IUnknown:QueryInterface (in: This=0x579308, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f000 | out: ppvObject=0x19f000*=0x4e6b9c) returned 0x0 [0219.156] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4e6b9c, pProxy=0x579308, pAuthnSvc=0x19f050, pAuthzSvc=0x19f04c, pServerPrincName=0x19f044, pAuthnLevel=0x19f048, pImpLevel=0x19f038, pAuthInfo=0x19f03c, pCapabilites=0x19f040 | out: pAuthnSvc=0x19f050*=0xa, pAuthzSvc=0x19f04c*=0x0, pServerPrincName=0x19f044, pAuthnLevel=0x19f048*=0x6, pImpLevel=0x19f038*=0x2, pAuthInfo=0x19f03c, pCapabilites=0x19f040*=0x1) returned 0x0 [0219.156] WbemLocator:IUnknown:Release (This=0x4e6b9c) returned 0x1 [0219.156] WbemLocator:IUnknown:QueryInterface (in: This=0x579308, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eff4 | out: ppvObject=0x19eff4*=0x4e6bc0) returned 0x0 [0219.156] WbemLocator:IUnknown:QueryInterface (in: This=0x579308, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eff0 | out: ppvObject=0x19eff0*=0x4e6b9c) returned 0x0 [0219.157] WbemLocator:IClientSecurity:SetBlanket (This=0x4e6b9c, pProxy=0x579308, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.157] WbemLocator:IUnknown:Release (This=0x4e6b9c) returned 0x2 [0219.157] WbemLocator:IUnknown:Release (This=0x4e6bc0) returned 0x1 [0219.157] CoTaskMemFree (pv=0x50fa70) [0219.157] WbemLocator:IUnknown:Release (This=0x544ca0) returned 0x0 [0219.157] WbemLocator:IUnknown:QueryInterface (in: This=0x579308, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebf0 | out: ppvObject=0x19ebf0*=0x4e6bc0) returned 0x0 [0219.157] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ebac | out: ppvObject=0x19ebac*=0x0) returned 0x80004002 [0219.159] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e9cc | out: ppvObject=0x19e9cc*=0x0) returned 0x80004002 [0219.159] WbemLocator:IUnknown:QueryInterface (in: This=0x579308, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e7a4 | out: ppvObject=0x19e7a4*=0x0) returned 0x80004002 [0219.162] WbemLocator:IUnknown:AddRef (This=0x4e6bc0) returned 0x3 [0219.162] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e50c | out: ppvObject=0x19e50c*=0x0) returned 0x80004002 [0219.162] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e4bc | out: ppvObject=0x19e4bc*=0x0) returned 0x80004002 [0219.163] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e4c8 | out: ppvObject=0x19e4c8*=0x4e6b1c) returned 0x0 [0219.163] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6b1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e4d0 | out: pCid=0x19e4d0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.163] WbemLocator:IUnknown:Release (This=0x4e6b1c) returned 0x3 [0219.163] CoGetContextToken (in: pToken=0x19e528 | out: pToken=0x19e528) returned 0x0 [0219.163] CoGetContextToken (in: pToken=0x19e930 | out: pToken=0x19e930) returned 0x0 [0219.163] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9c0 | out: ppvObject=0x19e9c0*=0x4e6ba4) returned 0x0 [0219.163] WbemLocator:IRpcOptions:Query (in: This=0x4e6ba4, pPrx=0x4e6bc0, dwProperty=2, pdwValue=0x19e9e8 | out: pdwValue=0x19e9e8) returned 0x80004002 [0219.163] WbemLocator:IUnknown:Release (This=0x4e6ba4) returned 0x3 [0219.163] WbemLocator:IUnknown:Release (This=0x4e6bc0) returned 0x2 [0219.163] CoGetContextToken (in: pToken=0x19ef00 | out: pToken=0x19ef00) returned 0x0 [0219.163] CoGetContextToken (in: pToken=0x19ee60 | out: pToken=0x19ee60) returned 0x0 [0219.163] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x19ef30*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19ef2c | out: ppvObject=0x19ef2c*=0x579308) returned 0x0 [0219.164] WbemLocator:IUnknown:AddRef (This=0x579308) returned 0x4 [0219.164] WbemLocator:IUnknown:Release (This=0x579308) returned 0x3 [0219.164] WbemLocator:IUnknown:Release (This=0x579308) returned 0x2 [0219.164] SysStringLen (param_1=0x0) returned 0x0 [0219.164] CoGetContextToken (in: pToken=0x19ef10 | out: pToken=0x19ef10) returned 0x0 [0219.164] WbemLocator:IUnknown:AddRef (This=0x4e6bc0) returned 0x3 [0219.164] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6bc0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eda4 | out: ppvObject=0x19eda4*=0x4e6bc0) returned 0x0 [0219.164] WbemLocator:IUnknown:Release (This=0x4e6bc0) returned 0x3 [0219.164] WbemLocator:IUnknown:Release (This=0x4e6bc0) returned 0x2 [0219.164] CoGetContextToken (in: pToken=0x19f000 | out: pToken=0x19f000) returned 0x0 [0219.164] WbemLocator:IUnknown:AddRef (This=0x579308) returned 0x3 [0219.164] IWbemServices:ExecQuery (in: This=0x579308, strQueryLanguage="WQL", strQuery="SELECT * FROM AntiSpyWareProduct", lFlags=16, pCtx=0x0, ppEnum=0x19f214 | out: ppEnum=0x19f214*=0x58d018) returned 0x0 [0219.170] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f074 | out: ppvObject=0x19f074*=0x58d01c) returned 0x0 [0219.171] IClientSecurity:QueryBlanket (in: This=0x58d01c, pProxy=0x58d018, pAuthnSvc=0x19f0c4, pAuthzSvc=0x19f0c0, pServerPrincName=0x19f0b8, pAuthnLevel=0x19f0bc, pImpLevel=0x19f0ac, pAuthInfo=0x19f0b0, pCapabilites=0x19f0b4 | out: pAuthnSvc=0x19f0c4*=0xa, pAuthzSvc=0x19f0c0*=0x0, pServerPrincName=0x19f0b8, pAuthnLevel=0x19f0bc*=0x6, pImpLevel=0x19f0ac*=0x2, pAuthInfo=0x19f0b0, pCapabilites=0x19f0b4*=0x1) returned 0x0 [0219.171] IUnknown:Release (This=0x58d01c) returned 0x1 [0219.171] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f068 | out: ppvObject=0x19f068*=0x4e6dc0) returned 0x0 [0219.171] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f064 | out: ppvObject=0x19f064*=0x58d01c) returned 0x0 [0219.171] IClientSecurity:SetBlanket (This=0x58d01c, pProxy=0x58d018, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.172] IUnknown:Release (This=0x58d01c) returned 0x2 [0219.172] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x1 [0219.173] CoTaskMemFree (pv=0x50f9e0) [0219.173] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x4e6dc0) returned 0x0 [0219.173] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec1c | out: ppvObject=0x19ec1c*=0x0) returned 0x80004002 [0219.173] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x0) returned 0x80004002 [0219.174] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e814 | out: ppvObject=0x19e814*=0x0) returned 0x80004002 [0219.174] WbemLocator:IUnknown:AddRef (This=0x4e6dc0) returned 0x3 [0219.174] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e57c | out: ppvObject=0x19e57c*=0x0) returned 0x80004002 [0219.174] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e52c | out: ppvObject=0x19e52c*=0x0) returned 0x80004002 [0219.174] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e538 | out: ppvObject=0x19e538*=0x4e6d1c) returned 0x0 [0219.174] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6d1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e540 | out: pCid=0x19e540*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.174] WbemLocator:IUnknown:Release (This=0x4e6d1c) returned 0x3 [0219.175] CoGetContextToken (in: pToken=0x19e598 | out: pToken=0x19e598) returned 0x0 [0219.175] CoGetContextToken (in: pToken=0x19e9a0 | out: pToken=0x19e9a0) returned 0x0 [0219.175] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea30 | out: ppvObject=0x19ea30*=0x4e6da4) returned 0x0 [0219.175] WbemLocator:IRpcOptions:Query (in: This=0x4e6da4, pPrx=0x4e6dc0, dwProperty=2, pdwValue=0x19ea58 | out: pdwValue=0x19ea58) returned 0x80004002 [0219.175] WbemLocator:IUnknown:Release (This=0x4e6da4) returned 0x3 [0219.175] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x2 [0219.175] CoGetContextToken (in: pToken=0x19ef70 | out: pToken=0x19ef70) returned 0x0 [0219.175] CoGetContextToken (in: pToken=0x19eed0 | out: pToken=0x19eed0) returned 0x0 [0219.175] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x19efa0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ef9c | out: ppvObject=0x19ef9c*=0x58d018) returned 0x0 [0219.175] IUnknown:AddRef (This=0x58d018) returned 0x4 [0219.175] IUnknown:Release (This=0x58d018) returned 0x3 [0219.175] IUnknown:Release (This=0x58d018) returned 0x2 [0219.175] WbemLocator:IUnknown:Release (This=0x579308) returned 0x2 [0219.175] SysStringLen (param_1=0x0) returned 0x0 [0219.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524260, puCount=0x19f260 | out: puCount=0x19f260*=0x2) returned 0x0 [0219.175] WbemDefPath:IWbemPath:GetText (in: This=0x524260, lFlags=4, puBuffLength=0x19f25c*=0x0, pszText=0x0 | out: puBuffLength=0x19f25c*=0x18, pszText=0x0) returned 0x0 [0219.176] WbemDefPath:IWbemPath:GetText (in: This=0x524260, lFlags=4, puBuffLength=0x19f25c*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19f25c*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0219.176] CoGetContextToken (in: pToken=0x19f0b0 | out: pToken=0x19f0b0) returned 0x0 [0219.176] IUnknown:AddRef (This=0x58d018) returned 0x3 [0219.176] IEnumWbemClassObject:Clone (in: This=0x58d018, ppEnum=0x19f26c | out: ppEnum=0x19f26c*=0x58cc30) returned 0x0 [0219.177] IUnknown:QueryInterface (in: This=0x58cc30, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f130 | out: ppvObject=0x19f130*=0x58cc34) returned 0x0 [0219.177] IClientSecurity:QueryBlanket (in: This=0x58cc34, pProxy=0x58cc30, pAuthnSvc=0x19f180, pAuthzSvc=0x19f17c, pServerPrincName=0x19f174, pAuthnLevel=0x19f178, pImpLevel=0x19f168, pAuthInfo=0x19f16c, pCapabilites=0x19f170 | out: pAuthnSvc=0x19f180*=0xa, pAuthzSvc=0x19f17c*=0x0, pServerPrincName=0x19f174, pAuthnLevel=0x19f178*=0x6, pImpLevel=0x19f168*=0x2, pAuthInfo=0x19f16c, pCapabilites=0x19f170*=0x1) returned 0x0 [0219.177] IUnknown:Release (This=0x58cc34) returned 0x1 [0219.177] IUnknown:QueryInterface (in: This=0x58cc30, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f124 | out: ppvObject=0x19f124*=0x4e6fc0) returned 0x0 [0219.177] IUnknown:QueryInterface (in: This=0x58cc30, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f120 | out: ppvObject=0x19f120*=0x58cc34) returned 0x0 [0219.177] IClientSecurity:SetBlanket (This=0x58cc34, pProxy=0x58cc30, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.179] IUnknown:Release (This=0x58cc34) returned 0x2 [0219.179] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0219.179] CoTaskMemFree (pv=0x50fa70) [0219.179] IUnknown:QueryInterface (in: This=0x58cc30, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x4e6fc0) returned 0x0 [0219.179] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ecc8 | out: ppvObject=0x19ecc8*=0x0) returned 0x80004002 [0219.179] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002 [0219.180] IUnknown:QueryInterface (in: This=0x58cc30, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e8bc | out: ppvObject=0x19e8bc*=0x0) returned 0x80004002 [0219.180] WbemLocator:IUnknown:AddRef (This=0x4e6fc0) returned 0x3 [0219.180] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e624 | out: ppvObject=0x19e624*=0x0) returned 0x80004002 [0219.180] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e5d4 | out: ppvObject=0x19e5d4*=0x0) returned 0x80004002 [0219.180] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5e0 | out: ppvObject=0x19e5e0*=0x4e6f1c) returned 0x0 [0219.180] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6f1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e5e8 | out: pCid=0x19e5e8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.180] WbemLocator:IUnknown:Release (This=0x4e6f1c) returned 0x3 [0219.180] CoGetContextToken (in: pToken=0x19e640 | out: pToken=0x19e640) returned 0x0 [0219.181] CoGetContextToken (in: pToken=0x19ea48 | out: pToken=0x19ea48) returned 0x0 [0219.181] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ead8 | out: ppvObject=0x19ead8*=0x4e6fa4) returned 0x0 [0219.181] WbemLocator:IRpcOptions:Query (in: This=0x4e6fa4, pPrx=0x4e6fc0, dwProperty=2, pdwValue=0x19eb00 | out: pdwValue=0x19eb00) returned 0x80004002 [0219.181] WbemLocator:IUnknown:Release (This=0x4e6fa4) returned 0x3 [0219.181] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x2 [0219.181] CoGetContextToken (in: pToken=0x19f020 | out: pToken=0x19f020) returned 0x0 [0219.181] CoGetContextToken (in: pToken=0x19ef80 | out: pToken=0x19ef80) returned 0x0 [0219.181] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x19f050*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f04c | out: ppvObject=0x19f04c*=0x58cc30) returned 0x0 [0219.181] IUnknown:AddRef (This=0x58cc30) returned 0x4 [0219.181] IUnknown:Release (This=0x58cc30) returned 0x3 [0219.181] IUnknown:Release (This=0x58cc30) returned 0x2 [0219.181] IUnknown:Release (This=0x58d018) returned 0x2 [0219.182] SysStringLen (param_1=0x0) returned 0x0 [0219.182] IEnumWbemClassObject:Reset (This=0x58cc30) returned 0x0 [0219.183] CoTaskMemAlloc (cb=0x4) returned 0x58e928 [0219.183] IEnumWbemClassObject:Next (in: This=0x58cc30, lTimeout=-1, uCount=0x1, apObjects=0x58e928, puReturned=0x23e0890 | out: apObjects=0x58e928*=0x0, puReturned=0x23e0890*=0x0) returned 0x1 [0219.184] CoTaskMemFree (pv=0x58e928) [0219.184] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0219.184] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0219.184] IUnknown:Release (This=0x58cc30) returned 0x0 [0219.185] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0219.185] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x1 [0219.185] IUnknown:Release (This=0x58d018) returned 0x0 [0219.186] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f288 | out: ppv=0x19f288*=0x4d0cbc) returned 0x0 [0219.186] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f280 | out: pAptType=0x19f280*=1) returned 0x0 [0219.186] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x0) returned 0x80004002 [0219.186] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.187] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ebf0 | out: ppv=0x19ebf0*=0x544ca0) returned 0x0 [0219.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x544ca0, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ee08 | out: ppvObject=0x19ee08*=0x0) returned 0x80004002 [0219.187] WbemDefPath:IClassFactory:CreateInstance (in: This=0x544ca0, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee1c | out: ppvObject=0x19ee1c*=0x524490) returned 0x0 [0219.187] WbemDefPath:IUnknown:Release (This=0x544ca0) returned 0x0 [0219.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x524490) returned 0x0 [0219.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e9f8 | out: ppvObject=0x19e9f8*=0x0) returned 0x80004002 [0219.187] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e5ec | out: ppvObject=0x19e5ec*=0x0) returned 0x80004002 [0219.188] WbemDefPath:IUnknown:AddRef (This=0x524490) returned 0x3 [0219.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e354 | out: ppvObject=0x19e354*=0x0) returned 0x80004002 [0219.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e304 | out: ppvObject=0x19e304*=0x0) returned 0x80004002 [0219.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e310 | out: ppvObject=0x19e310*=0x5553a88) returned 0x0 [0219.188] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5553a88, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e318 | out: pCid=0x19e318*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.188] WbemDefPath:IUnknown:Release (This=0x5553a88) returned 0x3 [0219.188] CoGetContextToken (in: pToken=0x19e370 | out: pToken=0x19e370) returned 0x0 [0219.188] CoGetContextToken (in: pToken=0x19e778 | out: pToken=0x19e778) returned 0x0 [0219.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x0) returned 0x80004002 [0219.188] WbemDefPath:IUnknown:Release (This=0x524490) returned 0x2 [0219.188] WbemDefPath:IUnknown:Release (This=0x524490) returned 0x1 [0219.188] CoGetContextToken (in: pToken=0x19f100 | out: pToken=0x19f100) returned 0x0 [0219.188] CoGetContextToken (in: pToken=0x19f060 | out: pToken=0x19f060) returned 0x0 [0219.188] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x19f130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f12c | out: ppvObject=0x19f12c*=0x524490) returned 0x0 [0219.188] WbemDefPath:IUnknown:AddRef (This=0x524490) returned 0x3 [0219.189] WbemDefPath:IUnknown:Release (This=0x524490) returned 0x2 [0219.189] WbemDefPath:IWbemPath:SetText (This=0x524490, uMode=0x4, pszPath="ROOT\\SecurityCenter") returned 0x0 [0219.189] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524490, puCount=0x19f2b0 | out: puCount=0x19f2b0*=0x2) returned 0x0 [0219.189] WbemDefPath:IWbemPath:GetText (in: This=0x524490, lFlags=4, puBuffLength=0x19f2ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f2ac*=0x18, pszText=0x0) returned 0x0 [0219.189] WbemDefPath:IWbemPath:GetText (in: This=0x524490, lFlags=4, puBuffLength=0x19f2ac*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19f2ac*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0219.189] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524490, puCount=0x19f29c | out: puCount=0x19f29c*=0x2) returned 0x0 [0219.189] WbemDefPath:IWbemPath:GetText (in: This=0x524490, lFlags=4, puBuffLength=0x19f298*=0x0, pszText=0x0 | out: puBuffLength=0x19f298*=0x18, pszText=0x0) returned 0x0 [0219.189] WbemDefPath:IWbemPath:GetText (in: This=0x524490, lFlags=4, puBuffLength=0x19f298*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19f298*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0219.189] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f230 | out: ppv=0x19f230*=0x4d0cbc) returned 0x0 [0219.189] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f228 | out: pAptType=0x19f228*=1) returned 0x0 [0219.189] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f22c | out: ppvObject=0x19f22c*=0x0) returned 0x80004002 [0219.189] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.190] CoGetClassObject (in: rclsid=0x55079c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ee50 | out: ppv=0x19ee50*=0x5553728) returned 0x0 [0219.190] WbemLocator:IUnknown:QueryInterface (in: This=0x5553728, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19f068 | out: ppvObject=0x19f068*=0x0) returned 0x80004002 [0219.190] WbemLocator:IClassFactory:CreateInstance (in: This=0x5553728, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f07c | out: ppvObject=0x19f07c*=0x544e00) returned 0x0 [0219.190] WbemLocator:IUnknown:Release (This=0x5553728) returned 0x0 [0219.190] WbemLocator:IUnknown:QueryInterface (in: This=0x544e00, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec9c | out: ppvObject=0x19ec9c*=0x544e00) returned 0x0 [0219.190] WbemLocator:IUnknown:QueryInterface (in: This=0x544e00, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec58 | out: ppvObject=0x19ec58*=0x0) returned 0x80004002 [0219.190] WbemLocator:IUnknown:QueryInterface (in: This=0x544e00, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002 [0219.191] WbemLocator:IUnknown:AddRef (This=0x544e00) returned 0x3 [0219.191] WbemLocator:IUnknown:QueryInterface (in: This=0x544e00, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e5b4 | out: ppvObject=0x19e5b4*=0x0) returned 0x80004002 [0219.191] WbemLocator:IUnknown:QueryInterface (in: This=0x544e00, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e564 | out: ppvObject=0x19e564*=0x0) returned 0x80004002 [0219.191] WbemLocator:IUnknown:QueryInterface (in: This=0x544e00, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e570 | out: ppvObject=0x19e570*=0x0) returned 0x80004002 [0219.191] CoGetContextToken (in: pToken=0x19e5d0 | out: pToken=0x19e5d0) returned 0x0 [0219.191] CoGetContextToken (in: pToken=0x19e9d8 | out: pToken=0x19e9d8) returned 0x0 [0219.191] WbemLocator:IUnknown:QueryInterface (in: This=0x544e00, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea68 | out: ppvObject=0x19ea68*=0x0) returned 0x80004002 [0219.191] WbemLocator:IUnknown:Release (This=0x544e00) returned 0x2 [0219.191] WbemLocator:IUnknown:Release (This=0x544e00) returned 0x1 [0219.191] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0219.191] CoGetContextToken (in: pToken=0x19efa8 | out: pToken=0x19efa8) returned 0x0 [0219.191] WbemLocator:IUnknown:QueryInterface (in: This=0x544e00, riid=0x19f078*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19f074 | out: ppvObject=0x19f074*=0x544e00) returned 0x0 [0219.191] WbemLocator:IUnknown:AddRef (This=0x544e00) returned 0x3 [0219.192] WbemLocator:IUnknown:Release (This=0x544e00) returned 0x2 [0219.192] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524490, puCount=0x19f20c | out: puCount=0x19f20c*=0x2) returned 0x0 [0219.192] WbemDefPath:IWbemPath:GetText (in: This=0x524490, lFlags=8, puBuffLength=0x19f208*=0x0, pszText=0x0 | out: puBuffLength=0x19f208*=0x18, pszText=0x0) returned 0x0 [0219.192] WbemDefPath:IWbemPath:GetText (in: This=0x524490, lFlags=8, puBuffLength=0x19f208*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19f208*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0219.192] CoCreateInstance (in: rclsid=0x6ce21284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ce212e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x19f0d0 | out: ppv=0x19f0d0*=0x4fa458) returned 0x0 [0219.192] WbemLocator:IWbemLocator:ConnectServer (in: This=0x4fa458, strNetworkResource="\\\\.\\ROOT\\SecurityCenter", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x19f178 | out: ppNamespace=0x19f178*=0x579268) returned 0x0 [0219.212] WbemLocator:IUnknown:QueryInterface (in: This=0x579268, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f000 | out: ppvObject=0x19f000*=0x4e5e9c) returned 0x0 [0219.212] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4e5e9c, pProxy=0x579268, pAuthnSvc=0x19f050, pAuthzSvc=0x19f04c, pServerPrincName=0x19f044, pAuthnLevel=0x19f048, pImpLevel=0x19f038, pAuthInfo=0x19f03c, pCapabilites=0x19f040 | out: pAuthnSvc=0x19f050*=0xa, pAuthzSvc=0x19f04c*=0x0, pServerPrincName=0x19f044, pAuthnLevel=0x19f048*=0x6, pImpLevel=0x19f038*=0x2, pAuthInfo=0x19f03c, pCapabilites=0x19f040*=0x1) returned 0x0 [0219.212] WbemLocator:IUnknown:Release (This=0x4e5e9c) returned 0x1 [0219.212] WbemLocator:IUnknown:QueryInterface (in: This=0x579268, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eff4 | out: ppvObject=0x19eff4*=0x4e5ec0) returned 0x0 [0219.212] WbemLocator:IUnknown:QueryInterface (in: This=0x579268, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eff0 | out: ppvObject=0x19eff0*=0x4e5e9c) returned 0x0 [0219.212] WbemLocator:IClientSecurity:SetBlanket (This=0x4e5e9c, pProxy=0x579268, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.212] WbemLocator:IUnknown:Release (This=0x4e5e9c) returned 0x2 [0219.212] WbemLocator:IUnknown:Release (This=0x4e5ec0) returned 0x1 [0219.212] CoTaskMemFree (pv=0x50fb90) [0219.213] WbemLocator:IUnknown:Release (This=0x4fa458) returned 0x0 [0219.213] WbemLocator:IUnknown:QueryInterface (in: This=0x579268, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebf0 | out: ppvObject=0x19ebf0*=0x4e5ec0) returned 0x0 [0219.213] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ebac | out: ppvObject=0x19ebac*=0x0) returned 0x80004002 [0219.213] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e9cc | out: ppvObject=0x19e9cc*=0x0) returned 0x80004002 [0219.214] WbemLocator:IUnknown:QueryInterface (in: This=0x579268, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e7a4 | out: ppvObject=0x19e7a4*=0x0) returned 0x80004002 [0219.214] WbemLocator:IUnknown:AddRef (This=0x4e5ec0) returned 0x3 [0219.214] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e50c | out: ppvObject=0x19e50c*=0x0) returned 0x80004002 [0219.214] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e4bc | out: ppvObject=0x19e4bc*=0x0) returned 0x80004002 [0219.214] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e4c8 | out: ppvObject=0x19e4c8*=0x4e5e1c) returned 0x0 [0219.214] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e5e1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e4d0 | out: pCid=0x19e4d0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.214] WbemLocator:IUnknown:Release (This=0x4e5e1c) returned 0x3 [0219.215] CoGetContextToken (in: pToken=0x19e528 | out: pToken=0x19e528) returned 0x0 [0219.215] CoGetContextToken (in: pToken=0x19e930 | out: pToken=0x19e930) returned 0x0 [0219.215] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9c0 | out: ppvObject=0x19e9c0*=0x4e5ea4) returned 0x0 [0219.215] WbemLocator:IRpcOptions:Query (in: This=0x4e5ea4, pPrx=0x4e5ec0, dwProperty=2, pdwValue=0x19e9e8 | out: pdwValue=0x19e9e8) returned 0x80004002 [0219.215] WbemLocator:IUnknown:Release (This=0x4e5ea4) returned 0x3 [0219.215] WbemLocator:IUnknown:Release (This=0x4e5ec0) returned 0x2 [0219.215] CoGetContextToken (in: pToken=0x19ef00 | out: pToken=0x19ef00) returned 0x0 [0219.215] CoGetContextToken (in: pToken=0x19ee60 | out: pToken=0x19ee60) returned 0x0 [0219.215] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x19ef30*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19ef2c | out: ppvObject=0x19ef2c*=0x579268) returned 0x0 [0219.215] WbemLocator:IUnknown:AddRef (This=0x579268) returned 0x4 [0219.215] WbemLocator:IUnknown:Release (This=0x579268) returned 0x3 [0219.215] WbemLocator:IUnknown:Release (This=0x579268) returned 0x2 [0219.215] SysStringLen (param_1=0x0) returned 0x0 [0219.215] CoGetContextToken (in: pToken=0x19ef10 | out: pToken=0x19ef10) returned 0x0 [0219.215] WbemLocator:IUnknown:AddRef (This=0x4e5ec0) returned 0x3 [0219.216] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eda4 | out: ppvObject=0x19eda4*=0x4e5ec0) returned 0x0 [0219.216] WbemLocator:IUnknown:Release (This=0x4e5ec0) returned 0x3 [0219.216] WbemLocator:IUnknown:Release (This=0x4e5ec0) returned 0x2 [0219.216] CoGetContextToken (in: pToken=0x19f008 | out: pToken=0x19f008) returned 0x0 [0219.216] WbemLocator:IUnknown:AddRef (This=0x579268) returned 0x3 [0219.216] IWbemServices:ExecQuery (in: This=0x579268, strQueryLanguage="WQL", strQuery="SELECT * FROM FirewallProduct", lFlags=16, pCtx=0x0, ppEnum=0x19f214 | out: ppEnum=0x19f214*=0x58cdc0) returned 0x0 [0219.222] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f078 | out: ppvObject=0x19f078*=0x58cdc4) returned 0x0 [0219.223] IClientSecurity:QueryBlanket (in: This=0x58cdc4, pProxy=0x58cdc0, pAuthnSvc=0x19f0c8, pAuthzSvc=0x19f0c4, pServerPrincName=0x19f0bc, pAuthnLevel=0x19f0c0, pImpLevel=0x19f0b0, pAuthInfo=0x19f0b4, pCapabilites=0x19f0b8 | out: pAuthnSvc=0x19f0c8*=0xa, pAuthzSvc=0x19f0c4*=0x0, pServerPrincName=0x19f0bc, pAuthnLevel=0x19f0c0*=0x6, pImpLevel=0x19f0b0*=0x2, pAuthInfo=0x19f0b4, pCapabilites=0x19f0b8*=0x1) returned 0x0 [0219.223] IUnknown:Release (This=0x58cdc4) returned 0x1 [0219.223] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f06c | out: ppvObject=0x19f06c*=0x4e54c0) returned 0x0 [0219.223] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f068 | out: ppvObject=0x19f068*=0x58cdc4) returned 0x0 [0219.223] IClientSecurity:SetBlanket (This=0x58cdc4, pProxy=0x58cdc0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.224] IUnknown:Release (This=0x58cdc4) returned 0x2 [0219.224] WbemLocator:IUnknown:Release (This=0x4e54c0) returned 0x1 [0219.225] CoTaskMemFree (pv=0x50fb00) [0219.225] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec64 | out: ppvObject=0x19ec64*=0x4e54c0) returned 0x0 [0219.225] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec20 | out: ppvObject=0x19ec20*=0x0) returned 0x80004002 [0219.226] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x0) returned 0x80004002 [0219.228] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e814 | out: ppvObject=0x19e814*=0x0) returned 0x80004002 [0219.228] WbemLocator:IUnknown:AddRef (This=0x4e54c0) returned 0x3 [0219.229] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e57c | out: ppvObject=0x19e57c*=0x0) returned 0x80004002 [0219.229] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e52c | out: ppvObject=0x19e52c*=0x0) returned 0x80004002 [0219.229] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e538 | out: ppvObject=0x19e538*=0x4e541c) returned 0x0 [0219.229] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e541c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e540 | out: pCid=0x19e540*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.229] WbemLocator:IUnknown:Release (This=0x4e541c) returned 0x3 [0219.229] CoGetContextToken (in: pToken=0x19e598 | out: pToken=0x19e598) returned 0x0 [0219.229] CoGetContextToken (in: pToken=0x19e9a0 | out: pToken=0x19e9a0) returned 0x0 [0219.229] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea30 | out: ppvObject=0x19ea30*=0x4e54a4) returned 0x0 [0219.229] WbemLocator:IRpcOptions:Query (in: This=0x4e54a4, pPrx=0x4e54c0, dwProperty=2, pdwValue=0x19ea58 | out: pdwValue=0x19ea58) returned 0x80004002 [0219.231] WbemLocator:IUnknown:Release (This=0x4e54a4) returned 0x3 [0219.231] WbemLocator:IUnknown:Release (This=0x4e54c0) returned 0x2 [0219.231] CoGetContextToken (in: pToken=0x19ef78 | out: pToken=0x19ef78) returned 0x0 [0219.231] CoGetContextToken (in: pToken=0x19eed8 | out: pToken=0x19eed8) returned 0x0 [0219.231] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x19efa8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19efa4 | out: ppvObject=0x19efa4*=0x58cdc0) returned 0x0 [0219.231] IUnknown:AddRef (This=0x58cdc0) returned 0x4 [0219.231] IUnknown:Release (This=0x58cdc0) returned 0x3 [0219.231] IUnknown:Release (This=0x58cdc0) returned 0x2 [0219.231] WbemLocator:IUnknown:Release (This=0x579268) returned 0x2 [0219.231] SysStringLen (param_1=0x0) returned 0x0 [0219.231] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524490, puCount=0x19f260 | out: puCount=0x19f260*=0x2) returned 0x0 [0219.231] WbemDefPath:IWbemPath:GetText (in: This=0x524490, lFlags=4, puBuffLength=0x19f25c*=0x0, pszText=0x0 | out: puBuffLength=0x19f25c*=0x18, pszText=0x0) returned 0x0 [0219.231] WbemDefPath:IWbemPath:GetText (in: This=0x524490, lFlags=4, puBuffLength=0x19f25c*=0x18, pszText="00000000000000000000000" | out: puBuffLength=0x19f25c*=0x18, pszText="\\\\.\\ROOT\\SecurityCenter") returned 0x0 [0219.231] CoGetContextToken (in: pToken=0x19f0b0 | out: pToken=0x19f0b0) returned 0x0 [0219.231] IUnknown:AddRef (This=0x58cdc0) returned 0x3 [0219.231] IEnumWbemClassObject:Clone (in: This=0x58cdc0, ppEnum=0x19f26c | out: ppEnum=0x19f26c*=0x58ce88) returned 0x0 [0219.233] IUnknown:QueryInterface (in: This=0x58ce88, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f130 | out: ppvObject=0x19f130*=0x58ce8c) returned 0x0 [0219.233] IClientSecurity:QueryBlanket (in: This=0x58ce8c, pProxy=0x58ce88, pAuthnSvc=0x19f180, pAuthzSvc=0x19f17c, pServerPrincName=0x19f174, pAuthnLevel=0x19f178, pImpLevel=0x19f168, pAuthInfo=0x19f16c, pCapabilites=0x19f170 | out: pAuthnSvc=0x19f180*=0xa, pAuthzSvc=0x19f17c*=0x0, pServerPrincName=0x19f174, pAuthnLevel=0x19f178*=0x6, pImpLevel=0x19f168*=0x2, pAuthInfo=0x19f16c, pCapabilites=0x19f170*=0x1) returned 0x0 [0219.233] IUnknown:Release (This=0x58ce8c) returned 0x1 [0219.233] IUnknown:QueryInterface (in: This=0x58ce88, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f124 | out: ppvObject=0x19f124*=0x4e5ac0) returned 0x0 [0219.234] IUnknown:QueryInterface (in: This=0x58ce88, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f120 | out: ppvObject=0x19f120*=0x58ce8c) returned 0x0 [0219.234] IClientSecurity:SetBlanket (This=0x58ce8c, pProxy=0x58ce88, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.235] IUnknown:Release (This=0x58ce8c) returned 0x2 [0219.235] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x1 [0219.235] CoTaskMemFree (pv=0x50fb30) [0219.235] IUnknown:QueryInterface (in: This=0x58ce88, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x4e5ac0) returned 0x0 [0219.236] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ecc8 | out: ppvObject=0x19ecc8*=0x0) returned 0x80004002 [0219.236] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002 [0219.236] IUnknown:QueryInterface (in: This=0x58ce88, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e8bc | out: ppvObject=0x19e8bc*=0x0) returned 0x80004002 [0219.237] WbemLocator:IUnknown:AddRef (This=0x4e5ac0) returned 0x3 [0219.237] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e624 | out: ppvObject=0x19e624*=0x0) returned 0x80004002 [0219.237] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e5d4 | out: ppvObject=0x19e5d4*=0x0) returned 0x80004002 [0219.237] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5e0 | out: ppvObject=0x19e5e0*=0x4e5a1c) returned 0x0 [0219.237] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e5a1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e5e8 | out: pCid=0x19e5e8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.237] WbemLocator:IUnknown:Release (This=0x4e5a1c) returned 0x3 [0219.237] CoGetContextToken (in: pToken=0x19e640 | out: pToken=0x19e640) returned 0x0 [0219.237] CoGetContextToken (in: pToken=0x19ea48 | out: pToken=0x19ea48) returned 0x0 [0219.237] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ead8 | out: ppvObject=0x19ead8*=0x4e5aa4) returned 0x0 [0219.237] WbemLocator:IRpcOptions:Query (in: This=0x4e5aa4, pPrx=0x4e5ac0, dwProperty=2, pdwValue=0x19eb00 | out: pdwValue=0x19eb00) returned 0x80004002 [0219.237] WbemLocator:IUnknown:Release (This=0x4e5aa4) returned 0x3 [0219.238] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x2 [0219.238] CoGetContextToken (in: pToken=0x19f020 | out: pToken=0x19f020) returned 0x0 [0219.238] CoGetContextToken (in: pToken=0x19ef80 | out: pToken=0x19ef80) returned 0x0 [0219.238] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x19f050*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f04c | out: ppvObject=0x19f04c*=0x58ce88) returned 0x0 [0219.238] IUnknown:AddRef (This=0x58ce88) returned 0x4 [0219.238] IUnknown:Release (This=0x58ce88) returned 0x3 [0219.238] IUnknown:Release (This=0x58ce88) returned 0x2 [0219.238] IUnknown:Release (This=0x58cdc0) returned 0x2 [0219.238] SysStringLen (param_1=0x0) returned 0x0 [0219.238] IEnumWbemClassObject:Reset (This=0x58ce88) returned 0x0 [0219.239] CoTaskMemAlloc (cb=0x4) returned 0x58e6c8 [0219.239] IEnumWbemClassObject:Next (in: This=0x58ce88, lTimeout=-1, uCount=0x1, apObjects=0x58e6c8, puReturned=0x23e193c | out: apObjects=0x58e6c8*=0x0, puReturned=0x23e193c*=0x0) returned 0x1 [0219.239] CoTaskMemFree (pv=0x58e6c8) [0219.240] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0219.240] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x1 [0219.240] IUnknown:Release (This=0x58ce88) returned 0x0 [0219.241] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0219.241] WbemLocator:IUnknown:Release (This=0x4e54c0) returned 0x1 [0219.241] IUnknown:Release (This=0x58cdc0) returned 0x0 [0219.242] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f288 | out: ppv=0x19f288*=0x4d0cbc) returned 0x0 [0219.242] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f280 | out: pAptType=0x19f280*=1) returned 0x0 [0219.242] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x0) returned 0x80004002 [0219.242] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.243] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ebf0 | out: ppv=0x19ebf0*=0x58e6c8) returned 0x0 [0219.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6c8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ee08 | out: ppvObject=0x19ee08*=0x0) returned 0x80004002 [0219.243] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6c8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee1c | out: ppvObject=0x19ee1c*=0x524570) returned 0x0 [0219.243] WbemDefPath:IUnknown:Release (This=0x58e6c8) returned 0x0 [0219.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x524570, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x524570) returned 0x0 [0219.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x524570, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e9f8 | out: ppvObject=0x19e9f8*=0x0) returned 0x80004002 [0219.243] WbemDefPath:IUnknown:QueryInterface (in: This=0x524570, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e5ec | out: ppvObject=0x19e5ec*=0x0) returned 0x80004002 [0219.243] WbemDefPath:IUnknown:AddRef (This=0x524570) returned 0x3 [0219.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x524570, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e354 | out: ppvObject=0x19e354*=0x0) returned 0x80004002 [0219.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x524570, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e304 | out: ppvObject=0x19e304*=0x0) returned 0x80004002 [0219.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x524570, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e310 | out: ppvObject=0x19e310*=0x55537b8) returned 0x0 [0219.244] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x55537b8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e318 | out: pCid=0x19e318*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.244] WbemDefPath:IUnknown:Release (This=0x55537b8) returned 0x3 [0219.244] CoGetContextToken (in: pToken=0x19e370 | out: pToken=0x19e370) returned 0x0 [0219.244] CoGetContextToken (in: pToken=0x19e778 | out: pToken=0x19e778) returned 0x0 [0219.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x524570, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x0) returned 0x80004002 [0219.244] WbemDefPath:IUnknown:Release (This=0x524570) returned 0x2 [0219.244] WbemDefPath:IUnknown:Release (This=0x524570) returned 0x1 [0219.244] CoGetContextToken (in: pToken=0x19f100 | out: pToken=0x19f100) returned 0x0 [0219.244] CoGetContextToken (in: pToken=0x19f060 | out: pToken=0x19f060) returned 0x0 [0219.244] WbemDefPath:IUnknown:QueryInterface (in: This=0x524570, riid=0x19f130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f12c | out: ppvObject=0x19f12c*=0x524570) returned 0x0 [0219.244] WbemDefPath:IUnknown:AddRef (This=0x524570) returned 0x3 [0219.245] WbemDefPath:IUnknown:Release (This=0x524570) returned 0x2 [0219.245] WbemDefPath:IWbemPath:SetText (This=0x524570, uMode=0x4, pszPath="ROOT\\SecurityCenter2") returned 0x0 [0219.245] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524570, puCount=0x19f2b0 | out: puCount=0x19f2b0*=0x2) returned 0x0 [0219.245] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=4, puBuffLength=0x19f2ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f2ac*=0x19, pszText=0x0) returned 0x0 [0219.245] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=4, puBuffLength=0x19f2ac*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f2ac*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.245] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524570, puCount=0x19f29c | out: puCount=0x19f29c*=0x2) returned 0x0 [0219.245] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=4, puBuffLength=0x19f298*=0x0, pszText=0x0 | out: puBuffLength=0x19f298*=0x19, pszText=0x0) returned 0x0 [0219.245] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=4, puBuffLength=0x19f298*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f298*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.245] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f230 | out: ppv=0x19f230*=0x4d0cbc) returned 0x0 [0219.245] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f228 | out: pAptType=0x19f228*=1) returned 0x0 [0219.245] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f22c | out: ppvObject=0x19f22c*=0x0) returned 0x80004002 [0219.245] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.246] CoGetClassObject (in: rclsid=0x55079c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ee50 | out: ppv=0x19ee50*=0x5553890) returned 0x0 [0219.246] WbemLocator:IUnknown:QueryInterface (in: This=0x5553890, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19f068 | out: ppvObject=0x19f068*=0x0) returned 0x80004002 [0219.246] WbemLocator:IClassFactory:CreateInstance (in: This=0x5553890, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f07c | out: ppvObject=0x19f07c*=0x58e7c8) returned 0x0 [0219.246] WbemLocator:IUnknown:Release (This=0x5553890) returned 0x0 [0219.246] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7c8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec9c | out: ppvObject=0x19ec9c*=0x58e7c8) returned 0x0 [0219.246] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7c8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec58 | out: ppvObject=0x19ec58*=0x0) returned 0x80004002 [0219.246] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7c8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002 [0219.246] WbemLocator:IUnknown:AddRef (This=0x58e7c8) returned 0x3 [0219.246] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7c8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e5b4 | out: ppvObject=0x19e5b4*=0x0) returned 0x80004002 [0219.246] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7c8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e564 | out: ppvObject=0x19e564*=0x0) returned 0x80004002 [0219.247] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7c8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e570 | out: ppvObject=0x19e570*=0x0) returned 0x80004002 [0219.247] CoGetContextToken (in: pToken=0x19e5d0 | out: pToken=0x19e5d0) returned 0x0 [0219.247] CoGetContextToken (in: pToken=0x19e9d8 | out: pToken=0x19e9d8) returned 0x0 [0219.247] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7c8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea68 | out: ppvObject=0x19ea68*=0x0) returned 0x80004002 [0219.247] WbemLocator:IUnknown:Release (This=0x58e7c8) returned 0x2 [0219.247] WbemLocator:IUnknown:Release (This=0x58e7c8) returned 0x1 [0219.247] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0219.247] CoGetContextToken (in: pToken=0x19efa8 | out: pToken=0x19efa8) returned 0x0 [0219.247] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7c8, riid=0x19f078*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19f074 | out: ppvObject=0x19f074*=0x58e7c8) returned 0x0 [0219.247] WbemLocator:IUnknown:AddRef (This=0x58e7c8) returned 0x3 [0219.247] WbemLocator:IUnknown:Release (This=0x58e7c8) returned 0x2 [0219.247] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524570, puCount=0x19f20c | out: puCount=0x19f20c*=0x2) returned 0x0 [0219.247] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=8, puBuffLength=0x19f208*=0x0, pszText=0x0 | out: puBuffLength=0x19f208*=0x19, pszText=0x0) returned 0x0 [0219.247] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=8, puBuffLength=0x19f208*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f208*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.247] CoCreateInstance (in: rclsid=0x6ce21284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ce212e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x19f0d0 | out: ppv=0x19f0d0*=0x58e6a8) returned 0x0 [0219.247] WbemLocator:IWbemLocator:ConnectServer (in: This=0x58e6a8, strNetworkResource="\\\\.\\ROOT\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x19f178 | out: ppNamespace=0x19f178*=0x579d58) returned 0x0 [0219.264] WbemLocator:IUnknown:QueryInterface (in: This=0x579d58, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f000 | out: ppvObject=0x19f000*=0x4e579c) returned 0x0 [0219.265] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4e579c, pProxy=0x579d58, pAuthnSvc=0x19f050, pAuthzSvc=0x19f04c, pServerPrincName=0x19f044, pAuthnLevel=0x19f048, pImpLevel=0x19f038, pAuthInfo=0x19f03c, pCapabilites=0x19f040 | out: pAuthnSvc=0x19f050*=0xa, pAuthzSvc=0x19f04c*=0x0, pServerPrincName=0x19f044, pAuthnLevel=0x19f048*=0x6, pImpLevel=0x19f038*=0x2, pAuthInfo=0x19f03c, pCapabilites=0x19f040*=0x1) returned 0x0 [0219.265] WbemLocator:IUnknown:Release (This=0x4e579c) returned 0x1 [0219.265] WbemLocator:IUnknown:QueryInterface (in: This=0x579d58, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eff4 | out: ppvObject=0x19eff4*=0x4e57c0) returned 0x0 [0219.265] WbemLocator:IUnknown:QueryInterface (in: This=0x579d58, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eff0 | out: ppvObject=0x19eff0*=0x4e579c) returned 0x0 [0219.265] WbemLocator:IClientSecurity:SetBlanket (This=0x4e579c, pProxy=0x579d58, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.265] WbemLocator:IUnknown:Release (This=0x4e579c) returned 0x2 [0219.265] WbemLocator:IUnknown:Release (This=0x4e57c0) returned 0x1 [0219.265] CoTaskMemFree (pv=0x50fa70) [0219.266] WbemLocator:IUnknown:Release (This=0x58e6a8) returned 0x0 [0219.266] WbemLocator:IUnknown:QueryInterface (in: This=0x579d58, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebf0 | out: ppvObject=0x19ebf0*=0x4e57c0) returned 0x0 [0219.266] WbemLocator:IUnknown:QueryInterface (in: This=0x4e57c0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ebac | out: ppvObject=0x19ebac*=0x0) returned 0x80004002 [0219.266] WbemLocator:IUnknown:QueryInterface (in: This=0x4e57c0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e9cc | out: ppvObject=0x19e9cc*=0x0) returned 0x80004002 [0219.267] WbemLocator:IUnknown:QueryInterface (in: This=0x579d58, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e7a4 | out: ppvObject=0x19e7a4*=0x0) returned 0x80004002 [0219.267] WbemLocator:IUnknown:AddRef (This=0x4e57c0) returned 0x3 [0219.267] WbemLocator:IUnknown:QueryInterface (in: This=0x4e57c0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e50c | out: ppvObject=0x19e50c*=0x0) returned 0x80004002 [0219.267] WbemLocator:IUnknown:QueryInterface (in: This=0x4e57c0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e4bc | out: ppvObject=0x19e4bc*=0x0) returned 0x80004002 [0219.267] WbemLocator:IUnknown:QueryInterface (in: This=0x4e57c0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e4c8 | out: ppvObject=0x19e4c8*=0x4e571c) returned 0x0 [0219.267] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e571c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e4d0 | out: pCid=0x19e4d0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.267] WbemLocator:IUnknown:Release (This=0x4e571c) returned 0x3 [0219.267] CoGetContextToken (in: pToken=0x19e528 | out: pToken=0x19e528) returned 0x0 [0219.267] CoGetContextToken (in: pToken=0x19e930 | out: pToken=0x19e930) returned 0x0 [0219.268] WbemLocator:IUnknown:QueryInterface (in: This=0x4e57c0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9c0 | out: ppvObject=0x19e9c0*=0x4e57a4) returned 0x0 [0219.268] WbemLocator:IRpcOptions:Query (in: This=0x4e57a4, pPrx=0x4e57c0, dwProperty=2, pdwValue=0x19e9e8 | out: pdwValue=0x19e9e8) returned 0x80004002 [0219.268] WbemLocator:IUnknown:Release (This=0x4e57a4) returned 0x3 [0219.268] WbemLocator:IUnknown:Release (This=0x4e57c0) returned 0x2 [0219.268] CoGetContextToken (in: pToken=0x19ef00 | out: pToken=0x19ef00) returned 0x0 [0219.268] CoGetContextToken (in: pToken=0x19ee60 | out: pToken=0x19ee60) returned 0x0 [0219.268] WbemLocator:IUnknown:QueryInterface (in: This=0x4e57c0, riid=0x19ef30*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19ef2c | out: ppvObject=0x19ef2c*=0x579d58) returned 0x0 [0219.268] WbemLocator:IUnknown:AddRef (This=0x579d58) returned 0x4 [0219.268] WbemLocator:IUnknown:Release (This=0x579d58) returned 0x3 [0219.268] WbemLocator:IUnknown:Release (This=0x579d58) returned 0x2 [0219.268] SysStringLen (param_1=0x0) returned 0x0 [0219.268] CoGetContextToken (in: pToken=0x19ef10 | out: pToken=0x19ef10) returned 0x0 [0219.268] WbemLocator:IUnknown:AddRef (This=0x4e57c0) returned 0x3 [0219.271] WbemLocator:IUnknown:QueryInterface (in: This=0x4e57c0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eda4 | out: ppvObject=0x19eda4*=0x4e57c0) returned 0x0 [0219.271] WbemLocator:IUnknown:Release (This=0x4e57c0) returned 0x3 [0219.271] WbemLocator:IUnknown:Release (This=0x4e57c0) returned 0x2 [0219.271] CoGetContextToken (in: pToken=0x19f008 | out: pToken=0x19f008) returned 0x0 [0219.271] WbemLocator:IUnknown:AddRef (This=0x579d58) returned 0x3 [0219.271] IWbemServices:ExecQuery (in: This=0x579d58, strQueryLanguage="WQL", strQuery="SELECT * FROM AntivirusProduct", lFlags=16, pCtx=0x0, ppEnum=0x19f214 | out: ppEnum=0x19f214*=0x58cb68) returned 0x0 [0219.302] IUnknown:QueryInterface (in: This=0x58cb68, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f078 | out: ppvObject=0x19f078*=0x58cb6c) returned 0x0 [0219.302] IClientSecurity:QueryBlanket (in: This=0x58cb6c, pProxy=0x58cb68, pAuthnSvc=0x19f0c8, pAuthzSvc=0x19f0c4, pServerPrincName=0x19f0bc, pAuthnLevel=0x19f0c0, pImpLevel=0x19f0b0, pAuthInfo=0x19f0b4, pCapabilites=0x19f0b8 | out: pAuthnSvc=0x19f0c8*=0xa, pAuthzSvc=0x19f0c4*=0x0, pServerPrincName=0x19f0bc, pAuthnLevel=0x19f0c0*=0x6, pImpLevel=0x19f0b0*=0x2, pAuthInfo=0x19f0b4, pCapabilites=0x19f0b8*=0x1) returned 0x0 [0219.302] IUnknown:Release (This=0x58cb6c) returned 0x1 [0219.302] IUnknown:QueryInterface (in: This=0x58cb68, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f06c | out: ppvObject=0x19f06c*=0x4e6dc0) returned 0x0 [0219.303] IUnknown:QueryInterface (in: This=0x58cb68, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f068 | out: ppvObject=0x19f068*=0x58cb6c) returned 0x0 [0219.303] IClientSecurity:SetBlanket (This=0x58cb6c, pProxy=0x58cb68, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.309] IUnknown:Release (This=0x58cb6c) returned 0x2 [0219.309] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x1 [0219.309] CoTaskMemFree (pv=0x50fa70) [0219.310] IUnknown:QueryInterface (in: This=0x58cb68, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec64 | out: ppvObject=0x19ec64*=0x4e6dc0) returned 0x0 [0219.310] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec20 | out: ppvObject=0x19ec20*=0x0) returned 0x80004002 [0219.310] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x0) returned 0x80004002 [0219.311] IUnknown:QueryInterface (in: This=0x58cb68, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e814 | out: ppvObject=0x19e814*=0x0) returned 0x80004002 [0219.311] WbemLocator:IUnknown:AddRef (This=0x4e6dc0) returned 0x3 [0219.311] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e57c | out: ppvObject=0x19e57c*=0x0) returned 0x80004002 [0219.311] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e52c | out: ppvObject=0x19e52c*=0x0) returned 0x80004002 [0219.311] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e538 | out: ppvObject=0x19e538*=0x4e6d1c) returned 0x0 [0219.311] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6d1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e540 | out: pCid=0x19e540*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.311] WbemLocator:IUnknown:Release (This=0x4e6d1c) returned 0x3 [0219.311] CoGetContextToken (in: pToken=0x19e598 | out: pToken=0x19e598) returned 0x0 [0219.312] CoGetContextToken (in: pToken=0x19e9a0 | out: pToken=0x19e9a0) returned 0x0 [0219.312] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea30 | out: ppvObject=0x19ea30*=0x4e6da4) returned 0x0 [0219.312] WbemLocator:IRpcOptions:Query (in: This=0x4e6da4, pPrx=0x4e6dc0, dwProperty=2, pdwValue=0x19ea58 | out: pdwValue=0x19ea58) returned 0x80004002 [0219.312] WbemLocator:IUnknown:Release (This=0x4e6da4) returned 0x3 [0219.312] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x2 [0219.312] CoGetContextToken (in: pToken=0x19ef78 | out: pToken=0x19ef78) returned 0x0 [0219.312] CoGetContextToken (in: pToken=0x19eed8 | out: pToken=0x19eed8) returned 0x0 [0219.312] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x19efa8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19efa4 | out: ppvObject=0x19efa4*=0x58cb68) returned 0x0 [0219.312] IUnknown:AddRef (This=0x58cb68) returned 0x4 [0219.312] IUnknown:Release (This=0x58cb68) returned 0x3 [0219.312] IUnknown:Release (This=0x58cb68) returned 0x2 [0219.312] WbemLocator:IUnknown:Release (This=0x579d58) returned 0x2 [0219.312] SysStringLen (param_1=0x0) returned 0x0 [0219.312] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524570, puCount=0x19f260 | out: puCount=0x19f260*=0x2) returned 0x0 [0219.312] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=4, puBuffLength=0x19f25c*=0x0, pszText=0x0 | out: puBuffLength=0x19f25c*=0x19, pszText=0x0) returned 0x0 [0219.312] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=4, puBuffLength=0x19f25c*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f25c*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.312] CoGetContextToken (in: pToken=0x19f0b0 | out: pToken=0x19f0b0) returned 0x0 [0219.312] IUnknown:AddRef (This=0x58cb68) returned 0x3 [0219.312] IEnumWbemClassObject:Clone (in: This=0x58cb68, ppEnum=0x19f26c | out: ppEnum=0x19f26c*=0x58d018) returned 0x0 [0219.314] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f130 | out: ppvObject=0x19f130*=0x58d01c) returned 0x0 [0219.314] IClientSecurity:QueryBlanket (in: This=0x58d01c, pProxy=0x58d018, pAuthnSvc=0x19f180, pAuthzSvc=0x19f17c, pServerPrincName=0x19f174, pAuthnLevel=0x19f178, pImpLevel=0x19f168, pAuthInfo=0x19f16c, pCapabilites=0x19f170 | out: pAuthnSvc=0x19f180*=0xa, pAuthzSvc=0x19f17c*=0x0, pServerPrincName=0x19f174, pAuthnLevel=0x19f178*=0x6, pImpLevel=0x19f168*=0x2, pAuthInfo=0x19f16c, pCapabilites=0x19f170*=0x1) returned 0x0 [0219.314] IUnknown:Release (This=0x58d01c) returned 0x1 [0219.314] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f124 | out: ppvObject=0x19f124*=0x4e5fc0) returned 0x0 [0219.314] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f120 | out: ppvObject=0x19f120*=0x58d01c) returned 0x0 [0219.314] IClientSecurity:SetBlanket (This=0x58d01c, pProxy=0x58d018, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.315] IUnknown:Release (This=0x58d01c) returned 0x2 [0219.315] WbemLocator:IUnknown:Release (This=0x4e5fc0) returned 0x1 [0219.315] CoTaskMemFree (pv=0x50fa40) [0219.316] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x4e5fc0) returned 0x0 [0219.316] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ecc8 | out: ppvObject=0x19ecc8*=0x0) returned 0x80004002 [0219.316] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002 [0219.316] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e8bc | out: ppvObject=0x19e8bc*=0x0) returned 0x80004002 [0219.317] WbemLocator:IUnknown:AddRef (This=0x4e5fc0) returned 0x3 [0219.317] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e624 | out: ppvObject=0x19e624*=0x0) returned 0x80004002 [0219.317] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e5d4 | out: ppvObject=0x19e5d4*=0x0) returned 0x80004002 [0219.317] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5e0 | out: ppvObject=0x19e5e0*=0x4e5f1c) returned 0x0 [0219.317] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e5f1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e5e8 | out: pCid=0x19e5e8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.317] WbemLocator:IUnknown:Release (This=0x4e5f1c) returned 0x3 [0219.317] CoGetContextToken (in: pToken=0x19e640 | out: pToken=0x19e640) returned 0x0 [0219.317] CoGetContextToken (in: pToken=0x19ea48 | out: pToken=0x19ea48) returned 0x0 [0219.317] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ead8 | out: ppvObject=0x19ead8*=0x4e5fa4) returned 0x0 [0219.318] WbemLocator:IRpcOptions:Query (in: This=0x4e5fa4, pPrx=0x4e5fc0, dwProperty=2, pdwValue=0x19eb00 | out: pdwValue=0x19eb00) returned 0x80004002 [0219.318] WbemLocator:IUnknown:Release (This=0x4e5fa4) returned 0x3 [0219.318] WbemLocator:IUnknown:Release (This=0x4e5fc0) returned 0x2 [0219.318] CoGetContextToken (in: pToken=0x19f020 | out: pToken=0x19f020) returned 0x0 [0219.318] CoGetContextToken (in: pToken=0x19ef80 | out: pToken=0x19ef80) returned 0x0 [0219.318] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x19f050*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f04c | out: ppvObject=0x19f04c*=0x58d018) returned 0x0 [0219.318] IUnknown:AddRef (This=0x58d018) returned 0x4 [0219.318] IUnknown:Release (This=0x58d018) returned 0x3 [0219.318] IUnknown:Release (This=0x58d018) returned 0x2 [0219.318] IUnknown:Release (This=0x58cb68) returned 0x2 [0219.318] SysStringLen (param_1=0x0) returned 0x0 [0219.318] IEnumWbemClassObject:Reset (This=0x58d018) returned 0x0 [0219.319] CoTaskMemAlloc (cb=0x4) returned 0x58e6b8 [0219.319] IEnumWbemClassObject:Next (in: This=0x58d018, lTimeout=-1, uCount=0x1, apObjects=0x58e6b8, puReturned=0x23e2e54 | out: apObjects=0x58e6b8*=0x4febf0, puReturned=0x23e2e54*=0x1) returned 0x0 [0219.320] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e8d0 | out: ppvObject=0x19e8d0*=0x4febf0) returned 0x0 [0219.320] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e88c | out: ppvObject=0x19e88c*=0x0) returned 0x80004002 [0219.320] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e6ac | out: ppvObject=0x19e6ac*=0x0) returned 0x80004002 [0219.320] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e484 | out: ppvObject=0x19e484*=0x0) returned 0x80004002 [0219.320] IUnknown:AddRef (This=0x4febf0) returned 0x3 [0219.322] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e1ec | out: ppvObject=0x19e1ec*=0x0) returned 0x80004002 [0219.322] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e19c | out: ppvObject=0x19e19c*=0x0) returned 0x80004002 [0219.322] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e1a8 | out: ppvObject=0x19e1a8*=0x4febf4) returned 0x0 [0219.322] IMarshal:GetUnmarshalClass (in: This=0x4febf4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e1b0 | out: pCid=0x19e1b0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0219.322] IUnknown:Release (This=0x4febf4) returned 0x3 [0219.322] CoGetContextToken (in: pToken=0x19e208 | out: pToken=0x19e208) returned 0x0 [0219.322] CoGetContextToken (in: pToken=0x19e610 | out: pToken=0x19e610) returned 0x0 [0219.322] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6a0 | out: ppvObject=0x19e6a0*=0x0) returned 0x80004002 [0219.322] IUnknown:Release (This=0x4febf0) returned 0x2 [0219.322] CoGetContextToken (in: pToken=0x19ebe0 | out: pToken=0x19ebe0) returned 0x0 [0219.322] CoGetContextToken (in: pToken=0x19eb40 | out: pToken=0x19eb40) returned 0x0 [0219.322] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x19ec10*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ec0c | out: ppvObject=0x19ec0c*=0x4febf0) returned 0x0 [0219.322] IUnknown:AddRef (This=0x4febf0) returned 0x4 [0219.323] IUnknown:Release (This=0x4febf0) returned 0x3 [0219.323] IUnknown:Release (This=0x4febf0) returned 0x2 [0219.323] CoTaskMemFree (pv=0x58e6b8) [0219.323] CoGetContextToken (in: pToken=0x19ef48 | out: pToken=0x19ef48) returned 0x0 [0219.323] IUnknown:AddRef (This=0x4febf0) returned 0x3 [0219.323] IWbemClassObject:Get (in: This=0x4febf0, wszName="__GENUS", lFlags=0, pVal=0x19f25c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f2dc*=0, plFlavor=0x19f2d8*=0 | out: pVal=0x19f25c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f2dc*=3, plFlavor=0x19f2d8*=64) returned 0x0 [0219.323] IWbemClassObject:Get (in: This=0x4febf0, wszName="__PATH", lFlags=0, pVal=0x19f240*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f2c4*=0, plFlavor=0x19f2c0*=0 | out: pVal=0x19f240*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"", varVal2=0x0), pType=0x19f2c4*=8, plFlavor=0x19f2c0*=64) returned 0x0 [0219.323] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xc8 [0219.323] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xc8 [0219.323] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f26c | out: ppv=0x19f26c*=0x4d0cbc) returned 0x0 [0219.323] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f264 | out: pAptType=0x19f264*=1) returned 0x0 [0219.324] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f268 | out: ppvObject=0x19f268*=0x0) returned 0x80004002 [0219.324] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.324] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ebd8 | out: ppv=0x19ebd8*=0x58e648) returned 0x0 [0219.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e648, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19edf0 | out: ppvObject=0x19edf0*=0x0) returned 0x80004002 [0219.325] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e648, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee04 | out: ppvObject=0x19ee04*=0x5246c0) returned 0x0 [0219.325] WbemDefPath:IUnknown:Release (This=0x58e648) returned 0x0 [0219.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x5246c0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea24 | out: ppvObject=0x19ea24*=0x5246c0) returned 0x0 [0219.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x5246c0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e9e0 | out: ppvObject=0x19e9e0*=0x0) returned 0x80004002 [0219.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x5246c0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e5d4 | out: ppvObject=0x19e5d4*=0x0) returned 0x80004002 [0219.325] WbemDefPath:IUnknown:AddRef (This=0x5246c0) returned 0x3 [0219.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x5246c0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e33c | out: ppvObject=0x19e33c*=0x0) returned 0x80004002 [0219.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x5246c0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e2ec | out: ppvObject=0x19e2ec*=0x0) returned 0x80004002 [0219.326] WbemDefPath:IUnknown:QueryInterface (in: This=0x5246c0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e2f8 | out: ppvObject=0x19e2f8*=0x5553980) returned 0x0 [0219.326] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5553980, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e300 | out: pCid=0x19e300*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.326] WbemDefPath:IUnknown:Release (This=0x5553980) returned 0x3 [0219.326] CoGetContextToken (in: pToken=0x19e358 | out: pToken=0x19e358) returned 0x0 [0219.326] CoGetContextToken (in: pToken=0x19e760 | out: pToken=0x19e760) returned 0x0 [0219.326] WbemDefPath:IUnknown:QueryInterface (in: This=0x5246c0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7f0 | out: ppvObject=0x19e7f0*=0x0) returned 0x80004002 [0219.326] WbemDefPath:IUnknown:Release (This=0x5246c0) returned 0x2 [0219.326] WbemDefPath:IUnknown:Release (This=0x5246c0) returned 0x1 [0219.326] CoGetContextToken (in: pToken=0x19f0e8 | out: pToken=0x19f0e8) returned 0x0 [0219.326] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0219.326] WbemDefPath:IUnknown:QueryInterface (in: This=0x5246c0, riid=0x19f118*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f114 | out: ppvObject=0x19f114*=0x5246c0) returned 0x0 [0219.326] WbemDefPath:IUnknown:AddRef (This=0x5246c0) returned 0x3 [0219.326] WbemDefPath:IUnknown:Release (This=0x5246c0) returned 0x2 [0219.326] WbemDefPath:IWbemPath:SetText (This=0x5246c0, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiVirusProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0x0 [0219.327] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524570, puCount=0x19f298 | out: puCount=0x19f298*=0x2) returned 0x0 [0219.327] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=4, puBuffLength=0x19f294*=0x0, pszText=0x0 | out: puBuffLength=0x19f294*=0x19, pszText=0x0) returned 0x0 [0219.327] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=4, puBuffLength=0x19f294*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f294*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.327] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524570, puCount=0x19f264 | out: puCount=0x19f264*=0x2) returned 0x0 [0219.327] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=4, puBuffLength=0x19f260*=0x0, pszText=0x0 | out: puBuffLength=0x19f260*=0x19, pszText=0x0) returned 0x0 [0219.327] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=4, puBuffLength=0x19f260*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f260*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.327] IWbemClassObject:Get (in: This=0x4febf0, wszName="displayName", lFlags=0, pVal=0x19f260*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e3734*=0, plFlavor=0x23e3738*=0 | out: pVal=0x19f260*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x23e3734*=8, plFlavor=0x23e3738*=0) returned 0x0 [0219.327] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0219.327] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0219.327] IWbemClassObject:Get (in: This=0x4febf0, wszName="displayName", lFlags=0, pVal=0x19f268*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e3734*=8, plFlavor=0x23e3738*=0 | out: pVal=0x19f268*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x23e3734*=8, plFlavor=0x23e3738*=0) returned 0x0 [0219.327] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0219.327] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0219.327] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524570, puCount=0x19f264 | out: puCount=0x19f264*=0x2) returned 0x0 [0219.327] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=4, puBuffLength=0x19f260*=0x0, pszText=0x0 | out: puBuffLength=0x19f260*=0x19, pszText=0x0) returned 0x0 [0219.328] WbemDefPath:IWbemPath:GetText (in: This=0x524570, lFlags=4, puBuffLength=0x19f260*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f260*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.328] IWbemClassObject:Get (in: This=0x4febf0, wszName="displayName", lFlags=0, pVal=0x19f260*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e3844*=0, plFlavor=0x23e3848*=0 | out: pVal=0x19f260*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x23e3844*=8, plFlavor=0x23e3848*=0) returned 0x0 [0219.328] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0219.328] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0219.328] IWbemClassObject:Get (in: This=0x4febf0, wszName="displayName", lFlags=0, pVal=0x19f268*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e3844*=8, plFlavor=0x23e3848*=0 | out: pVal=0x19f268*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x23e3844*=8, plFlavor=0x23e3848*=0) returned 0x0 [0219.328] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0219.328] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0219.328] CoTaskMemAlloc (cb=0x4) returned 0x58e7d8 [0219.328] IEnumWbemClassObject:Next (in: This=0x58d018, lTimeout=-1, uCount=0x1, apObjects=0x58e7d8, puReturned=0x23e2e54 | out: apObjects=0x58e7d8*=0x0, puReturned=0x23e2e54*=0x0) returned 0x1 [0219.330] CoTaskMemFree (pv=0x58e7d8) [0219.330] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0219.330] WbemLocator:IUnknown:Release (This=0x4e5fc0) returned 0x1 [0219.330] IUnknown:Release (This=0x58d018) returned 0x0 [0219.331] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0219.331] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x1 [0219.331] IUnknown:Release (This=0x58cb68) returned 0x0 [0219.332] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f288 | out: ppv=0x19f288*=0x4d0cbc) returned 0x0 [0219.332] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f280 | out: pAptType=0x19f280*=1) returned 0x0 [0219.332] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x0) returned 0x80004002 [0219.332] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.333] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ebf0 | out: ppv=0x19ebf0*=0x58e698) returned 0x0 [0219.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e698, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ee08 | out: ppvObject=0x19ee08*=0x0) returned 0x80004002 [0219.334] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e698, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee1c | out: ppvObject=0x19ee1c*=0x5245e0) returned 0x0 [0219.334] WbemDefPath:IUnknown:Release (This=0x58e698) returned 0x0 [0219.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x5245e0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x5245e0) returned 0x0 [0219.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x5245e0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e9f8 | out: ppvObject=0x19e9f8*=0x0) returned 0x80004002 [0219.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x5245e0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e5ec | out: ppvObject=0x19e5ec*=0x0) returned 0x80004002 [0219.334] WbemDefPath:IUnknown:AddRef (This=0x5245e0) returned 0x3 [0219.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x5245e0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e354 | out: ppvObject=0x19e354*=0x0) returned 0x80004002 [0219.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x5245e0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e304 | out: ppvObject=0x19e304*=0x0) returned 0x80004002 [0219.334] WbemDefPath:IUnknown:QueryInterface (in: This=0x5245e0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e310 | out: ppvObject=0x19e310*=0x58a7f8) returned 0x0 [0219.334] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a7f8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e318 | out: pCid=0x19e318*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.334] WbemDefPath:IUnknown:Release (This=0x58a7f8) returned 0x3 [0219.334] CoGetContextToken (in: pToken=0x19e370 | out: pToken=0x19e370) returned 0x0 [0219.335] CoGetContextToken (in: pToken=0x19e778 | out: pToken=0x19e778) returned 0x0 [0219.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x5245e0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x0) returned 0x80004002 [0219.335] WbemDefPath:IUnknown:Release (This=0x5245e0) returned 0x2 [0219.335] WbemDefPath:IUnknown:Release (This=0x5245e0) returned 0x1 [0219.335] CoGetContextToken (in: pToken=0x19f100 | out: pToken=0x19f100) returned 0x0 [0219.335] CoGetContextToken (in: pToken=0x19f060 | out: pToken=0x19f060) returned 0x0 [0219.335] WbemDefPath:IUnknown:QueryInterface (in: This=0x5245e0, riid=0x19f130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f12c | out: ppvObject=0x19f12c*=0x5245e0) returned 0x0 [0219.335] WbemDefPath:IUnknown:AddRef (This=0x5245e0) returned 0x3 [0219.335] WbemDefPath:IUnknown:Release (This=0x5245e0) returned 0x2 [0219.335] WbemDefPath:IWbemPath:SetText (This=0x5245e0, uMode=0x4, pszPath="ROOT\\SecurityCenter2") returned 0x0 [0219.335] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5245e0, puCount=0x19f2b0 | out: puCount=0x19f2b0*=0x2) returned 0x0 [0219.335] WbemDefPath:IWbemPath:GetText (in: This=0x5245e0, lFlags=4, puBuffLength=0x19f2ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f2ac*=0x19, pszText=0x0) returned 0x0 [0219.335] WbemDefPath:IWbemPath:GetText (in: This=0x5245e0, lFlags=4, puBuffLength=0x19f2ac*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f2ac*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.335] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5245e0, puCount=0x19f29c | out: puCount=0x19f29c*=0x2) returned 0x0 [0219.335] WbemDefPath:IWbemPath:GetText (in: This=0x5245e0, lFlags=4, puBuffLength=0x19f298*=0x0, pszText=0x0 | out: puBuffLength=0x19f298*=0x19, pszText=0x0) returned 0x0 [0219.335] WbemDefPath:IWbemPath:GetText (in: This=0x5245e0, lFlags=4, puBuffLength=0x19f298*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f298*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.336] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f230 | out: ppv=0x19f230*=0x4d0cbc) returned 0x0 [0219.336] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f228 | out: pAptType=0x19f228*=1) returned 0x0 [0219.336] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f22c | out: ppvObject=0x19f22c*=0x0) returned 0x80004002 [0219.336] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.336] CoGetClassObject (in: rclsid=0x55079c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ee50 | out: ppv=0x19ee50*=0x58a630) returned 0x0 [0219.337] WbemLocator:IUnknown:QueryInterface (in: This=0x58a630, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19f068 | out: ppvObject=0x19f068*=0x0) returned 0x80004002 [0219.337] WbemLocator:IClassFactory:CreateInstance (in: This=0x58a630, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f07c | out: ppvObject=0x19f07c*=0x58e838) returned 0x0 [0219.337] WbemLocator:IUnknown:Release (This=0x58a630) returned 0x0 [0219.337] WbemLocator:IUnknown:QueryInterface (in: This=0x58e838, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec9c | out: ppvObject=0x19ec9c*=0x58e838) returned 0x0 [0219.337] WbemLocator:IUnknown:QueryInterface (in: This=0x58e838, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec58 | out: ppvObject=0x19ec58*=0x0) returned 0x80004002 [0219.337] WbemLocator:IUnknown:QueryInterface (in: This=0x58e838, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002 [0219.337] WbemLocator:IUnknown:AddRef (This=0x58e838) returned 0x3 [0219.337] WbemLocator:IUnknown:QueryInterface (in: This=0x58e838, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e5b4 | out: ppvObject=0x19e5b4*=0x0) returned 0x80004002 [0219.337] WbemLocator:IUnknown:QueryInterface (in: This=0x58e838, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e564 | out: ppvObject=0x19e564*=0x0) returned 0x80004002 [0219.337] WbemLocator:IUnknown:QueryInterface (in: This=0x58e838, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e570 | out: ppvObject=0x19e570*=0x0) returned 0x80004002 [0219.337] CoGetContextToken (in: pToken=0x19e5d0 | out: pToken=0x19e5d0) returned 0x0 [0219.338] CoGetContextToken (in: pToken=0x19e9d8 | out: pToken=0x19e9d8) returned 0x0 [0219.338] WbemLocator:IUnknown:QueryInterface (in: This=0x58e838, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea68 | out: ppvObject=0x19ea68*=0x0) returned 0x80004002 [0219.338] WbemLocator:IUnknown:Release (This=0x58e838) returned 0x2 [0219.338] WbemLocator:IUnknown:Release (This=0x58e838) returned 0x1 [0219.338] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0219.338] CoGetContextToken (in: pToken=0x19efa8 | out: pToken=0x19efa8) returned 0x0 [0219.338] WbemLocator:IUnknown:QueryInterface (in: This=0x58e838, riid=0x19f078*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19f074 | out: ppvObject=0x19f074*=0x58e838) returned 0x0 [0219.338] WbemLocator:IUnknown:AddRef (This=0x58e838) returned 0x3 [0219.339] WbemLocator:IUnknown:Release (This=0x58e838) returned 0x2 [0219.339] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5245e0, puCount=0x19f20c | out: puCount=0x19f20c*=0x2) returned 0x0 [0219.339] WbemDefPath:IWbemPath:GetText (in: This=0x5245e0, lFlags=8, puBuffLength=0x19f208*=0x0, pszText=0x0 | out: puBuffLength=0x19f208*=0x19, pszText=0x0) returned 0x0 [0219.339] WbemDefPath:IWbemPath:GetText (in: This=0x5245e0, lFlags=8, puBuffLength=0x19f208*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f208*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.339] CoCreateInstance (in: rclsid=0x6ce21284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ce212e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x19f0d0 | out: ppv=0x19f0d0*=0x58e778) returned 0x0 [0219.340] WbemLocator:IWbemLocator:ConnectServer (in: This=0x58e778, strNetworkResource="\\\\.\\ROOT\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x19f178 | out: ppNamespace=0x19f178*=0x57a028) returned 0x0 [0219.371] WbemLocator:IUnknown:QueryInterface (in: This=0x57a028, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f000 | out: ppvObject=0x19f000*=0x4e5a9c) returned 0x0 [0219.371] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4e5a9c, pProxy=0x57a028, pAuthnSvc=0x19f050, pAuthzSvc=0x19f04c, pServerPrincName=0x19f044, pAuthnLevel=0x19f048, pImpLevel=0x19f038, pAuthInfo=0x19f03c, pCapabilites=0x19f040 | out: pAuthnSvc=0x19f050*=0xa, pAuthzSvc=0x19f04c*=0x0, pServerPrincName=0x19f044, pAuthnLevel=0x19f048*=0x6, pImpLevel=0x19f038*=0x2, pAuthInfo=0x19f03c, pCapabilites=0x19f040*=0x1) returned 0x0 [0219.371] WbemLocator:IUnknown:Release (This=0x4e5a9c) returned 0x1 [0219.371] WbemLocator:IUnknown:QueryInterface (in: This=0x57a028, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eff4 | out: ppvObject=0x19eff4*=0x4e5ac0) returned 0x0 [0219.371] WbemLocator:IUnknown:QueryInterface (in: This=0x57a028, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eff0 | out: ppvObject=0x19eff0*=0x4e5a9c) returned 0x0 [0219.372] WbemLocator:IClientSecurity:SetBlanket (This=0x4e5a9c, pProxy=0x57a028, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.372] WbemLocator:IUnknown:Release (This=0x4e5a9c) returned 0x2 [0219.372] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x1 [0219.372] CoTaskMemFree (pv=0x50fa70) [0219.372] WbemLocator:IUnknown:Release (This=0x58e778) returned 0x0 [0219.372] WbemLocator:IUnknown:QueryInterface (in: This=0x57a028, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebf0 | out: ppvObject=0x19ebf0*=0x4e5ac0) returned 0x0 [0219.372] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ebac | out: ppvObject=0x19ebac*=0x0) returned 0x80004002 [0219.374] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e9cc | out: ppvObject=0x19e9cc*=0x0) returned 0x80004002 [0219.375] WbemLocator:IUnknown:QueryInterface (in: This=0x57a028, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e7a4 | out: ppvObject=0x19e7a4*=0x0) returned 0x80004002 [0219.375] WbemLocator:IUnknown:AddRef (This=0x4e5ac0) returned 0x3 [0219.376] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e50c | out: ppvObject=0x19e50c*=0x0) returned 0x80004002 [0219.376] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e4bc | out: ppvObject=0x19e4bc*=0x0) returned 0x80004002 [0219.376] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e4c8 | out: ppvObject=0x19e4c8*=0x4e5a1c) returned 0x0 [0219.376] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e5a1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e4d0 | out: pCid=0x19e4d0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.376] WbemLocator:IUnknown:Release (This=0x4e5a1c) returned 0x3 [0219.376] CoGetContextToken (in: pToken=0x19e528 | out: pToken=0x19e528) returned 0x0 [0219.376] CoGetContextToken (in: pToken=0x19e930 | out: pToken=0x19e930) returned 0x0 [0219.376] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9c0 | out: ppvObject=0x19e9c0*=0x4e5aa4) returned 0x0 [0219.376] WbemLocator:IRpcOptions:Query (in: This=0x4e5aa4, pPrx=0x4e5ac0, dwProperty=2, pdwValue=0x19e9e8 | out: pdwValue=0x19e9e8) returned 0x80004002 [0219.376] WbemLocator:IUnknown:Release (This=0x4e5aa4) returned 0x3 [0219.376] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x2 [0219.376] CoGetContextToken (in: pToken=0x19ef00 | out: pToken=0x19ef00) returned 0x0 [0219.376] CoGetContextToken (in: pToken=0x19ee60 | out: pToken=0x19ee60) returned 0x0 [0219.376] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x19ef30*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19ef2c | out: ppvObject=0x19ef2c*=0x57a028) returned 0x0 [0219.377] WbemLocator:IUnknown:AddRef (This=0x57a028) returned 0x4 [0219.377] WbemLocator:IUnknown:Release (This=0x57a028) returned 0x3 [0219.377] WbemLocator:IUnknown:Release (This=0x57a028) returned 0x2 [0219.377] SysStringLen (param_1=0x0) returned 0x0 [0219.377] CoGetContextToken (in: pToken=0x19ef10 | out: pToken=0x19ef10) returned 0x0 [0219.377] WbemLocator:IUnknown:AddRef (This=0x4e5ac0) returned 0x3 [0219.377] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ac0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eda4 | out: ppvObject=0x19eda4*=0x4e5ac0) returned 0x0 [0219.377] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x3 [0219.377] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x2 [0219.377] CoGetContextToken (in: pToken=0x19f000 | out: pToken=0x19f000) returned 0x0 [0219.377] WbemLocator:IUnknown:AddRef (This=0x57a028) returned 0x3 [0219.377] IWbemServices:ExecQuery (in: This=0x57a028, strQueryLanguage="WQL", strQuery="SELECT * FROM AntiSpyWareProduct", lFlags=16, pCtx=0x0, ppEnum=0x19f214 | out: ppEnum=0x19f214*=0x58caa0) returned 0x0 [0219.381] IUnknown:QueryInterface (in: This=0x58caa0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f074 | out: ppvObject=0x19f074*=0x58caa4) returned 0x0 [0219.381] IClientSecurity:QueryBlanket (in: This=0x58caa4, pProxy=0x58caa0, pAuthnSvc=0x19f0c4, pAuthzSvc=0x19f0c0, pServerPrincName=0x19f0b8, pAuthnLevel=0x19f0bc, pImpLevel=0x19f0ac, pAuthInfo=0x19f0b0, pCapabilites=0x19f0b4 | out: pAuthnSvc=0x19f0c4*=0xa, pAuthzSvc=0x19f0c0*=0x0, pServerPrincName=0x19f0b8, pAuthnLevel=0x19f0bc*=0x6, pImpLevel=0x19f0ac*=0x2, pAuthInfo=0x19f0b0, pCapabilites=0x19f0b4*=0x1) returned 0x0 [0219.381] IUnknown:Release (This=0x58caa4) returned 0x1 [0219.381] IUnknown:QueryInterface (in: This=0x58caa0, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f068 | out: ppvObject=0x19f068*=0x4e6dc0) returned 0x0 [0219.381] IUnknown:QueryInterface (in: This=0x58caa0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f064 | out: ppvObject=0x19f064*=0x58caa4) returned 0x0 [0219.381] IClientSecurity:SetBlanket (This=0x58caa4, pProxy=0x58caa0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.383] IUnknown:Release (This=0x58caa4) returned 0x2 [0219.383] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x1 [0219.383] CoTaskMemFree (pv=0x50fad0) [0219.383] IUnknown:QueryInterface (in: This=0x58caa0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x4e6dc0) returned 0x0 [0219.384] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec1c | out: ppvObject=0x19ec1c*=0x0) returned 0x80004002 [0219.384] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x0) returned 0x80004002 [0219.384] IUnknown:QueryInterface (in: This=0x58caa0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e814 | out: ppvObject=0x19e814*=0x0) returned 0x80004002 [0219.385] WbemLocator:IUnknown:AddRef (This=0x4e6dc0) returned 0x3 [0219.385] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e57c | out: ppvObject=0x19e57c*=0x0) returned 0x80004002 [0219.385] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e52c | out: ppvObject=0x19e52c*=0x0) returned 0x80004002 [0219.385] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e538 | out: ppvObject=0x19e538*=0x4e6d1c) returned 0x0 [0219.385] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6d1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e540 | out: pCid=0x19e540*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.385] WbemLocator:IUnknown:Release (This=0x4e6d1c) returned 0x3 [0219.385] CoGetContextToken (in: pToken=0x19e598 | out: pToken=0x19e598) returned 0x0 [0219.385] CoGetContextToken (in: pToken=0x19e9a0 | out: pToken=0x19e9a0) returned 0x0 [0219.385] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea30 | out: ppvObject=0x19ea30*=0x4e6da4) returned 0x0 [0219.385] WbemLocator:IRpcOptions:Query (in: This=0x4e6da4, pPrx=0x4e6dc0, dwProperty=2, pdwValue=0x19ea58 | out: pdwValue=0x19ea58) returned 0x80004002 [0219.385] WbemLocator:IUnknown:Release (This=0x4e6da4) returned 0x3 [0219.385] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x2 [0219.385] CoGetContextToken (in: pToken=0x19ef70 | out: pToken=0x19ef70) returned 0x0 [0219.385] CoGetContextToken (in: pToken=0x19eed0 | out: pToken=0x19eed0) returned 0x0 [0219.386] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x19efa0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ef9c | out: ppvObject=0x19ef9c*=0x58caa0) returned 0x0 [0219.386] IUnknown:AddRef (This=0x58caa0) returned 0x4 [0219.386] IUnknown:Release (This=0x58caa0) returned 0x3 [0219.386] IUnknown:Release (This=0x58caa0) returned 0x2 [0219.386] WbemLocator:IUnknown:Release (This=0x57a028) returned 0x2 [0219.386] SysStringLen (param_1=0x0) returned 0x0 [0219.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5245e0, puCount=0x19f260 | out: puCount=0x19f260*=0x2) returned 0x0 [0219.386] WbemDefPath:IWbemPath:GetText (in: This=0x5245e0, lFlags=4, puBuffLength=0x19f25c*=0x0, pszText=0x0 | out: puBuffLength=0x19f25c*=0x19, pszText=0x0) returned 0x0 [0219.386] WbemDefPath:IWbemPath:GetText (in: This=0x5245e0, lFlags=4, puBuffLength=0x19f25c*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f25c*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.386] CoGetContextToken (in: pToken=0x19f0b0 | out: pToken=0x19f0b0) returned 0x0 [0219.386] IUnknown:AddRef (This=0x58caa0) returned 0x3 [0219.386] IEnumWbemClassObject:Clone (in: This=0x58caa0, ppEnum=0x19f26c | out: ppEnum=0x19f26c*=0x58cdc0) returned 0x0 [0219.387] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f130 | out: ppvObject=0x19f130*=0x58cdc4) returned 0x0 [0219.387] IClientSecurity:QueryBlanket (in: This=0x58cdc4, pProxy=0x58cdc0, pAuthnSvc=0x19f180, pAuthzSvc=0x19f17c, pServerPrincName=0x19f174, pAuthnLevel=0x19f178, pImpLevel=0x19f168, pAuthInfo=0x19f16c, pCapabilites=0x19f170 | out: pAuthnSvc=0x19f180*=0xa, pAuthzSvc=0x19f17c*=0x0, pServerPrincName=0x19f174, pAuthnLevel=0x19f178*=0x6, pImpLevel=0x19f168*=0x2, pAuthInfo=0x19f16c, pCapabilites=0x19f170*=0x1) returned 0x0 [0219.387] IUnknown:Release (This=0x58cdc4) returned 0x1 [0219.387] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f124 | out: ppvObject=0x19f124*=0x4e6fc0) returned 0x0 [0219.387] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f120 | out: ppvObject=0x19f120*=0x58cdc4) returned 0x0 [0219.388] IClientSecurity:SetBlanket (This=0x58cdc4, pProxy=0x58cdc0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.389] IUnknown:Release (This=0x58cdc4) returned 0x2 [0219.389] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0219.389] CoTaskMemFree (pv=0x50fad0) [0219.389] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x4e6fc0) returned 0x0 [0219.390] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ecc8 | out: ppvObject=0x19ecc8*=0x0) returned 0x80004002 [0219.390] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002 [0219.391] IUnknown:QueryInterface (in: This=0x58cdc0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e8bc | out: ppvObject=0x19e8bc*=0x0) returned 0x80004002 [0219.392] WbemLocator:IUnknown:AddRef (This=0x4e6fc0) returned 0x3 [0219.392] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e624 | out: ppvObject=0x19e624*=0x0) returned 0x80004002 [0219.392] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e5d4 | out: ppvObject=0x19e5d4*=0x0) returned 0x80004002 [0219.392] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5e0 | out: ppvObject=0x19e5e0*=0x4e6f1c) returned 0x0 [0219.392] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6f1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e5e8 | out: pCid=0x19e5e8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.392] WbemLocator:IUnknown:Release (This=0x4e6f1c) returned 0x3 [0219.392] CoGetContextToken (in: pToken=0x19e640 | out: pToken=0x19e640) returned 0x0 [0219.392] CoGetContextToken (in: pToken=0x19ea48 | out: pToken=0x19ea48) returned 0x0 [0219.392] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ead8 | out: ppvObject=0x19ead8*=0x4e6fa4) returned 0x0 [0219.392] WbemLocator:IRpcOptions:Query (in: This=0x4e6fa4, pPrx=0x4e6fc0, dwProperty=2, pdwValue=0x19eb00 | out: pdwValue=0x19eb00) returned 0x80004002 [0219.392] WbemLocator:IUnknown:Release (This=0x4e6fa4) returned 0x3 [0219.392] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x2 [0219.392] CoGetContextToken (in: pToken=0x19f020 | out: pToken=0x19f020) returned 0x0 [0219.392] CoGetContextToken (in: pToken=0x19ef80 | out: pToken=0x19ef80) returned 0x0 [0219.393] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x19f050*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f04c | out: ppvObject=0x19f04c*=0x58cdc0) returned 0x0 [0219.393] IUnknown:AddRef (This=0x58cdc0) returned 0x4 [0219.393] IUnknown:Release (This=0x58cdc0) returned 0x3 [0219.393] IUnknown:Release (This=0x58cdc0) returned 0x2 [0219.393] IUnknown:Release (This=0x58caa0) returned 0x2 [0219.393] SysStringLen (param_1=0x0) returned 0x0 [0219.393] IEnumWbemClassObject:Reset (This=0x58cdc0) returned 0x0 [0219.394] CoTaskMemAlloc (cb=0x4) returned 0x58e7d8 [0219.394] IEnumWbemClassObject:Next (in: This=0x58cdc0, lTimeout=-1, uCount=0x1, apObjects=0x58e7d8, puReturned=0x23e4974 | out: apObjects=0x58e7d8*=0x4fe728, puReturned=0x23e4974*=0x1) returned 0x0 [0219.395] IUnknown:QueryInterface (in: This=0x4fe728, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e8d0 | out: ppvObject=0x19e8d0*=0x4fe728) returned 0x0 [0219.395] IUnknown:QueryInterface (in: This=0x4fe728, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e88c | out: ppvObject=0x19e88c*=0x0) returned 0x80004002 [0219.395] IUnknown:QueryInterface (in: This=0x4fe728, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e6ac | out: ppvObject=0x19e6ac*=0x0) returned 0x80004002 [0219.395] IUnknown:QueryInterface (in: This=0x4fe728, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e484 | out: ppvObject=0x19e484*=0x0) returned 0x80004002 [0219.396] IUnknown:AddRef (This=0x4fe728) returned 0x3 [0219.396] IUnknown:QueryInterface (in: This=0x4fe728, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e1ec | out: ppvObject=0x19e1ec*=0x0) returned 0x80004002 [0219.396] IUnknown:QueryInterface (in: This=0x4fe728, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e19c | out: ppvObject=0x19e19c*=0x0) returned 0x80004002 [0219.396] IUnknown:QueryInterface (in: This=0x4fe728, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e1a8 | out: ppvObject=0x19e1a8*=0x4fe72c) returned 0x0 [0219.396] IMarshal:GetUnmarshalClass (in: This=0x4fe72c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e1b0 | out: pCid=0x19e1b0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0219.396] IUnknown:Release (This=0x4fe72c) returned 0x3 [0219.396] CoGetContextToken (in: pToken=0x19e208 | out: pToken=0x19e208) returned 0x0 [0219.396] CoGetContextToken (in: pToken=0x19e610 | out: pToken=0x19e610) returned 0x0 [0219.396] IUnknown:QueryInterface (in: This=0x4fe728, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e6a0 | out: ppvObject=0x19e6a0*=0x0) returned 0x80004002 [0219.396] IUnknown:Release (This=0x4fe728) returned 0x2 [0219.397] CoGetContextToken (in: pToken=0x19ebe0 | out: pToken=0x19ebe0) returned 0x0 [0219.397] CoGetContextToken (in: pToken=0x19eb40 | out: pToken=0x19eb40) returned 0x0 [0219.397] IUnknown:QueryInterface (in: This=0x4fe728, riid=0x19ec10*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ec0c | out: ppvObject=0x19ec0c*=0x4fe728) returned 0x0 [0219.397] IUnknown:AddRef (This=0x4fe728) returned 0x4 [0219.397] IUnknown:Release (This=0x4fe728) returned 0x3 [0219.397] IUnknown:Release (This=0x4fe728) returned 0x2 [0219.397] CoTaskMemFree (pv=0x58e7d8) [0219.397] CoGetContextToken (in: pToken=0x19ef48 | out: pToken=0x19ef48) returned 0x0 [0219.397] IUnknown:AddRef (This=0x4fe728) returned 0x3 [0219.397] IWbemClassObject:Get (in: This=0x4fe728, wszName="__GENUS", lFlags=0, pVal=0x19f25c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f2dc*=0, plFlavor=0x19f2d8*=0 | out: pVal=0x19f25c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f2dc*=3, plFlavor=0x19f2d8*=64) returned 0x0 [0219.397] IWbemClassObject:Get (in: This=0x4fe728, wszName="__PATH", lFlags=0, pVal=0x19f240*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f2c4*=0, plFlavor=0x19f2c0*=0 | out: pVal=0x19f240*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiSpywareProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"", varVal2=0x0), pType=0x19f2c4*=8, plFlavor=0x19f2c0*=64) returned 0x0 [0219.397] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiSpywareProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xcc [0219.397] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiSpywareProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0xcc [0219.398] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f26c | out: ppv=0x19f26c*=0x4d0cbc) returned 0x0 [0219.398] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f264 | out: pAptType=0x19f264*=1) returned 0x0 [0219.398] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f268 | out: ppvObject=0x19f268*=0x0) returned 0x80004002 [0219.398] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.399] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ebd8 | out: ppv=0x19ebd8*=0x58e6c8) returned 0x0 [0219.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6c8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19edf0 | out: ppvObject=0x19edf0*=0x0) returned 0x80004002 [0219.399] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6c8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee04 | out: ppvObject=0x19ee04*=0x524730) returned 0x0 [0219.399] WbemDefPath:IUnknown:Release (This=0x58e6c8) returned 0x0 [0219.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x524730, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea24 | out: ppvObject=0x19ea24*=0x524730) returned 0x0 [0219.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x524730, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e9e0 | out: ppvObject=0x19e9e0*=0x0) returned 0x80004002 [0219.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x524730, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e5d4 | out: ppvObject=0x19e5d4*=0x0) returned 0x80004002 [0219.400] WbemDefPath:IUnknown:AddRef (This=0x524730) returned 0x3 [0219.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x524730, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e33c | out: ppvObject=0x19e33c*=0x0) returned 0x80004002 [0219.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x524730, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e2ec | out: ppvObject=0x19e2ec*=0x0) returned 0x80004002 [0219.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x524730, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e2f8 | out: ppvObject=0x19e2f8*=0x58a7b0) returned 0x0 [0219.400] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a7b0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e300 | out: pCid=0x19e300*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.400] WbemDefPath:IUnknown:Release (This=0x58a7b0) returned 0x3 [0219.400] CoGetContextToken (in: pToken=0x19e358 | out: pToken=0x19e358) returned 0x0 [0219.400] CoGetContextToken (in: pToken=0x19e760 | out: pToken=0x19e760) returned 0x0 [0219.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x524730, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7f0 | out: ppvObject=0x19e7f0*=0x0) returned 0x80004002 [0219.400] WbemDefPath:IUnknown:Release (This=0x524730) returned 0x2 [0219.400] WbemDefPath:IUnknown:Release (This=0x524730) returned 0x1 [0219.400] CoGetContextToken (in: pToken=0x19f0e8 | out: pToken=0x19f0e8) returned 0x0 [0219.400] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0219.400] WbemDefPath:IUnknown:QueryInterface (in: This=0x524730, riid=0x19f118*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f114 | out: ppvObject=0x19f114*=0x524730) returned 0x0 [0219.400] WbemDefPath:IUnknown:AddRef (This=0x524730) returned 0x3 [0219.400] WbemDefPath:IUnknown:Release (This=0x524730) returned 0x2 [0219.401] WbemDefPath:IWbemPath:SetText (This=0x524730, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\SecurityCenter2:AntiSpywareProduct.instanceGuid=\"{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\"") returned 0x0 [0219.401] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5245e0, puCount=0x19f298 | out: puCount=0x19f298*=0x2) returned 0x0 [0219.401] WbemDefPath:IWbemPath:GetText (in: This=0x5245e0, lFlags=4, puBuffLength=0x19f294*=0x0, pszText=0x0 | out: puBuffLength=0x19f294*=0x19, pszText=0x0) returned 0x0 [0219.401] WbemDefPath:IWbemPath:GetText (in: This=0x5245e0, lFlags=4, puBuffLength=0x19f294*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f294*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.401] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5245e0, puCount=0x19f264 | out: puCount=0x19f264*=0x2) returned 0x0 [0219.401] WbemDefPath:IWbemPath:GetText (in: This=0x5245e0, lFlags=4, puBuffLength=0x19f260*=0x0, pszText=0x0 | out: puBuffLength=0x19f260*=0x19, pszText=0x0) returned 0x0 [0219.401] WbemDefPath:IWbemPath:GetText (in: This=0x5245e0, lFlags=4, puBuffLength=0x19f260*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f260*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.401] IWbemClassObject:Get (in: This=0x4fe728, wszName="displayName", lFlags=0, pVal=0x19f260*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e5258*=0, plFlavor=0x23e525c*=0 | out: pVal=0x19f260*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x23e5258*=8, plFlavor=0x23e525c*=0) returned 0x0 [0219.401] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0219.401] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0219.401] IWbemClassObject:Get (in: This=0x4fe728, wszName="displayName", lFlags=0, pVal=0x19f268*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e5258*=8, plFlavor=0x23e525c*=0 | out: pVal=0x19f268*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Windows Defender", varVal2=0x0), pType=0x23e5258*=8, plFlavor=0x23e525c*=0) returned 0x0 [0219.401] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0219.401] SysStringByteLen (bstr="Windows Defender") returned 0x20 [0219.402] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0219.402] IEnumWbemClassObject:Next (in: This=0x58cdc0, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23e4974 | out: apObjects=0x58e7e8*=0x0, puReturned=0x23e4974*=0x0) returned 0x1 [0219.402] CoTaskMemFree (pv=0x58e7e8) [0219.402] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0219.402] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0219.402] IUnknown:Release (This=0x58cdc0) returned 0x0 [0219.403] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0219.403] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x1 [0219.403] IUnknown:Release (This=0x58caa0) returned 0x0 [0219.404] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f288 | out: ppv=0x19f288*=0x4d0cbc) returned 0x0 [0219.404] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f280 | out: pAptType=0x19f280*=1) returned 0x0 [0219.404] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x0) returned 0x80004002 [0219.404] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.405] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ebf0 | out: ppv=0x19ebf0*=0x58e7e8) returned 0x0 [0219.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ee08 | out: ppvObject=0x19ee08*=0x0) returned 0x80004002 [0219.405] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee1c | out: ppvObject=0x19ee1c*=0x524810) returned 0x0 [0219.406] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0219.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x524810) returned 0x0 [0219.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e9f8 | out: ppvObject=0x19e9f8*=0x0) returned 0x80004002 [0219.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e5ec | out: ppvObject=0x19e5ec*=0x0) returned 0x80004002 [0219.406] WbemDefPath:IUnknown:AddRef (This=0x524810) returned 0x3 [0219.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e354 | out: ppvObject=0x19e354*=0x0) returned 0x80004002 [0219.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e304 | out: ppvObject=0x19e304*=0x0) returned 0x80004002 [0219.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e310 | out: ppvObject=0x19e310*=0x58a558) returned 0x0 [0219.406] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a558, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e318 | out: pCid=0x19e318*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.406] WbemDefPath:IUnknown:Release (This=0x58a558) returned 0x3 [0219.406] CoGetContextToken (in: pToken=0x19e370 | out: pToken=0x19e370) returned 0x0 [0219.406] CoGetContextToken (in: pToken=0x19e778 | out: pToken=0x19e778) returned 0x0 [0219.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x0) returned 0x80004002 [0219.407] WbemDefPath:IUnknown:Release (This=0x524810) returned 0x2 [0219.407] WbemDefPath:IUnknown:Release (This=0x524810) returned 0x1 [0219.407] CoGetContextToken (in: pToken=0x19f100 | out: pToken=0x19f100) returned 0x0 [0219.407] CoGetContextToken (in: pToken=0x19f060 | out: pToken=0x19f060) returned 0x0 [0219.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x19f130*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f12c | out: ppvObject=0x19f12c*=0x524810) returned 0x0 [0219.407] WbemDefPath:IUnknown:AddRef (This=0x524810) returned 0x3 [0219.407] WbemDefPath:IUnknown:Release (This=0x524810) returned 0x2 [0219.407] WbemDefPath:IWbemPath:SetText (This=0x524810, uMode=0x4, pszPath="ROOT\\SecurityCenter2") returned 0x0 [0219.407] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524810, puCount=0x19f2b0 | out: puCount=0x19f2b0*=0x2) returned 0x0 [0219.407] WbemDefPath:IWbemPath:GetText (in: This=0x524810, lFlags=4, puBuffLength=0x19f2ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f2ac*=0x19, pszText=0x0) returned 0x0 [0219.407] WbemDefPath:IWbemPath:GetText (in: This=0x524810, lFlags=4, puBuffLength=0x19f2ac*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f2ac*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.407] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524810, puCount=0x19f29c | out: puCount=0x19f29c*=0x2) returned 0x0 [0219.407] WbemDefPath:IWbemPath:GetText (in: This=0x524810, lFlags=4, puBuffLength=0x19f298*=0x0, pszText=0x0 | out: puBuffLength=0x19f298*=0x19, pszText=0x0) returned 0x0 [0219.407] WbemDefPath:IWbemPath:GetText (in: This=0x524810, lFlags=4, puBuffLength=0x19f298*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f298*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.407] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f230 | out: ppv=0x19f230*=0x4d0cbc) returned 0x0 [0219.407] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f228 | out: pAptType=0x19f228*=1) returned 0x0 [0219.407] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f22c | out: ppvObject=0x19f22c*=0x0) returned 0x80004002 [0219.408] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.408] CoGetClassObject (in: rclsid=0x55079c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ee50 | out: ppv=0x19ee50*=0x58a888) returned 0x0 [0219.408] WbemLocator:IUnknown:QueryInterface (in: This=0x58a888, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19f068 | out: ppvObject=0x19f068*=0x0) returned 0x80004002 [0219.408] WbemLocator:IClassFactory:CreateInstance (in: This=0x58a888, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f07c | out: ppvObject=0x19f07c*=0x58e798) returned 0x0 [0219.409] WbemLocator:IUnknown:Release (This=0x58a888) returned 0x0 [0219.409] WbemLocator:IUnknown:QueryInterface (in: This=0x58e798, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec9c | out: ppvObject=0x19ec9c*=0x58e798) returned 0x0 [0219.409] WbemLocator:IUnknown:QueryInterface (in: This=0x58e798, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec58 | out: ppvObject=0x19ec58*=0x0) returned 0x80004002 [0219.409] WbemLocator:IUnknown:QueryInterface (in: This=0x58e798, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002 [0219.409] WbemLocator:IUnknown:AddRef (This=0x58e798) returned 0x3 [0219.409] WbemLocator:IUnknown:QueryInterface (in: This=0x58e798, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e5b4 | out: ppvObject=0x19e5b4*=0x0) returned 0x80004002 [0219.409] WbemLocator:IUnknown:QueryInterface (in: This=0x58e798, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e564 | out: ppvObject=0x19e564*=0x0) returned 0x80004002 [0219.411] WbemLocator:IUnknown:QueryInterface (in: This=0x58e798, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e570 | out: ppvObject=0x19e570*=0x0) returned 0x80004002 [0219.411] CoGetContextToken (in: pToken=0x19e5d0 | out: pToken=0x19e5d0) returned 0x0 [0219.411] CoGetContextToken (in: pToken=0x19e9d8 | out: pToken=0x19e9d8) returned 0x0 [0219.411] WbemLocator:IUnknown:QueryInterface (in: This=0x58e798, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea68 | out: ppvObject=0x19ea68*=0x0) returned 0x80004002 [0219.411] WbemLocator:IUnknown:Release (This=0x58e798) returned 0x2 [0219.411] WbemLocator:IUnknown:Release (This=0x58e798) returned 0x1 [0219.411] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0 [0219.411] CoGetContextToken (in: pToken=0x19efa8 | out: pToken=0x19efa8) returned 0x0 [0219.411] WbemLocator:IUnknown:QueryInterface (in: This=0x58e798, riid=0x19f078*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19f074 | out: ppvObject=0x19f074*=0x58e798) returned 0x0 [0219.411] WbemLocator:IUnknown:AddRef (This=0x58e798) returned 0x3 [0219.411] WbemLocator:IUnknown:Release (This=0x58e798) returned 0x2 [0219.411] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524810, puCount=0x19f20c | out: puCount=0x19f20c*=0x2) returned 0x0 [0219.411] WbemDefPath:IWbemPath:GetText (in: This=0x524810, lFlags=8, puBuffLength=0x19f208*=0x0, pszText=0x0 | out: puBuffLength=0x19f208*=0x19, pszText=0x0) returned 0x0 [0219.412] WbemDefPath:IWbemPath:GetText (in: This=0x524810, lFlags=8, puBuffLength=0x19f208*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f208*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.412] CoCreateInstance (in: rclsid=0x6ce21284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ce212e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x19f0d0 | out: ppv=0x19f0d0*=0x58e738) returned 0x0 [0219.412] WbemLocator:IWbemLocator:ConnectServer (in: This=0x58e738, strNetworkResource="\\\\.\\ROOT\\SecurityCenter2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x19f178 | out: ppNamespace=0x19f178*=0x579c68) returned 0x0 [0219.433] WbemLocator:IUnknown:QueryInterface (in: This=0x579c68, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f000 | out: ppvObject=0x19f000*=0x4e6d9c) returned 0x0 [0219.433] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4e6d9c, pProxy=0x579c68, pAuthnSvc=0x19f050, pAuthzSvc=0x19f04c, pServerPrincName=0x19f044, pAuthnLevel=0x19f048, pImpLevel=0x19f038, pAuthInfo=0x19f03c, pCapabilites=0x19f040 | out: pAuthnSvc=0x19f050*=0xa, pAuthzSvc=0x19f04c*=0x0, pServerPrincName=0x19f044, pAuthnLevel=0x19f048*=0x6, pImpLevel=0x19f038*=0x2, pAuthInfo=0x19f03c, pCapabilites=0x19f040*=0x1) returned 0x0 [0219.433] WbemLocator:IUnknown:Release (This=0x4e6d9c) returned 0x1 [0219.433] WbemLocator:IUnknown:QueryInterface (in: This=0x579c68, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eff4 | out: ppvObject=0x19eff4*=0x4e6dc0) returned 0x0 [0219.433] WbemLocator:IUnknown:QueryInterface (in: This=0x579c68, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eff0 | out: ppvObject=0x19eff0*=0x4e6d9c) returned 0x0 [0219.433] WbemLocator:IClientSecurity:SetBlanket (This=0x4e6d9c, pProxy=0x579c68, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.434] WbemLocator:IUnknown:Release (This=0x4e6d9c) returned 0x2 [0219.434] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x1 [0219.434] CoTaskMemFree (pv=0x50fa70) [0219.434] WbemLocator:IUnknown:Release (This=0x58e738) returned 0x0 [0219.434] WbemLocator:IUnknown:QueryInterface (in: This=0x579c68, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebf0 | out: ppvObject=0x19ebf0*=0x4e6dc0) returned 0x0 [0219.434] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ebac | out: ppvObject=0x19ebac*=0x0) returned 0x80004002 [0219.438] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e9cc | out: ppvObject=0x19e9cc*=0x0) returned 0x80004002 [0219.438] WbemLocator:IUnknown:QueryInterface (in: This=0x579c68, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e7a4 | out: ppvObject=0x19e7a4*=0x0) returned 0x80004002 [0219.441] WbemLocator:IUnknown:AddRef (This=0x4e6dc0) returned 0x3 [0219.441] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e50c | out: ppvObject=0x19e50c*=0x0) returned 0x80004002 [0219.441] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e4bc | out: ppvObject=0x19e4bc*=0x0) returned 0x80004002 [0219.441] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e4c8 | out: ppvObject=0x19e4c8*=0x4e6d1c) returned 0x0 [0219.441] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6d1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e4d0 | out: pCid=0x19e4d0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.441] WbemLocator:IUnknown:Release (This=0x4e6d1c) returned 0x3 [0219.441] CoGetContextToken (in: pToken=0x19e528 | out: pToken=0x19e528) returned 0x0 [0219.441] CoGetContextToken (in: pToken=0x19e930 | out: pToken=0x19e930) returned 0x0 [0219.441] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9c0 | out: ppvObject=0x19e9c0*=0x4e6da4) returned 0x0 [0219.441] WbemLocator:IRpcOptions:Query (in: This=0x4e6da4, pPrx=0x4e6dc0, dwProperty=2, pdwValue=0x19e9e8 | out: pdwValue=0x19e9e8) returned 0x80004002 [0219.442] WbemLocator:IUnknown:Release (This=0x4e6da4) returned 0x3 [0219.442] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x2 [0219.442] CoGetContextToken (in: pToken=0x19ef00 | out: pToken=0x19ef00) returned 0x0 [0219.442] CoGetContextToken (in: pToken=0x19ee60 | out: pToken=0x19ee60) returned 0x0 [0219.442] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x19ef30*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19ef2c | out: ppvObject=0x19ef2c*=0x579c68) returned 0x0 [0219.442] WbemLocator:IUnknown:AddRef (This=0x579c68) returned 0x4 [0219.442] WbemLocator:IUnknown:Release (This=0x579c68) returned 0x3 [0219.442] WbemLocator:IUnknown:Release (This=0x579c68) returned 0x2 [0219.442] SysStringLen (param_1=0x0) returned 0x0 [0219.442] CoGetContextToken (in: pToken=0x19ef10 | out: pToken=0x19ef10) returned 0x0 [0219.442] WbemLocator:IUnknown:AddRef (This=0x4e6dc0) returned 0x3 [0219.442] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eda4 | out: ppvObject=0x19eda4*=0x4e6dc0) returned 0x0 [0219.442] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x3 [0219.442] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x2 [0219.442] CoGetContextToken (in: pToken=0x19f008 | out: pToken=0x19f008) returned 0x0 [0219.442] WbemLocator:IUnknown:AddRef (This=0x579c68) returned 0x3 [0219.442] IWbemServices:ExecQuery (in: This=0x579c68, strQueryLanguage="WQL", strQuery="SELECT * FROM FirewallProduct", lFlags=16, pCtx=0x0, ppEnum=0x19f214 | out: ppEnum=0x19f214*=0x58cc30) returned 0x0 [0219.450] IUnknown:QueryInterface (in: This=0x58cc30, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f078 | out: ppvObject=0x19f078*=0x58cc34) returned 0x0 [0219.450] IClientSecurity:QueryBlanket (in: This=0x58cc34, pProxy=0x58cc30, pAuthnSvc=0x19f0c8, pAuthzSvc=0x19f0c4, pServerPrincName=0x19f0bc, pAuthnLevel=0x19f0c0, pImpLevel=0x19f0b0, pAuthInfo=0x19f0b4, pCapabilites=0x19f0b8 | out: pAuthnSvc=0x19f0c8*=0xa, pAuthzSvc=0x19f0c4*=0x0, pServerPrincName=0x19f0bc, pAuthnLevel=0x19f0c0*=0x6, pImpLevel=0x19f0b0*=0x2, pAuthInfo=0x19f0b4, pCapabilites=0x19f0b8*=0x1) returned 0x0 [0219.450] IUnknown:Release (This=0x58cc34) returned 0x1 [0219.450] IUnknown:QueryInterface (in: This=0x58cc30, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f06c | out: ppvObject=0x19f06c*=0x4e60c0) returned 0x0 [0219.450] IUnknown:QueryInterface (in: This=0x58cc30, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f068 | out: ppvObject=0x19f068*=0x58cc34) returned 0x0 [0219.450] IClientSecurity:SetBlanket (This=0x58cc34, pProxy=0x58cc30, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.452] IUnknown:Release (This=0x58cc34) returned 0x2 [0219.452] WbemLocator:IUnknown:Release (This=0x4e60c0) returned 0x1 [0219.452] CoTaskMemFree (pv=0x50fa40) [0219.452] IUnknown:QueryInterface (in: This=0x58cc30, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec64 | out: ppvObject=0x19ec64*=0x4e60c0) returned 0x0 [0219.452] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec20 | out: ppvObject=0x19ec20*=0x0) returned 0x80004002 [0219.453] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea3c | out: ppvObject=0x19ea3c*=0x0) returned 0x80004002 [0219.453] IUnknown:QueryInterface (in: This=0x58cc30, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e814 | out: ppvObject=0x19e814*=0x0) returned 0x80004002 [0219.453] WbemLocator:IUnknown:AddRef (This=0x4e60c0) returned 0x3 [0219.454] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e57c | out: ppvObject=0x19e57c*=0x0) returned 0x80004002 [0219.454] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e52c | out: ppvObject=0x19e52c*=0x0) returned 0x80004002 [0219.454] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e538 | out: ppvObject=0x19e538*=0x4e601c) returned 0x0 [0219.454] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e601c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e540 | out: pCid=0x19e540*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.454] WbemLocator:IUnknown:Release (This=0x4e601c) returned 0x3 [0219.454] CoGetContextToken (in: pToken=0x19e598 | out: pToken=0x19e598) returned 0x0 [0219.454] CoGetContextToken (in: pToken=0x19e9a0 | out: pToken=0x19e9a0) returned 0x0 [0219.454] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea30 | out: ppvObject=0x19ea30*=0x4e60a4) returned 0x0 [0219.454] WbemLocator:IRpcOptions:Query (in: This=0x4e60a4, pPrx=0x4e60c0, dwProperty=2, pdwValue=0x19ea58 | out: pdwValue=0x19ea58) returned 0x80004002 [0219.454] WbemLocator:IUnknown:Release (This=0x4e60a4) returned 0x3 [0219.454] WbemLocator:IUnknown:Release (This=0x4e60c0) returned 0x2 [0219.454] CoGetContextToken (in: pToken=0x19ef78 | out: pToken=0x19ef78) returned 0x0 [0219.454] CoGetContextToken (in: pToken=0x19eed8 | out: pToken=0x19eed8) returned 0x0 [0219.454] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x19efa8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19efa4 | out: ppvObject=0x19efa4*=0x58cc30) returned 0x0 [0219.454] IUnknown:AddRef (This=0x58cc30) returned 0x4 [0219.454] IUnknown:Release (This=0x58cc30) returned 0x3 [0219.454] IUnknown:Release (This=0x58cc30) returned 0x2 [0219.455] WbemLocator:IUnknown:Release (This=0x579c68) returned 0x2 [0219.455] SysStringLen (param_1=0x0) returned 0x0 [0219.455] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524810, puCount=0x19f260 | out: puCount=0x19f260*=0x2) returned 0x0 [0219.455] WbemDefPath:IWbemPath:GetText (in: This=0x524810, lFlags=4, puBuffLength=0x19f25c*=0x0, pszText=0x0 | out: puBuffLength=0x19f25c*=0x19, pszText=0x0) returned 0x0 [0219.455] WbemDefPath:IWbemPath:GetText (in: This=0x524810, lFlags=4, puBuffLength=0x19f25c*=0x19, pszText="000000000000000000000000" | out: puBuffLength=0x19f25c*=0x19, pszText="\\\\.\\ROOT\\SecurityCenter2") returned 0x0 [0219.455] CoGetContextToken (in: pToken=0x19f0b0 | out: pToken=0x19f0b0) returned 0x0 [0219.455] IUnknown:AddRef (This=0x58cc30) returned 0x3 [0219.455] IEnumWbemClassObject:Clone (in: This=0x58cc30, ppEnum=0x19f26c | out: ppEnum=0x19f26c*=0x58ccf8) returned 0x0 [0219.456] IUnknown:QueryInterface (in: This=0x58ccf8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f130 | out: ppvObject=0x19f130*=0x58ccfc) returned 0x0 [0219.456] IClientSecurity:QueryBlanket (in: This=0x58ccfc, pProxy=0x58ccf8, pAuthnSvc=0x19f180, pAuthzSvc=0x19f17c, pServerPrincName=0x19f174, pAuthnLevel=0x19f178, pImpLevel=0x19f168, pAuthInfo=0x19f16c, pCapabilites=0x19f170 | out: pAuthnSvc=0x19f180*=0xa, pAuthzSvc=0x19f17c*=0x0, pServerPrincName=0x19f174, pAuthnLevel=0x19f178*=0x6, pImpLevel=0x19f168*=0x2, pAuthInfo=0x19f16c, pCapabilites=0x19f170*=0x1) returned 0x0 [0219.456] IUnknown:Release (This=0x58ccfc) returned 0x1 [0219.456] IUnknown:QueryInterface (in: This=0x58ccf8, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f124 | out: ppvObject=0x19f124*=0x4e6fc0) returned 0x0 [0219.456] IUnknown:QueryInterface (in: This=0x58ccf8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f120 | out: ppvObject=0x19f120*=0x58ccfc) returned 0x0 [0219.456] IClientSecurity:SetBlanket (This=0x58ccfc, pProxy=0x58ccf8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.458] IUnknown:Release (This=0x58ccfc) returned 0x2 [0219.458] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0219.458] CoTaskMemFree (pv=0x50fb00) [0219.458] IUnknown:QueryInterface (in: This=0x58ccf8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x4e6fc0) returned 0x0 [0219.458] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ecc8 | out: ppvObject=0x19ecc8*=0x0) returned 0x80004002 [0219.459] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002 [0219.460] IUnknown:QueryInterface (in: This=0x58ccf8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e8bc | out: ppvObject=0x19e8bc*=0x0) returned 0x80004002 [0219.461] WbemLocator:IUnknown:AddRef (This=0x4e6fc0) returned 0x3 [0219.461] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e624 | out: ppvObject=0x19e624*=0x0) returned 0x80004002 [0219.461] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e5d4 | out: ppvObject=0x19e5d4*=0x0) returned 0x80004002 [0219.461] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5e0 | out: ppvObject=0x19e5e0*=0x4e6f1c) returned 0x0 [0219.461] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6f1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e5e8 | out: pCid=0x19e5e8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.461] WbemLocator:IUnknown:Release (This=0x4e6f1c) returned 0x3 [0219.461] CoGetContextToken (in: pToken=0x19e640 | out: pToken=0x19e640) returned 0x0 [0219.461] CoGetContextToken (in: pToken=0x19ea48 | out: pToken=0x19ea48) returned 0x0 [0219.461] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ead8 | out: ppvObject=0x19ead8*=0x4e6fa4) returned 0x0 [0219.461] WbemLocator:IRpcOptions:Query (in: This=0x4e6fa4, pPrx=0x4e6fc0, dwProperty=2, pdwValue=0x19eb00 | out: pdwValue=0x19eb00) returned 0x80004002 [0219.461] WbemLocator:IUnknown:Release (This=0x4e6fa4) returned 0x3 [0219.462] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x2 [0219.462] CoGetContextToken (in: pToken=0x19f020 | out: pToken=0x19f020) returned 0x0 [0219.462] CoGetContextToken (in: pToken=0x19ef80 | out: pToken=0x19ef80) returned 0x0 [0219.462] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x19f050*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f04c | out: ppvObject=0x19f04c*=0x58ccf8) returned 0x0 [0219.462] IUnknown:AddRef (This=0x58ccf8) returned 0x4 [0219.462] IUnknown:Release (This=0x58ccf8) returned 0x3 [0219.462] IUnknown:Release (This=0x58ccf8) returned 0x2 [0219.462] IUnknown:Release (This=0x58cc30) returned 0x2 [0219.462] SysStringLen (param_1=0x0) returned 0x0 [0219.462] IEnumWbemClassObject:Reset (This=0x58ccf8) returned 0x0 [0219.463] CoTaskMemAlloc (cb=0x4) returned 0x58e658 [0219.463] IEnumWbemClassObject:Next (in: This=0x58ccf8, lTimeout=-1, uCount=0x1, apObjects=0x58e658, puReturned=0x23e6364 | out: apObjects=0x58e658*=0x0, puReturned=0x23e6364*=0x0) returned 0x1 [0219.467] CoTaskMemFree (pv=0x58e658) [0219.467] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0219.467] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0219.467] IUnknown:Release (This=0x58ccf8) returned 0x0 [0219.469] CoGetContextToken (in: pToken=0x19f198 | out: pToken=0x19f198) returned 0x0 [0219.469] WbemLocator:IUnknown:Release (This=0x4e60c0) returned 0x1 [0219.469] IUnknown:Release (This=0x58cc30) returned 0x0 [0219.480] CoCreateGuid (in: pguid=0x19efd4 | out: pguid=0x19efd4*(Data1=0x50ab96d0, Data2=0xe90b, Data3=0x427e, Data4=([0]=0x90, [1]=0xb, [2]=0x89, [3]=0xfe, [4]=0x30, [5]=0xa7, [6]=0x70, [7]=0x98))) returned 0x0 [0219.480] CoCreateGuid (in: pguid=0x19ef04 | out: pguid=0x19ef04*(Data1=0x5be297bb, Data2=0x89f7, Data3=0x4a22, Data4=([0]=0xb8, [1]=0xc2, [2]=0xe5, [3]=0x11, [4]=0x9, [5]=0x8c, [6]=0xd4, [7]=0x24))) returned 0x0 [0219.480] send (s=0x2cc, buf=0x22f8843*, len=191, flags=0) returned 191 [0219.481] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 125 [0219.542] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f274 | out: puCount=0x19f274*=0x2) returned 0x0 [0219.542] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f270*=0x0, pszText=0x0 | out: puBuffLength=0x19f270*=0xf, pszText=0x0) returned 0x0 [0219.542] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f270*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f270*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0219.542] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f200 | out: ppv=0x19f200*=0x4d0cbc) returned 0x0 [0219.542] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1f8 | out: pAptType=0x19f1f8*=1) returned 0x0 [0219.542] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1fc | out: ppvObject=0x19f1fc*=0x0) returned 0x80004002 [0219.542] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0219.543] CoGetClassObject (in: rclsid=0x55079c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ee20 | out: ppv=0x19ee20*=0x58a2b8) returned 0x0 [0219.543] WbemLocator:IUnknown:QueryInterface (in: This=0x58a2b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19f038 | out: ppvObject=0x19f038*=0x0) returned 0x80004002 [0219.543] WbemLocator:IClassFactory:CreateInstance (in: This=0x58a2b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f04c | out: ppvObject=0x19f04c*=0x58e778) returned 0x0 [0219.544] WbemLocator:IUnknown:Release (This=0x58a2b8) returned 0x0 [0219.544] WbemLocator:IUnknown:QueryInterface (in: This=0x58e778, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x58e778) returned 0x0 [0219.544] WbemLocator:IUnknown:QueryInterface (in: This=0x58e778, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec28 | out: ppvObject=0x19ec28*=0x0) returned 0x80004002 [0219.544] WbemLocator:IUnknown:QueryInterface (in: This=0x58e778, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e81c | out: ppvObject=0x19e81c*=0x0) returned 0x80004002 [0219.544] WbemLocator:IUnknown:AddRef (This=0x58e778) returned 0x3 [0219.544] WbemLocator:IUnknown:QueryInterface (in: This=0x58e778, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e584 | out: ppvObject=0x19e584*=0x0) returned 0x80004002 [0219.544] WbemLocator:IUnknown:QueryInterface (in: This=0x58e778, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e534 | out: ppvObject=0x19e534*=0x0) returned 0x80004002 [0219.544] WbemLocator:IUnknown:QueryInterface (in: This=0x58e778, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e540 | out: ppvObject=0x19e540*=0x0) returned 0x80004002 [0219.544] CoGetContextToken (in: pToken=0x19e5a0 | out: pToken=0x19e5a0) returned 0x0 [0219.544] CoGetContextToken (in: pToken=0x19e9a8 | out: pToken=0x19e9a8) returned 0x0 [0219.544] WbemLocator:IUnknown:QueryInterface (in: This=0x58e778, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea38 | out: ppvObject=0x19ea38*=0x0) returned 0x80004002 [0219.544] WbemLocator:IUnknown:Release (This=0x58e778) returned 0x2 [0219.544] WbemLocator:IUnknown:Release (This=0x58e778) returned 0x1 [0219.544] CoGetContextToken (in: pToken=0x19f018 | out: pToken=0x19f018) returned 0x0 [0219.544] CoGetContextToken (in: pToken=0x19ef78 | out: pToken=0x19ef78) returned 0x0 [0219.544] WbemLocator:IUnknown:QueryInterface (in: This=0x58e778, riid=0x19f048*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19f044 | out: ppvObject=0x19f044*=0x58e778) returned 0x0 [0219.545] WbemLocator:IUnknown:AddRef (This=0x58e778) returned 0x3 [0219.545] WbemLocator:IUnknown:Release (This=0x58e778) returned 0x2 [0219.545] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1dc | out: puCount=0x19f1dc*=0x2) returned 0x0 [0219.545] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=8, puBuffLength=0x19f1d8*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d8*=0xf, pszText=0x0) returned 0x0 [0219.545] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=8, puBuffLength=0x19f1d8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0219.545] CoCreateInstance (in: rclsid=0x6ce21284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ce212e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x19f0b4 | out: ppv=0x19f0b4*=0x58e788) returned 0x0 [0219.545] WbemLocator:IWbemLocator:ConnectServer (in: This=0x58e788, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x19f148 | out: ppNamespace=0x19f148*=0x579cb8) returned 0x0 [0219.572] WbemLocator:IUnknown:QueryInterface (in: This=0x579cb8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efe4 | out: ppvObject=0x19efe4*=0x4e549c) returned 0x0 [0219.573] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4e549c, pProxy=0x579cb8, pAuthnSvc=0x19f034, pAuthzSvc=0x19f030, pServerPrincName=0x19f028, pAuthnLevel=0x19f02c, pImpLevel=0x19f01c, pAuthInfo=0x19f020, pCapabilites=0x19f024 | out: pAuthnSvc=0x19f034*=0xa, pAuthzSvc=0x19f030*=0x0, pServerPrincName=0x19f028, pAuthnLevel=0x19f02c*=0x6, pImpLevel=0x19f01c*=0x2, pAuthInfo=0x19f020, pCapabilites=0x19f024*=0x1) returned 0x0 [0219.573] WbemLocator:IUnknown:Release (This=0x4e549c) returned 0x1 [0219.573] WbemLocator:IUnknown:QueryInterface (in: This=0x579cb8, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efd8 | out: ppvObject=0x19efd8*=0x4e54c0) returned 0x0 [0219.573] WbemLocator:IUnknown:QueryInterface (in: This=0x579cb8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efd4 | out: ppvObject=0x19efd4*=0x4e549c) returned 0x0 [0219.573] WbemLocator:IClientSecurity:SetBlanket (This=0x4e549c, pProxy=0x579cb8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.573] WbemLocator:IUnknown:Release (This=0x4e549c) returned 0x2 [0219.573] WbemLocator:IUnknown:Release (This=0x4e54c0) returned 0x1 [0219.573] CoTaskMemFree (pv=0x50fa70) [0219.573] WbemLocator:IUnknown:Release (This=0x58e788) returned 0x0 [0219.573] WbemLocator:IUnknown:QueryInterface (in: This=0x579cb8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebd4 | out: ppvObject=0x19ebd4*=0x4e54c0) returned 0x0 [0219.574] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eb90 | out: ppvObject=0x19eb90*=0x0) returned 0x80004002 [0219.576] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e9ac | out: ppvObject=0x19e9ac*=0x0) returned 0x80004002 [0219.577] WbemLocator:IUnknown:QueryInterface (in: This=0x579cb8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e784 | out: ppvObject=0x19e784*=0x0) returned 0x80004002 [0219.578] WbemLocator:IUnknown:AddRef (This=0x4e54c0) returned 0x3 [0219.578] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e4ec | out: ppvObject=0x19e4ec*=0x0) returned 0x80004002 [0219.578] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e49c | out: ppvObject=0x19e49c*=0x0) returned 0x80004002 [0219.578] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e4a8 | out: ppvObject=0x19e4a8*=0x4e541c) returned 0x0 [0219.578] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e541c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e4b0 | out: pCid=0x19e4b0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.578] WbemLocator:IUnknown:Release (This=0x4e541c) returned 0x3 [0219.578] CoGetContextToken (in: pToken=0x19e508 | out: pToken=0x19e508) returned 0x0 [0219.578] CoGetContextToken (in: pToken=0x19e910 | out: pToken=0x19e910) returned 0x0 [0219.578] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9a0 | out: ppvObject=0x19e9a0*=0x4e54a4) returned 0x0 [0219.579] WbemLocator:IRpcOptions:Query (in: This=0x4e54a4, pPrx=0x4e54c0, dwProperty=2, pdwValue=0x19e9c8 | out: pdwValue=0x19e9c8) returned 0x80004002 [0219.579] WbemLocator:IUnknown:Release (This=0x4e54a4) returned 0x3 [0219.579] WbemLocator:IUnknown:Release (This=0x4e54c0) returned 0x2 [0219.579] CoGetContextToken (in: pToken=0x19eee8 | out: pToken=0x19eee8) returned 0x0 [0219.579] CoGetContextToken (in: pToken=0x19ee48 | out: pToken=0x19ee48) returned 0x0 [0219.579] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x19ef18*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19ef14 | out: ppvObject=0x19ef14*=0x579cb8) returned 0x0 [0219.579] WbemLocator:IUnknown:AddRef (This=0x579cb8) returned 0x4 [0219.579] WbemLocator:IUnknown:Release (This=0x579cb8) returned 0x3 [0219.579] WbemLocator:IUnknown:Release (This=0x579cb8) returned 0x2 [0219.579] SysStringLen (param_1=0x0) returned 0x0 [0219.579] CoGetContextToken (in: pToken=0x19eee0 | out: pToken=0x19eee0) returned 0x0 [0219.579] WbemLocator:IUnknown:AddRef (This=0x4e54c0) returned 0x3 [0219.579] WbemLocator:IUnknown:QueryInterface (in: This=0x4e54c0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x4e54c0) returned 0x0 [0219.579] WbemLocator:IUnknown:Release (This=0x4e54c0) returned 0x3 [0219.579] WbemLocator:IUnknown:Release (This=0x4e54c0) returned 0x2 [0219.579] CoGetContextToken (in: pToken=0x19efd8 | out: pToken=0x19efd8) returned 0x0 [0219.579] WbemLocator:IUnknown:AddRef (This=0x579cb8) returned 0x3 [0219.580] IWbemServices:ExecQuery (in: This=0x579cb8, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Processor", lFlags=16, pCtx=0x0, ppEnum=0x19f1e4 | out: ppEnum=0x19f1e4*=0x58c460) returned 0x0 [0219.617] IUnknown:QueryInterface (in: This=0x58c460, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f048 | out: ppvObject=0x19f048*=0x58c464) returned 0x0 [0219.617] IClientSecurity:QueryBlanket (in: This=0x58c464, pProxy=0x58c460, pAuthnSvc=0x19f098, pAuthzSvc=0x19f094, pServerPrincName=0x19f08c, pAuthnLevel=0x19f090, pImpLevel=0x19f080, pAuthInfo=0x19f084, pCapabilites=0x19f088 | out: pAuthnSvc=0x19f098*=0xa, pAuthzSvc=0x19f094*=0x0, pServerPrincName=0x19f08c, pAuthnLevel=0x19f090*=0x6, pImpLevel=0x19f080*=0x2, pAuthInfo=0x19f084, pCapabilites=0x19f088*=0x1) returned 0x0 [0219.617] IUnknown:Release (This=0x58c464) returned 0x1 [0219.617] IUnknown:QueryInterface (in: This=0x58c460, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f03c | out: ppvObject=0x19f03c*=0x4e5fc0) returned 0x0 [0219.617] IUnknown:QueryInterface (in: This=0x58c460, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f038 | out: ppvObject=0x19f038*=0x58c464) returned 0x0 [0219.618] IClientSecurity:SetBlanket (This=0x58c464, pProxy=0x58c460, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.619] IUnknown:Release (This=0x58c464) returned 0x2 [0219.619] WbemLocator:IUnknown:Release (This=0x4e5fc0) returned 0x1 [0219.619] CoTaskMemFree (pv=0x50fa40) [0219.619] IUnknown:QueryInterface (in: This=0x58c460, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec34 | out: ppvObject=0x19ec34*=0x4e5fc0) returned 0x0 [0219.620] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ebf0 | out: ppvObject=0x19ebf0*=0x0) returned 0x80004002 [0219.620] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea0c | out: ppvObject=0x19ea0c*=0x0) returned 0x80004002 [0219.620] IUnknown:QueryInterface (in: This=0x58c460, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e7e4 | out: ppvObject=0x19e7e4*=0x0) returned 0x80004002 [0219.621] WbemLocator:IUnknown:AddRef (This=0x4e5fc0) returned 0x3 [0219.621] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e54c | out: ppvObject=0x19e54c*=0x0) returned 0x80004002 [0219.621] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e4fc | out: ppvObject=0x19e4fc*=0x0) returned 0x80004002 [0219.621] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e508 | out: ppvObject=0x19e508*=0x4e5f1c) returned 0x0 [0219.621] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e5f1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e510 | out: pCid=0x19e510*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.621] WbemLocator:IUnknown:Release (This=0x4e5f1c) returned 0x3 [0219.621] CoGetContextToken (in: pToken=0x19e568 | out: pToken=0x19e568) returned 0x0 [0219.621] CoGetContextToken (in: pToken=0x19e970 | out: pToken=0x19e970) returned 0x0 [0219.621] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea00 | out: ppvObject=0x19ea00*=0x4e5fa4) returned 0x0 [0219.621] WbemLocator:IRpcOptions:Query (in: This=0x4e5fa4, pPrx=0x4e5fc0, dwProperty=2, pdwValue=0x19ea28 | out: pdwValue=0x19ea28) returned 0x80004002 [0219.621] WbemLocator:IUnknown:Release (This=0x4e5fa4) returned 0x3 [0219.621] WbemLocator:IUnknown:Release (This=0x4e5fc0) returned 0x2 [0219.621] CoGetContextToken (in: pToken=0x19ef48 | out: pToken=0x19ef48) returned 0x0 [0219.621] CoGetContextToken (in: pToken=0x19eea8 | out: pToken=0x19eea8) returned 0x0 [0219.621] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x19ef78*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ef74 | out: ppvObject=0x19ef74*=0x58c460) returned 0x0 [0219.621] IUnknown:AddRef (This=0x58c460) returned 0x4 [0219.621] IUnknown:Release (This=0x58c460) returned 0x3 [0219.622] IUnknown:Release (This=0x58c460) returned 0x2 [0219.622] WbemLocator:IUnknown:Release (This=0x579cb8) returned 0x2 [0219.622] SysStringLen (param_1=0x0) returned 0x0 [0219.622] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f230 | out: puCount=0x19f230*=0x2) returned 0x0 [0219.622] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f22c*=0x0, pszText=0x0 | out: puBuffLength=0x19f22c*=0xf, pszText=0x0) returned 0x0 [0219.622] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f22c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f22c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0219.622] CoGetContextToken (in: pToken=0x19f080 | out: pToken=0x19f080) returned 0x0 [0219.622] IUnknown:AddRef (This=0x58c460) returned 0x3 [0219.622] IEnumWbemClassObject:Clone (in: This=0x58c460, ppEnum=0x19f23c | out: ppEnum=0x19f23c*=0x58c9d8) returned 0x0 [0219.623] IUnknown:QueryInterface (in: This=0x58c9d8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f100 | out: ppvObject=0x19f100*=0x58c9dc) returned 0x0 [0219.623] IClientSecurity:QueryBlanket (in: This=0x58c9dc, pProxy=0x58c9d8, pAuthnSvc=0x19f150, pAuthzSvc=0x19f14c, pServerPrincName=0x19f144, pAuthnLevel=0x19f148, pImpLevel=0x19f138, pAuthInfo=0x19f13c, pCapabilites=0x19f140 | out: pAuthnSvc=0x19f150*=0xa, pAuthzSvc=0x19f14c*=0x0, pServerPrincName=0x19f144, pAuthnLevel=0x19f148*=0x6, pImpLevel=0x19f138*=0x2, pAuthInfo=0x19f13c, pCapabilites=0x19f140*=0x1) returned 0x0 [0219.623] IUnknown:Release (This=0x58c9dc) returned 0x1 [0219.623] IUnknown:QueryInterface (in: This=0x58c9d8, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0f4 | out: ppvObject=0x19f0f4*=0x4e6fc0) returned 0x0 [0219.624] IUnknown:QueryInterface (in: This=0x58c9d8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0f0 | out: ppvObject=0x19f0f0*=0x58c9dc) returned 0x0 [0219.624] IClientSecurity:SetBlanket (This=0x58c9dc, pProxy=0x58c9d8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0219.625] IUnknown:Release (This=0x58c9dc) returned 0x2 [0219.625] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0219.625] CoTaskMemFree (pv=0x50fa70) [0219.625] IUnknown:QueryInterface (in: This=0x58c9d8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ecdc | out: ppvObject=0x19ecdc*=0x4e6fc0) returned 0x0 [0219.626] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec98 | out: ppvObject=0x19ec98*=0x0) returned 0x80004002 [0219.626] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eab4 | out: ppvObject=0x19eab4*=0x0) returned 0x80004002 [0219.696] IUnknown:QueryInterface (in: This=0x58c9d8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e88c | out: ppvObject=0x19e88c*=0x0) returned 0x80004002 [0219.697] WbemLocator:IUnknown:AddRef (This=0x4e6fc0) returned 0x3 [0219.697] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e5f4 | out: ppvObject=0x19e5f4*=0x0) returned 0x80004002 [0219.697] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e5a4 | out: ppvObject=0x19e5a4*=0x0) returned 0x80004002 [0219.697] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5b0 | out: ppvObject=0x19e5b0*=0x4e6f1c) returned 0x0 [0219.697] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6f1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e5b8 | out: pCid=0x19e5b8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0219.697] WbemLocator:IUnknown:Release (This=0x4e6f1c) returned 0x3 [0219.697] CoGetContextToken (in: pToken=0x19e610 | out: pToken=0x19e610) returned 0x0 [0219.697] CoGetContextToken (in: pToken=0x19ea18 | out: pToken=0x19ea18) returned 0x0 [0219.697] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eaa8 | out: ppvObject=0x19eaa8*=0x4e6fa4) returned 0x0 [0219.697] WbemLocator:IRpcOptions:Query (in: This=0x4e6fa4, pPrx=0x4e6fc0, dwProperty=2, pdwValue=0x19ead0 | out: pdwValue=0x19ead0) returned 0x80004002 [0219.697] WbemLocator:IUnknown:Release (This=0x4e6fa4) returned 0x3 [0219.697] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x2 [0219.698] CoGetContextToken (in: pToken=0x19eff0 | out: pToken=0x19eff0) returned 0x0 [0219.698] CoGetContextToken (in: pToken=0x19ef50 | out: pToken=0x19ef50) returned 0x0 [0219.698] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x19f020*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f01c | out: ppvObject=0x19f01c*=0x58c9d8) returned 0x0 [0219.698] IUnknown:AddRef (This=0x58c9d8) returned 0x4 [0219.698] IUnknown:Release (This=0x58c9d8) returned 0x3 [0219.698] IUnknown:Release (This=0x58c9d8) returned 0x2 [0219.698] IUnknown:Release (This=0x58c460) returned 0x2 [0219.698] SysStringLen (param_1=0x0) returned 0x0 [0219.698] IEnumWbemClassObject:Reset (This=0x58c9d8) returned 0x0 [0219.698] CoTaskMemAlloc (cb=0x4) returned 0x58e708 [0219.698] IEnumWbemClassObject:Next (in: This=0x58c9d8, lTimeout=-1, uCount=0x1, apObjects=0x58e708, puReturned=0x23e76e0 | out: apObjects=0x58e708*=0x5141a0, puReturned=0x23e76e0*=0x1) returned 0x0 [0230.108] IUnknown:QueryInterface (in: This=0x5141a0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e8a0 | out: ppvObject=0x19e8a0*=0x5141a0) returned 0x0 [0230.108] IUnknown:QueryInterface (in: This=0x5141a0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e85c | out: ppvObject=0x19e85c*=0x0) returned 0x80004002 [0230.108] IUnknown:QueryInterface (in: This=0x5141a0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e67c | out: ppvObject=0x19e67c*=0x0) returned 0x80004002 [0230.108] IUnknown:QueryInterface (in: This=0x5141a0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e454 | out: ppvObject=0x19e454*=0x0) returned 0x80004002 [0230.109] IUnknown:AddRef (This=0x5141a0) returned 0x3 [0230.109] IUnknown:QueryInterface (in: This=0x5141a0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e1bc | out: ppvObject=0x19e1bc*=0x0) returned 0x80004002 [0230.109] IUnknown:QueryInterface (in: This=0x5141a0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e16c | out: ppvObject=0x19e16c*=0x0) returned 0x80004002 [0230.109] IUnknown:QueryInterface (in: This=0x5141a0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e178 | out: ppvObject=0x19e178*=0x5141a4) returned 0x0 [0230.109] IMarshal:GetUnmarshalClass (in: This=0x5141a4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e180 | out: pCid=0x19e180*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0230.109] IUnknown:Release (This=0x5141a4) returned 0x3 [0230.109] CoGetContextToken (in: pToken=0x19e1d8 | out: pToken=0x19e1d8) returned 0x0 [0230.109] CoGetContextToken (in: pToken=0x19e5e0 | out: pToken=0x19e5e0) returned 0x0 [0230.109] IUnknown:QueryInterface (in: This=0x5141a0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e670 | out: ppvObject=0x19e670*=0x0) returned 0x80004002 [0230.109] IUnknown:Release (This=0x5141a0) returned 0x2 [0230.109] CoGetContextToken (in: pToken=0x19ebb0 | out: pToken=0x19ebb0) returned 0x0 [0230.110] CoGetContextToken (in: pToken=0x19eb10 | out: pToken=0x19eb10) returned 0x0 [0230.110] IUnknown:QueryInterface (in: This=0x5141a0, riid=0x19ebe0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ebdc | out: ppvObject=0x19ebdc*=0x5141a0) returned 0x0 [0230.110] IUnknown:AddRef (This=0x5141a0) returned 0x4 [0230.110] IUnknown:Release (This=0x5141a0) returned 0x3 [0230.110] IUnknown:Release (This=0x5141a0) returned 0x2 [0230.110] CoTaskMemFree (pv=0x58e708) [0230.110] CoGetContextToken (in: pToken=0x19ef18 | out: pToken=0x19ef18) returned 0x0 [0230.110] IUnknown:AddRef (This=0x5141a0) returned 0x3 [0230.110] IWbemClassObject:Get (in: This=0x5141a0, wszName="__GENUS", lFlags=0, pVal=0x19f22c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f2ac*=0, plFlavor=0x19f2a8*=0 | out: pVal=0x19f22c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f2ac*=3, plFlavor=0x19f2a8*=64) returned 0x0 [0230.111] IWbemClassObject:Get (in: This=0x5141a0, wszName="__PATH", lFlags=0, pVal=0x19f210*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f294*=0, plFlavor=0x19f290*=0 | out: pVal=0x19f210*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x19f294*=8, plFlavor=0x19f290*=64) returned 0x0 [0230.111] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0230.111] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x66 [0230.111] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f23c | out: ppv=0x19f23c*=0x4d0cbc) returned 0x0 [0230.112] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f234 | out: pAptType=0x19f234*=1) returned 0x0 [0230.112] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f238 | out: ppvObject=0x19f238*=0x0) returned 0x80004002 [0230.112] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0230.114] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eba8 | out: ppv=0x19eba8*=0x58e668) returned 0x0 [0230.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e668, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19edc0 | out: ppvObject=0x19edc0*=0x0) returned 0x80004002 [0230.115] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e668, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19edd4 | out: ppvObject=0x19edd4*=0x524880) returned 0x0 [0230.115] WbemDefPath:IUnknown:Release (This=0x58e668) returned 0x0 [0230.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x524880, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9f4 | out: ppvObject=0x19e9f4*=0x524880) returned 0x0 [0230.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x524880, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e9b0 | out: ppvObject=0x19e9b0*=0x0) returned 0x80004002 [0230.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x524880, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e5a4 | out: ppvObject=0x19e5a4*=0x0) returned 0x80004002 [0230.116] WbemDefPath:IUnknown:AddRef (This=0x524880) returned 0x3 [0230.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x524880, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e30c | out: ppvObject=0x19e30c*=0x0) returned 0x80004002 [0230.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x524880, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e2bc | out: ppvObject=0x19e2bc*=0x0) returned 0x80004002 [0230.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x524880, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e2c8 | out: ppvObject=0x19e2c8*=0x58a300) returned 0x0 [0230.116] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a300, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e2d0 | out: pCid=0x19e2d0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0230.116] WbemDefPath:IUnknown:Release (This=0x58a300) returned 0x3 [0230.116] CoGetContextToken (in: pToken=0x19e328 | out: pToken=0x19e328) returned 0x0 [0230.116] CoGetContextToken (in: pToken=0x19e730 | out: pToken=0x19e730) returned 0x0 [0230.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x524880, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7c0 | out: ppvObject=0x19e7c0*=0x0) returned 0x80004002 [0230.116] WbemDefPath:IUnknown:Release (This=0x524880) returned 0x2 [0230.116] WbemDefPath:IUnknown:Release (This=0x524880) returned 0x1 [0230.117] CoGetContextToken (in: pToken=0x19f0b8 | out: pToken=0x19f0b8) returned 0x0 [0230.117] CoGetContextToken (in: pToken=0x19f018 | out: pToken=0x19f018) returned 0x0 [0230.117] WbemDefPath:IUnknown:QueryInterface (in: This=0x524880, riid=0x19f0e8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f0e4 | out: ppvObject=0x19f0e4*=0x524880) returned 0x0 [0230.117] WbemDefPath:IUnknown:AddRef (This=0x524880) returned 0x3 [0230.117] WbemDefPath:IUnknown:Release (This=0x524880) returned 0x2 [0230.117] WbemDefPath:IWbemPath:SetText (This=0x524880, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0230.117] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f268 | out: puCount=0x19f268*=0x2) returned 0x0 [0230.117] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f264*=0x0, pszText=0x0 | out: puBuffLength=0x19f264*=0xf, pszText=0x0) returned 0x0 [0230.117] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f264*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f264*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0230.117] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f234 | out: puCount=0x19f234*=0x2) returned 0x0 [0230.117] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f230*=0x0, pszText=0x0 | out: puBuffLength=0x19f230*=0xf, pszText=0x0) returned 0x0 [0230.118] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f230*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f230*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0230.118] IWbemClassObject:Get (in: This=0x5141a0, wszName="Name", lFlags=0, pVal=0x19f230*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e7f00*=0, plFlavor=0x23e7f04*=0 | out: pVal=0x19f230*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x23e7f00*=8, plFlavor=0x23e7f04*=0) returned 0x0 [0230.118] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0230.118] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0230.118] IWbemClassObject:Get (in: This=0x5141a0, wszName="Name", lFlags=0, pVal=0x19f238*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e7f00*=8, plFlavor=0x23e7f04*=0 | out: pVal=0x19f238*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", varVal2=0x0), pType=0x23e7f00*=8, plFlavor=0x23e7f04*=0) returned 0x0 [0230.118] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0230.118] SysStringByteLen (bstr="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x4e [0230.118] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f234 | out: puCount=0x19f234*=0x2) returned 0x0 [0230.118] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f230*=0x0, pszText=0x0 | out: puBuffLength=0x19f230*=0xf, pszText=0x0) returned 0x0 [0230.118] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f230*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f230*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0230.118] IWbemClassObject:Get (in: This=0x5141a0, wszName="NumberOfCores", lFlags=0, pVal=0x19f230*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e800c*=0, plFlavor=0x23e8010*=0 | out: pVal=0x19f230*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x23e800c*=19, plFlavor=0x23e8010*=0) returned 0x0 [0230.119] IWbemClassObject:Get (in: This=0x5141a0, wszName="NumberOfCores", lFlags=0, pVal=0x19f238*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e800c*=19, plFlavor=0x23e8010*=0 | out: pVal=0x19f238*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), pType=0x23e800c*=19, plFlavor=0x23e8010*=0) returned 0x0 [0230.122] CoTaskMemAlloc (cb=0x4) returned 0x58e758 [0230.122] IEnumWbemClassObject:Next (in: This=0x58c9d8, lTimeout=-1, uCount=0x1, apObjects=0x58e758, puReturned=0x23e76e0 | out: apObjects=0x58e758*=0x0, puReturned=0x23e76e0*=0x0) returned 0x1 [0230.131] CoTaskMemFree (pv=0x58e758) [0230.131] CoGetContextToken (in: pToken=0x19f168 | out: pToken=0x19f168) returned 0x0 [0230.131] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0230.131] IUnknown:Release (This=0x58c9d8) returned 0x0 [0230.136] CoGetContextToken (in: pToken=0x19f168 | out: pToken=0x19f168) returned 0x0 [0230.136] WbemLocator:IUnknown:Release (This=0x4e5fc0) returned 0x1 [0230.136] IUnknown:Release (This=0x58c460) returned 0x0 [0230.166] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f254 | out: ppv=0x19f254*=0x4d0cbc) returned 0x0 [0230.166] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f24c | out: pAptType=0x19f24c*=1) returned 0x0 [0230.166] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f250 | out: ppvObject=0x19f250*=0x0) returned 0x80004002 [0230.166] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0230.167] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ebc0 | out: ppv=0x19ebc0*=0x58e708) returned 0x0 [0230.167] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e708, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19edd8 | out: ppvObject=0x19edd8*=0x0) returned 0x80004002 [0230.168] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e708, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19edec | out: ppvObject=0x19edec*=0x519928) returned 0x0 [0230.168] WbemDefPath:IUnknown:Release (This=0x58e708) returned 0x0 [0230.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x519928, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea0c | out: ppvObject=0x19ea0c*=0x519928) returned 0x0 [0230.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x519928, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e9c8 | out: ppvObject=0x19e9c8*=0x0) returned 0x80004002 [0230.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x519928, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e5bc | out: ppvObject=0x19e5bc*=0x0) returned 0x80004002 [0230.168] WbemDefPath:IUnknown:AddRef (This=0x519928) returned 0x3 [0230.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x519928, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e324 | out: ppvObject=0x19e324*=0x0) returned 0x80004002 [0230.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x519928, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e2d4 | out: ppvObject=0x19e2d4*=0x0) returned 0x80004002 [0230.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x519928, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e2e0 | out: ppvObject=0x19e2e0*=0x58a318) returned 0x0 [0230.168] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x58a318, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e2e8 | out: pCid=0x19e2e8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0230.168] WbemDefPath:IUnknown:Release (This=0x58a318) returned 0x3 [0230.168] CoGetContextToken (in: pToken=0x19e340 | out: pToken=0x19e340) returned 0x0 [0230.168] CoGetContextToken (in: pToken=0x19e748 | out: pToken=0x19e748) returned 0x0 [0230.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x519928, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7d8 | out: ppvObject=0x19e7d8*=0x0) returned 0x80004002 [0230.168] WbemDefPath:IUnknown:Release (This=0x519928) returned 0x2 [0230.168] WbemDefPath:IUnknown:Release (This=0x519928) returned 0x1 [0230.168] CoGetContextToken (in: pToken=0x19f0d0 | out: pToken=0x19f0d0) returned 0x0 [0230.168] CoGetContextToken (in: pToken=0x19f030 | out: pToken=0x19f030) returned 0x0 [0230.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x519928, riid=0x19f100*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f0fc | out: ppvObject=0x19f0fc*=0x519928) returned 0x0 [0230.169] WbemDefPath:IUnknown:AddRef (This=0x519928) returned 0x3 [0230.169] WbemDefPath:IUnknown:Release (This=0x519928) returned 0x2 [0230.169] WbemDefPath:IWbemPath:SetText (This=0x519928, uMode=0x4, pszPath="root\\CIMV2") returned 0x0 [0230.169] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x519928, puCount=0x19f27c | out: puCount=0x19f27c*=0x2) returned 0x0 [0230.169] WbemDefPath:IWbemPath:GetText (in: This=0x519928, lFlags=4, puBuffLength=0x19f278*=0x0, pszText=0x0 | out: puBuffLength=0x19f278*=0xf, pszText=0x0) returned 0x0 [0230.169] WbemDefPath:IWbemPath:GetText (in: This=0x519928, lFlags=4, puBuffLength=0x19f278*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f278*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0230.169] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x519928, puCount=0x19f268 | out: puCount=0x19f268*=0x2) returned 0x0 [0230.169] WbemDefPath:IWbemPath:GetText (in: This=0x519928, lFlags=4, puBuffLength=0x19f264*=0x0, pszText=0x0 | out: puBuffLength=0x19f264*=0xf, pszText=0x0) returned 0x0 [0230.169] WbemDefPath:IWbemPath:GetText (in: This=0x519928, lFlags=4, puBuffLength=0x19f264*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f264*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0230.169] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1fc | out: ppv=0x19f1fc*=0x4d0cbc) returned 0x0 [0230.169] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1f4 | out: pAptType=0x19f1f4*=1) returned 0x0 [0230.169] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1f8 | out: ppvObject=0x19f1f8*=0x0) returned 0x80004002 [0230.169] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0230.170] CoGetClassObject (in: rclsid=0x55079c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ee18 | out: ppv=0x19ee18*=0x5553800) returned 0x0 [0230.170] WbemLocator:IUnknown:QueryInterface (in: This=0x5553800, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19f030 | out: ppvObject=0x19f030*=0x0) returned 0x80004002 [0230.170] WbemLocator:IClassFactory:CreateInstance (in: This=0x5553800, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f044 | out: ppvObject=0x19f044*=0x58e808) returned 0x0 [0230.170] WbemLocator:IUnknown:Release (This=0x5553800) returned 0x0 [0230.170] WbemLocator:IUnknown:QueryInterface (in: This=0x58e808, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec64 | out: ppvObject=0x19ec64*=0x58e808) returned 0x0 [0230.170] WbemLocator:IUnknown:QueryInterface (in: This=0x58e808, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec20 | out: ppvObject=0x19ec20*=0x0) returned 0x80004002 [0230.170] WbemLocator:IUnknown:QueryInterface (in: This=0x58e808, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e814 | out: ppvObject=0x19e814*=0x0) returned 0x80004002 [0230.170] WbemLocator:IUnknown:AddRef (This=0x58e808) returned 0x3 [0230.170] WbemLocator:IUnknown:QueryInterface (in: This=0x58e808, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e57c | out: ppvObject=0x19e57c*=0x0) returned 0x80004002 [0230.170] WbemLocator:IUnknown:QueryInterface (in: This=0x58e808, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e52c | out: ppvObject=0x19e52c*=0x0) returned 0x80004002 [0230.171] WbemLocator:IUnknown:QueryInterface (in: This=0x58e808, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e538 | out: ppvObject=0x19e538*=0x0) returned 0x80004002 [0230.171] CoGetContextToken (in: pToken=0x19e598 | out: pToken=0x19e598) returned 0x0 [0230.171] CoGetContextToken (in: pToken=0x19e9a0 | out: pToken=0x19e9a0) returned 0x0 [0230.171] WbemLocator:IUnknown:QueryInterface (in: This=0x58e808, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea30 | out: ppvObject=0x19ea30*=0x0) returned 0x80004002 [0230.171] WbemLocator:IUnknown:Release (This=0x58e808) returned 0x2 [0230.171] WbemLocator:IUnknown:Release (This=0x58e808) returned 0x1 [0230.171] CoGetContextToken (in: pToken=0x19f010 | out: pToken=0x19f010) returned 0x0 [0230.171] CoGetContextToken (in: pToken=0x19ef70 | out: pToken=0x19ef70) returned 0x0 [0230.171] WbemLocator:IUnknown:QueryInterface (in: This=0x58e808, riid=0x19f040*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19f03c | out: ppvObject=0x19f03c*=0x58e808) returned 0x0 [0230.171] WbemLocator:IUnknown:AddRef (This=0x58e808) returned 0x3 [0230.171] WbemLocator:IUnknown:Release (This=0x58e808) returned 0x2 [0230.171] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x519928, puCount=0x19f1d8 | out: puCount=0x19f1d8*=0x2) returned 0x0 [0230.171] WbemDefPath:IWbemPath:GetText (in: This=0x519928, lFlags=8, puBuffLength=0x19f1d4*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d4*=0xf, pszText=0x0) returned 0x0 [0230.171] WbemDefPath:IWbemPath:GetText (in: This=0x519928, lFlags=8, puBuffLength=0x19f1d4*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d4*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0230.171] CoCreateInstance (in: rclsid=0x6ce21284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ce212e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x19f0b0 | out: ppv=0x19f0b0*=0x58e7d8) returned 0x0 [0230.171] WbemLocator:IWbemLocator:ConnectServer (in: This=0x58e7d8, strNetworkResource="\\\\.\\root\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x19f144 | out: ppNamespace=0x19f144*=0x4e0cb0) returned 0x0 [0230.243] WbemLocator:IUnknown:QueryInterface (in: This=0x4e0cb0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efe0 | out: ppvObject=0x19efe0*=0x4e609c) returned 0x0 [0230.244] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4e609c, pProxy=0x4e0cb0, pAuthnSvc=0x19f030, pAuthzSvc=0x19f02c, pServerPrincName=0x19f024, pAuthnLevel=0x19f028, pImpLevel=0x19f018, pAuthInfo=0x19f01c, pCapabilites=0x19f020 | out: pAuthnSvc=0x19f030*=0xa, pAuthzSvc=0x19f02c*=0x0, pServerPrincName=0x19f024, pAuthnLevel=0x19f028*=0x6, pImpLevel=0x19f018*=0x2, pAuthInfo=0x19f01c, pCapabilites=0x19f020*=0x1) returned 0x0 [0230.244] WbemLocator:IUnknown:Release (This=0x4e609c) returned 0x1 [0230.244] WbemLocator:IUnknown:QueryInterface (in: This=0x4e0cb0, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efd4 | out: ppvObject=0x19efd4*=0x4e60c0) returned 0x0 [0230.244] WbemLocator:IUnknown:QueryInterface (in: This=0x4e0cb0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efd0 | out: ppvObject=0x19efd0*=0x4e609c) returned 0x0 [0230.244] WbemLocator:IClientSecurity:SetBlanket (This=0x4e609c, pProxy=0x4e0cb0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0230.244] WbemLocator:IUnknown:Release (This=0x4e609c) returned 0x2 [0230.244] WbemLocator:IUnknown:Release (This=0x4e60c0) returned 0x1 [0230.244] CoTaskMemFree (pv=0x50fb00) [0230.244] WbemLocator:IUnknown:Release (This=0x58e7d8) returned 0x0 [0230.244] WbemLocator:IUnknown:QueryInterface (in: This=0x4e0cb0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebd0 | out: ppvObject=0x19ebd0*=0x4e60c0) returned 0x0 [0230.245] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eb8c | out: ppvObject=0x19eb8c*=0x0) returned 0x80004002 [0230.245] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e9ac | out: ppvObject=0x19e9ac*=0x0) returned 0x80004002 [0230.245] WbemLocator:IUnknown:QueryInterface (in: This=0x4e0cb0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e784 | out: ppvObject=0x19e784*=0x0) returned 0x80004002 [0230.245] WbemLocator:IUnknown:AddRef (This=0x4e60c0) returned 0x3 [0230.245] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e4ec | out: ppvObject=0x19e4ec*=0x0) returned 0x80004002 [0230.245] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e49c | out: ppvObject=0x19e49c*=0x0) returned 0x80004002 [0230.246] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e4a8 | out: ppvObject=0x19e4a8*=0x4e601c) returned 0x0 [0230.246] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e601c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e4b0 | out: pCid=0x19e4b0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0230.246] WbemLocator:IUnknown:Release (This=0x4e601c) returned 0x3 [0230.246] CoGetContextToken (in: pToken=0x19e508 | out: pToken=0x19e508) returned 0x0 [0230.246] CoGetContextToken (in: pToken=0x19e910 | out: pToken=0x19e910) returned 0x0 [0230.246] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9a0 | out: ppvObject=0x19e9a0*=0x4e60a4) returned 0x0 [0230.246] WbemLocator:IRpcOptions:Query (in: This=0x4e60a4, pPrx=0x4e60c0, dwProperty=2, pdwValue=0x19e9c8 | out: pdwValue=0x19e9c8) returned 0x80004002 [0230.246] WbemLocator:IUnknown:Release (This=0x4e60a4) returned 0x3 [0230.246] WbemLocator:IUnknown:Release (This=0x4e60c0) returned 0x2 [0230.246] CoGetContextToken (in: pToken=0x19eee0 | out: pToken=0x19eee0) returned 0x0 [0230.246] CoGetContextToken (in: pToken=0x19ee40 | out: pToken=0x19ee40) returned 0x0 [0230.246] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x19ef10*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19ef0c | out: ppvObject=0x19ef0c*=0x4e0cb0) returned 0x0 [0230.246] WbemLocator:IUnknown:AddRef (This=0x4e0cb0) returned 0x4 [0230.246] WbemLocator:IUnknown:Release (This=0x4e0cb0) returned 0x3 [0230.246] WbemLocator:IUnknown:Release (This=0x4e0cb0) returned 0x2 [0230.246] SysStringLen (param_1=0x0) returned 0x0 [0230.246] CoGetContextToken (in: pToken=0x19eed8 | out: pToken=0x19eed8) returned 0x0 [0230.246] WbemLocator:IUnknown:AddRef (This=0x4e60c0) returned 0x3 [0230.246] WbemLocator:IUnknown:QueryInterface (in: This=0x4e60c0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed6c | out: ppvObject=0x19ed6c*=0x4e60c0) returned 0x0 [0230.247] WbemLocator:IUnknown:Release (This=0x4e60c0) returned 0x3 [0230.247] WbemLocator:IUnknown:Release (This=0x4e60c0) returned 0x2 [0230.247] CoGetContextToken (in: pToken=0x19efc8 | out: pToken=0x19efc8) returned 0x0 [0230.247] WbemLocator:IUnknown:AddRef (This=0x4e0cb0) returned 0x3 [0230.247] IWbemServices:ExecQuery (in: This=0x4e0cb0, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_VideoController", lFlags=16, pCtx=0x0, ppEnum=0x19f1e0 | out: ppEnum=0x19f1e0*=0x58ce88) returned 0x0 [0230.263] IUnknown:QueryInterface (in: This=0x58ce88, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f038 | out: ppvObject=0x19f038*=0x58ce8c) returned 0x0 [0230.264] IClientSecurity:QueryBlanket (in: This=0x58ce8c, pProxy=0x58ce88, pAuthnSvc=0x19f088, pAuthzSvc=0x19f084, pServerPrincName=0x19f07c, pAuthnLevel=0x19f080, pImpLevel=0x19f070, pAuthInfo=0x19f074, pCapabilites=0x19f078 | out: pAuthnSvc=0x19f088*=0xa, pAuthzSvc=0x19f084*=0x0, pServerPrincName=0x19f07c, pAuthnLevel=0x19f080*=0x6, pImpLevel=0x19f070*=0x2, pAuthInfo=0x19f074, pCapabilites=0x19f078*=0x1) returned 0x0 [0230.264] IUnknown:Release (This=0x58ce8c) returned 0x1 [0230.264] IUnknown:QueryInterface (in: This=0x58ce88, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f02c | out: ppvObject=0x19f02c*=0x4e6fc0) returned 0x0 [0230.308] IUnknown:QueryInterface (in: This=0x58ce88, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f028 | out: ppvObject=0x19f028*=0x58ce8c) returned 0x0 [0230.309] IClientSecurity:SetBlanket (This=0x58ce8c, pProxy=0x58ce88, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0230.311] IUnknown:Release (This=0x58ce8c) returned 0x2 [0230.311] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0230.311] CoTaskMemFree (pv=0x50fa70) [0230.311] IUnknown:QueryInterface (in: This=0x58ce88, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec24 | out: ppvObject=0x19ec24*=0x4e6fc0) returned 0x0 [0230.311] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ebe0 | out: ppvObject=0x19ebe0*=0x0) returned 0x80004002 [0230.311] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e9fc | out: ppvObject=0x19e9fc*=0x0) returned 0x80004002 [0230.312] IUnknown:QueryInterface (in: This=0x58ce88, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e7d4 | out: ppvObject=0x19e7d4*=0x0) returned 0x80004002 [0230.312] WbemLocator:IUnknown:AddRef (This=0x4e6fc0) returned 0x3 [0230.312] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e53c | out: ppvObject=0x19e53c*=0x0) returned 0x80004002 [0230.312] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e4ec | out: ppvObject=0x19e4ec*=0x0) returned 0x80004002 [0230.312] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e4f8 | out: ppvObject=0x19e4f8*=0x4e6f1c) returned 0x0 [0230.312] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6f1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e500 | out: pCid=0x19e500*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0230.312] WbemLocator:IUnknown:Release (This=0x4e6f1c) returned 0x3 [0230.312] CoGetContextToken (in: pToken=0x19e558 | out: pToken=0x19e558) returned 0x0 [0230.312] CoGetContextToken (in: pToken=0x19e960 | out: pToken=0x19e960) returned 0x0 [0230.312] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9f0 | out: ppvObject=0x19e9f0*=0x4e6fa4) returned 0x0 [0230.312] WbemLocator:IRpcOptions:Query (in: This=0x4e6fa4, pPrx=0x4e6fc0, dwProperty=2, pdwValue=0x19ea18 | out: pdwValue=0x19ea18) returned 0x80004002 [0230.312] WbemLocator:IUnknown:Release (This=0x4e6fa4) returned 0x3 [0230.313] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x2 [0230.313] CoGetContextToken (in: pToken=0x19ef38 | out: pToken=0x19ef38) returned 0x0 [0230.313] CoGetContextToken (in: pToken=0x19ee98 | out: pToken=0x19ee98) returned 0x0 [0230.313] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x19ef68*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ef64 | out: ppvObject=0x19ef64*=0x58ce88) returned 0x0 [0230.313] IUnknown:AddRef (This=0x58ce88) returned 0x4 [0230.313] IUnknown:Release (This=0x58ce88) returned 0x3 [0230.313] IUnknown:Release (This=0x58ce88) returned 0x2 [0230.313] WbemLocator:IUnknown:Release (This=0x4e0cb0) returned 0x2 [0230.313] SysStringLen (param_1=0x0) returned 0x0 [0230.313] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x519928, puCount=0x19f22c | out: puCount=0x19f22c*=0x2) returned 0x0 [0230.313] WbemDefPath:IWbemPath:GetText (in: This=0x519928, lFlags=4, puBuffLength=0x19f228*=0x0, pszText=0x0 | out: puBuffLength=0x19f228*=0xf, pszText=0x0) returned 0x0 [0230.313] WbemDefPath:IWbemPath:GetText (in: This=0x519928, lFlags=4, puBuffLength=0x19f228*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f228*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0230.313] CoGetContextToken (in: pToken=0x19f078 | out: pToken=0x19f078) returned 0x0 [0230.313] IUnknown:AddRef (This=0x58ce88) returned 0x3 [0230.313] IEnumWbemClassObject:Clone (in: This=0x58ce88, ppEnum=0x19f238 | out: ppEnum=0x19f238*=0x58c398) returned 0x0 [0230.314] IUnknown:QueryInterface (in: This=0x58c398, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0fc | out: ppvObject=0x19f0fc*=0x58c39c) returned 0x0 [0230.314] IClientSecurity:QueryBlanket (in: This=0x58c39c, pProxy=0x58c398, pAuthnSvc=0x19f14c, pAuthzSvc=0x19f148, pServerPrincName=0x19f140, pAuthnLevel=0x19f144, pImpLevel=0x19f134, pAuthInfo=0x19f138, pCapabilites=0x19f13c | out: pAuthnSvc=0x19f14c*=0xa, pAuthzSvc=0x19f148*=0x0, pServerPrincName=0x19f140, pAuthnLevel=0x19f144*=0x6, pImpLevel=0x19f134*=0x2, pAuthInfo=0x19f138, pCapabilites=0x19f13c*=0x1) returned 0x0 [0230.314] IUnknown:Release (This=0x58c39c) returned 0x1 [0230.314] IUnknown:QueryInterface (in: This=0x58c398, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0f0 | out: ppvObject=0x19f0f0*=0x4e70c0) returned 0x0 [0230.315] IUnknown:QueryInterface (in: This=0x58c398, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0ec | out: ppvObject=0x19f0ec*=0x58c39c) returned 0x0 [0230.315] IClientSecurity:SetBlanket (This=0x58c39c, pProxy=0x58c398, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0230.316] IUnknown:Release (This=0x58c39c) returned 0x2 [0230.316] WbemLocator:IUnknown:Release (This=0x4e70c0) returned 0x1 [0230.316] CoTaskMemFree (pv=0x50f980) [0230.316] IUnknown:QueryInterface (in: This=0x58c398, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ecd8 | out: ppvObject=0x19ecd8*=0x4e70c0) returned 0x0 [0230.316] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec94 | out: ppvObject=0x19ec94*=0x0) returned 0x80004002 [0230.317] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eab4 | out: ppvObject=0x19eab4*=0x0) returned 0x80004002 [0230.317] IUnknown:QueryInterface (in: This=0x58c398, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e88c | out: ppvObject=0x19e88c*=0x0) returned 0x80004002 [0230.317] WbemLocator:IUnknown:AddRef (This=0x4e70c0) returned 0x3 [0230.317] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e5f4 | out: ppvObject=0x19e5f4*=0x0) returned 0x80004002 [0230.317] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e5a4 | out: ppvObject=0x19e5a4*=0x0) returned 0x80004002 [0230.317] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5b0 | out: ppvObject=0x19e5b0*=0x4e701c) returned 0x0 [0230.317] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e701c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e5b8 | out: pCid=0x19e5b8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0230.317] WbemLocator:IUnknown:Release (This=0x4e701c) returned 0x3 [0230.317] CoGetContextToken (in: pToken=0x19e610 | out: pToken=0x19e610) returned 0x0 [0230.317] CoGetContextToken (in: pToken=0x19ea18 | out: pToken=0x19ea18) returned 0x0 [0230.318] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eaa8 | out: ppvObject=0x19eaa8*=0x4e70a4) returned 0x0 [0230.318] WbemLocator:IRpcOptions:Query (in: This=0x4e70a4, pPrx=0x4e70c0, dwProperty=2, pdwValue=0x19ead0 | out: pdwValue=0x19ead0) returned 0x80004002 [0230.318] WbemLocator:IUnknown:Release (This=0x4e70a4) returned 0x3 [0230.318] WbemLocator:IUnknown:Release (This=0x4e70c0) returned 0x2 [0230.318] CoGetContextToken (in: pToken=0x19efe8 | out: pToken=0x19efe8) returned 0x0 [0230.318] CoGetContextToken (in: pToken=0x19ef48 | out: pToken=0x19ef48) returned 0x0 [0230.318] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x19f018*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f014 | out: ppvObject=0x19f014*=0x58c398) returned 0x0 [0230.318] IUnknown:AddRef (This=0x58c398) returned 0x4 [0230.318] IUnknown:Release (This=0x58c398) returned 0x3 [0230.318] IUnknown:Release (This=0x58c398) returned 0x2 [0230.318] IUnknown:Release (This=0x58ce88) returned 0x2 [0230.318] SysStringLen (param_1=0x0) returned 0x0 [0230.318] IEnumWbemClassObject:Reset (This=0x58c398) returned 0x0 [0230.318] CoTaskMemAlloc (cb=0x4) returned 0x58e6e8 [0230.319] IEnumWbemClassObject:Next (in: This=0x58c398, lTimeout=-1, uCount=0x1, apObjects=0x58e6e8, puReturned=0x23e91ac | out: apObjects=0x58e6e8*=0x513cd8, puReturned=0x23e91ac*=0x1) returned 0x0 [0230.328] IUnknown:QueryInterface (in: This=0x513cd8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e898 | out: ppvObject=0x19e898*=0x513cd8) returned 0x0 [0230.328] IUnknown:QueryInterface (in: This=0x513cd8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e854 | out: ppvObject=0x19e854*=0x0) returned 0x80004002 [0230.328] IUnknown:QueryInterface (in: This=0x513cd8, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e674 | out: ppvObject=0x19e674*=0x0) returned 0x80004002 [0230.328] IUnknown:QueryInterface (in: This=0x513cd8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e44c | out: ppvObject=0x19e44c*=0x0) returned 0x80004002 [0230.329] IUnknown:AddRef (This=0x513cd8) returned 0x3 [0230.329] IUnknown:QueryInterface (in: This=0x513cd8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e1b4 | out: ppvObject=0x19e1b4*=0x0) returned 0x80004002 [0230.329] IUnknown:QueryInterface (in: This=0x513cd8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e164 | out: ppvObject=0x19e164*=0x0) returned 0x80004002 [0230.329] IUnknown:QueryInterface (in: This=0x513cd8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e170 | out: ppvObject=0x19e170*=0x513cdc) returned 0x0 [0230.329] IMarshal:GetUnmarshalClass (in: This=0x513cdc, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e178 | out: pCid=0x19e178*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0230.329] IUnknown:Release (This=0x513cdc) returned 0x3 [0230.329] CoGetContextToken (in: pToken=0x19e1d0 | out: pToken=0x19e1d0) returned 0x0 [0230.329] CoGetContextToken (in: pToken=0x19e5d8 | out: pToken=0x19e5d8) returned 0x0 [0230.329] IUnknown:QueryInterface (in: This=0x513cd8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e668 | out: ppvObject=0x19e668*=0x0) returned 0x80004002 [0230.330] IUnknown:Release (This=0x513cd8) returned 0x2 [0230.330] CoGetContextToken (in: pToken=0x19eba8 | out: pToken=0x19eba8) returned 0x0 [0230.330] CoGetContextToken (in: pToken=0x19eb08 | out: pToken=0x19eb08) returned 0x0 [0230.330] IUnknown:QueryInterface (in: This=0x513cd8, riid=0x19ebd8*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ebd4 | out: ppvObject=0x19ebd4*=0x513cd8) returned 0x0 [0230.330] IUnknown:AddRef (This=0x513cd8) returned 0x4 [0230.330] IUnknown:Release (This=0x513cd8) returned 0x3 [0230.330] IUnknown:Release (This=0x513cd8) returned 0x2 [0230.330] CoTaskMemFree (pv=0x58e6e8) [0230.330] CoGetContextToken (in: pToken=0x19ef18 | out: pToken=0x19ef18) returned 0x0 [0230.330] IUnknown:AddRef (This=0x513cd8) returned 0x3 [0230.330] IWbemClassObject:Get (in: This=0x513cd8, wszName="__GENUS", lFlags=0, pVal=0x19f228*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f2a8*=0, plFlavor=0x19f2a4*=0 | out: pVal=0x19f228*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f2a8*=3, plFlavor=0x19f2a4*=64) returned 0x0 [0230.330] IWbemClassObject:Get (in: This=0x513cd8, wszName="__PATH", lFlags=0, pVal=0x19f20c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f290*=0, plFlavor=0x19f28c*=0 | out: pVal=0x19f20c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"", varVal2=0x0), pType=0x19f290*=8, plFlavor=0x19f28c*=64) returned 0x0 [0230.330] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x8a [0230.330] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x8a [0230.330] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f238 | out: ppv=0x19f238*=0x4d0cbc) returned 0x0 [0230.330] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f230 | out: pAptType=0x19f230*=1) returned 0x0 [0230.331] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f234 | out: ppvObject=0x19f234*=0x0) returned 0x80004002 [0230.331] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0230.331] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eba0 | out: ppv=0x19eba0*=0x58e688) returned 0x0 [0230.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e688, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19edb8 | out: ppvObject=0x19edb8*=0x0) returned 0x80004002 [0230.332] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e688, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19edcc | out: ppvObject=0x19edcc*=0x519688) returned 0x0 [0230.332] WbemDefPath:IUnknown:Release (This=0x58e688) returned 0x0 [0230.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x519688, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9ec | out: ppvObject=0x19e9ec*=0x519688) returned 0x0 [0230.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x519688, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e9a8 | out: ppvObject=0x19e9a8*=0x0) returned 0x80004002 [0230.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x519688, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e59c | out: ppvObject=0x19e59c*=0x0) returned 0x80004002 [0230.332] WbemDefPath:IUnknown:AddRef (This=0x519688) returned 0x3 [0230.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x519688, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e304 | out: ppvObject=0x19e304*=0x0) returned 0x80004002 [0230.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x519688, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e2b4 | out: ppvObject=0x19e2b4*=0x0) returned 0x80004002 [0230.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x519688, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e2c0 | out: ppvObject=0x19e2c0*=0x528988) returned 0x0 [0230.332] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x528988, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e2c8 | out: pCid=0x19e2c8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0230.332] WbemDefPath:IUnknown:Release (This=0x528988) returned 0x3 [0230.332] CoGetContextToken (in: pToken=0x19e320 | out: pToken=0x19e320) returned 0x0 [0230.332] CoGetContextToken (in: pToken=0x19e728 | out: pToken=0x19e728) returned 0x0 [0230.332] WbemDefPath:IUnknown:QueryInterface (in: This=0x519688, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7b8 | out: ppvObject=0x19e7b8*=0x0) returned 0x80004002 [0230.332] WbemDefPath:IUnknown:Release (This=0x519688) returned 0x2 [0230.332] WbemDefPath:IUnknown:Release (This=0x519688) returned 0x1 [0230.333] CoGetContextToken (in: pToken=0x19f0b0 | out: pToken=0x19f0b0) returned 0x0 [0230.333] CoGetContextToken (in: pToken=0x19f010 | out: pToken=0x19f010) returned 0x0 [0230.333] WbemDefPath:IUnknown:QueryInterface (in: This=0x519688, riid=0x19f0e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f0dc | out: ppvObject=0x19f0dc*=0x519688) returned 0x0 [0230.333] WbemDefPath:IUnknown:AddRef (This=0x519688) returned 0x3 [0230.333] WbemDefPath:IUnknown:Release (This=0x519688) returned 0x2 [0230.333] WbemDefPath:IWbemPath:SetText (This=0x519688, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\CIMV2:Win32_VideoController.DeviceID=\"VideoController1\"") returned 0x0 [0230.333] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x519928, puCount=0x19f264 | out: puCount=0x19f264*=0x2) returned 0x0 [0230.333] WbemDefPath:IWbemPath:GetText (in: This=0x519928, lFlags=4, puBuffLength=0x19f260*=0x0, pszText=0x0 | out: puBuffLength=0x19f260*=0xf, pszText=0x0) returned 0x0 [0230.333] WbemDefPath:IWbemPath:GetText (in: This=0x519928, lFlags=4, puBuffLength=0x19f260*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f260*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0230.333] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x519928, puCount=0x19f230 | out: puCount=0x19f230*=0x2) returned 0x0 [0230.333] WbemDefPath:IWbemPath:GetText (in: This=0x519928, lFlags=4, puBuffLength=0x19f22c*=0x0, pszText=0x0 | out: puBuffLength=0x19f22c*=0xf, pszText=0x0) returned 0x0 [0230.333] WbemDefPath:IWbemPath:GetText (in: This=0x519928, lFlags=4, puBuffLength=0x19f22c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f22c*=0xf, pszText="\\\\.\\root\\CIMV2") returned 0x0 [0230.333] IWbemClassObject:Get (in: This=0x513cd8, wszName="AdapterRAM", lFlags=0, pVal=0x19f22c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e99dc*=0, plFlavor=0x23e99e0*=0 | out: pVal=0x19f22c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e99dc*=19, plFlavor=0x23e99e0*=0) returned 0x0 [0230.333] IWbemClassObject:Get (in: This=0x513cd8, wszName="AdapterRAM", lFlags=0, pVal=0x19f234*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e99dc*=19, plFlavor=0x23e99e0*=0 | out: pVal=0x19f234*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e99dc*=19, plFlavor=0x23e99e0*=0) returned 0x0 [0230.334] CoTaskMemAlloc (cb=0x4) returned 0x58e6e8 [0230.334] IEnumWbemClassObject:Next (in: This=0x58c398, lTimeout=-1, uCount=0x1, apObjects=0x58e6e8, puReturned=0x23e91ac | out: apObjects=0x58e6e8*=0x0, puReturned=0x23e91ac*=0x0) returned 0x1 [0230.334] CoTaskMemFree (pv=0x58e6e8) [0230.334] CoGetContextToken (in: pToken=0x19f160 | out: pToken=0x19f160) returned 0x0 [0230.334] WbemLocator:IUnknown:Release (This=0x4e70c0) returned 0x1 [0230.334] IUnknown:Release (This=0x58c398) returned 0x0 [0230.336] CoGetContextToken (in: pToken=0x19f160 | out: pToken=0x19f160) returned 0x0 [0230.336] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0230.336] IUnknown:Release (This=0x58ce88) returned 0x0 [0230.362] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f25c | out: puCount=0x19f25c*=0x2) returned 0x0 [0230.362] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f258*=0x0, pszText=0x0 | out: puBuffLength=0x19f258*=0xf, pszText=0x0) returned 0x0 [0230.362] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f258*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f258*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0230.362] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1e8 | out: ppv=0x19f1e8*=0x4d0cbc) returned 0x0 [0230.362] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1e0 | out: pAptType=0x19f1e0*=1) returned 0x0 [0230.362] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1e4 | out: ppvObject=0x19f1e4*=0x0) returned 0x80004002 [0230.362] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0230.363] CoGetClassObject (in: rclsid=0x55079c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19ee08 | out: ppv=0x19ee08*=0x5289d0) returned 0x0 [0230.363] WbemLocator:IUnknown:QueryInterface (in: This=0x5289d0, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19f020 | out: ppvObject=0x19f020*=0x0) returned 0x80004002 [0230.363] WbemLocator:IClassFactory:CreateInstance (in: This=0x5289d0, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f034 | out: ppvObject=0x19f034*=0x58e7d8) returned 0x0 [0230.363] WbemLocator:IUnknown:Release (This=0x5289d0) returned 0x0 [0230.363] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7d8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec54 | out: ppvObject=0x19ec54*=0x58e7d8) returned 0x0 [0230.363] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7d8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec10 | out: ppvObject=0x19ec10*=0x0) returned 0x80004002 [0230.363] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7d8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e804 | out: ppvObject=0x19e804*=0x0) returned 0x80004002 [0230.363] WbemLocator:IUnknown:AddRef (This=0x58e7d8) returned 0x3 [0230.363] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7d8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e56c | out: ppvObject=0x19e56c*=0x0) returned 0x80004002 [0230.363] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7d8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e51c | out: ppvObject=0x19e51c*=0x0) returned 0x80004002 [0230.364] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7d8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e528 | out: ppvObject=0x19e528*=0x0) returned 0x80004002 [0230.364] CoGetContextToken (in: pToken=0x19e588 | out: pToken=0x19e588) returned 0x0 [0230.364] CoGetContextToken (in: pToken=0x19e990 | out: pToken=0x19e990) returned 0x0 [0230.364] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7d8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea20 | out: ppvObject=0x19ea20*=0x0) returned 0x80004002 [0230.364] WbemLocator:IUnknown:Release (This=0x58e7d8) returned 0x2 [0230.364] WbemLocator:IUnknown:Release (This=0x58e7d8) returned 0x1 [0230.364] CoGetContextToken (in: pToken=0x19f000 | out: pToken=0x19f000) returned 0x0 [0230.364] CoGetContextToken (in: pToken=0x19ef60 | out: pToken=0x19ef60) returned 0x0 [0230.364] WbemLocator:IUnknown:QueryInterface (in: This=0x58e7d8, riid=0x19f030*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19f02c | out: ppvObject=0x19f02c*=0x58e7d8) returned 0x0 [0230.364] WbemLocator:IUnknown:AddRef (This=0x58e7d8) returned 0x3 [0230.364] WbemLocator:IUnknown:Release (This=0x58e7d8) returned 0x2 [0230.364] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1c4 | out: puCount=0x19f1c4*=0x2) returned 0x0 [0230.364] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=8, puBuffLength=0x19f1c0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1c0*=0xf, pszText=0x0) returned 0x0 [0230.364] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=8, puBuffLength=0x19f1c0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1c0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0230.364] CoCreateInstance (in: rclsid=0x6ce21284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ce212e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x19f09c | out: ppv=0x19f09c*=0x58e758) returned 0x0 [0230.365] WbemLocator:IWbemLocator:ConnectServer (in: This=0x58e758, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x19f130 | out: ppNamespace=0x19f130*=0x579d08) returned 0x0 [0230.380] WbemLocator:IUnknown:QueryInterface (in: This=0x579d08, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efcc | out: ppvObject=0x19efcc*=0x4e6f9c) returned 0x0 [0230.380] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4e6f9c, pProxy=0x579d08, pAuthnSvc=0x19f01c, pAuthzSvc=0x19f018, pServerPrincName=0x19f010, pAuthnLevel=0x19f014, pImpLevel=0x19f004, pAuthInfo=0x19f008, pCapabilites=0x19f00c | out: pAuthnSvc=0x19f01c*=0xa, pAuthzSvc=0x19f018*=0x0, pServerPrincName=0x19f010, pAuthnLevel=0x19f014*=0x6, pImpLevel=0x19f004*=0x2, pAuthInfo=0x19f008, pCapabilites=0x19f00c*=0x1) returned 0x0 [0230.380] WbemLocator:IUnknown:Release (This=0x4e6f9c) returned 0x1 [0230.380] WbemLocator:IUnknown:QueryInterface (in: This=0x579d08, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efc0 | out: ppvObject=0x19efc0*=0x4e6fc0) returned 0x0 [0230.380] WbemLocator:IUnknown:QueryInterface (in: This=0x579d08, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efbc | out: ppvObject=0x19efbc*=0x4e6f9c) returned 0x0 [0230.380] WbemLocator:IClientSecurity:SetBlanket (This=0x4e6f9c, pProxy=0x579d08, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0230.380] WbemLocator:IUnknown:Release (This=0x4e6f9c) returned 0x2 [0230.380] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0230.380] CoTaskMemFree (pv=0x50fb30) [0230.380] WbemLocator:IUnknown:Release (This=0x58e758) returned 0x0 [0230.380] WbemLocator:IUnknown:QueryInterface (in: This=0x579d08, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebbc | out: ppvObject=0x19ebbc*=0x4e6fc0) returned 0x0 [0230.381] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eb78 | out: ppvObject=0x19eb78*=0x0) returned 0x80004002 [0230.390] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x0) returned 0x80004002 [0230.392] WbemLocator:IUnknown:QueryInterface (in: This=0x579d08, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e76c | out: ppvObject=0x19e76c*=0x0) returned 0x80004002 [0230.396] WbemLocator:IUnknown:AddRef (This=0x4e6fc0) returned 0x3 [0230.396] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e4d4 | out: ppvObject=0x19e4d4*=0x0) returned 0x80004002 [0230.397] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e484 | out: ppvObject=0x19e484*=0x0) returned 0x80004002 [0230.397] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e490 | out: ppvObject=0x19e490*=0x4e6f1c) returned 0x0 [0230.397] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6f1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e498 | out: pCid=0x19e498*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0230.397] WbemLocator:IUnknown:Release (This=0x4e6f1c) returned 0x3 [0230.397] CoGetContextToken (in: pToken=0x19e4f0 | out: pToken=0x19e4f0) returned 0x0 [0230.397] CoGetContextToken (in: pToken=0x19e8f8 | out: pToken=0x19e8f8) returned 0x0 [0230.397] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e988 | out: ppvObject=0x19e988*=0x4e6fa4) returned 0x0 [0230.398] WbemLocator:IRpcOptions:Query (in: This=0x4e6fa4, pPrx=0x4e6fc0, dwProperty=2, pdwValue=0x19e9b0 | out: pdwValue=0x19e9b0) returned 0x80004002 [0230.398] WbemLocator:IUnknown:Release (This=0x4e6fa4) returned 0x3 [0230.398] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x2 [0230.398] CoGetContextToken (in: pToken=0x19eed0 | out: pToken=0x19eed0) returned 0x0 [0230.398] CoGetContextToken (in: pToken=0x19ee30 | out: pToken=0x19ee30) returned 0x0 [0230.398] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x19ef00*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19eefc | out: ppvObject=0x19eefc*=0x579d08) returned 0x0 [0230.399] WbemLocator:IUnknown:AddRef (This=0x579d08) returned 0x4 [0230.399] WbemLocator:IUnknown:Release (This=0x579d08) returned 0x3 [0230.399] WbemLocator:IUnknown:Release (This=0x579d08) returned 0x2 [0230.399] SysStringLen (param_1=0x0) returned 0x0 [0230.399] CoGetContextToken (in: pToken=0x19eec8 | out: pToken=0x19eec8) returned 0x0 [0230.399] WbemLocator:IUnknown:AddRef (This=0x4e6fc0) returned 0x3 [0230.399] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6fc0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed5c | out: ppvObject=0x19ed5c*=0x4e6fc0) returned 0x0 [0230.399] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x3 [0230.399] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x2 [0230.399] CoGetContextToken (in: pToken=0x19efb0 | out: pToken=0x19efb0) returned 0x0 [0230.399] WbemLocator:IUnknown:AddRef (This=0x579d08) returned 0x3 [0230.401] IWbemServices:ExecQuery (in: This=0x579d08, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_OperatingSystem", lFlags=16, pCtx=0x0, ppEnum=0x19f1cc | out: ppEnum=0x19f1cc*=0x58c848) returned 0x0 [0230.443] IUnknown:QueryInterface (in: This=0x58c848, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f024 | out: ppvObject=0x19f024*=0x58c84c) returned 0x0 [0230.443] IClientSecurity:QueryBlanket (in: This=0x58c84c, pProxy=0x58c848, pAuthnSvc=0x19f074, pAuthzSvc=0x19f070, pServerPrincName=0x19f068, pAuthnLevel=0x19f06c, pImpLevel=0x19f05c, pAuthInfo=0x19f060, pCapabilites=0x19f064 | out: pAuthnSvc=0x19f074*=0xa, pAuthzSvc=0x19f070*=0x0, pServerPrincName=0x19f068, pAuthnLevel=0x19f06c*=0x6, pImpLevel=0x19f05c*=0x2, pAuthInfo=0x19f060, pCapabilites=0x19f064*=0x1) returned 0x0 [0230.443] IUnknown:Release (This=0x58c84c) returned 0x1 [0230.443] IUnknown:QueryInterface (in: This=0x58c848, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f018 | out: ppvObject=0x19f018*=0x4e70c0) returned 0x0 [0230.443] IUnknown:QueryInterface (in: This=0x58c848, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f014 | out: ppvObject=0x19f014*=0x58c84c) returned 0x0 [0230.443] IClientSecurity:SetBlanket (This=0x58c84c, pProxy=0x58c848, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0230.445] IUnknown:Release (This=0x58c84c) returned 0x2 [0230.445] WbemLocator:IUnknown:Release (This=0x4e70c0) returned 0x1 [0230.445] CoTaskMemFree (pv=0x50f9b0) [0230.445] IUnknown:QueryInterface (in: This=0x58c848, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec10 | out: ppvObject=0x19ec10*=0x4e70c0) returned 0x0 [0230.445] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ebcc | out: ppvObject=0x19ebcc*=0x0) returned 0x80004002 [0230.445] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e9ec | out: ppvObject=0x19e9ec*=0x0) returned 0x80004002 [0230.445] IUnknown:QueryInterface (in: This=0x58c848, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e7c4 | out: ppvObject=0x19e7c4*=0x0) returned 0x80004002 [0230.446] WbemLocator:IUnknown:AddRef (This=0x4e70c0) returned 0x3 [0230.446] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e52c | out: ppvObject=0x19e52c*=0x0) returned 0x80004002 [0230.446] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e4dc | out: ppvObject=0x19e4dc*=0x0) returned 0x80004002 [0230.446] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e4e8 | out: ppvObject=0x19e4e8*=0x4e701c) returned 0x0 [0230.446] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e701c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e4f0 | out: pCid=0x19e4f0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0230.446] WbemLocator:IUnknown:Release (This=0x4e701c) returned 0x3 [0230.446] CoGetContextToken (in: pToken=0x19e548 | out: pToken=0x19e548) returned 0x0 [0230.446] CoGetContextToken (in: pToken=0x19e950 | out: pToken=0x19e950) returned 0x0 [0230.446] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9e0 | out: ppvObject=0x19e9e0*=0x4e70a4) returned 0x0 [0230.446] WbemLocator:IRpcOptions:Query (in: This=0x4e70a4, pPrx=0x4e70c0, dwProperty=2, pdwValue=0x19ea08 | out: pdwValue=0x19ea08) returned 0x80004002 [0230.446] WbemLocator:IUnknown:Release (This=0x4e70a4) returned 0x3 [0230.446] WbemLocator:IUnknown:Release (This=0x4e70c0) returned 0x2 [0230.446] CoGetContextToken (in: pToken=0x19ef20 | out: pToken=0x19ef20) returned 0x0 [0230.446] CoGetContextToken (in: pToken=0x19ee80 | out: pToken=0x19ee80) returned 0x0 [0230.447] WbemLocator:IUnknown:QueryInterface (in: This=0x4e70c0, riid=0x19ef50*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19ef4c | out: ppvObject=0x19ef4c*=0x58c848) returned 0x0 [0230.447] IUnknown:AddRef (This=0x58c848) returned 0x4 [0230.447] IUnknown:Release (This=0x58c848) returned 0x3 [0230.447] IUnknown:Release (This=0x58c848) returned 0x2 [0230.447] WbemLocator:IUnknown:Release (This=0x579d08) returned 0x2 [0230.447] SysStringLen (param_1=0x0) returned 0x0 [0230.447] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f218 | out: puCount=0x19f218*=0x2) returned 0x0 [0230.447] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f214*=0x0, pszText=0x0 | out: puBuffLength=0x19f214*=0xf, pszText=0x0) returned 0x0 [0230.447] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f214*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f214*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0230.447] CoGetContextToken (in: pToken=0x19f068 | out: pToken=0x19f068) returned 0x0 [0230.447] IUnknown:AddRef (This=0x58c848) returned 0x3 [0230.447] IEnumWbemClassObject:Clone (in: This=0x58c848, ppEnum=0x19f224 | out: ppEnum=0x19f224*=0x58d018) returned 0x0 [0230.448] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0e8 | out: ppvObject=0x19f0e8*=0x58d01c) returned 0x0 [0230.448] IClientSecurity:QueryBlanket (in: This=0x58d01c, pProxy=0x58d018, pAuthnSvc=0x19f138, pAuthzSvc=0x19f134, pServerPrincName=0x19f12c, pAuthnLevel=0x19f130, pImpLevel=0x19f120, pAuthInfo=0x19f124, pCapabilites=0x19f128 | out: pAuthnSvc=0x19f138*=0xa, pAuthzSvc=0x19f134*=0x0, pServerPrincName=0x19f12c, pAuthnLevel=0x19f130*=0x6, pImpLevel=0x19f120*=0x2, pAuthInfo=0x19f124, pCapabilites=0x19f128*=0x1) returned 0x0 [0230.448] IUnknown:Release (This=0x58d01c) returned 0x1 [0230.448] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0dc | out: ppvObject=0x19f0dc*=0x4e62c0) returned 0x0 [0230.448] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0d8 | out: ppvObject=0x19f0d8*=0x58d01c) returned 0x0 [0230.448] IClientSecurity:SetBlanket (This=0x58d01c, pProxy=0x58d018, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0230.449] IUnknown:Release (This=0x58d01c) returned 0x2 [0230.449] WbemLocator:IUnknown:Release (This=0x4e62c0) returned 0x1 [0230.449] CoTaskMemFree (pv=0x50f950) [0230.449] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ecc4 | out: ppvObject=0x19ecc4*=0x4e62c0) returned 0x0 [0230.450] WbemLocator:IUnknown:QueryInterface (in: This=0x4e62c0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec80 | out: ppvObject=0x19ec80*=0x0) returned 0x80004002 [0230.450] WbemLocator:IUnknown:QueryInterface (in: This=0x4e62c0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea9c | out: ppvObject=0x19ea9c*=0x0) returned 0x80004002 [0230.450] IUnknown:QueryInterface (in: This=0x58d018, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e874 | out: ppvObject=0x19e874*=0x0) returned 0x80004002 [0230.450] WbemLocator:IUnknown:AddRef (This=0x4e62c0) returned 0x3 [0230.450] WbemLocator:IUnknown:QueryInterface (in: This=0x4e62c0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e5dc | out: ppvObject=0x19e5dc*=0x0) returned 0x80004002 [0230.450] WbemLocator:IUnknown:QueryInterface (in: This=0x4e62c0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e58c | out: ppvObject=0x19e58c*=0x0) returned 0x80004002 [0230.450] WbemLocator:IUnknown:QueryInterface (in: This=0x4e62c0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e598 | out: ppvObject=0x19e598*=0x4e621c) returned 0x0 [0230.451] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e621c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e5a0 | out: pCid=0x19e5a0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0230.451] WbemLocator:IUnknown:Release (This=0x4e621c) returned 0x3 [0230.451] CoGetContextToken (in: pToken=0x19e5f8 | out: pToken=0x19e5f8) returned 0x0 [0230.451] CoGetContextToken (in: pToken=0x19ea00 | out: pToken=0x19ea00) returned 0x0 [0230.451] WbemLocator:IUnknown:QueryInterface (in: This=0x4e62c0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea90 | out: ppvObject=0x19ea90*=0x4e62a4) returned 0x0 [0230.451] WbemLocator:IRpcOptions:Query (in: This=0x4e62a4, pPrx=0x4e62c0, dwProperty=2, pdwValue=0x19eab8 | out: pdwValue=0x19eab8) returned 0x80004002 [0230.451] WbemLocator:IUnknown:Release (This=0x4e62a4) returned 0x3 [0230.451] WbemLocator:IUnknown:Release (This=0x4e62c0) returned 0x2 [0230.451] CoGetContextToken (in: pToken=0x19efd8 | out: pToken=0x19efd8) returned 0x0 [0230.451] CoGetContextToken (in: pToken=0x19ef38 | out: pToken=0x19ef38) returned 0x0 [0230.451] WbemLocator:IUnknown:QueryInterface (in: This=0x4e62c0, riid=0x19f008*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f004 | out: ppvObject=0x19f004*=0x58d018) returned 0x0 [0230.451] IUnknown:AddRef (This=0x58d018) returned 0x4 [0230.451] IUnknown:Release (This=0x58d018) returned 0x3 [0230.451] IUnknown:Release (This=0x58d018) returned 0x2 [0230.451] IUnknown:Release (This=0x58c848) returned 0x2 [0230.451] SysStringLen (param_1=0x0) returned 0x0 [0230.451] IEnumWbemClassObject:Reset (This=0x58d018) returned 0x0 [0230.463] CoTaskMemAlloc (cb=0x4) returned 0x58e688 [0230.463] IEnumWbemClassObject:Next (in: This=0x58d018, lTimeout=-1, uCount=0x1, apObjects=0x58e688, puReturned=0x23ea65c | out: apObjects=0x58e688*=0x513678, puReturned=0x23ea65c*=0x1) returned 0x0 [0230.471] IUnknown:QueryInterface (in: This=0x513678, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e888 | out: ppvObject=0x19e888*=0x513678) returned 0x0 [0230.471] IUnknown:QueryInterface (in: This=0x513678, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e844 | out: ppvObject=0x19e844*=0x0) returned 0x80004002 [0230.471] IUnknown:QueryInterface (in: This=0x513678, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e664 | out: ppvObject=0x19e664*=0x0) returned 0x80004002 [0230.471] IUnknown:QueryInterface (in: This=0x513678, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e43c | out: ppvObject=0x19e43c*=0x0) returned 0x80004002 [0230.471] IUnknown:AddRef (This=0x513678) returned 0x3 [0230.471] IUnknown:QueryInterface (in: This=0x513678, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e1a4 | out: ppvObject=0x19e1a4*=0x0) returned 0x80004002 [0230.471] IUnknown:QueryInterface (in: This=0x513678, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e154 | out: ppvObject=0x19e154*=0x0) returned 0x80004002 [0230.471] IUnknown:QueryInterface (in: This=0x513678, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e160 | out: ppvObject=0x19e160*=0x51367c) returned 0x0 [0230.471] IMarshal:GetUnmarshalClass (in: This=0x51367c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e168 | out: pCid=0x19e168*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0230.471] IUnknown:Release (This=0x51367c) returned 0x3 [0230.472] CoGetContextToken (in: pToken=0x19e1c0 | out: pToken=0x19e1c0) returned 0x0 [0230.472] CoGetContextToken (in: pToken=0x19e5c8 | out: pToken=0x19e5c8) returned 0x0 [0230.472] IUnknown:QueryInterface (in: This=0x513678, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e658 | out: ppvObject=0x19e658*=0x0) returned 0x80004002 [0230.472] IUnknown:Release (This=0x513678) returned 0x2 [0230.472] CoGetContextToken (in: pToken=0x19eb98 | out: pToken=0x19eb98) returned 0x0 [0230.472] CoGetContextToken (in: pToken=0x19eaf8 | out: pToken=0x19eaf8) returned 0x0 [0230.472] IUnknown:QueryInterface (in: This=0x513678, riid=0x19ebc8*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19ebc4 | out: ppvObject=0x19ebc4*=0x513678) returned 0x0 [0230.472] IUnknown:AddRef (This=0x513678) returned 0x4 [0230.472] IUnknown:Release (This=0x513678) returned 0x3 [0230.472] IUnknown:Release (This=0x513678) returned 0x2 [0230.472] CoTaskMemFree (pv=0x58e688) [0230.472] CoGetContextToken (in: pToken=0x19ef00 | out: pToken=0x19ef00) returned 0x0 [0230.472] IUnknown:AddRef (This=0x513678) returned 0x3 [0230.472] IWbemClassObject:Get (in: This=0x513678, wszName="__GENUS", lFlags=0, pVal=0x19f214*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f294*=0, plFlavor=0x19f290*=0 | out: pVal=0x19f214*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f294*=3, plFlavor=0x19f290*=64) returned 0x0 [0230.472] IWbemClassObject:Get (in: This=0x513678, wszName="__PATH", lFlags=0, pVal=0x19f1f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f27c*=0, plFlavor=0x19f278*=0 | out: pVal=0x19f1f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"", varVal2=0x0), pType=0x19f27c*=8, plFlavor=0x19f278*=64) returned 0x0 [0230.472] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0230.472] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x72 [0230.472] CoGetObjectContext (in: riid=0x232009c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f224 | out: ppv=0x19f224*=0x4d0cbc) returned 0x0 [0230.473] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f21c | out: pAptType=0x19f21c*=1) returned 0x0 [0230.473] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x2320084*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f220 | out: ppvObject=0x19f220*=0x0) returned 0x80004002 [0230.473] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0230.473] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb90 | out: ppv=0x19eb90*=0x58e688) returned 0x0 [0230.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e688, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19eda8 | out: ppvObject=0x19eda8*=0x0) returned 0x80004002 [0230.474] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e688, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19edbc | out: ppvObject=0x19edbc*=0x519a78) returned 0x0 [0230.474] WbemDefPath:IUnknown:Release (This=0x58e688) returned 0x0 [0230.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a78, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9dc | out: ppvObject=0x19e9dc*=0x519a78) returned 0x0 [0230.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a78, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e998 | out: ppvObject=0x19e998*=0x0) returned 0x80004002 [0230.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a78, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e58c | out: ppvObject=0x19e58c*=0x0) returned 0x80004002 [0230.474] WbemDefPath:IUnknown:AddRef (This=0x519a78) returned 0x3 [0230.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a78, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2f4 | out: ppvObject=0x19e2f4*=0x0) returned 0x80004002 [0230.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a78, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e2a4 | out: ppvObject=0x19e2a4*=0x0) returned 0x80004002 [0230.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a78, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e2b0 | out: ppvObject=0x19e2b0*=0x528448) returned 0x0 [0230.474] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x528448, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e2b8 | out: pCid=0x19e2b8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0230.474] WbemDefPath:IUnknown:Release (This=0x528448) returned 0x3 [0230.474] CoGetContextToken (in: pToken=0x19e310 | out: pToken=0x19e310) returned 0x0 [0230.474] CoGetContextToken (in: pToken=0x19e718 | out: pToken=0x19e718) returned 0x0 [0230.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a78, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7a8 | out: ppvObject=0x19e7a8*=0x0) returned 0x80004002 [0230.475] WbemDefPath:IUnknown:Release (This=0x519a78) returned 0x2 [0230.475] WbemDefPath:IUnknown:Release (This=0x519a78) returned 0x1 [0230.475] CoGetContextToken (in: pToken=0x19f0a0 | out: pToken=0x19f0a0) returned 0x0 [0230.475] CoGetContextToken (in: pToken=0x19f000 | out: pToken=0x19f000) returned 0x0 [0230.475] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a78, riid=0x19f0d0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f0cc | out: ppvObject=0x19f0cc*=0x519a78) returned 0x0 [0230.475] WbemDefPath:IUnknown:AddRef (This=0x519a78) returned 0x3 [0230.475] WbemDefPath:IUnknown:Release (This=0x519a78) returned 0x2 [0230.475] WbemDefPath:IWbemPath:SetText (This=0x519a78, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_OperatingSystem.CSName=\"XC64ZB\"") returned 0x0 [0230.475] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f250 | out: puCount=0x19f250*=0x2) returned 0x0 [0230.475] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f24c*=0x0, pszText=0x0 | out: puBuffLength=0x19f24c*=0xf, pszText=0x0) returned 0x0 [0230.475] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f24c*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f24c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0230.475] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f21c | out: puCount=0x19f21c*=0x2) returned 0x0 [0230.475] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f218*=0x0, pszText=0x0 | out: puBuffLength=0x19f218*=0xf, pszText=0x0) returned 0x0 [0230.475] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f218*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f218*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0230.475] IWbemClassObject:Get (in: This=0x513678, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x19f218*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23eaee8*=0, plFlavor=0x23eaeec*=0 | out: pVal=0x19f218*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x23eaee8*=21, plFlavor=0x23eaeec*=0) returned 0x0 [0230.475] SysStringByteLen (bstr="2096620") returned 0xe [0230.475] SysStringByteLen (bstr="2096620") returned 0xe [0230.475] IWbemClassObject:Get (in: This=0x513678, wszName="TotalVisibleMemorySize", lFlags=0, pVal=0x19f220*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23eaee8*=21, plFlavor=0x23eaeec*=0 | out: pVal=0x19f220*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="2096620", varVal2=0x0), pType=0x23eaee8*=21, plFlavor=0x23eaeec*=0) returned 0x0 [0230.475] SysStringByteLen (bstr="2096620") returned 0xe [0230.475] SysStringByteLen (bstr="2096620") returned 0xe [0230.477] CoTaskMemAlloc (cb=0x4) returned 0x58e688 [0230.477] IEnumWbemClassObject:Next (in: This=0x58d018, lTimeout=-1, uCount=0x1, apObjects=0x58e688, puReturned=0x23ea65c | out: apObjects=0x58e688*=0x0, puReturned=0x23ea65c*=0x0) returned 0x1 [0230.478] CoTaskMemFree (pv=0x58e688) [0230.478] CoGetContextToken (in: pToken=0x19f150 | out: pToken=0x19f150) returned 0x0 [0230.478] WbemLocator:IUnknown:Release (This=0x4e62c0) returned 0x1 [0230.478] IUnknown:Release (This=0x58d018) returned 0x0 [0230.480] CoGetContextToken (in: pToken=0x19f150 | out: pToken=0x19f150) returned 0x0 [0230.480] WbemLocator:IUnknown:Release (This=0x4e70c0) returned 0x1 [0230.480] IUnknown:Release (This=0x58c848) returned 0x0 [0230.484] CoCreateGuid (in: pguid=0x19ef80 | out: pguid=0x19ef80*(Data1=0x8a60a7df, Data2=0x932b, Data3=0x435c, Data4=([0]=0x8c, [1]=0x9, [2]=0xbb, [3]=0x5b, [4]=0x18, [5]=0xce, [6]=0x32, [7]=0x7b))) returned 0x0 [0230.484] CoCreateGuid (in: pguid=0x19eeb0 | out: pguid=0x19eeb0*(Data1=0xd2355118, Data2=0x125d, Data3=0x4237, Data4=([0]=0xb2, [1]=0x43, [2]=0x3, [3]=0x1e, [4]=0xa9, [5]=0x4a, [6]=0x81, [7]=0x58))) returned 0x0 [0230.515] send (s=0x2cc, buf=0x22f8843*, len=292, flags=0) returned 292 [0230.516] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 128 [0230.578] GdipCreateFromHWND (hwnd=0x0, graphics=0x19f284) returned 0x0 [0230.579] GdipGetDC (graphics=0x53c1f08, hdc=0x19f294) returned 0x0 [0230.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="gdi32", cchWideChar=5, lpMultiByteStr=0x19f234, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gdi32Îë\x04ÏÓ&\x9a «flhö\x19", lpUsedDefaultChar=0x0) returned 5 [0230.580] LoadLibraryA (lpLibFileName="gdi32") returned 0x77440000 [0230.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDeviceCaps", cchWideChar=13, lpMultiByteStr=0x19f22c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDeviceCapsÏë\x04ÏÓ&\x9a «flhö\x19", lpUsedDefaultChar=0x0) returned 13 [0230.581] GetProcAddress (hModule=0x77440000, lpProcName="GetDeviceCaps") returned 0x774c0fe0 [0230.581] GetDeviceCaps (hdc=0x6010190, index=10) returned 900 [0230.581] GetDeviceCaps (hdc=0x6010190, index=117) returned 900 [0230.581] GdipReleaseDC (graphics=0x53c1f08, hdc=0x6010190) returned 0x0 [0230.581] GdipDeleteGraphics (graphics=0x53c1f08) returned 0x0 [0230.727] GdipCreateBitmapFromScan0 (width=1440, height=900, stride=0, format=0x26200a, scan0=0x0, bitmap=0x19f274) returned 0x0 [0230.799] GdipGetImagePixelFormat (image=0x53c1f08, format=0x19f2f4) returned 0x0 [0230.799] GdipGetImageGraphicsContext (image=0x53c1f08, graphics=0x19f300) returned 0x0 [0230.802] GdipSetInterpolationMode (graphics=0x53c2408, interpolationMode=0x4) returned 0x0 [0230.802] GdipSetPixelOffsetMode (graphics=0x53c2408, pixelOffsetMode=0x1) returned 0x0 [0230.803] GdipSetSmoothingMode (graphics=0x53c2408, smoothingMode=0x1) returned 0x0 [0231.017] GetDC (hWnd=0x0) returned 0xe0106ca [0231.020] GetCurrentObject (hdc=0xe0106ca, type=0x1) returned 0x1b00017 [0231.020] GetCurrentObject (hdc=0xe0106ca, type=0x2) returned 0x1900010 [0231.020] GetCurrentObject (hdc=0xe0106ca, type=0x7) returned 0xbf050541 [0231.020] GetCurrentObject (hdc=0xe0106ca, type=0x6) returned 0x18a0048 [0231.020] GdipGetDC (graphics=0x53c2408, hdc=0x19f1f4) returned 0x0 [0231.100] BitBlt (hdc=0x2a01066e, x=0, y=0, cx=1440, cy=900, hdcSrc=0xe0106ca, x1=0, y1=0, rop=0xcc0020) returned 1 [0231.456] GdipReleaseDC (graphics=0x53c2408, hdc=0x2a01066e) returned 0x0 [0231.460] ReleaseDC (hWnd=0x0, hDC=0xe0106ca) returned 1 [0231.460] GdipDeleteGraphics (graphics=0x53c2408) returned 0x0 [0231.466] GdipGetImageEncodersSize (numEncoders=0x19f27c, size=0x19f278) returned 0x0 [0231.466] LocalAlloc (uFlags=0x0, uBytes=0x410) returned 0x58c220 [0231.467] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x58c220 | out: encoders=0x58c220) returned 0x0 [0231.471] LocalFree (hMem=0x58c220) returned 0x0 [0231.480] GdipSaveImageToStream (image=0x53c1f08, stream=0x5670030, clsidEncoder=0x19f28c*(Data1=0x557cf406, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0232.034] CoCreateGuid (in: pguid=0x19efd4 | out: pguid=0x19efd4*(Data1=0x3b0c3887, Data2=0x4a28, Data3=0x4472, Data4=([0]=0x8b, [1]=0x60, [2]=0xd3, [3]=0xce, [4]=0x3e, [5]=0x50, [6]=0x93, [7]=0x4))) returned 0x0 [0232.034] CoCreateGuid (in: pguid=0x19ef04 | out: pguid=0x19ef04*(Data1=0x7e8540fe, Data2=0xbbb1, Data3=0x43d8, Data4=([0]=0xb9, [1]=0x4e, [2]=0xb, [3]=0xff, [4]=0x4c, [5]=0x8c, [6]=0xe7, [7]=0x0))) returned 0x0 [0232.066] send (s=0x2cc, buf=0x36f40a6*, len=65536, flags=0) returned 65536 [0232.068] send (s=0x2cc, buf=0x37040a6*, len=65536, flags=0) returned 65536 [0232.152] send (s=0x2cc, buf=0x37140a6*, len=65536, flags=0) returned 65536 [0232.268] send (s=0x2cc, buf=0x37240a6*, len=65536, flags=0) returned 65536 [0232.328] send (s=0x2cc, buf=0x37340a6*, len=65536, flags=0) returned 65536 [0232.503] send (s=0x2cc, buf=0x37440a6*, len=65536, flags=0) returned 65536 [0232.571] send (s=0x2cc, buf=0x37540a6*, len=65536, flags=0) returned 65536 [0232.798] send (s=0x2cc, buf=0x37640a6*, len=65536, flags=0) returned 65536 [0232.859] send (s=0x2cc, buf=0x37740a6*, len=65536, flags=0) returned 65536 [0233.206] send (s=0x2cc, buf=0x37840a6*, len=65536, flags=0) returned 65536 [0233.267] send (s=0x2cc, buf=0x37940a6*, len=65536, flags=0) returned 65536 [0233.652] send (s=0x2cc, buf=0x37a40a6*, len=65536, flags=0) returned 65536 [0233.715] send (s=0x2cc, buf=0x37b40a6*, len=55586, flags=0) returned 55586 [0234.002] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 125 [0234.180] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x294) returned 0x0 [0234.181] RegQueryInfoKeyW (in: hKey=0x294, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x19f2ec, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19f2e8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x19f2ec*=0x2c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x19f2e8*=0x0, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.181] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x0, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="AddressBook", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.181] CoTaskMemFree (pv=0x0) [0234.181] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x1, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Connection Manager", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.181] CoTaskMemFree (pv=0x0) [0234.181] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x2, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DirectDrawEx", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.181] CoTaskMemFree (pv=0x0) [0234.181] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x3, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DXM_Runtime", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.181] CoTaskMemFree (pv=0x0) [0234.181] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x4, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Fontcore", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.181] CoTaskMemFree (pv=0x0) [0234.181] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x5, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE40", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.181] CoTaskMemFree (pv=0x0) [0234.181] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x6, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE4Data", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.182] CoTaskMemFree (pv=0x0) [0234.182] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x7, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE5BAKEX", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.182] CoTaskMemFree (pv=0x0) [0234.182] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x8, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEData", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.182] CoTaskMemFree (pv=0x0) [0234.182] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x9, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MobileOptionPack", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.182] CoTaskMemFree (pv=0x0) [0234.182] RegEnumKeyExW (in: hKey=0x294, dwIndex=0xa, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MPlayer2", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.182] CoTaskMemFree (pv=0x0) [0234.182] RegEnumKeyExW (in: hKey=0x294, dwIndex=0xb, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="SchedulingAgent", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.182] CoTaskMemFree (pv=0x0) [0234.182] RegEnumKeyExW (in: hKey=0x294, dwIndex=0xc, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WIC", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.182] CoTaskMemFree (pv=0x0) [0234.182] RegEnumKeyExW (in: hKey=0x294, dwIndex=0xd, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{0FA68574-690B-4B00-89AA-B28946231449}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.182] CoTaskMemFree (pv=0x0) [0234.182] RegEnumKeyExW (in: hKey=0x294, dwIndex=0xe, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.182] CoTaskMemFree (pv=0x0) [0234.182] RegEnumKeyExW (in: hKey=0x294, dwIndex=0xf, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.183] CoTaskMemFree (pv=0x0) [0234.183] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x10, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.183] CoTaskMemFree (pv=0x0) [0234.183] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x11, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.183] CoTaskMemFree (pv=0x0) [0234.183] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x12, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.183] CoTaskMemFree (pv=0x0) [0234.183] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x13, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.183] CoTaskMemFree (pv=0x0) [0234.183] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x14, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.183] CoTaskMemFree (pv=0x0) [0234.183] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x15, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.183] CoTaskMemFree (pv=0x0) [0234.183] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x16, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.183] CoTaskMemFree (pv=0x0) [0234.183] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x17, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.183] CoTaskMemFree (pv=0x0) [0234.183] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x18, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.184] CoTaskMemFree (pv=0x0) [0234.184] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x19, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{65e650ff-30be-469d-b63a-418d71ea1765}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.184] CoTaskMemFree (pv=0x0) [0234.184] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x1a, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{6913e92a-b64e-41c9-a5e6-cef39207fe89}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.184] CoTaskMemFree (pv=0x0) [0234.184] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x1b, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.184] CoTaskMemFree (pv=0x0) [0234.184] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x1c, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0000-0000-0000000FF1CE}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.184] CoTaskMemFree (pv=0x0) [0234.184] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x1d, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0409-0000-0000000FF1CE}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.184] CoTaskMemFree (pv=0x0) [0234.184] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x1e, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.184] CoTaskMemFree (pv=0x0) [0234.184] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x1f, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{B175520C-86A2-35A7-8619-86DC379688B9}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.184] CoTaskMemFree (pv=0x0) [0234.184] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x20, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.184] CoTaskMemFree (pv=0x0) [0234.185] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x21, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.185] CoTaskMemFree (pv=0x0) [0234.185] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x22, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.185] CoTaskMemFree (pv=0x0) [0234.185] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x23, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.185] CoTaskMemFree (pv=0x0) [0234.185] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x24, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.185] CoTaskMemFree (pv=0x0) [0234.185] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x25, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.185] CoTaskMemFree (pv=0x0) [0234.185] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x26, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.185] CoTaskMemFree (pv=0x0) [0234.185] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x27, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.185] CoTaskMemFree (pv=0x0) [0234.185] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x28, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.185] CoTaskMemFree (pv=0x0) [0234.186] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x29, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.186] CoTaskMemFree (pv=0x0) [0234.186] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x2a, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.186] CoTaskMemFree (pv=0x0) [0234.186] RegEnumKeyExW (in: hKey=0x294, dwIndex=0x2b, lpName=0x23a6b08, lpcchName=0x19f308, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x19f308, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0234.186] CoTaskMemFree (pv=0x0) [0234.186] RegOpenKeyExW (in: hKey=0x294, lpSubKey="AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.186] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.186] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.186] RegCloseKey (hKey=0x270) returned 0x0 [0234.186] RegOpenKeyExW (in: hKey=0x294, lpSubKey="Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.187] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.187] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.187] RegCloseKey (hKey=0x270) returned 0x0 [0234.187] RegOpenKeyExW (in: hKey=0x294, lpSubKey="DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.187] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.187] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.187] RegCloseKey (hKey=0x270) returned 0x0 [0234.187] RegOpenKeyExW (in: hKey=0x294, lpSubKey="DXM_Runtime", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.187] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.188] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.188] RegCloseKey (hKey=0x270) returned 0x0 [0234.188] RegOpenKeyExW (in: hKey=0x294, lpSubKey="Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.188] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.188] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.188] RegCloseKey (hKey=0x270) returned 0x0 [0234.188] RegOpenKeyExW (in: hKey=0x294, lpSubKey="IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.188] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.188] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.188] RegCloseKey (hKey=0x270) returned 0x0 [0234.188] RegOpenKeyExW (in: hKey=0x294, lpSubKey="IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.188] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.188] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.188] RegCloseKey (hKey=0x270) returned 0x0 [0234.189] RegOpenKeyExW (in: hKey=0x294, lpSubKey="IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.189] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.189] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.189] RegCloseKey (hKey=0x270) returned 0x0 [0234.189] RegOpenKeyExW (in: hKey=0x294, lpSubKey="IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.189] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.189] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.189] RegCloseKey (hKey=0x270) returned 0x0 [0234.189] RegOpenKeyExW (in: hKey=0x294, lpSubKey="MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.189] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.189] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.190] RegCloseKey (hKey=0x270) returned 0x0 [0234.190] RegOpenKeyExW (in: hKey=0x294, lpSubKey="MPlayer2", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.190] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.190] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.190] RegCloseKey (hKey=0x270) returned 0x0 [0234.190] RegOpenKeyExW (in: hKey=0x294, lpSubKey="SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.190] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.190] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.190] RegCloseKey (hKey=0x270) returned 0x0 [0234.190] RegOpenKeyExW (in: hKey=0x294, lpSubKey="WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.190] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.190] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.190] RegCloseKey (hKey=0x270) returned 0x0 [0234.191] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{0FA68574-690B-4B00-89AA-B28946231449}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.191] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x7e) returned 0x0 [0234.191] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23a902c, lpcbData=0x19f2e0*=0x7e | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508", lpcbData=0x19f2e0*=0x7e) returned 0x0 [0234.191] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x18) returned 0x0 [0234.191] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23a9198, lpcbData=0x19f2e0*=0x18 | out: lpType=0x19f2e4*=0x1, lpData="14.25.28508", lpcbData=0x19f2e0*=0x18) returned 0x0 [0234.225] RegCloseKey (hKey=0x270) returned 0x0 [0234.225] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.225] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x76) returned 0x0 [0234.225] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23aea64, lpcbData=0x19f2e0*=0x76 | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpcbData=0x19f2e0*=0x76) returned 0x0 [0234.225] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x16) returned 0x0 [0234.225] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23aebc0, lpcbData=0x19f2e0*=0x16 | out: lpType=0x19f2e4*=0x1, lpData="12.0.21005", lpcbData=0x19f2e0*=0x16) returned 0x0 [0234.225] RegCloseKey (hKey=0x270) returned 0x0 [0234.225] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.226] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.226] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.226] RegCloseKey (hKey=0x270) returned 0x0 [0234.226] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.226] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.226] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.226] RegCloseKey (hKey=0x270) returned 0x0 [0234.226] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.226] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.226] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.226] RegCloseKey (hKey=0x270) returned 0x0 [0234.226] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.226] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.226] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.227] RegCloseKey (hKey=0x270) returned 0x0 [0234.227] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.227] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.227] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.227] RegCloseKey (hKey=0x270) returned 0x0 [0234.227] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.227] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.227] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.227] RegCloseKey (hKey=0x270) returned 0x0 [0234.227] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.227] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.227] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.227] RegCloseKey (hKey=0x270) returned 0x0 [0234.228] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.228] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x78) returned 0x0 [0234.228] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23afbe4, lpcbData=0x19f2e0*=0x78 | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508", lpcbData=0x19f2e0*=0x78) returned 0x0 [0234.228] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x18) returned 0x0 [0234.228] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23afd40, lpcbData=0x19f2e0*=0x18 | out: lpType=0x19f2e4*=0x1, lpData="14.25.28508", lpcbData=0x19f2e0*=0x18) returned 0x0 [0234.228] RegCloseKey (hKey=0x270) returned 0x0 [0234.228] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.228] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x7a) returned 0x0 [0234.228] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b00b8, lpcbData=0x19f2e0*=0x7a | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpcbData=0x19f2e0*=0x7a) returned 0x0 [0234.228] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x1a) returned 0x0 [0234.229] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b021c, lpcbData=0x19f2e0*=0x1a | out: lpType=0x19f2e4*=0x1, lpData="11.0.61030.0", lpcbData=0x19f2e0*=0x1a) returned 0x0 [0234.229] RegCloseKey (hKey=0x270) returned 0x0 [0234.229] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{3c3aafc8-d898-43ec-998f-965ffdae065a}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.229] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x7a) returned 0x0 [0234.229] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b05a0, lpcbData=0x19f2e0*=0x7a | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501", lpcbData=0x19f2e0*=0x7a) returned 0x0 [0234.229] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x1a) returned 0x0 [0234.229] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b0704, lpcbData=0x19f2e0*=0x1a | out: lpType=0x19f2e4*=0x1, lpData="12.0.30501.0", lpcbData=0x19f2e0*=0x1a) returned 0x0 [0234.229] RegCloseKey (hKey=0x270) returned 0x0 [0234.230] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{65e650ff-30be-469d-b63a-418d71ea1765}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.230] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x86) returned 0x0 [0234.230] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b0ab4, lpcbData=0x19f2e0*=0x86 | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508", lpcbData=0x19f2e0*=0x86) returned 0x0 [0234.230] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x1c) returned 0x0 [0234.230] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b0c30, lpcbData=0x19f2e0*=0x1c | out: lpType=0x19f2e4*=0x1, lpData="14.25.28508.3", lpcbData=0x19f2e0*=0x1c) returned 0x0 [0234.230] RegCloseKey (hKey=0x270) returned 0x0 [0234.230] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{6913e92a-b64e-41c9-a5e6-cef39207fe89}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.230] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x86) returned 0x0 [0234.230] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b0fc4, lpcbData=0x19f2e0*=0x86 | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508", lpcbData=0x19f2e0*=0x86) returned 0x0 [0234.230] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x1c) returned 0x0 [0234.231] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b1140, lpcbData=0x19f2e0*=0x1c | out: lpType=0x19f2e4*=0x1, lpData="14.25.28508.3", lpcbData=0x19f2e0*=0x1c) returned 0x0 [0234.231] RegCloseKey (hKey=0x270) returned 0x0 [0234.231] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.231] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x54) returned 0x0 [0234.231] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b14d4, lpcbData=0x19f2e0*=0x54 | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2005 Redistributable", lpcbData=0x19f2e0*=0x54) returned 0x0 [0234.231] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x14) returned 0x0 [0234.231] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b15e8, lpcbData=0x19f2e0*=0x14 | out: lpType=0x19f2e4*=0x1, lpData="8.0.61001", lpcbData=0x19f2e0*=0x14) returned 0x0 [0234.232] RegCloseKey (hKey=0x270) returned 0x0 [0234.232] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{90160000-008C-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.232] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x5e) returned 0x0 [0234.232] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b1930, lpcbData=0x19f2e0*=0x5e | out: lpType=0x19f2e4*=0x1, lpData="Office 16 Click-to-Run Extensibility Component", lpcbData=0x19f2e0*=0x5e) returned 0x0 [0234.232] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x1e) returned 0x0 [0234.232] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b1a5c, lpcbData=0x19f2e0*=0x1e | out: lpType=0x19f2e4*=0x1, lpData="16.0.4266.1003", lpcbData=0x19f2e0*=0x1e) returned 0x0 [0234.232] RegCloseKey (hKey=0x270) returned 0x0 [0234.232] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{90160000-008C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.232] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x5c) returned 0x0 [0234.232] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b1e1c, lpcbData=0x19f2e0*=0x5c | out: lpType=0x19f2e4*=0x1, lpData="Office 16 Click-to-Run Localization Component", lpcbData=0x19f2e0*=0x5c) returned 0x0 [0234.233] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x1e) returned 0x0 [0234.233] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b1f40, lpcbData=0x19f2e0*=0x1e | out: lpType=0x19f2e4*=0x1, lpData="16.0.4266.1003", lpcbData=0x19f2e0*=0x1e) returned 0x0 [0234.233] RegCloseKey (hKey=0x270) returned 0x0 [0234.233] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.233] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x7e) returned 0x0 [0234.233] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b22b4, lpcbData=0x19f2e0*=0x7e | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpcbData=0x19f2e0*=0x7e) returned 0x0 [0234.233] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x1e) returned 0x0 [0234.233] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b2420, lpcbData=0x19f2e0*=0x1e | out: lpType=0x19f2e4*=0x1, lpData="9.0.30729.6161", lpcbData=0x19f2e0*=0x1e) returned 0x0 [0234.233] RegCloseKey (hKey=0x270) returned 0x0 [0234.233] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.233] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x7c) returned 0x0 [0234.234] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b27b4, lpcbData=0x19f2e0*=0x7c | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpcbData=0x19f2e0*=0x7c) returned 0x0 [0234.234] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x16) returned 0x0 [0234.234] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b2918, lpcbData=0x19f2e0*=0x16 | out: lpType=0x19f2e4*=0x1, lpData="11.0.61030", lpcbData=0x19f2e0*=0x16) returned 0x0 [0234.234] RegCloseKey (hKey=0x270) returned 0x0 [0234.234] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.234] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x76) returned 0x0 [0234.234] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b2c94, lpcbData=0x19f2e0*=0x76 | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpcbData=0x19f2e0*=0x76) returned 0x0 [0234.234] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x16) returned 0x0 [0234.234] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b2df0, lpcbData=0x19f2e0*=0x16 | out: lpType=0x19f2e4*=0x1, lpData="11.0.61030", lpcbData=0x19f2e0*=0x16) returned 0x0 [0234.234] RegCloseKey (hKey=0x270) returned 0x0 [0234.234] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.235] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x7a) returned 0x0 [0234.235] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b3164, lpcbData=0x19f2e0*=0x7a | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030", lpcbData=0x19f2e0*=0x7a) returned 0x0 [0234.235] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x1a) returned 0x0 [0234.235] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b32c8, lpcbData=0x19f2e0*=0x1a | out: lpType=0x19f2e4*=0x1, lpData="11.0.61030.0", lpcbData=0x19f2e0*=0x1a) returned 0x0 [0234.235] RegCloseKey (hKey=0x270) returned 0x0 [0234.235] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.235] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x7a) returned 0x0 [0234.235] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b364c, lpcbData=0x19f2e0*=0x7a | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpcbData=0x19f2e0*=0x7a) returned 0x0 [0234.235] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x1a) returned 0x0 [0234.235] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b37b0, lpcbData=0x19f2e0*=0x1a | out: lpType=0x19f2e4*=0x1, lpData="12.0.30501.0", lpcbData=0x19f2e0*=0x1a) returned 0x0 [0234.235] RegCloseKey (hKey=0x270) returned 0x0 [0234.236] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.236] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x78) returned 0x0 [0234.236] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b3b34, lpcbData=0x19f2e0*=0x78 | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpcbData=0x19f2e0*=0x78) returned 0x0 [0234.236] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x16) returned 0x0 [0234.236] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b3c90, lpcbData=0x19f2e0*=0x16 | out: lpType=0x19f2e4*=0x1, lpData="10.0.40219", lpcbData=0x19f2e0*=0x16) returned 0x0 [0234.236] RegCloseKey (hKey=0x270) returned 0x0 [0234.236] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.236] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.236] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.236] RegCloseKey (hKey=0x270) returned 0x0 [0234.237] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.237] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.237] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.237] RegCloseKey (hKey=0x270) returned 0x0 [0234.237] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.237] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.237] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.237] RegCloseKey (hKey=0x270) returned 0x0 [0234.237] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.238] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.238] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.238] RegCloseKey (hKey=0x270) returned 0x0 [0234.238] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.238] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.238] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.238] RegCloseKey (hKey=0x270) returned 0x0 [0234.238] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.238] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.239] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.239] RegCloseKey (hKey=0x270) returned 0x0 [0234.239] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.239] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.239] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x0, lpData=0x0, lpcbData=0x19f2e0*=0x0) returned 0x2 [0234.239] RegCloseKey (hKey=0x270) returned 0x0 [0234.240] RegOpenKeyExW (in: hKey=0x294, lpSubKey="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2c4 | out: phkResult=0x19f2c4*=0x270) returned 0x0 [0234.240] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x7c) returned 0x0 [0234.240] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b4cb8, lpcbData=0x19f2e0*=0x7c | out: lpType=0x19f2e4*=0x1, lpData="Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpcbData=0x19f2e0*=0x7c) returned 0x0 [0234.240] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x0, lpcbData=0x19f2e0*=0x0 | out: lpType=0x19f2e4*=0x1, lpData=0x0, lpcbData=0x19f2e0*=0x16) returned 0x0 [0234.240] RegQueryValueExW (in: hKey=0x270, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19f2e4, lpData=0x23b4e1c, lpcbData=0x19f2e0*=0x16 | out: lpType=0x19f2e4*=0x1, lpData="12.0.21005", lpcbData=0x19f2e0*=0x16) returned 0x0 [0234.240] RegCloseKey (hKey=0x270) returned 0x0 [0234.240] RegCloseKey (hKey=0x294) returned 0x0 [0234.249] CoCreateGuid (in: pguid=0x19efd4 | out: pguid=0x19efd4*(Data1=0x1a766ee, Data2=0xcb01, Data3=0x4832, Data4=([0]=0x96, [1]=0x6, [2]=0xdf, [3]=0xcb, [4]=0x98, [5]=0xa8, [6]=0x8e, [7]=0x1))) returned 0x0 [0234.249] CoCreateGuid (in: pguid=0x19ef04 | out: pguid=0x19ef04*(Data1=0xaf8d6c1b, Data2=0xc1fa, Data3=0x4658, Data4=([0]=0x8a, [1]=0xf3, [2]=0x4c, [3]=0x5f, [4]=0x40, [5]=0x8a, [6]=0xd, [7]=0x12))) returned 0x0 [0234.250] send (s=0x2cc, buf=0x35f4087*, len=1471, flags=0) returned 1471 [0234.251] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 125 [0234.286] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Valve\\Steam", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f278 | out: phkResult=0x19f278*=0x0) returned 0x2 [0234.287] CoCreateGuid (in: pguid=0x19efd0 | out: pguid=0x19efd0*(Data1=0xe5b580a8, Data2=0x9cf, Data3=0x49b1, Data4=([0]=0x94, [1]=0x3f, [2]=0xe8, [3]=0xa3, [4]=0x28, [5]=0x1d, [6]=0x4b, [7]=0x71))) returned 0x0 [0234.287] CoCreateGuid (in: pguid=0x19ef00 | out: pguid=0x19ef00*(Data1=0x61a55368, Data2=0x8153, Data3=0x402b, Data4=([0]=0x8f, [1]=0xd8, [2]=0x45, [3]=0x79, [4]=0x78, [5]=0xc3, [6]=0xab, [7]=0xc0))) returned 0x0 [0234.287] send (s=0x2cc, buf=0x35f4087*, len=162, flags=0) returned 162 [0234.288] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 128 [0234.362] CoCreateGuid (in: pguid=0x19efd4 | out: pguid=0x19efd4*(Data1=0x78adf942, Data2=0xed71, Data3=0x47b5, Data4=([0]=0x8d, [1]=0x85, [2]=0x8e, [3]=0xbf, [4]=0xee, [5]=0x7e, [6]=0x23, [7]=0x80))) returned 0x0 [0234.362] CoCreateGuid (in: pguid=0x19ef04 | out: pguid=0x19ef04*(Data1=0xafff4fc7, Data2=0x2f12, Data3=0x4c00, Data4=([0]=0x8e, [1]=0x97, [2]=0x49, [3]=0xa, [4]=0x8b, [5]=0x3e, [6]=0x26, [7]=0xad))) returned 0x0 [0234.362] send (s=0x2cc, buf=0x35f4087*, len=171, flags=0) returned 171 [0234.363] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 126 [0234.432] GetCurrentProcessId () returned 0xdb0 [0234.436] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19eb4c | out: lpLuid=0x19eb4c*(LowPart=0x14, HighPart=0)) returned 1 [0234.437] GetCurrentProcess () returned 0xffffffff [0234.438] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19eb48 | out: TokenHandle=0x19eb48*=0x270) returned 1 [0234.438] AdjustTokenPrivileges (in: TokenHandle=0x270, DisableAllPrivileges=0, NewState=0x23b7550*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0234.439] CloseHandle (hObject=0x270) returned 1 [0234.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32830b0, Length=0x20000, ResultLength=0x19f22c | out: SystemInformation=0x32830b0, ResultLength=0x19f22c*=0x174b8) returned 0x0 [0234.467] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f214 | out: puCount=0x19f214*=0x2) returned 0x0 [0234.467] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f210*=0x0, pszText=0x0 | out: puBuffLength=0x19f210*=0xf, pszText=0x0) returned 0x0 [0234.467] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f210*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f210*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.467] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1a0 | out: ppv=0x19f1a0*=0x4d0cbc) returned 0x0 [0234.467] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f198 | out: pAptType=0x19f198*=1) returned 0x0 [0234.467] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f19c | out: ppvObject=0x19f19c*=0x0) returned 0x80004002 [0234.468] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.469] CoGetClassObject (in: rclsid=0x55079c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19edc0 | out: ppv=0x19edc0*=0x528610) returned 0x0 [0234.470] WbemLocator:IUnknown:QueryInterface (in: This=0x528610, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19efd8 | out: ppvObject=0x19efd8*=0x0) returned 0x80004002 [0234.470] WbemLocator:IClassFactory:CreateInstance (in: This=0x528610, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efec | out: ppvObject=0x19efec*=0x58e738) returned 0x0 [0234.470] WbemLocator:IUnknown:Release (This=0x528610) returned 0x0 [0234.470] WbemLocator:IUnknown:QueryInterface (in: This=0x58e738, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec0c | out: ppvObject=0x19ec0c*=0x58e738) returned 0x0 [0234.470] WbemLocator:IUnknown:QueryInterface (in: This=0x58e738, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ebc8 | out: ppvObject=0x19ebc8*=0x0) returned 0x80004002 [0234.470] WbemLocator:IUnknown:QueryInterface (in: This=0x58e738, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e7bc | out: ppvObject=0x19e7bc*=0x0) returned 0x80004002 [0234.470] WbemLocator:IUnknown:AddRef (This=0x58e738) returned 0x3 [0234.470] WbemLocator:IUnknown:QueryInterface (in: This=0x58e738, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e524 | out: ppvObject=0x19e524*=0x0) returned 0x80004002 [0234.470] WbemLocator:IUnknown:QueryInterface (in: This=0x58e738, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e4d4 | out: ppvObject=0x19e4d4*=0x0) returned 0x80004002 [0234.470] WbemLocator:IUnknown:QueryInterface (in: This=0x58e738, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e4e0 | out: ppvObject=0x19e4e0*=0x0) returned 0x80004002 [0234.470] CoGetContextToken (in: pToken=0x19e540 | out: pToken=0x19e540) returned 0x0 [0234.470] CoGetContextToken (in: pToken=0x19e948 | out: pToken=0x19e948) returned 0x0 [0234.471] WbemLocator:IUnknown:QueryInterface (in: This=0x58e738, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e9d8 | out: ppvObject=0x19e9d8*=0x0) returned 0x80004002 [0234.471] WbemLocator:IUnknown:Release (This=0x58e738) returned 0x2 [0234.471] WbemLocator:IUnknown:Release (This=0x58e738) returned 0x1 [0234.471] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.471] CoGetContextToken (in: pToken=0x19ef18 | out: pToken=0x19ef18) returned 0x0 [0234.471] WbemLocator:IUnknown:QueryInterface (in: This=0x58e738, riid=0x19efe8*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19efe4 | out: ppvObject=0x19efe4*=0x58e738) returned 0x0 [0234.471] WbemLocator:IUnknown:AddRef (This=0x58e738) returned 0x3 [0234.471] WbemLocator:IUnknown:Release (This=0x58e738) returned 0x2 [0234.471] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f17c | out: puCount=0x19f17c*=0x2) returned 0x0 [0234.471] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=8, puBuffLength=0x19f178*=0x0, pszText=0x0 | out: puBuffLength=0x19f178*=0xf, pszText=0x0) returned 0x0 [0234.471] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=8, puBuffLength=0x19f178*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f178*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.471] CoCreateInstance (in: rclsid=0x6ce21284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6ce212e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x19f054 | out: ppv=0x19f054*=0x58e748) returned 0x0 [0234.471] WbemLocator:IWbemLocator:ConnectServer (in: This=0x58e748, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x19f0e8 | out: ppNamespace=0x19f0e8*=0x555e8d0) returned 0x0 [0234.488] WbemLocator:IUnknown:QueryInterface (in: This=0x555e8d0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef84 | out: ppvObject=0x19ef84*=0x4e5e9c) returned 0x0 [0234.488] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x4e5e9c, pProxy=0x555e8d0, pAuthnSvc=0x19efd4, pAuthzSvc=0x19efd0, pServerPrincName=0x19efc8, pAuthnLevel=0x19efcc, pImpLevel=0x19efbc, pAuthInfo=0x19efc0, pCapabilites=0x19efc4 | out: pAuthnSvc=0x19efd4*=0xa, pAuthzSvc=0x19efd0*=0x0, pServerPrincName=0x19efc8, pAuthnLevel=0x19efcc*=0x6, pImpLevel=0x19efbc*=0x2, pAuthInfo=0x19efc0, pCapabilites=0x19efc4*=0x1) returned 0x0 [0234.488] WbemLocator:IUnknown:Release (This=0x4e5e9c) returned 0x1 [0234.488] WbemLocator:IUnknown:QueryInterface (in: This=0x555e8d0, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef78 | out: ppvObject=0x19ef78*=0x4e5ec0) returned 0x0 [0234.488] WbemLocator:IUnknown:QueryInterface (in: This=0x555e8d0, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef74 | out: ppvObject=0x19ef74*=0x4e5e9c) returned 0x0 [0234.489] WbemLocator:IClientSecurity:SetBlanket (This=0x4e5e9c, pProxy=0x555e8d0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0234.489] WbemLocator:IUnknown:Release (This=0x4e5e9c) returned 0x2 [0234.489] WbemLocator:IUnknown:Release (This=0x4e5ec0) returned 0x1 [0234.489] CoTaskMemFree (pv=0x50f590) [0234.489] WbemLocator:IUnknown:Release (This=0x58e748) returned 0x0 [0234.489] WbemLocator:IUnknown:QueryInterface (in: This=0x555e8d0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eb74 | out: ppvObject=0x19eb74*=0x4e5ec0) returned 0x0 [0234.489] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eb30 | out: ppvObject=0x19eb30*=0x0) returned 0x80004002 [0234.489] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e94c | out: ppvObject=0x19e94c*=0x0) returned 0x80004002 [0234.490] WbemLocator:IUnknown:QueryInterface (in: This=0x555e8d0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e724 | out: ppvObject=0x19e724*=0x0) returned 0x80004002 [0234.490] WbemLocator:IUnknown:AddRef (This=0x4e5ec0) returned 0x3 [0234.490] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e48c | out: ppvObject=0x19e48c*=0x0) returned 0x80004002 [0234.490] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e43c | out: ppvObject=0x19e43c*=0x0) returned 0x80004002 [0234.490] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e448 | out: ppvObject=0x19e448*=0x4e5e1c) returned 0x0 [0234.490] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e5e1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e450 | out: pCid=0x19e450*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.490] WbemLocator:IUnknown:Release (This=0x4e5e1c) returned 0x3 [0234.490] CoGetContextToken (in: pToken=0x19e4a8 | out: pToken=0x19e4a8) returned 0x0 [0234.490] CoGetContextToken (in: pToken=0x19e8b0 | out: pToken=0x19e8b0) returned 0x0 [0234.490] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e940 | out: ppvObject=0x19e940*=0x4e5ea4) returned 0x0 [0234.490] WbemLocator:IRpcOptions:Query (in: This=0x4e5ea4, pPrx=0x4e5ec0, dwProperty=2, pdwValue=0x19e968 | out: pdwValue=0x19e968) returned 0x80004002 [0234.490] WbemLocator:IUnknown:Release (This=0x4e5ea4) returned 0x3 [0234.490] WbemLocator:IUnknown:Release (This=0x4e5ec0) returned 0x2 [0234.491] CoGetContextToken (in: pToken=0x19ee88 | out: pToken=0x19ee88) returned 0x0 [0234.491] CoGetContextToken (in: pToken=0x19ede8 | out: pToken=0x19ede8) returned 0x0 [0234.491] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x19eeb8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19eeb4 | out: ppvObject=0x19eeb4*=0x555e8d0) returned 0x0 [0234.491] WbemLocator:IUnknown:AddRef (This=0x555e8d0) returned 0x4 [0234.491] WbemLocator:IUnknown:Release (This=0x555e8d0) returned 0x3 [0234.491] WbemLocator:IUnknown:Release (This=0x555e8d0) returned 0x2 [0234.491] SysStringLen (param_1=0x0) returned 0x0 [0234.491] CoGetContextToken (in: pToken=0x19ee80 | out: pToken=0x19ee80) returned 0x0 [0234.491] WbemLocator:IUnknown:AddRef (This=0x4e5ec0) returned 0x3 [0234.491] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5ec0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed14 | out: ppvObject=0x19ed14*=0x4e5ec0) returned 0x0 [0234.491] WbemLocator:IUnknown:Release (This=0x4e5ec0) returned 0x3 [0234.491] WbemLocator:IUnknown:Release (This=0x4e5ec0) returned 0x2 [0234.491] CoGetContextToken (in: pToken=0x19ef50 | out: pToken=0x19ef50) returned 0x0 [0234.491] WbemLocator:IUnknown:AddRef (This=0x555e8d0) returned 0x3 [0234.491] IWbemServices:ExecQuery (in: This=0x555e8d0, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_Process Where SessionId='1'", lFlags=16, pCtx=0x0, ppEnum=0x19f184 | out: ppEnum=0x19f184*=0x58d1a8) returned 0x0 [0234.513] IUnknown:QueryInterface (in: This=0x58d1a8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efc4 | out: ppvObject=0x19efc4*=0x58d1ac) returned 0x0 [0234.514] IClientSecurity:QueryBlanket (in: This=0x58d1ac, pProxy=0x58d1a8, pAuthnSvc=0x19f014, pAuthzSvc=0x19f010, pServerPrincName=0x19f008, pAuthnLevel=0x19f00c, pImpLevel=0x19effc, pAuthInfo=0x19f000, pCapabilites=0x19f004 | out: pAuthnSvc=0x19f014*=0xa, pAuthzSvc=0x19f010*=0x0, pServerPrincName=0x19f008, pAuthnLevel=0x19f00c*=0x6, pImpLevel=0x19effc*=0x2, pAuthInfo=0x19f000, pCapabilites=0x19f004*=0x1) returned 0x0 [0234.514] IUnknown:Release (This=0x58d1ac) returned 0x1 [0234.514] IUnknown:QueryInterface (in: This=0x58d1a8, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efb8 | out: ppvObject=0x19efb8*=0x4e5fc0) returned 0x0 [0234.514] IUnknown:QueryInterface (in: This=0x58d1a8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19efb4 | out: ppvObject=0x19efb4*=0x58d1ac) returned 0x0 [0234.514] IClientSecurity:SetBlanket (This=0x58d1ac, pProxy=0x58d1a8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0234.564] IUnknown:Release (This=0x58d1ac) returned 0x2 [0234.564] WbemLocator:IUnknown:Release (This=0x4e5fc0) returned 0x1 [0234.565] CoTaskMemFree (pv=0x50f6b0) [0234.565] IUnknown:QueryInterface (in: This=0x58d1a8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ebb0 | out: ppvObject=0x19ebb0*=0x4e5fc0) returned 0x0 [0234.565] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eb6c | out: ppvObject=0x19eb6c*=0x0) returned 0x80004002 [0234.565] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e98c | out: ppvObject=0x19e98c*=0x0) returned 0x80004002 [0234.566] IUnknown:QueryInterface (in: This=0x58d1a8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e764 | out: ppvObject=0x19e764*=0x0) returned 0x80004002 [0234.566] WbemLocator:IUnknown:AddRef (This=0x4e5fc0) returned 0x3 [0234.566] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e4cc | out: ppvObject=0x19e4cc*=0x0) returned 0x80004002 [0234.566] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e47c | out: ppvObject=0x19e47c*=0x0) returned 0x80004002 [0234.566] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e488 | out: ppvObject=0x19e488*=0x4e5f1c) returned 0x0 [0234.566] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e5f1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e490 | out: pCid=0x19e490*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.567] WbemLocator:IUnknown:Release (This=0x4e5f1c) returned 0x3 [0234.567] CoGetContextToken (in: pToken=0x19e4e8 | out: pToken=0x19e4e8) returned 0x0 [0234.567] CoGetContextToken (in: pToken=0x19e8f0 | out: pToken=0x19e8f0) returned 0x0 [0234.567] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e980 | out: ppvObject=0x19e980*=0x4e5fa4) returned 0x0 [0234.567] WbemLocator:IRpcOptions:Query (in: This=0x4e5fa4, pPrx=0x4e5fc0, dwProperty=2, pdwValue=0x19e9a8 | out: pdwValue=0x19e9a8) returned 0x80004002 [0234.567] WbemLocator:IUnknown:Release (This=0x4e5fa4) returned 0x3 [0234.567] WbemLocator:IUnknown:Release (This=0x4e5fc0) returned 0x2 [0234.567] CoGetContextToken (in: pToken=0x19eec0 | out: pToken=0x19eec0) returned 0x0 [0234.567] CoGetContextToken (in: pToken=0x19ee20 | out: pToken=0x19ee20) returned 0x0 [0234.567] WbemLocator:IUnknown:QueryInterface (in: This=0x4e5fc0, riid=0x19eef0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19eeec | out: ppvObject=0x19eeec*=0x58d1a8) returned 0x0 [0234.567] IUnknown:AddRef (This=0x58d1a8) returned 0x4 [0234.567] IUnknown:Release (This=0x58d1a8) returned 0x3 [0234.567] IUnknown:Release (This=0x58d1a8) returned 0x2 [0234.567] WbemLocator:IUnknown:Release (This=0x555e8d0) returned 0x2 [0234.567] SysStringLen (param_1=0x0) returned 0x0 [0234.567] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d0 | out: puCount=0x19f1d0*=0x2) returned 0x0 [0234.567] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1cc*=0x0, pszText=0x0 | out: puBuffLength=0x19f1cc*=0xf, pszText=0x0) returned 0x0 [0234.567] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.568] CoGetContextToken (in: pToken=0x19f020 | out: pToken=0x19f020) returned 0x0 [0234.568] IUnknown:AddRef (This=0x58d1a8) returned 0x3 [0234.568] IEnumWbemClassObject:Clone (in: This=0x58d1a8, ppEnum=0x19f1dc | out: ppEnum=0x19f1dc*=0x58c6b8) returned 0x0 [0234.569] IUnknown:QueryInterface (in: This=0x58c6b8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f0a0 | out: ppvObject=0x19f0a0*=0x58c6bc) returned 0x0 [0234.569] IClientSecurity:QueryBlanket (in: This=0x58c6bc, pProxy=0x58c6b8, pAuthnSvc=0x19f0f0, pAuthzSvc=0x19f0ec, pServerPrincName=0x19f0e4, pAuthnLevel=0x19f0e8, pImpLevel=0x19f0d8, pAuthInfo=0x19f0dc, pCapabilites=0x19f0e0 | out: pAuthnSvc=0x19f0f0*=0xa, pAuthzSvc=0x19f0ec*=0x0, pServerPrincName=0x19f0e4, pAuthnLevel=0x19f0e8*=0x6, pImpLevel=0x19f0d8*=0x2, pAuthInfo=0x19f0dc, pCapabilites=0x19f0e0*=0x1) returned 0x0 [0234.569] IUnknown:Release (This=0x58c6bc) returned 0x1 [0234.569] IUnknown:QueryInterface (in: This=0x58c6b8, riid=0x6ce210f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f094 | out: ppvObject=0x19f094*=0x4e6dc0) returned 0x0 [0234.569] IUnknown:QueryInterface (in: This=0x58c6b8, riid=0x6ce21104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f090 | out: ppvObject=0x19f090*=0x58c6bc) returned 0x0 [0234.569] IClientSecurity:SetBlanket (This=0x58c6bc, pProxy=0x58c6b8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0234.571] IUnknown:Release (This=0x58c6bc) returned 0x2 [0234.571] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x1 [0234.571] CoTaskMemFree (pv=0x50f9e0) [0234.571] IUnknown:QueryInterface (in: This=0x58c6b8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec7c | out: ppvObject=0x19ec7c*=0x4e6dc0) returned 0x0 [0234.571] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ec38 | out: ppvObject=0x19ec38*=0x0) returned 0x80004002 [0234.571] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ea54 | out: ppvObject=0x19ea54*=0x0) returned 0x80004002 [0234.572] IUnknown:QueryInterface (in: This=0x58c6b8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e82c | out: ppvObject=0x19e82c*=0x0) returned 0x80004002 [0234.572] WbemLocator:IUnknown:AddRef (This=0x4e6dc0) returned 0x3 [0234.572] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e594 | out: ppvObject=0x19e594*=0x0) returned 0x80004002 [0234.572] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.572] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e550 | out: ppvObject=0x19e550*=0x4e6d1c) returned 0x0 [0234.572] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x4e6d1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e558 | out: pCid=0x19e558*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.572] WbemLocator:IUnknown:Release (This=0x4e6d1c) returned 0x3 [0234.572] CoGetContextToken (in: pToken=0x19e5b0 | out: pToken=0x19e5b0) returned 0x0 [0234.573] CoGetContextToken (in: pToken=0x19e9b8 | out: pToken=0x19e9b8) returned 0x0 [0234.573] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ea48 | out: ppvObject=0x19ea48*=0x4e6da4) returned 0x0 [0234.573] WbemLocator:IRpcOptions:Query (in: This=0x4e6da4, pPrx=0x4e6dc0, dwProperty=2, pdwValue=0x19ea70 | out: pdwValue=0x19ea70) returned 0x80004002 [0234.573] WbemLocator:IUnknown:Release (This=0x4e6da4) returned 0x3 [0234.573] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x2 [0234.573] CoGetContextToken (in: pToken=0x19ef90 | out: pToken=0x19ef90) returned 0x0 [0234.573] CoGetContextToken (in: pToken=0x19eef0 | out: pToken=0x19eef0) returned 0x0 [0234.573] WbemLocator:IUnknown:QueryInterface (in: This=0x4e6dc0, riid=0x19efc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19efbc | out: ppvObject=0x19efbc*=0x58c6b8) returned 0x0 [0234.573] IUnknown:AddRef (This=0x58c6b8) returned 0x4 [0234.573] IUnknown:Release (This=0x58c6b8) returned 0x3 [0234.573] IUnknown:Release (This=0x58c6b8) returned 0x2 [0234.573] IUnknown:Release (This=0x58d1a8) returned 0x2 [0234.573] SysStringLen (param_1=0x0) returned 0x0 [0234.574] IEnumWbemClassObject:Reset (This=0x58c6b8) returned 0x0 [0234.574] CoTaskMemAlloc (cb=0x4) returned 0x58e798 [0234.574] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e798, puReturned=0x23de044 | out: apObjects=0x58e798*=0x4fe590, puReturned=0x23de044*=0x1) returned 0x0 [0234.706] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x4fe590) returned 0x0 [0234.707] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.707] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.708] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.708] IUnknown:AddRef (This=0x4fe590) returned 0x3 [0234.708] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.708] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.708] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x4fe594) returned 0x0 [0234.708] IMarshal:GetUnmarshalClass (in: This=0x4fe594, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.708] IUnknown:Release (This=0x4fe594) returned 0x3 [0234.708] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.708] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.708] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.708] IUnknown:Release (This=0x4fe590) returned 0x2 [0234.708] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.708] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.708] IUnknown:QueryInterface (in: This=0x4fe590, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x4fe590) returned 0x0 [0234.709] IUnknown:AddRef (This=0x4fe590) returned 0x4 [0234.709] IUnknown:Release (This=0x4fe590) returned 0x3 [0234.709] IUnknown:Release (This=0x4fe590) returned 0x2 [0234.709] CoTaskMemFree (pv=0x58e798) [0234.709] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.709] IUnknown:AddRef (This=0x4fe590) returned 0x3 [0234.709] IWbemClassObject:Get (in: This=0x4fe590, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.709] IWbemClassObject:Get (in: This=0x4fe590, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"456\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.709] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"456\"") returned 0x5c [0234.709] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"456\"") returned 0x5c [0234.710] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.710] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.710] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.710] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.711] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7d8) returned 0x0 [0234.711] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7d8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.711] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7d8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5196f8) returned 0x0 [0234.711] WbemDefPath:IUnknown:Release (This=0x58e7d8) returned 0x0 [0234.711] WbemDefPath:IUnknown:QueryInterface (in: This=0x5196f8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x5196f8) returned 0x0 [0234.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x5196f8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x5196f8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.712] WbemDefPath:IUnknown:AddRef (This=0x5196f8) returned 0x3 [0234.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x5196f8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x5196f8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x5196f8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x528718) returned 0x0 [0234.712] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x528718, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.712] WbemDefPath:IUnknown:Release (This=0x528718) returned 0x3 [0234.712] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.712] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.712] WbemDefPath:IUnknown:QueryInterface (in: This=0x5196f8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.712] WbemDefPath:IUnknown:Release (This=0x5196f8) returned 0x2 [0234.712] WbemDefPath:IUnknown:Release (This=0x5196f8) returned 0x1 [0234.712] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.713] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.713] WbemDefPath:IUnknown:QueryInterface (in: This=0x5196f8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x5196f8) returned 0x0 [0234.713] WbemDefPath:IUnknown:AddRef (This=0x5196f8) returned 0x3 [0234.713] WbemDefPath:IUnknown:Release (This=0x5196f8) returned 0x2 [0234.713] WbemDefPath:IWbemPath:SetText (This=0x5196f8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"456\"") returned 0x0 [0234.713] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.713] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.713] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.713] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.713] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.713] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.713] IWbemClassObject:Get (in: This=0x4fe590, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23de934*=0, plFlavor=0x23de938*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="csrss.exe", varVal2=0x0), pType=0x23de934*=8, plFlavor=0x23de938*=0) returned 0x0 [0234.713] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0234.713] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0234.714] IWbemClassObject:Get (in: This=0x4fe590, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23de934*=8, plFlavor=0x23de938*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="csrss.exe", varVal2=0x0), pType=0x23de934*=8, plFlavor=0x23de938*=0) returned 0x0 [0234.714] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0234.714] SysStringByteLen (bstr="csrss.exe") returned 0x12 [0234.714] CoTaskMemAlloc (cb=0x4) returned 0x58e798 [0234.714] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e798, puReturned=0x23de044 | out: apObjects=0x58e798*=0x4fe8c0, puReturned=0x23de044*=0x1) returned 0x0 [0234.716] IUnknown:QueryInterface (in: This=0x4fe8c0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x4fe8c0) returned 0x0 [0234.716] IUnknown:QueryInterface (in: This=0x4fe8c0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.716] IUnknown:QueryInterface (in: This=0x4fe8c0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.716] IUnknown:QueryInterface (in: This=0x4fe8c0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.716] IUnknown:AddRef (This=0x4fe8c0) returned 0x3 [0234.716] IUnknown:QueryInterface (in: This=0x4fe8c0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.716] IUnknown:QueryInterface (in: This=0x4fe8c0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.716] IUnknown:QueryInterface (in: This=0x4fe8c0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x4fe8c4) returned 0x0 [0234.717] IMarshal:GetUnmarshalClass (in: This=0x4fe8c4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.717] IUnknown:Release (This=0x4fe8c4) returned 0x3 [0234.717] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.717] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.717] IUnknown:QueryInterface (in: This=0x4fe8c0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.717] IUnknown:Release (This=0x4fe8c0) returned 0x2 [0234.717] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.717] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.717] IUnknown:QueryInterface (in: This=0x4fe8c0, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x4fe8c0) returned 0x0 [0234.717] IUnknown:AddRef (This=0x4fe8c0) returned 0x4 [0234.717] IUnknown:Release (This=0x4fe8c0) returned 0x3 [0234.717] IUnknown:Release (This=0x4fe8c0) returned 0x2 [0234.717] CoTaskMemFree (pv=0x58e798) [0234.717] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.717] IUnknown:AddRef (This=0x4fe8c0) returned 0x3 [0234.717] IWbemClassObject:Get (in: This=0x4fe8c0, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.718] IWbemClassObject:Get (in: This=0x4fe8c0, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"508\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.718] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"508\"") returned 0x5c [0234.718] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"508\"") returned 0x5c [0234.718] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.718] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.718] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.718] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.719] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6b8) returned 0x0 [0234.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.719] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5190d8) returned 0x0 [0234.719] WbemDefPath:IUnknown:Release (This=0x58e6b8) returned 0x0 [0234.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x5190d8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x5190d8) returned 0x0 [0234.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x5190d8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.719] WbemDefPath:IUnknown:QueryInterface (in: This=0x5190d8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.720] WbemDefPath:IUnknown:AddRef (This=0x5190d8) returned 0x3 [0234.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x5190d8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x5190d8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x5190d8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x528730) returned 0x0 [0234.720] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x528730, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.720] WbemDefPath:IUnknown:Release (This=0x528730) returned 0x3 [0234.720] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.720] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x5190d8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.720] WbemDefPath:IUnknown:Release (This=0x5190d8) returned 0x2 [0234.720] WbemDefPath:IUnknown:Release (This=0x5190d8) returned 0x1 [0234.720] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.720] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.720] WbemDefPath:IUnknown:QueryInterface (in: This=0x5190d8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x5190d8) returned 0x0 [0234.720] WbemDefPath:IUnknown:AddRef (This=0x5190d8) returned 0x3 [0234.720] WbemDefPath:IUnknown:Release (This=0x5190d8) returned 0x2 [0234.720] WbemDefPath:IWbemPath:SetText (This=0x5190d8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"508\"") returned 0x0 [0234.721] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.721] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.721] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.721] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.721] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.721] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.721] IWbemClassObject:Get (in: This=0x4fe8c0, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23df190*=0, plFlavor=0x23df194*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x23df190*=8, plFlavor=0x23df194*=0) returned 0x0 [0234.721] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0234.721] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0234.721] IWbemClassObject:Get (in: This=0x4fe8c0, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23df190*=8, plFlavor=0x23df194*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="winlogon.exe", varVal2=0x0), pType=0x23df190*=8, plFlavor=0x23df194*=0) returned 0x0 [0234.721] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0234.721] SysStringByteLen (bstr="winlogon.exe") returned 0x18 [0234.721] CoTaskMemAlloc (cb=0x4) returned 0x58e688 [0234.721] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e688, puReturned=0x23de044 | out: apObjects=0x58e688*=0x4febf0, puReturned=0x23de044*=0x1) returned 0x0 [0234.723] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x4febf0) returned 0x0 [0234.723] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.723] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.723] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.724] IUnknown:AddRef (This=0x4febf0) returned 0x3 [0234.724] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.724] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.724] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x4febf4) returned 0x0 [0234.724] IMarshal:GetUnmarshalClass (in: This=0x4febf4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.724] IUnknown:Release (This=0x4febf4) returned 0x3 [0234.724] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.724] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.724] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.724] IUnknown:Release (This=0x4febf0) returned 0x2 [0234.724] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.724] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.724] IUnknown:QueryInterface (in: This=0x4febf0, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x4febf0) returned 0x0 [0234.724] IUnknown:AddRef (This=0x4febf0) returned 0x4 [0234.724] IUnknown:Release (This=0x4febf0) returned 0x3 [0234.724] IUnknown:Release (This=0x4febf0) returned 0x2 [0234.725] CoTaskMemFree (pv=0x58e688) [0234.725] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.725] IUnknown:AddRef (This=0x4febf0) returned 0x3 [0234.725] IWbemClassObject:Get (in: This=0x4febf0, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.725] IWbemClassObject:Get (in: This=0x4febf0, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"816\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.725] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"816\"") returned 0x5c [0234.725] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"816\"") returned 0x5c [0234.725] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.725] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.725] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.725] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.726] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e688) returned 0x0 [0234.726] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e688, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.727] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e688, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519768) returned 0x0 [0234.727] WbemDefPath:IUnknown:Release (This=0x58e688) returned 0x0 [0234.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x519768, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519768) returned 0x0 [0234.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x519768, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x519768, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.727] WbemDefPath:IUnknown:AddRef (This=0x519768) returned 0x3 [0234.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x519768, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x519768, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x519768, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5553a10) returned 0x0 [0234.727] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5553a10, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.727] WbemDefPath:IUnknown:Release (This=0x5553a10) returned 0x3 [0234.727] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.727] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.727] WbemDefPath:IUnknown:QueryInterface (in: This=0x519768, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.728] WbemDefPath:IUnknown:Release (This=0x519768) returned 0x2 [0234.728] WbemDefPath:IUnknown:Release (This=0x519768) returned 0x1 [0234.728] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.728] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.728] WbemDefPath:IUnknown:QueryInterface (in: This=0x519768, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519768) returned 0x0 [0234.728] WbemDefPath:IUnknown:AddRef (This=0x519768) returned 0x3 [0234.728] WbemDefPath:IUnknown:Release (This=0x519768) returned 0x2 [0234.728] WbemDefPath:IWbemPath:SetText (This=0x519768, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"816\"") returned 0x0 [0234.728] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.728] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.728] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.728] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.728] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.728] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.728] IWbemClassObject:Get (in: This=0x4febf0, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23df9fc*=0, plFlavor=0x23dfa00*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dwm.exe", varVal2=0x0), pType=0x23df9fc*=8, plFlavor=0x23dfa00*=0) returned 0x0 [0234.728] SysStringByteLen (bstr="dwm.exe") returned 0xe [0234.728] SysStringByteLen (bstr="dwm.exe") returned 0xe [0234.729] IWbemClassObject:Get (in: This=0x4febf0, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23df9fc*=8, plFlavor=0x23dfa00*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dwm.exe", varVal2=0x0), pType=0x23df9fc*=8, plFlavor=0x23dfa00*=0) returned 0x0 [0234.729] SysStringByteLen (bstr="dwm.exe") returned 0xe [0234.729] SysStringByteLen (bstr="dwm.exe") returned 0xe [0234.764] CoTaskMemAlloc (cb=0x4) returned 0x58e7d8 [0234.764] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7d8, puReturned=0x23de044 | out: apObjects=0x58e7d8*=0x53f8e8, puReturned=0x23de044*=0x1) returned 0x0 [0234.765] IUnknown:QueryInterface (in: This=0x53f8e8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53f8e8) returned 0x0 [0234.765] IUnknown:QueryInterface (in: This=0x53f8e8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.765] IUnknown:QueryInterface (in: This=0x53f8e8, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.765] IUnknown:QueryInterface (in: This=0x53f8e8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.765] IUnknown:AddRef (This=0x53f8e8) returned 0x3 [0234.765] IUnknown:QueryInterface (in: This=0x53f8e8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.766] IUnknown:QueryInterface (in: This=0x53f8e8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.766] IUnknown:QueryInterface (in: This=0x53f8e8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53f8ec) returned 0x0 [0234.766] IMarshal:GetUnmarshalClass (in: This=0x53f8ec, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.766] IUnknown:Release (This=0x53f8ec) returned 0x3 [0234.766] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.766] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.766] IUnknown:QueryInterface (in: This=0x53f8e8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.766] IUnknown:Release (This=0x53f8e8) returned 0x2 [0234.766] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.766] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.766] IUnknown:QueryInterface (in: This=0x53f8e8, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53f8e8) returned 0x0 [0234.766] IUnknown:AddRef (This=0x53f8e8) returned 0x4 [0234.766] IUnknown:Release (This=0x53f8e8) returned 0x3 [0234.766] IUnknown:Release (This=0x53f8e8) returned 0x2 [0234.766] CoTaskMemFree (pv=0x58e7d8) [0234.766] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.766] IUnknown:AddRef (This=0x53f8e8) returned 0x3 [0234.767] IWbemClassObject:Get (in: This=0x53f8e8, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.767] IWbemClassObject:Get (in: This=0x53f8e8, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1468\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.767] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1468\"") returned 0x5e [0234.767] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1468\"") returned 0x5e [0234.767] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.767] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.767] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.767] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.768] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6b8) returned 0x0 [0234.768] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.768] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x518ea8) returned 0x0 [0234.768] WbemDefPath:IUnknown:Release (This=0x58e6b8) returned 0x0 [0234.768] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ea8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x518ea8) returned 0x0 [0234.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ea8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ea8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.769] WbemDefPath:IUnknown:AddRef (This=0x518ea8) returned 0x3 [0234.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ea8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ea8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ea8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x548598) returned 0x0 [0234.769] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x548598, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.769] WbemDefPath:IUnknown:Release (This=0x548598) returned 0x3 [0234.769] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.769] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.769] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ea8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.769] WbemDefPath:IUnknown:Release (This=0x518ea8) returned 0x2 [0234.769] WbemDefPath:IUnknown:Release (This=0x518ea8) returned 0x1 [0234.769] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.770] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.770] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ea8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x518ea8) returned 0x0 [0234.770] WbemDefPath:IUnknown:AddRef (This=0x518ea8) returned 0x3 [0234.770] WbemDefPath:IUnknown:Release (This=0x518ea8) returned 0x2 [0234.770] WbemDefPath:IWbemPath:SetText (This=0x518ea8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1468\"") returned 0x0 [0234.770] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.770] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.770] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.770] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.770] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.770] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.770] IWbemClassObject:Get (in: This=0x53f8e8, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e0250*=0, plFlavor=0x23e0254*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x23e0250*=8, plFlavor=0x23e0254*=0) returned 0x0 [0234.770] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0234.770] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0234.770] IWbemClassObject:Get (in: This=0x53f8e8, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e0250*=8, plFlavor=0x23e0254*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sihost.exe", varVal2=0x0), pType=0x23e0250*=8, plFlavor=0x23e0254*=0) returned 0x0 [0234.771] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0234.771] SysStringByteLen (bstr="sihost.exe") returned 0x14 [0234.771] CoTaskMemAlloc (cb=0x4) returned 0x58e688 [0234.771] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e688, puReturned=0x23de044 | out: apObjects=0x58e688*=0x53e430, puReturned=0x23de044*=0x1) returned 0x0 [0234.771] IUnknown:QueryInterface (in: This=0x53e430, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53e430) returned 0x0 [0234.772] IUnknown:QueryInterface (in: This=0x53e430, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.772] IUnknown:QueryInterface (in: This=0x53e430, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.772] IUnknown:QueryInterface (in: This=0x53e430, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.772] IUnknown:AddRef (This=0x53e430) returned 0x3 [0234.772] IUnknown:QueryInterface (in: This=0x53e430, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.772] IUnknown:QueryInterface (in: This=0x53e430, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.772] IUnknown:QueryInterface (in: This=0x53e430, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53e434) returned 0x0 [0234.772] IMarshal:GetUnmarshalClass (in: This=0x53e434, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.772] IUnknown:Release (This=0x53e434) returned 0x3 [0234.772] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.772] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.772] IUnknown:QueryInterface (in: This=0x53e430, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.772] IUnknown:Release (This=0x53e430) returned 0x2 [0234.772] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.772] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.773] IUnknown:QueryInterface (in: This=0x53e430, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53e430) returned 0x0 [0234.773] IUnknown:AddRef (This=0x53e430) returned 0x4 [0234.773] IUnknown:Release (This=0x53e430) returned 0x3 [0234.773] IUnknown:Release (This=0x53e430) returned 0x2 [0234.773] CoTaskMemFree (pv=0x58e688) [0234.773] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.773] IUnknown:AddRef (This=0x53e430) returned 0x3 [0234.773] IWbemClassObject:Get (in: This=0x53e430, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.773] IWbemClassObject:Get (in: This=0x53e430, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1560\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.773] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1560\"") returned 0x5e [0234.773] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1560\"") returned 0x5e [0234.773] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.773] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.773] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.774] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.774] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7d8) returned 0x0 [0234.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7d8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.775] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7d8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5197d8) returned 0x0 [0234.775] WbemDefPath:IUnknown:Release (This=0x58e7d8) returned 0x0 [0234.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x5197d8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x5197d8) returned 0x0 [0234.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x5197d8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x5197d8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.775] WbemDefPath:IUnknown:AddRef (This=0x5197d8) returned 0x3 [0234.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x5197d8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x5197d8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.775] WbemDefPath:IUnknown:QueryInterface (in: This=0x5197d8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x574a58) returned 0x0 [0234.775] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x574a58, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.775] WbemDefPath:IUnknown:Release (This=0x574a58) returned 0x3 [0234.775] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.776] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.776] WbemDefPath:IUnknown:QueryInterface (in: This=0x5197d8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.776] WbemDefPath:IUnknown:Release (This=0x5197d8) returned 0x2 [0234.776] WbemDefPath:IUnknown:Release (This=0x5197d8) returned 0x1 [0234.776] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.776] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.776] WbemDefPath:IUnknown:QueryInterface (in: This=0x5197d8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x5197d8) returned 0x0 [0234.776] WbemDefPath:IUnknown:AddRef (This=0x5197d8) returned 0x3 [0234.776] WbemDefPath:IUnknown:Release (This=0x5197d8) returned 0x2 [0234.776] WbemDefPath:IWbemPath:SetText (This=0x5197d8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1560\"") returned 0x0 [0234.776] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.776] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.776] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.776] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.776] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.776] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.777] IWbemClassObject:Get (in: This=0x53e430, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e0ab4*=0, plFlavor=0x23e0ab8*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe", varVal2=0x0), pType=0x23e0ab4*=8, plFlavor=0x23e0ab8*=0) returned 0x0 [0234.777] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0234.777] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0234.777] IWbemClassObject:Get (in: This=0x53e430, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e0ab4*=8, plFlavor=0x23e0ab8*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="explorer.exe", varVal2=0x0), pType=0x23e0ab4*=8, plFlavor=0x23e0ab8*=0) returned 0x0 [0234.777] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0234.777] SysStringByteLen (bstr="explorer.exe") returned 0x18 [0234.777] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0234.777] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x53fa80, puReturned=0x23de044*=0x1) returned 0x0 [0234.779] IUnknown:QueryInterface (in: This=0x53fa80, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53fa80) returned 0x0 [0234.779] IUnknown:QueryInterface (in: This=0x53fa80, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.779] IUnknown:QueryInterface (in: This=0x53fa80, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.779] IUnknown:QueryInterface (in: This=0x53fa80, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.779] IUnknown:AddRef (This=0x53fa80) returned 0x3 [0234.779] IUnknown:QueryInterface (in: This=0x53fa80, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.779] IUnknown:QueryInterface (in: This=0x53fa80, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.779] IUnknown:QueryInterface (in: This=0x53fa80, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53fa84) returned 0x0 [0234.779] IMarshal:GetUnmarshalClass (in: This=0x53fa84, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.779] IUnknown:Release (This=0x53fa84) returned 0x3 [0234.779] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.780] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.780] IUnknown:QueryInterface (in: This=0x53fa80, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.780] IUnknown:Release (This=0x53fa80) returned 0x2 [0234.780] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.780] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.780] IUnknown:QueryInterface (in: This=0x53fa80, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53fa80) returned 0x0 [0234.780] IUnknown:AddRef (This=0x53fa80) returned 0x4 [0234.780] IUnknown:Release (This=0x53fa80) returned 0x3 [0234.780] IUnknown:Release (This=0x53fa80) returned 0x2 [0234.780] CoTaskMemFree (pv=0x58e6f8) [0234.780] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.780] IUnknown:AddRef (This=0x53fa80) returned 0x3 [0234.780] IWbemClassObject:Get (in: This=0x53fa80, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.780] IWbemClassObject:Get (in: This=0x53fa80, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1636\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.780] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1636\"") returned 0x5e [0234.780] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1636\"") returned 0x5e [0234.780] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.781] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.781] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.781] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.782] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6b8) returned 0x0 [0234.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.782] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519378) returned 0x0 [0234.782] WbemDefPath:IUnknown:Release (This=0x58e6b8) returned 0x0 [0234.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x519378, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519378) returned 0x0 [0234.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x519378, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x519378, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.782] WbemDefPath:IUnknown:AddRef (This=0x519378) returned 0x3 [0234.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x519378, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x519378, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.782] WbemDefPath:IUnknown:QueryInterface (in: This=0x519378, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x513e90) returned 0x0 [0234.783] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x513e90, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.783] WbemDefPath:IUnknown:Release (This=0x513e90) returned 0x3 [0234.783] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.783] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x519378, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.783] WbemDefPath:IUnknown:Release (This=0x519378) returned 0x2 [0234.783] WbemDefPath:IUnknown:Release (This=0x519378) returned 0x1 [0234.783] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.783] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.783] WbemDefPath:IUnknown:QueryInterface (in: This=0x519378, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519378) returned 0x0 [0234.783] WbemDefPath:IUnknown:AddRef (This=0x519378) returned 0x3 [0234.783] WbemDefPath:IUnknown:Release (This=0x519378) returned 0x2 [0234.783] WbemDefPath:IWbemPath:SetText (This=0x519378, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1636\"") returned 0x0 [0234.783] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.783] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.783] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.783] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.783] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.783] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.784] IWbemClassObject:Get (in: This=0x53fa80, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e1320*=0, plFlavor=0x23e1324*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RuntimeBroker.exe", varVal2=0x0), pType=0x23e1320*=8, plFlavor=0x23e1324*=0) returned 0x0 [0234.784] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0234.784] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0234.784] IWbemClassObject:Get (in: This=0x53fa80, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e1320*=8, plFlavor=0x23e1324*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="RuntimeBroker.exe", varVal2=0x0), pType=0x23e1320*=8, plFlavor=0x23e1324*=0) returned 0x0 [0234.784] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0234.784] SysStringByteLen (bstr="RuntimeBroker.exe") returned 0x22 [0234.784] CoTaskMemAlloc (cb=0x4) returned 0x58e818 [0234.784] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e818, puReturned=0x23de044 | out: apObjects=0x58e818*=0x53e5c8, puReturned=0x23de044*=0x1) returned 0x0 [0234.798] IUnknown:QueryInterface (in: This=0x53e5c8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53e5c8) returned 0x0 [0234.798] IUnknown:QueryInterface (in: This=0x53e5c8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.798] IUnknown:QueryInterface (in: This=0x53e5c8, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.798] IUnknown:QueryInterface (in: This=0x53e5c8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.799] IUnknown:AddRef (This=0x53e5c8) returned 0x3 [0234.799] IUnknown:QueryInterface (in: This=0x53e5c8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.799] IUnknown:QueryInterface (in: This=0x53e5c8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.799] IUnknown:QueryInterface (in: This=0x53e5c8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53e5cc) returned 0x0 [0234.799] IMarshal:GetUnmarshalClass (in: This=0x53e5cc, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.799] IUnknown:Release (This=0x53e5cc) returned 0x3 [0234.799] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.799] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.799] IUnknown:QueryInterface (in: This=0x53e5c8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.799] IUnknown:Release (This=0x53e5c8) returned 0x2 [0234.799] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.799] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.799] IUnknown:QueryInterface (in: This=0x53e5c8, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53e5c8) returned 0x0 [0234.799] IUnknown:AddRef (This=0x53e5c8) returned 0x4 [0234.799] IUnknown:Release (This=0x53e5c8) returned 0x3 [0234.799] IUnknown:Release (This=0x53e5c8) returned 0x2 [0234.799] CoTaskMemFree (pv=0x58e818) [0234.799] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.799] IUnknown:AddRef (This=0x53e5c8) returned 0x3 [0234.800] IWbemClassObject:Get (in: This=0x53e5c8, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.800] IWbemClassObject:Get (in: This=0x53e5c8, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2060\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.800] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2060\"") returned 0x5e [0234.800] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2060\"") returned 0x5e [0234.800] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.800] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.800] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.800] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.801] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6b8) returned 0x0 [0234.801] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.801] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5191b8) returned 0x0 [0234.802] WbemDefPath:IUnknown:Release (This=0x58e6b8) returned 0x0 [0234.802] WbemDefPath:IUnknown:QueryInterface (in: This=0x5191b8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x5191b8) returned 0x0 [0234.802] WbemDefPath:IUnknown:QueryInterface (in: This=0x5191b8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.802] WbemDefPath:IUnknown:QueryInterface (in: This=0x5191b8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.802] WbemDefPath:IUnknown:AddRef (This=0x5191b8) returned 0x3 [0234.802] WbemDefPath:IUnknown:QueryInterface (in: This=0x5191b8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.802] WbemDefPath:IUnknown:QueryInterface (in: This=0x5191b8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.802] WbemDefPath:IUnknown:QueryInterface (in: This=0x5191b8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x514010) returned 0x0 [0234.802] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x514010, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.802] WbemDefPath:IUnknown:Release (This=0x514010) returned 0x3 [0234.802] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.802] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.802] WbemDefPath:IUnknown:QueryInterface (in: This=0x5191b8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.802] WbemDefPath:IUnknown:Release (This=0x5191b8) returned 0x2 [0234.802] WbemDefPath:IUnknown:Release (This=0x5191b8) returned 0x1 [0234.802] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.803] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.803] WbemDefPath:IUnknown:QueryInterface (in: This=0x5191b8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x5191b8) returned 0x0 [0234.803] WbemDefPath:IUnknown:AddRef (This=0x5191b8) returned 0x3 [0234.803] WbemDefPath:IUnknown:Release (This=0x5191b8) returned 0x2 [0234.803] WbemDefPath:IWbemPath:SetText (This=0x5191b8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2060\"") returned 0x0 [0234.803] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.803] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.803] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.803] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.803] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.803] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.803] IWbemClassObject:Get (in: This=0x53e5c8, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e1b9c*=0, plFlavor=0x23e1ba0*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SkypeHost.exe", varVal2=0x0), pType=0x23e1b9c*=8, plFlavor=0x23e1ba0*=0) returned 0x0 [0234.803] SysStringByteLen (bstr="SkypeHost.exe") returned 0x1a [0234.803] SysStringByteLen (bstr="SkypeHost.exe") returned 0x1a [0234.803] IWbemClassObject:Get (in: This=0x53e5c8, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e1b9c*=8, plFlavor=0x23e1ba0*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SkypeHost.exe", varVal2=0x0), pType=0x23e1b9c*=8, plFlavor=0x23e1ba0*=0) returned 0x0 [0234.803] SysStringByteLen (bstr="SkypeHost.exe") returned 0x1a [0234.803] SysStringByteLen (bstr="SkypeHost.exe") returned 0x1a [0234.804] CoTaskMemAlloc (cb=0x4) returned 0x58e818 [0234.804] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e818, puReturned=0x23de044 | out: apObjects=0x58e818*=0x53fc18, puReturned=0x23de044*=0x1) returned 0x0 [0234.806] IUnknown:QueryInterface (in: This=0x53fc18, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53fc18) returned 0x0 [0234.806] IUnknown:QueryInterface (in: This=0x53fc18, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.806] IUnknown:QueryInterface (in: This=0x53fc18, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.806] IUnknown:QueryInterface (in: This=0x53fc18, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.806] IUnknown:AddRef (This=0x53fc18) returned 0x3 [0234.806] IUnknown:QueryInterface (in: This=0x53fc18, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.806] IUnknown:QueryInterface (in: This=0x53fc18, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.806] IUnknown:QueryInterface (in: This=0x53fc18, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53fc1c) returned 0x0 [0234.806] IMarshal:GetUnmarshalClass (in: This=0x53fc1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.806] IUnknown:Release (This=0x53fc1c) returned 0x3 [0234.806] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.806] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.806] IUnknown:QueryInterface (in: This=0x53fc18, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.806] IUnknown:Release (This=0x53fc18) returned 0x2 [0234.806] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.806] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.807] IUnknown:QueryInterface (in: This=0x53fc18, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53fc18) returned 0x0 [0234.807] IUnknown:AddRef (This=0x53fc18) returned 0x4 [0234.807] IUnknown:Release (This=0x53fc18) returned 0x3 [0234.807] IUnknown:Release (This=0x53fc18) returned 0x2 [0234.807] CoTaskMemFree (pv=0x58e818) [0234.807] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.807] IUnknown:AddRef (This=0x53fc18) returned 0x3 [0234.807] IWbemClassObject:Get (in: This=0x53fc18, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.807] IWbemClassObject:Get (in: This=0x53fc18, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2288\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.807] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2288\"") returned 0x5e [0234.807] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2288\"") returned 0x5e [0234.807] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.807] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.807] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.809] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.810] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0234.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.810] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519848) returned 0x0 [0234.810] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0234.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x519848, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519848) returned 0x0 [0234.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x519848, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x519848, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.810] WbemDefPath:IUnknown:AddRef (This=0x519848) returned 0x3 [0234.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x519848, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x519848, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.810] WbemDefPath:IUnknown:QueryInterface (in: This=0x519848, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x513350) returned 0x0 [0234.811] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x513350, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.811] WbemDefPath:IUnknown:Release (This=0x513350) returned 0x3 [0234.811] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.811] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x519848, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.811] WbemDefPath:IUnknown:Release (This=0x519848) returned 0x2 [0234.811] WbemDefPath:IUnknown:Release (This=0x519848) returned 0x1 [0234.811] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.811] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.811] WbemDefPath:IUnknown:QueryInterface (in: This=0x519848, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519848) returned 0x0 [0234.811] WbemDefPath:IUnknown:AddRef (This=0x519848) returned 0x3 [0234.811] WbemDefPath:IUnknown:Release (This=0x519848) returned 0x2 [0234.811] WbemDefPath:IWbemPath:SetText (This=0x519848, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2288\"") returned 0x0 [0234.811] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.811] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.811] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.811] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.811] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.812] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.812] IWbemClassObject:Get (in: This=0x53fc18, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e2408*=0, plFlavor=0x23e240c*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe", varVal2=0x0), pType=0x23e2408*=8, plFlavor=0x23e240c*=0) returned 0x0 [0234.812] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0234.812] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0234.812] IWbemClassObject:Get (in: This=0x53fc18, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e2408*=8, plFlavor=0x23e240c*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="taskhostw.exe", varVal2=0x0), pType=0x23e2408*=8, plFlavor=0x23e240c*=0) returned 0x0 [0234.812] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0234.812] SysStringByteLen (bstr="taskhostw.exe") returned 0x1a [0234.812] CoTaskMemAlloc (cb=0x4) returned 0x58e7d8 [0234.812] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7d8, puReturned=0x23de044 | out: apObjects=0x58e7d8*=0x53ec28, puReturned=0x23de044*=0x1) returned 0x0 [0234.814] IUnknown:QueryInterface (in: This=0x53ec28, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53ec28) returned 0x0 [0234.814] IUnknown:QueryInterface (in: This=0x53ec28, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.814] IUnknown:QueryInterface (in: This=0x53ec28, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.814] IUnknown:QueryInterface (in: This=0x53ec28, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.814] IUnknown:AddRef (This=0x53ec28) returned 0x3 [0234.814] IUnknown:QueryInterface (in: This=0x53ec28, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.814] IUnknown:QueryInterface (in: This=0x53ec28, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.814] IUnknown:QueryInterface (in: This=0x53ec28, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53ec2c) returned 0x0 [0234.814] IMarshal:GetUnmarshalClass (in: This=0x53ec2c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.814] IUnknown:Release (This=0x53ec2c) returned 0x3 [0234.814] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.815] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.815] IUnknown:QueryInterface (in: This=0x53ec28, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.815] IUnknown:Release (This=0x53ec28) returned 0x2 [0234.815] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.815] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.815] IUnknown:QueryInterface (in: This=0x53ec28, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53ec28) returned 0x0 [0234.815] IUnknown:AddRef (This=0x53ec28) returned 0x4 [0234.815] IUnknown:Release (This=0x53ec28) returned 0x3 [0234.815] IUnknown:Release (This=0x53ec28) returned 0x2 [0234.815] CoTaskMemFree (pv=0x58e7d8) [0234.815] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.815] IUnknown:AddRef (This=0x53ec28) returned 0x3 [0234.815] IWbemClassObject:Get (in: This=0x53ec28, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.815] IWbemClassObject:Get (in: This=0x53ec28, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2472\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.816] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2472\"") returned 0x5e [0234.816] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2472\"") returned 0x5e [0234.816] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.816] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.816] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.816] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.817] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e688) returned 0x0 [0234.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e688, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.817] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e688, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x518f88) returned 0x0 [0234.817] WbemDefPath:IUnknown:Release (This=0x58e688) returned 0x0 [0234.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f88, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x518f88) returned 0x0 [0234.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f88, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.817] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f88, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.818] WbemDefPath:IUnknown:AddRef (This=0x518f88) returned 0x3 [0234.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f88, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f88, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f88, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x513290) returned 0x0 [0234.818] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x513290, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.818] WbemDefPath:IUnknown:Release (This=0x513290) returned 0x3 [0234.818] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.818] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f88, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.818] WbemDefPath:IUnknown:Release (This=0x518f88) returned 0x2 [0234.818] WbemDefPath:IUnknown:Release (This=0x518f88) returned 0x1 [0234.818] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.818] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.818] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f88, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x518f88) returned 0x0 [0234.818] WbemDefPath:IUnknown:AddRef (This=0x518f88) returned 0x3 [0234.818] WbemDefPath:IUnknown:Release (This=0x518f88) returned 0x2 [0234.818] WbemDefPath:IWbemPath:SetText (This=0x518f88, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2472\"") returned 0x0 [0234.818] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.818] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.818] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.818] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.819] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.819] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.819] IWbemClassObject:Get (in: This=0x53ec28, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e2c74*=0, plFlavor=0x23e2c78*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ShellExperienceHost.exe", varVal2=0x0), pType=0x23e2c74*=8, plFlavor=0x23e2c78*=0) returned 0x0 [0234.819] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0234.819] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0234.819] IWbemClassObject:Get (in: This=0x53ec28, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e2c74*=8, plFlavor=0x23e2c78*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ShellExperienceHost.exe", varVal2=0x0), pType=0x23e2c74*=8, plFlavor=0x23e2c78*=0) returned 0x0 [0234.819] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0234.819] SysStringByteLen (bstr="ShellExperienceHost.exe") returned 0x2e [0234.819] CoTaskMemAlloc (cb=0x4) returned 0x58e7d8 [0234.819] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7d8, puReturned=0x23de044 | out: apObjects=0x58e7d8*=0x53ff48, puReturned=0x23de044*=0x1) returned 0x0 [0234.820] IUnknown:QueryInterface (in: This=0x53ff48, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53ff48) returned 0x0 [0234.820] IUnknown:QueryInterface (in: This=0x53ff48, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.820] IUnknown:QueryInterface (in: This=0x53ff48, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.820] IUnknown:QueryInterface (in: This=0x53ff48, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.820] IUnknown:AddRef (This=0x53ff48) returned 0x3 [0234.820] IUnknown:QueryInterface (in: This=0x53ff48, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.820] IUnknown:QueryInterface (in: This=0x53ff48, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.820] IUnknown:QueryInterface (in: This=0x53ff48, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53ff4c) returned 0x0 [0234.820] IMarshal:GetUnmarshalClass (in: This=0x53ff4c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.821] IUnknown:Release (This=0x53ff4c) returned 0x3 [0234.821] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.821] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.821] IUnknown:QueryInterface (in: This=0x53ff48, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.821] IUnknown:Release (This=0x53ff48) returned 0x2 [0234.821] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.821] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.821] IUnknown:QueryInterface (in: This=0x53ff48, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53ff48) returned 0x0 [0234.821] IUnknown:AddRef (This=0x53ff48) returned 0x4 [0234.821] IUnknown:Release (This=0x53ff48) returned 0x3 [0234.821] IUnknown:Release (This=0x53ff48) returned 0x2 [0234.821] CoTaskMemFree (pv=0x58e7d8) [0234.821] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.821] IUnknown:AddRef (This=0x53ff48) returned 0x3 [0234.821] IWbemClassObject:Get (in: This=0x53ff48, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.821] IWbemClassObject:Get (in: This=0x53ff48, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2588\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.821] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2588\"") returned 0x5e [0234.821] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2588\"") returned 0x5e [0234.822] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.822] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.822] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.822] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.822] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0234.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.823] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x518f18) returned 0x0 [0234.823] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0234.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f18, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x518f18) returned 0x0 [0234.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f18, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.823] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f18, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.823] WbemDefPath:IUnknown:AddRef (This=0x518f18) returned 0x3 [0234.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f18, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f18, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f18, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5134d0) returned 0x0 [0234.865] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5134d0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.865] WbemDefPath:IUnknown:Release (This=0x5134d0) returned 0x3 [0234.865] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.865] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.865] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f18, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.865] WbemDefPath:IUnknown:Release (This=0x518f18) returned 0x2 [0234.865] WbemDefPath:IUnknown:Release (This=0x518f18) returned 0x1 [0234.866] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.866] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.866] WbemDefPath:IUnknown:QueryInterface (in: This=0x518f18, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x518f18) returned 0x0 [0234.866] WbemDefPath:IUnknown:AddRef (This=0x518f18) returned 0x3 [0234.866] WbemDefPath:IUnknown:Release (This=0x518f18) returned 0x2 [0234.866] WbemDefPath:IWbemPath:SetText (This=0x518f18, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2588\"") returned 0x0 [0234.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.866] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.866] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.866] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.866] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.866] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.866] IWbemClassObject:Get (in: This=0x53ff48, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e3508*=0, plFlavor=0x23e350c*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SearchUI.exe", varVal2=0x0), pType=0x23e3508*=8, plFlavor=0x23e350c*=0) returned 0x0 [0234.867] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0234.867] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0234.867] IWbemClassObject:Get (in: This=0x53ff48, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e3508*=8, plFlavor=0x23e350c*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="SearchUI.exe", varVal2=0x0), pType=0x23e3508*=8, plFlavor=0x23e350c*=0) returned 0x0 [0234.867] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0234.867] SysStringByteLen (bstr="SearchUI.exe") returned 0x18 [0234.867] CoTaskMemAlloc (cb=0x4) returned 0x58e7d8 [0234.867] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7d8, puReturned=0x23de044 | out: apObjects=0x58e7d8*=0x53edc0, puReturned=0x23de044*=0x1) returned 0x0 [0234.869] IUnknown:QueryInterface (in: This=0x53edc0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53edc0) returned 0x0 [0234.869] IUnknown:QueryInterface (in: This=0x53edc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.869] IUnknown:QueryInterface (in: This=0x53edc0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.869] IUnknown:QueryInterface (in: This=0x53edc0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.869] IUnknown:AddRef (This=0x53edc0) returned 0x3 [0234.869] IUnknown:QueryInterface (in: This=0x53edc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.869] IUnknown:QueryInterface (in: This=0x53edc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.870] IUnknown:QueryInterface (in: This=0x53edc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53edc4) returned 0x0 [0234.870] IMarshal:GetUnmarshalClass (in: This=0x53edc4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.870] IUnknown:Release (This=0x53edc4) returned 0x3 [0234.870] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.870] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.870] IUnknown:QueryInterface (in: This=0x53edc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.870] IUnknown:Release (This=0x53edc0) returned 0x2 [0234.870] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.870] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.870] IUnknown:QueryInterface (in: This=0x53edc0, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53edc0) returned 0x0 [0234.870] IUnknown:AddRef (This=0x53edc0) returned 0x4 [0234.870] IUnknown:Release (This=0x53edc0) returned 0x3 [0234.870] IUnknown:Release (This=0x53edc0) returned 0x2 [0234.870] CoTaskMemFree (pv=0x58e7d8) [0234.870] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.870] IUnknown:AddRef (This=0x53edc0) returned 0x3 [0234.870] IWbemClassObject:Get (in: This=0x53edc0, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.871] IWbemClassObject:Get (in: This=0x53edc0, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2912\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.871] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2912\"") returned 0x5e [0234.871] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2912\"") returned 0x5e [0234.871] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.871] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.871] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.871] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.872] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e818) returned 0x0 [0234.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e818, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.872] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e818, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519b58) returned 0x0 [0234.872] WbemDefPath:IUnknown:Release (This=0x58e818) returned 0x0 [0234.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x519b58, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519b58) returned 0x0 [0234.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x519b58, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.872] WbemDefPath:IUnknown:QueryInterface (in: This=0x519b58, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.873] WbemDefPath:IUnknown:AddRef (This=0x519b58) returned 0x3 [0234.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x519b58, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x519b58, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x519b58, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x513650) returned 0x0 [0234.873] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x513650, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.873] WbemDefPath:IUnknown:Release (This=0x513650) returned 0x3 [0234.873] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.873] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x519b58, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.873] WbemDefPath:IUnknown:Release (This=0x519b58) returned 0x2 [0234.873] WbemDefPath:IUnknown:Release (This=0x519b58) returned 0x1 [0234.873] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.873] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.873] WbemDefPath:IUnknown:QueryInterface (in: This=0x519b58, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519b58) returned 0x0 [0234.873] WbemDefPath:IUnknown:AddRef (This=0x519b58) returned 0x3 [0234.873] WbemDefPath:IUnknown:Release (This=0x519b58) returned 0x2 [0234.873] WbemDefPath:IWbemPath:SetText (This=0x519b58, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2912\"") returned 0x0 [0234.874] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.874] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.874] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.874] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.874] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.874] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.874] IWbemClassObject:Get (in: This=0x53edc0, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e3d74*=0, plFlavor=0x23e3d78*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dllhost.exe", varVal2=0x0), pType=0x23e3d74*=8, plFlavor=0x23e3d78*=0) returned 0x0 [0234.874] SysStringByteLen (bstr="dllhost.exe") returned 0x16 [0234.874] SysStringByteLen (bstr="dllhost.exe") returned 0x16 [0234.874] IWbemClassObject:Get (in: This=0x53edc0, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e3d74*=8, plFlavor=0x23e3d78*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="dllhost.exe", varVal2=0x0), pType=0x23e3d74*=8, plFlavor=0x23e3d78*=0) returned 0x0 [0234.874] SysStringByteLen (bstr="dllhost.exe") returned 0x16 [0234.874] SysStringByteLen (bstr="dllhost.exe") returned 0x16 [0234.874] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0234.874] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x53ef58, puReturned=0x23de044*=0x1) returned 0x0 [0234.876] IUnknown:QueryInterface (in: This=0x53ef58, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53ef58) returned 0x0 [0234.876] IUnknown:QueryInterface (in: This=0x53ef58, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.876] IUnknown:QueryInterface (in: This=0x53ef58, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.876] IUnknown:QueryInterface (in: This=0x53ef58, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.878] IUnknown:AddRef (This=0x53ef58) returned 0x3 [0234.878] IUnknown:QueryInterface (in: This=0x53ef58, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.878] IUnknown:QueryInterface (in: This=0x53ef58, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.878] IUnknown:QueryInterface (in: This=0x53ef58, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53ef5c) returned 0x0 [0234.878] IMarshal:GetUnmarshalClass (in: This=0x53ef5c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.878] IUnknown:Release (This=0x53ef5c) returned 0x3 [0234.878] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.878] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.878] IUnknown:QueryInterface (in: This=0x53ef58, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.878] IUnknown:Release (This=0x53ef58) returned 0x2 [0234.878] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.878] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.878] IUnknown:QueryInterface (in: This=0x53ef58, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53ef58) returned 0x0 [0234.878] IUnknown:AddRef (This=0x53ef58) returned 0x4 [0234.878] IUnknown:Release (This=0x53ef58) returned 0x3 [0234.878] IUnknown:Release (This=0x53ef58) returned 0x2 [0234.878] CoTaskMemFree (pv=0x58e7e8) [0234.878] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.878] IUnknown:AddRef (This=0x53ef58) returned 0x3 [0234.879] IWbemClassObject:Get (in: This=0x53ef58, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.879] IWbemClassObject:Get (in: This=0x53ef58, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3272\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.879] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3272\"") returned 0x5e [0234.879] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3272\"") returned 0x5e [0234.879] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.879] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.879] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.879] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.880] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e818) returned 0x0 [0234.880] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e818, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.880] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e818, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519bc8) returned 0x0 [0234.880] WbemDefPath:IUnknown:Release (This=0x58e818) returned 0x0 [0234.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x519bc8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519bc8) returned 0x0 [0234.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x519bc8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x519bc8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.881] WbemDefPath:IUnknown:AddRef (This=0x519bc8) returned 0x3 [0234.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x519bc8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x519bc8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x519bc8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x513848) returned 0x0 [0234.881] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x513848, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.881] WbemDefPath:IUnknown:Release (This=0x513848) returned 0x3 [0234.881] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.881] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.881] WbemDefPath:IUnknown:QueryInterface (in: This=0x519bc8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.881] WbemDefPath:IUnknown:Release (This=0x519bc8) returned 0x2 [0234.881] WbemDefPath:IUnknown:Release (This=0x519bc8) returned 0x1 [0234.881] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.882] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.882] WbemDefPath:IUnknown:QueryInterface (in: This=0x519bc8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519bc8) returned 0x0 [0234.882] WbemDefPath:IUnknown:AddRef (This=0x519bc8) returned 0x3 [0234.882] WbemDefPath:IUnknown:Release (This=0x519bc8) returned 0x2 [0234.882] WbemDefPath:IWbemPath:SetText (This=0x519bc8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3272\"") returned 0x0 [0234.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.882] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.882] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.882] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.882] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.882] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.882] IWbemClassObject:Get (in: This=0x53ef58, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e45d8*=0, plFlavor=0x23e45dc*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="svchost.exe", varVal2=0x0), pType=0x23e45d8*=8, plFlavor=0x23e45dc*=0) returned 0x0 [0234.882] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0234.882] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0234.882] IWbemClassObject:Get (in: This=0x53ef58, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e45d8*=8, plFlavor=0x23e45dc*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="svchost.exe", varVal2=0x0), pType=0x23e45d8*=8, plFlavor=0x23e45dc*=0) returned 0x0 [0234.882] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0234.883] SysStringByteLen (bstr="svchost.exe") returned 0x16 [0234.883] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0234.883] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x5400e0, puReturned=0x23de044*=0x1) returned 0x0 [0234.884] IUnknown:QueryInterface (in: This=0x5400e0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5400e0) returned 0x0 [0234.884] IUnknown:QueryInterface (in: This=0x5400e0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.884] IUnknown:QueryInterface (in: This=0x5400e0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.884] IUnknown:QueryInterface (in: This=0x5400e0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.884] IUnknown:AddRef (This=0x5400e0) returned 0x3 [0234.884] IUnknown:QueryInterface (in: This=0x5400e0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.884] IUnknown:QueryInterface (in: This=0x5400e0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.884] IUnknown:QueryInterface (in: This=0x5400e0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5400e4) returned 0x0 [0234.884] IMarshal:GetUnmarshalClass (in: This=0x5400e4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.884] IUnknown:Release (This=0x5400e4) returned 0x3 [0234.884] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.884] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.884] IUnknown:QueryInterface (in: This=0x5400e0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.884] IUnknown:Release (This=0x5400e0) returned 0x2 [0234.884] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.885] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.885] IUnknown:QueryInterface (in: This=0x5400e0, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5400e0) returned 0x0 [0234.885] IUnknown:AddRef (This=0x5400e0) returned 0x4 [0234.885] IUnknown:Release (This=0x5400e0) returned 0x3 [0234.885] IUnknown:Release (This=0x5400e0) returned 0x2 [0234.885] CoTaskMemFree (pv=0x58e6f8) [0234.885] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.885] IUnknown:AddRef (This=0x5400e0) returned 0x3 [0234.885] IWbemClassObject:Get (in: This=0x5400e0, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.885] IWbemClassObject:Get (in: This=0x5400e0, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"480\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.885] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"480\"") returned 0x5c [0234.885] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"480\"") returned 0x5c [0234.885] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.885] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.885] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.885] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.886] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0234.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.887] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5198b8) returned 0x0 [0234.887] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0234.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x5198b8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x5198b8) returned 0x0 [0234.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x5198b8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x5198b8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.887] WbemDefPath:IUnknown:AddRef (This=0x5198b8) returned 0x3 [0234.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x5198b8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x5198b8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x5198b8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x513968) returned 0x0 [0234.887] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x513968, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.887] WbemDefPath:IUnknown:Release (This=0x513968) returned 0x3 [0234.887] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.887] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.887] WbemDefPath:IUnknown:QueryInterface (in: This=0x5198b8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.888] WbemDefPath:IUnknown:Release (This=0x5198b8) returned 0x2 [0234.888] WbemDefPath:IUnknown:Release (This=0x5198b8) returned 0x1 [0234.888] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.888] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.888] WbemDefPath:IUnknown:QueryInterface (in: This=0x5198b8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x5198b8) returned 0x0 [0234.888] WbemDefPath:IUnknown:AddRef (This=0x5198b8) returned 0x3 [0234.888] WbemDefPath:IUnknown:Release (This=0x5198b8) returned 0x2 [0234.888] WbemDefPath:IWbemPath:SetText (This=0x5198b8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"480\"") returned 0x0 [0234.888] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.888] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.888] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.888] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.888] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.888] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.888] IWbemClassObject:Get (in: This=0x5400e0, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e4e3c*=0, plFlavor=0x23e4e40*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x23e4e3c*=8, plFlavor=0x23e4e40*=0) returned 0x0 [0234.888] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0234.888] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0234.889] IWbemClassObject:Get (in: This=0x5400e0, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e4e3c*=8, plFlavor=0x23e4e40*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x23e4e3c*=8, plFlavor=0x23e4e40*=0) returned 0x0 [0234.889] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0234.889] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0234.889] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0234.889] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x540278, puReturned=0x23de044*=0x1) returned 0x0 [0234.897] IUnknown:QueryInterface (in: This=0x540278, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x540278) returned 0x0 [0234.897] IUnknown:QueryInterface (in: This=0x540278, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.897] IUnknown:QueryInterface (in: This=0x540278, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.897] IUnknown:QueryInterface (in: This=0x540278, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.897] IUnknown:AddRef (This=0x540278) returned 0x3 [0234.897] IUnknown:QueryInterface (in: This=0x540278, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.897] IUnknown:QueryInterface (in: This=0x540278, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.898] IUnknown:QueryInterface (in: This=0x540278, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x54027c) returned 0x0 [0234.898] IMarshal:GetUnmarshalClass (in: This=0x54027c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.898] IUnknown:Release (This=0x54027c) returned 0x3 [0234.898] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.898] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.898] IUnknown:QueryInterface (in: This=0x540278, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.898] IUnknown:Release (This=0x540278) returned 0x2 [0234.898] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.898] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.898] IUnknown:QueryInterface (in: This=0x540278, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x540278) returned 0x0 [0234.898] IUnknown:AddRef (This=0x540278) returned 0x4 [0234.898] IUnknown:Release (This=0x540278) returned 0x3 [0234.898] IUnknown:Release (This=0x540278) returned 0x2 [0234.898] CoTaskMemFree (pv=0x58e7e8) [0234.898] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.898] IUnknown:AddRef (This=0x540278) returned 0x3 [0234.898] IWbemClassObject:Get (in: This=0x540278, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.899] IWbemClassObject:Get (in: This=0x540278, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.899] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"") returned 0x5e [0234.899] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"") returned 0x5e [0234.899] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.899] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.899] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.899] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.900] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0234.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.900] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519298) returned 0x0 [0234.900] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0234.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x519298, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519298) returned 0x0 [0234.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x519298, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x519298, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.901] WbemDefPath:IUnknown:AddRef (This=0x519298) returned 0x3 [0234.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x519298, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x519298, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x519298, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x513cb0) returned 0x0 [0234.901] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x513cb0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.901] WbemDefPath:IUnknown:Release (This=0x513cb0) returned 0x3 [0234.901] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.901] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.901] WbemDefPath:IUnknown:QueryInterface (in: This=0x519298, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.901] WbemDefPath:IUnknown:Release (This=0x519298) returned 0x2 [0234.901] WbemDefPath:IUnknown:Release (This=0x519298) returned 0x1 [0234.901] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.901] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.902] WbemDefPath:IUnknown:QueryInterface (in: This=0x519298, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519298) returned 0x0 [0234.902] WbemDefPath:IUnknown:AddRef (This=0x519298) returned 0x3 [0234.902] WbemDefPath:IUnknown:Release (This=0x519298) returned 0x2 [0234.902] WbemDefPath:IWbemPath:SetText (This=0x519298, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"3484\"") returned 0x0 [0234.902] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.902] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.902] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.902] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.902] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.902] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.902] IWbemClassObject:Get (in: This=0x540278, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e56d0*=0, plFlavor=0x23e56d4*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x23e56d0*=8, plFlavor=0x23e56d4*=0) returned 0x0 [0234.902] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0234.902] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0234.902] IWbemClassObject:Get (in: This=0x540278, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e56d0*=8, plFlavor=0x23e56d4*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="backgroundTaskHost.exe", varVal2=0x0), pType=0x23e56d0*=8, plFlavor=0x23e56d4*=0) returned 0x0 [0234.902] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0234.902] SysStringByteLen (bstr="backgroundTaskHost.exe") returned 0x2c [0234.902] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0234.903] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x53fdb0, puReturned=0x23de044*=0x1) returned 0x0 [0234.903] IUnknown:QueryInterface (in: This=0x53fdb0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53fdb0) returned 0x0 [0234.903] IUnknown:QueryInterface (in: This=0x53fdb0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.903] IUnknown:QueryInterface (in: This=0x53fdb0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.903] IUnknown:QueryInterface (in: This=0x53fdb0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.904] IUnknown:AddRef (This=0x53fdb0) returned 0x3 [0234.904] IUnknown:QueryInterface (in: This=0x53fdb0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.904] IUnknown:QueryInterface (in: This=0x53fdb0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.904] IUnknown:QueryInterface (in: This=0x53fdb0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53fdb4) returned 0x0 [0234.904] IMarshal:GetUnmarshalClass (in: This=0x53fdb4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.904] IUnknown:Release (This=0x53fdb4) returned 0x3 [0234.904] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.904] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.904] IUnknown:QueryInterface (in: This=0x53fdb0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.904] IUnknown:Release (This=0x53fdb0) returned 0x2 [0234.904] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.904] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.904] IUnknown:QueryInterface (in: This=0x53fdb0, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53fdb0) returned 0x0 [0234.904] IUnknown:AddRef (This=0x53fdb0) returned 0x4 [0234.904] IUnknown:Release (This=0x53fdb0) returned 0x3 [0234.904] IUnknown:Release (This=0x53fdb0) returned 0x2 [0234.904] CoTaskMemFree (pv=0x58e7e8) [0234.904] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.905] IUnknown:AddRef (This=0x53fdb0) returned 0x3 [0234.905] IWbemClassObject:Get (in: This=0x53fdb0, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.905] IWbemClassObject:Get (in: This=0x53fdb0, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2224\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.905] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2224\"") returned 0x5e [0234.905] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2224\"") returned 0x5e [0234.905] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.905] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.905] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.905] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.906] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0234.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.906] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519458) returned 0x0 [0234.906] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0234.906] WbemDefPath:IUnknown:QueryInterface (in: This=0x519458, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519458) returned 0x0 [0234.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x519458, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x519458, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.907] WbemDefPath:IUnknown:AddRef (This=0x519458) returned 0x3 [0234.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x519458, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x519458, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x519458, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x513b00) returned 0x0 [0234.907] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x513b00, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.907] WbemDefPath:IUnknown:Release (This=0x513b00) returned 0x3 [0234.907] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.907] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.907] WbemDefPath:IUnknown:QueryInterface (in: This=0x519458, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.907] WbemDefPath:IUnknown:Release (This=0x519458) returned 0x2 [0234.907] WbemDefPath:IUnknown:Release (This=0x519458) returned 0x1 [0234.908] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.908] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.908] WbemDefPath:IUnknown:QueryInterface (in: This=0x519458, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519458) returned 0x0 [0234.908] WbemDefPath:IUnknown:AddRef (This=0x519458) returned 0x3 [0234.908] WbemDefPath:IUnknown:Release (This=0x519458) returned 0x2 [0234.908] WbemDefPath:IWbemPath:SetText (This=0x519458, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"2224\"") returned 0x0 [0234.908] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.908] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.908] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.908] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.908] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.908] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.908] IWbemClassObject:Get (in: This=0x53fdb0, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e5f64*=0, plFlavor=0x23e5f68*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x23e5f64*=8, plFlavor=0x23e5f68*=0) returned 0x0 [0234.908] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0234.908] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0234.908] IWbemClassObject:Get (in: This=0x53fdb0, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e5f64*=8, plFlavor=0x23e5f68*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x23e5f64*=8, plFlavor=0x23e5f68*=0) returned 0x0 [0234.909] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0234.909] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0234.909] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0234.909] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x53e760, puReturned=0x23de044*=0x1) returned 0x0 [0234.911] IUnknown:QueryInterface (in: This=0x53e760, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53e760) returned 0x0 [0234.911] IUnknown:QueryInterface (in: This=0x53e760, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.911] IUnknown:QueryInterface (in: This=0x53e760, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.911] IUnknown:QueryInterface (in: This=0x53e760, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.911] IUnknown:AddRef (This=0x53e760) returned 0x3 [0234.911] IUnknown:QueryInterface (in: This=0x53e760, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.911] IUnknown:QueryInterface (in: This=0x53e760, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.911] IUnknown:QueryInterface (in: This=0x53e760, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53e764) returned 0x0 [0234.911] IMarshal:GetUnmarshalClass (in: This=0x53e764, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.911] IUnknown:Release (This=0x53e764) returned 0x3 [0234.911] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.912] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.912] IUnknown:QueryInterface (in: This=0x53e760, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.912] IUnknown:Release (This=0x53e760) returned 0x2 [0234.912] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.912] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.912] IUnknown:QueryInterface (in: This=0x53e760, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53e760) returned 0x0 [0234.912] IUnknown:AddRef (This=0x53e760) returned 0x4 [0234.912] IUnknown:Release (This=0x53e760) returned 0x3 [0234.912] IUnknown:Release (This=0x53e760) returned 0x2 [0234.912] CoTaskMemFree (pv=0x58e6f8) [0234.912] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.912] IUnknown:AddRef (This=0x53e760) returned 0x3 [0234.912] IWbemClassObject:Get (in: This=0x53e760, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.912] IWbemClassObject:Get (in: This=0x53e760, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1432\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.912] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1432\"") returned 0x5e [0234.912] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1432\"") returned 0x5e [0234.913] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.913] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.913] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.913] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.914] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0234.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.914] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5194c8) returned 0x0 [0234.914] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0234.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x5194c8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x5194c8) returned 0x0 [0234.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x5194c8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.914] WbemDefPath:IUnknown:QueryInterface (in: This=0x5194c8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.915] WbemDefPath:IUnknown:AddRef (This=0x5194c8) returned 0x3 [0234.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x5194c8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x5194c8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x5194c8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x555ab18) returned 0x0 [0234.915] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x555ab18, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.915] WbemDefPath:IUnknown:Release (This=0x555ab18) returned 0x3 [0234.915] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.915] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x5194c8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.915] WbemDefPath:IUnknown:Release (This=0x5194c8) returned 0x2 [0234.915] WbemDefPath:IUnknown:Release (This=0x5194c8) returned 0x1 [0234.915] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.915] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.915] WbemDefPath:IUnknown:QueryInterface (in: This=0x5194c8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x5194c8) returned 0x0 [0234.915] WbemDefPath:IUnknown:AddRef (This=0x5194c8) returned 0x3 [0234.915] WbemDefPath:IUnknown:Release (This=0x5194c8) returned 0x2 [0234.915] WbemDefPath:IWbemPath:SetText (This=0x5194c8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"1432\"") returned 0x0 [0234.915] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.915] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.916] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.916] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.916] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.916] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.916] IWbemClassObject:Get (in: This=0x53e760, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e67d0*=0, plFlavor=0x23e67d4*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x23e67d0*=8, plFlavor=0x23e67d4*=0) returned 0x0 [0234.916] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0234.916] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0234.916] IWbemClassObject:Get (in: This=0x53e760, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e67d0*=8, plFlavor=0x23e67d4*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="iexplore.exe", varVal2=0x0), pType=0x23e67d0*=8, plFlavor=0x23e67d4*=0) returned 0x0 [0234.916] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0234.916] SysStringByteLen (bstr="iexplore.exe") returned 0x18 [0234.916] CoTaskMemAlloc (cb=0x4) returned 0x58e818 [0234.916] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e818, puReturned=0x23de044 | out: apObjects=0x58e818*=0x53e8f8, puReturned=0x23de044*=0x1) returned 0x0 [0234.918] IUnknown:QueryInterface (in: This=0x53e8f8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53e8f8) returned 0x0 [0234.918] IUnknown:QueryInterface (in: This=0x53e8f8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.918] IUnknown:QueryInterface (in: This=0x53e8f8, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.918] IUnknown:QueryInterface (in: This=0x53e8f8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.919] IUnknown:AddRef (This=0x53e8f8) returned 0x3 [0234.919] IUnknown:QueryInterface (in: This=0x53e8f8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.919] IUnknown:QueryInterface (in: This=0x53e8f8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.919] IUnknown:QueryInterface (in: This=0x53e8f8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53e8fc) returned 0x0 [0234.919] IMarshal:GetUnmarshalClass (in: This=0x53e8fc, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.919] IUnknown:Release (This=0x53e8fc) returned 0x3 [0234.919] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.919] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.919] IUnknown:QueryInterface (in: This=0x53e8f8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.919] IUnknown:Release (This=0x53e8f8) returned 0x2 [0234.919] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.919] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.919] IUnknown:QueryInterface (in: This=0x53e8f8, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53e8f8) returned 0x0 [0234.919] IUnknown:AddRef (This=0x53e8f8) returned 0x4 [0234.919] IUnknown:Release (This=0x53e8f8) returned 0x3 [0234.919] IUnknown:Release (This=0x53e8f8) returned 0x2 [0234.919] CoTaskMemFree (pv=0x58e818) [0234.919] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.920] IUnknown:AddRef (This=0x53e8f8) returned 0x3 [0234.920] IWbemClassObject:Get (in: This=0x53e8f8, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.920] IWbemClassObject:Get (in: This=0x53e8f8, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4160\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.920] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4160\"") returned 0x5e [0234.920] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4160\"") returned 0x5e [0234.920] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.920] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.920] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.920] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.921] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0234.921] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.921] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519998) returned 0x0 [0234.922] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0234.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x519998, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519998) returned 0x0 [0234.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x519998, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x519998, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.922] WbemDefPath:IUnknown:AddRef (This=0x519998) returned 0x3 [0234.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x519998, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x519998, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x519998, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x555a9e0) returned 0x0 [0234.922] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x555a9e0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.922] WbemDefPath:IUnknown:Release (This=0x555a9e0) returned 0x3 [0234.922] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.922] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x519998, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.922] WbemDefPath:IUnknown:Release (This=0x519998) returned 0x2 [0234.922] WbemDefPath:IUnknown:Release (This=0x519998) returned 0x1 [0234.922] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.922] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.922] WbemDefPath:IUnknown:QueryInterface (in: This=0x519998, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519998) returned 0x0 [0234.923] WbemDefPath:IUnknown:AddRef (This=0x519998) returned 0x3 [0234.923] WbemDefPath:IUnknown:Release (This=0x519998) returned 0x2 [0234.923] WbemDefPath:IWbemPath:SetText (This=0x519998, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4160\"") returned 0x0 [0234.923] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.923] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.923] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.923] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.923] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.923] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.923] IWbemClassObject:Get (in: This=0x53e8f8, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e703c*=0, plFlavor=0x23e7040*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wind.exe", varVal2=0x0), pType=0x23e703c*=8, plFlavor=0x23e7040*=0) returned 0x0 [0234.923] SysStringByteLen (bstr="wind.exe") returned 0x10 [0234.923] SysStringByteLen (bstr="wind.exe") returned 0x10 [0234.923] IWbemClassObject:Get (in: This=0x53e8f8, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e703c*=8, plFlavor=0x23e7040*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="wind.exe", varVal2=0x0), pType=0x23e703c*=8, plFlavor=0x23e7040*=0) returned 0x0 [0234.923] SysStringByteLen (bstr="wind.exe") returned 0x10 [0234.923] SysStringByteLen (bstr="wind.exe") returned 0x10 [0234.924] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0234.924] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x53ea90, puReturned=0x23de044*=0x1) returned 0x0 [0234.964] IUnknown:QueryInterface (in: This=0x53ea90, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53ea90) returned 0x0 [0234.964] IUnknown:QueryInterface (in: This=0x53ea90, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.964] IUnknown:QueryInterface (in: This=0x53ea90, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.964] IUnknown:QueryInterface (in: This=0x53ea90, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.964] IUnknown:AddRef (This=0x53ea90) returned 0x3 [0234.964] IUnknown:QueryInterface (in: This=0x53ea90, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.964] IUnknown:QueryInterface (in: This=0x53ea90, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.964] IUnknown:QueryInterface (in: This=0x53ea90, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53ea94) returned 0x0 [0234.964] IMarshal:GetUnmarshalClass (in: This=0x53ea94, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.964] IUnknown:Release (This=0x53ea94) returned 0x3 [0234.964] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.965] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.965] IUnknown:QueryInterface (in: This=0x53ea90, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.965] IUnknown:Release (This=0x53ea90) returned 0x2 [0234.965] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.965] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.965] IUnknown:QueryInterface (in: This=0x53ea90, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53ea90) returned 0x0 [0234.965] IUnknown:AddRef (This=0x53ea90) returned 0x4 [0234.965] IUnknown:Release (This=0x53ea90) returned 0x3 [0234.965] IUnknown:Release (This=0x53ea90) returned 0x2 [0234.965] CoTaskMemFree (pv=0x58e7e8) [0234.965] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.965] IUnknown:AddRef (This=0x53ea90) returned 0x3 [0234.965] IWbemClassObject:Get (in: This=0x53ea90, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.965] IWbemClassObject:Get (in: This=0x53ea90, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4168\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.965] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4168\"") returned 0x5e [0234.965] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4168\"") returned 0x5e [0234.966] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.966] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.966] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.966] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.967] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0234.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.967] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519a08) returned 0x0 [0234.967] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0234.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a08, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519a08) returned 0x0 [0234.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a08, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.967] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a08, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.968] WbemDefPath:IUnknown:AddRef (This=0x519a08) returned 0x3 [0234.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a08, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a08, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a08, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x555ae30) returned 0x0 [0234.968] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x555ae30, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.968] WbemDefPath:IUnknown:Release (This=0x555ae30) returned 0x3 [0234.968] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.968] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a08, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.968] WbemDefPath:IUnknown:Release (This=0x519a08) returned 0x2 [0234.968] WbemDefPath:IUnknown:Release (This=0x519a08) returned 0x1 [0234.968] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.968] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.968] WbemDefPath:IUnknown:QueryInterface (in: This=0x519a08, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519a08) returned 0x0 [0234.968] WbemDefPath:IUnknown:AddRef (This=0x519a08) returned 0x3 [0234.968] WbemDefPath:IUnknown:Release (This=0x519a08) returned 0x2 [0234.968] WbemDefPath:IWbemPath:SetText (This=0x519a08, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4168\"") returned 0x0 [0234.968] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.968] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.968] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.969] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.969] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.969] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.969] IWbemClassObject:Get (in: This=0x53ea90, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e7898*=0, plFlavor=0x23e789c*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="rest.exe", varVal2=0x0), pType=0x23e7898*=8, plFlavor=0x23e789c*=0) returned 0x0 [0234.969] SysStringByteLen (bstr="rest.exe") returned 0x10 [0234.969] SysStringByteLen (bstr="rest.exe") returned 0x10 [0234.969] IWbemClassObject:Get (in: This=0x53ea90, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e7898*=8, plFlavor=0x23e789c*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="rest.exe", varVal2=0x0), pType=0x23e7898*=8, plFlavor=0x23e789c*=0) returned 0x0 [0234.969] SysStringByteLen (bstr="rest.exe") returned 0x10 [0234.969] SysStringByteLen (bstr="rest.exe") returned 0x10 [0234.969] CoTaskMemAlloc (cb=0x4) returned 0x58e658 [0234.969] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e658, puReturned=0x23de044 | out: apObjects=0x58e658*=0x53f0f0, puReturned=0x23de044*=0x1) returned 0x0 [0234.973] IUnknown:QueryInterface (in: This=0x53f0f0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53f0f0) returned 0x0 [0234.973] IUnknown:QueryInterface (in: This=0x53f0f0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.973] IUnknown:QueryInterface (in: This=0x53f0f0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.973] IUnknown:QueryInterface (in: This=0x53f0f0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.973] IUnknown:AddRef (This=0x53f0f0) returned 0x3 [0234.973] IUnknown:QueryInterface (in: This=0x53f0f0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.974] IUnknown:QueryInterface (in: This=0x53f0f0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.974] IUnknown:QueryInterface (in: This=0x53f0f0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53f0f4) returned 0x0 [0234.974] IMarshal:GetUnmarshalClass (in: This=0x53f0f4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.974] IUnknown:Release (This=0x53f0f4) returned 0x3 [0234.974] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.974] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.974] IUnknown:QueryInterface (in: This=0x53f0f0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.974] IUnknown:Release (This=0x53f0f0) returned 0x2 [0234.974] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.974] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.974] IUnknown:QueryInterface (in: This=0x53f0f0, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53f0f0) returned 0x0 [0234.974] IUnknown:AddRef (This=0x53f0f0) returned 0x4 [0234.974] IUnknown:Release (This=0x53f0f0) returned 0x3 [0234.974] IUnknown:Release (This=0x53f0f0) returned 0x2 [0234.974] CoTaskMemFree (pv=0x58e658) [0234.974] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.974] IUnknown:AddRef (This=0x53f0f0) returned 0x3 [0234.974] IWbemClassObject:Get (in: This=0x53f0f0, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.975] IWbemClassObject:Get (in: This=0x53f0f0, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4176\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.975] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4176\"") returned 0x5e [0234.975] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4176\"") returned 0x5e [0234.975] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.975] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.975] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.975] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.976] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6b8) returned 0x0 [0234.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.976] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519228) returned 0x0 [0234.976] WbemDefPath:IUnknown:Release (This=0x58e6b8) returned 0x0 [0234.976] WbemDefPath:IUnknown:QueryInterface (in: This=0x519228, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519228) returned 0x0 [0234.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x519228, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x519228, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.977] WbemDefPath:IUnknown:AddRef (This=0x519228) returned 0x3 [0234.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x519228, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x519228, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x519228, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x555ad40) returned 0x0 [0234.977] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x555ad40, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.977] WbemDefPath:IUnknown:Release (This=0x555ad40) returned 0x3 [0234.977] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.977] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x519228, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.977] WbemDefPath:IUnknown:Release (This=0x519228) returned 0x2 [0234.977] WbemDefPath:IUnknown:Release (This=0x519228) returned 0x1 [0234.977] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.977] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.977] WbemDefPath:IUnknown:QueryInterface (in: This=0x519228, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519228) returned 0x0 [0234.978] WbemDefPath:IUnknown:AddRef (This=0x519228) returned 0x3 [0234.978] WbemDefPath:IUnknown:Release (This=0x519228) returned 0x2 [0234.978] WbemDefPath:IWbemPath:SetText (This=0x519228, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4176\"") returned 0x0 [0234.978] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.978] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.978] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.978] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.978] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.978] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.978] IWbemClassObject:Get (in: This=0x53f0f0, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e80f4*=0, plFlavor=0x23e80f8*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="eventtimemember.exe", varVal2=0x0), pType=0x23e80f4*=8, plFlavor=0x23e80f8*=0) returned 0x0 [0234.978] SysStringByteLen (bstr="eventtimemember.exe") returned 0x26 [0234.978] SysStringByteLen (bstr="eventtimemember.exe") returned 0x26 [0234.978] IWbemClassObject:Get (in: This=0x53f0f0, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e80f4*=8, plFlavor=0x23e80f8*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="eventtimemember.exe", varVal2=0x0), pType=0x23e80f4*=8, plFlavor=0x23e80f8*=0) returned 0x0 [0234.978] SysStringByteLen (bstr="eventtimemember.exe") returned 0x26 [0234.979] SysStringByteLen (bstr="eventtimemember.exe") returned 0x26 [0234.979] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0234.979] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x53f288, puReturned=0x23de044*=0x1) returned 0x0 [0234.979] IUnknown:QueryInterface (in: This=0x53f288, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53f288) returned 0x0 [0234.980] IUnknown:QueryInterface (in: This=0x53f288, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.980] IUnknown:QueryInterface (in: This=0x53f288, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.980] IUnknown:QueryInterface (in: This=0x53f288, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.980] IUnknown:AddRef (This=0x53f288) returned 0x3 [0234.980] IUnknown:QueryInterface (in: This=0x53f288, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.980] IUnknown:QueryInterface (in: This=0x53f288, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.980] IUnknown:QueryInterface (in: This=0x53f288, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53f28c) returned 0x0 [0234.980] IMarshal:GetUnmarshalClass (in: This=0x53f28c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.980] IUnknown:Release (This=0x53f28c) returned 0x3 [0234.980] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.980] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.980] IUnknown:QueryInterface (in: This=0x53f288, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.980] IUnknown:Release (This=0x53f288) returned 0x2 [0234.980] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.981] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.981] IUnknown:QueryInterface (in: This=0x53f288, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53f288) returned 0x0 [0234.981] IUnknown:AddRef (This=0x53f288) returned 0x4 [0234.981] IUnknown:Release (This=0x53f288) returned 0x3 [0234.981] IUnknown:Release (This=0x53f288) returned 0x2 [0234.981] CoTaskMemFree (pv=0x58e7e8) [0234.981] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.981] IUnknown:AddRef (This=0x53f288) returned 0x3 [0234.981] IWbemClassObject:Get (in: This=0x53f288, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.981] IWbemClassObject:Get (in: This=0x53f288, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4200\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.981] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4200\"") returned 0x5e [0234.981] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4200\"") returned 0x5e [0234.981] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.981] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.982] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.982] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.982] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0234.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.983] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519308) returned 0x0 [0234.983] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0234.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x519308, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519308) returned 0x0 [0234.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x519308, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x519308, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.983] WbemDefPath:IUnknown:AddRef (This=0x519308) returned 0x3 [0234.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x519308, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x519308, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.983] WbemDefPath:IUnknown:QueryInterface (in: This=0x519308, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x555afc8) returned 0x0 [0234.983] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x555afc8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.983] WbemDefPath:IUnknown:Release (This=0x555afc8) returned 0x3 [0234.983] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.984] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x519308, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.984] WbemDefPath:IUnknown:Release (This=0x519308) returned 0x2 [0234.984] WbemDefPath:IUnknown:Release (This=0x519308) returned 0x1 [0234.984] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.984] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.984] WbemDefPath:IUnknown:QueryInterface (in: This=0x519308, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519308) returned 0x0 [0234.984] WbemDefPath:IUnknown:AddRef (This=0x519308) returned 0x3 [0234.984] WbemDefPath:IUnknown:Release (This=0x519308) returned 0x2 [0234.984] WbemDefPath:IWbemPath:SetText (This=0x519308, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4200\"") returned 0x0 [0234.984] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.984] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.984] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.984] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.984] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.984] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.984] IWbemClassObject:Get (in: This=0x53f288, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e8978*=0, plFlavor=0x23e897c*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fly herself occur.exe", varVal2=0x0), pType=0x23e8978*=8, plFlavor=0x23e897c*=0) returned 0x0 [0234.985] SysStringByteLen (bstr="fly herself occur.exe") returned 0x2a [0234.985] SysStringByteLen (bstr="fly herself occur.exe") returned 0x2a [0234.985] IWbemClassObject:Get (in: This=0x53f288, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e8978*=8, plFlavor=0x23e897c*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="fly herself occur.exe", varVal2=0x0), pType=0x23e8978*=8, plFlavor=0x23e897c*=0) returned 0x0 [0234.985] SysStringByteLen (bstr="fly herself occur.exe") returned 0x2a [0234.985] SysStringByteLen (bstr="fly herself occur.exe") returned 0x2a [0234.985] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0234.985] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x53f420, puReturned=0x23de044*=0x1) returned 0x0 [0234.987] IUnknown:QueryInterface (in: This=0x53f420, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53f420) returned 0x0 [0234.987] IUnknown:QueryInterface (in: This=0x53f420, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.987] IUnknown:QueryInterface (in: This=0x53f420, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.987] IUnknown:QueryInterface (in: This=0x53f420, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.987] IUnknown:AddRef (This=0x53f420) returned 0x3 [0234.987] IUnknown:QueryInterface (in: This=0x53f420, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.987] IUnknown:QueryInterface (in: This=0x53f420, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.987] IUnknown:QueryInterface (in: This=0x53f420, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53f424) returned 0x0 [0234.987] IMarshal:GetUnmarshalClass (in: This=0x53f424, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.987] IUnknown:Release (This=0x53f424) returned 0x3 [0234.987] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.988] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.988] IUnknown:QueryInterface (in: This=0x53f420, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.988] IUnknown:Release (This=0x53f420) returned 0x2 [0234.988] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.988] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.988] IUnknown:QueryInterface (in: This=0x53f420, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53f420) returned 0x0 [0234.988] IUnknown:AddRef (This=0x53f420) returned 0x4 [0234.988] IUnknown:Release (This=0x53f420) returned 0x3 [0234.988] IUnknown:Release (This=0x53f420) returned 0x2 [0234.988] CoTaskMemFree (pv=0x58e7e8) [0234.988] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.988] IUnknown:AddRef (This=0x53f420) returned 0x3 [0234.988] IWbemClassObject:Get (in: This=0x53f420, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.988] IWbemClassObject:Get (in: This=0x53f420, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4208\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.988] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4208\"") returned 0x5e [0234.988] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4208\"") returned 0x5e [0234.988] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.989] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.989] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.989] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.989] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e658) returned 0x0 [0234.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e658, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.990] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e658, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x518ff8) returned 0x0 [0234.990] WbemDefPath:IUnknown:Release (This=0x58e658) returned 0x0 [0234.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ff8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x518ff8) returned 0x0 [0234.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ff8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ff8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.990] WbemDefPath:IUnknown:AddRef (This=0x518ff8) returned 0x3 [0234.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ff8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ff8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.990] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ff8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x555a308) returned 0x0 [0234.990] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x555a308, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.990] WbemDefPath:IUnknown:Release (This=0x555a308) returned 0x3 [0234.990] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.991] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ff8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.991] WbemDefPath:IUnknown:Release (This=0x518ff8) returned 0x2 [0234.991] WbemDefPath:IUnknown:Release (This=0x518ff8) returned 0x1 [0234.991] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.991] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.991] WbemDefPath:IUnknown:QueryInterface (in: This=0x518ff8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x518ff8) returned 0x0 [0234.991] WbemDefPath:IUnknown:AddRef (This=0x518ff8) returned 0x3 [0234.991] WbemDefPath:IUnknown:Release (This=0x518ff8) returned 0x2 [0234.991] WbemDefPath:IWbemPath:SetText (This=0x518ff8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4208\"") returned 0x0 [0234.991] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.991] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.991] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.991] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.991] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.991] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.991] IWbemClassObject:Get (in: This=0x53f420, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e9204*=0, plFlavor=0x23e9208*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="product.exe", varVal2=0x0), pType=0x23e9204*=8, plFlavor=0x23e9208*=0) returned 0x0 [0234.992] SysStringByteLen (bstr="product.exe") returned 0x16 [0234.992] SysStringByteLen (bstr="product.exe") returned 0x16 [0234.992] IWbemClassObject:Get (in: This=0x53f420, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e9204*=8, plFlavor=0x23e9208*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="product.exe", varVal2=0x0), pType=0x23e9204*=8, plFlavor=0x23e9208*=0) returned 0x0 [0234.992] SysStringByteLen (bstr="product.exe") returned 0x16 [0234.992] SysStringByteLen (bstr="product.exe") returned 0x16 [0234.992] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0234.992] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x53f5b8, puReturned=0x23de044*=0x1) returned 0x0 [0234.994] IUnknown:QueryInterface (in: This=0x53f5b8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53f5b8) returned 0x0 [0234.994] IUnknown:QueryInterface (in: This=0x53f5b8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0234.994] IUnknown:QueryInterface (in: This=0x53f5b8, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0234.994] IUnknown:QueryInterface (in: This=0x53f5b8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0234.994] IUnknown:AddRef (This=0x53f5b8) returned 0x3 [0234.994] IUnknown:QueryInterface (in: This=0x53f5b8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0234.994] IUnknown:QueryInterface (in: This=0x53f5b8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0234.994] IUnknown:QueryInterface (in: This=0x53f5b8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53f5bc) returned 0x0 [0234.994] IMarshal:GetUnmarshalClass (in: This=0x53f5bc, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0234.994] IUnknown:Release (This=0x53f5bc) returned 0x3 [0234.994] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0234.995] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0234.995] IUnknown:QueryInterface (in: This=0x53f5b8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0234.995] IUnknown:Release (This=0x53f5b8) returned 0x2 [0234.995] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0234.995] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0234.995] IUnknown:QueryInterface (in: This=0x53f5b8, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53f5b8) returned 0x0 [0234.995] IUnknown:AddRef (This=0x53f5b8) returned 0x4 [0234.995] IUnknown:Release (This=0x53f5b8) returned 0x3 [0234.995] IUnknown:Release (This=0x53f5b8) returned 0x2 [0234.995] CoTaskMemFree (pv=0x58e7e8) [0234.995] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0234.995] IUnknown:AddRef (This=0x53f5b8) returned 0x3 [0234.995] IWbemClassObject:Get (in: This=0x53f5b8, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0234.995] IWbemClassObject:Get (in: This=0x53f5b8, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4224\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0234.995] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4224\"") returned 0x5e [0234.995] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4224\"") returned 0x5e [0234.996] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0234.996] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0234.996] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0234.996] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0234.997] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e688) returned 0x0 [0234.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e688, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0234.997] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e688, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519068) returned 0x0 [0234.997] WbemDefPath:IUnknown:Release (This=0x58e688) returned 0x0 [0234.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x519068, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519068) returned 0x0 [0234.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x519068, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0234.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x519068, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0234.997] WbemDefPath:IUnknown:AddRef (This=0x519068) returned 0x3 [0234.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x519068, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0234.997] WbemDefPath:IUnknown:QueryInterface (in: This=0x519068, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0234.998] WbemDefPath:IUnknown:QueryInterface (in: This=0x519068, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x555a2c0) returned 0x0 [0234.998] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x555a2c0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0234.998] WbemDefPath:IUnknown:Release (This=0x555a2c0) returned 0x3 [0234.998] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0234.998] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0234.998] WbemDefPath:IUnknown:QueryInterface (in: This=0x519068, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0234.998] WbemDefPath:IUnknown:Release (This=0x519068) returned 0x2 [0234.998] WbemDefPath:IUnknown:Release (This=0x519068) returned 0x1 [0234.998] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0234.998] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0234.998] WbemDefPath:IUnknown:QueryInterface (in: This=0x519068, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519068) returned 0x0 [0234.998] WbemDefPath:IUnknown:AddRef (This=0x519068) returned 0x3 [0234.998] WbemDefPath:IUnknown:Release (This=0x519068) returned 0x2 [0234.998] WbemDefPath:IWbemPath:SetText (This=0x519068, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4224\"") returned 0x0 [0234.998] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0234.998] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0234.998] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.998] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0234.999] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0234.999] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0234.999] IWbemClassObject:Get (in: This=0x53f5b8, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e9a68*=0, plFlavor=0x23e9a6c*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="tell film.exe", varVal2=0x0), pType=0x23e9a68*=8, plFlavor=0x23e9a6c*=0) returned 0x0 [0234.999] SysStringByteLen (bstr="tell film.exe") returned 0x1a [0234.999] SysStringByteLen (bstr="tell film.exe") returned 0x1a [0234.999] IWbemClassObject:Get (in: This=0x53f5b8, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23e9a68*=8, plFlavor=0x23e9a6c*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="tell film.exe", varVal2=0x0), pType=0x23e9a68*=8, plFlavor=0x23e9a6c*=0) returned 0x0 [0234.999] SysStringByteLen (bstr="tell film.exe") returned 0x1a [0234.999] SysStringByteLen (bstr="tell film.exe") returned 0x1a [0234.999] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0234.999] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x53f750, puReturned=0x23de044*=0x1) returned 0x0 [0235.002] IUnknown:QueryInterface (in: This=0x53f750, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x53f750) returned 0x0 [0235.002] IUnknown:QueryInterface (in: This=0x53f750, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.002] IUnknown:QueryInterface (in: This=0x53f750, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.002] IUnknown:QueryInterface (in: This=0x53f750, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.002] IUnknown:AddRef (This=0x53f750) returned 0x3 [0235.002] IUnknown:QueryInterface (in: This=0x53f750, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.003] IUnknown:QueryInterface (in: This=0x53f750, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.003] IUnknown:QueryInterface (in: This=0x53f750, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x53f754) returned 0x0 [0235.003] IMarshal:GetUnmarshalClass (in: This=0x53f754, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.003] IUnknown:Release (This=0x53f754) returned 0x3 [0235.003] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0235.003] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0235.003] IUnknown:QueryInterface (in: This=0x53f750, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.003] IUnknown:Release (This=0x53f750) returned 0x2 [0235.003] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0235.003] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0235.003] IUnknown:QueryInterface (in: This=0x53f750, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x53f750) returned 0x0 [0235.003] IUnknown:AddRef (This=0x53f750) returned 0x4 [0235.003] IUnknown:Release (This=0x53f750) returned 0x3 [0235.003] IUnknown:Release (This=0x53f750) returned 0x2 [0235.003] CoTaskMemFree (pv=0x58e7e8) [0235.003] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0235.003] IUnknown:AddRef (This=0x53f750) returned 0x3 [0235.003] IWbemClassObject:Get (in: This=0x53f750, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.004] IWbemClassObject:Get (in: This=0x53f750, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4236\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.004] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4236\"") returned 0x5e [0235.004] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4236\"") returned 0x5e [0235.004] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.004] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.004] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.004] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.005] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6b8) returned 0x0 [0235.005] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.005] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519148) returned 0x0 [0235.005] WbemDefPath:IUnknown:Release (This=0x58e6b8) returned 0x0 [0235.005] WbemDefPath:IUnknown:QueryInterface (in: This=0x519148, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519148) returned 0x0 [0235.005] WbemDefPath:IUnknown:QueryInterface (in: This=0x519148, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.006] WbemDefPath:IUnknown:QueryInterface (in: This=0x519148, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.006] WbemDefPath:IUnknown:AddRef (This=0x519148) returned 0x3 [0235.006] WbemDefPath:IUnknown:QueryInterface (in: This=0x519148, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.006] WbemDefPath:IUnknown:QueryInterface (in: This=0x519148, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.006] WbemDefPath:IUnknown:QueryInterface (in: This=0x519148, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x555a530) returned 0x0 [0235.006] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x555a530, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.006] WbemDefPath:IUnknown:Release (This=0x555a530) returned 0x3 [0235.006] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0235.006] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0235.006] WbemDefPath:IUnknown:QueryInterface (in: This=0x519148, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.006] WbemDefPath:IUnknown:Release (This=0x519148) returned 0x2 [0235.006] WbemDefPath:IUnknown:Release (This=0x519148) returned 0x1 [0235.006] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0235.006] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0235.007] WbemDefPath:IUnknown:QueryInterface (in: This=0x519148, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519148) returned 0x0 [0235.007] WbemDefPath:IUnknown:AddRef (This=0x519148) returned 0x3 [0235.007] WbemDefPath:IUnknown:Release (This=0x519148) returned 0x2 [0235.007] WbemDefPath:IWbemPath:SetText (This=0x519148, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4236\"") returned 0x0 [0235.007] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.007] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.007] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.007] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.007] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.007] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.007] IWbemClassObject:Get (in: This=0x53f750, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ea2d4*=0, plFlavor=0x23ea2d8*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alone.exe", varVal2=0x0), pType=0x23ea2d4*=8, plFlavor=0x23ea2d8*=0) returned 0x0 [0235.007] SysStringByteLen (bstr="alone.exe") returned 0x12 [0235.007] SysStringByteLen (bstr="alone.exe") returned 0x12 [0235.007] IWbemClassObject:Get (in: This=0x53f750, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ea2d4*=8, plFlavor=0x23ea2d8*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="alone.exe", varVal2=0x0), pType=0x23ea2d4*=8, plFlavor=0x23ea2d8*=0) returned 0x0 [0235.007] SysStringByteLen (bstr="alone.exe") returned 0x12 [0235.007] SysStringByteLen (bstr="alone.exe") returned 0x12 [0235.008] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.008] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5565168, puReturned=0x23de044*=0x1) returned 0x0 [0235.008] IUnknown:QueryInterface (in: This=0x5565168, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5565168) returned 0x0 [0235.008] IUnknown:QueryInterface (in: This=0x5565168, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.008] IUnknown:QueryInterface (in: This=0x5565168, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.009] IUnknown:QueryInterface (in: This=0x5565168, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.009] IUnknown:AddRef (This=0x5565168) returned 0x3 [0235.009] IUnknown:QueryInterface (in: This=0x5565168, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.009] IUnknown:QueryInterface (in: This=0x5565168, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.009] IUnknown:QueryInterface (in: This=0x5565168, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x556516c) returned 0x0 [0235.009] IMarshal:GetUnmarshalClass (in: This=0x556516c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.009] IUnknown:Release (This=0x556516c) returned 0x3 [0235.009] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0235.009] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0235.009] IUnknown:QueryInterface (in: This=0x5565168, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.009] IUnknown:Release (This=0x5565168) returned 0x2 [0235.009] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0235.009] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0235.009] IUnknown:QueryInterface (in: This=0x5565168, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5565168) returned 0x0 [0235.009] IUnknown:AddRef (This=0x5565168) returned 0x4 [0235.009] IUnknown:Release (This=0x5565168) returned 0x3 [0235.009] IUnknown:Release (This=0x5565168) returned 0x2 [0235.010] CoTaskMemFree (pv=0x58e7e8) [0235.010] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0235.010] IUnknown:AddRef (This=0x5565168) returned 0x3 [0235.010] IWbemClassObject:Get (in: This=0x5565168, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.010] IWbemClassObject:Get (in: This=0x5565168, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4256\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.010] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4256\"") returned 0x5e [0235.010] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4256\"") returned 0x5e [0235.010] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.010] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.010] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.010] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.011] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.011] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519ae8) returned 0x0 [0235.011] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ae8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519ae8) returned 0x0 [0235.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ae8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ae8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.012] WbemDefPath:IUnknown:AddRef (This=0x519ae8) returned 0x3 [0235.013] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ae8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.013] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ae8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.013] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ae8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x555a8a8) returned 0x0 [0235.013] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x555a8a8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.013] WbemDefPath:IUnknown:Release (This=0x555a8a8) returned 0x3 [0235.013] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0235.013] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0235.013] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ae8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.014] WbemDefPath:IUnknown:Release (This=0x519ae8) returned 0x2 [0235.014] WbemDefPath:IUnknown:Release (This=0x519ae8) returned 0x1 [0235.014] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0235.014] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0235.014] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ae8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519ae8) returned 0x0 [0235.014] WbemDefPath:IUnknown:AddRef (This=0x519ae8) returned 0x3 [0235.014] WbemDefPath:IUnknown:Release (This=0x519ae8) returned 0x2 [0235.014] WbemDefPath:IWbemPath:SetText (This=0x519ae8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4256\"") returned 0x0 [0235.014] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.014] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.014] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.014] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.014] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.014] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.014] IWbemClassObject:Get (in: This=0x5565168, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23eab30*=0, plFlavor=0x23eab34*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="project.exe", varVal2=0x0), pType=0x23eab30*=8, plFlavor=0x23eab34*=0) returned 0x0 [0235.014] SysStringByteLen (bstr="project.exe") returned 0x16 [0235.015] SysStringByteLen (bstr="project.exe") returned 0x16 [0235.015] IWbemClassObject:Get (in: This=0x5565168, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23eab30*=8, plFlavor=0x23eab34*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="project.exe", varVal2=0x0), pType=0x23eab30*=8, plFlavor=0x23eab34*=0) returned 0x0 [0235.015] SysStringByteLen (bstr="project.exe") returned 0x16 [0235.015] SysStringByteLen (bstr="project.exe") returned 0x16 [0235.015] CoTaskMemAlloc (cb=0x4) returned 0x58e6b8 [0235.015] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6b8, puReturned=0x23de044 | out: apObjects=0x58e6b8*=0x5565c90, puReturned=0x23de044*=0x1) returned 0x0 [0235.017] IUnknown:QueryInterface (in: This=0x5565c90, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5565c90) returned 0x0 [0235.017] IUnknown:QueryInterface (in: This=0x5565c90, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.017] IUnknown:QueryInterface (in: This=0x5565c90, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.017] IUnknown:QueryInterface (in: This=0x5565c90, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.017] IUnknown:AddRef (This=0x5565c90) returned 0x3 [0235.017] IUnknown:QueryInterface (in: This=0x5565c90, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.017] IUnknown:QueryInterface (in: This=0x5565c90, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.017] IUnknown:QueryInterface (in: This=0x5565c90, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5565c94) returned 0x0 [0235.017] IMarshal:GetUnmarshalClass (in: This=0x5565c94, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.017] IUnknown:Release (This=0x5565c94) returned 0x3 [0235.017] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0235.018] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0235.018] IUnknown:QueryInterface (in: This=0x5565c90, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.018] IUnknown:Release (This=0x5565c90) returned 0x2 [0235.018] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0235.018] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0235.018] IUnknown:QueryInterface (in: This=0x5565c90, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5565c90) returned 0x0 [0235.018] IUnknown:AddRef (This=0x5565c90) returned 0x4 [0235.018] IUnknown:Release (This=0x5565c90) returned 0x3 [0235.018] IUnknown:Release (This=0x5565c90) returned 0x2 [0235.018] CoTaskMemFree (pv=0x58e6b8) [0235.018] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0235.018] IUnknown:AddRef (This=0x5565c90) returned 0x3 [0235.018] IWbemClassObject:Get (in: This=0x5565c90, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.018] IWbemClassObject:Get (in: This=0x5565c90, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4264\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.018] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4264\"") returned 0x5e [0235.018] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4264\"") returned 0x5e [0235.019] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.019] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.019] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.019] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.019] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6f8) returned 0x0 [0235.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6f8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.020] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6f8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5193e8) returned 0x0 [0235.020] WbemDefPath:IUnknown:Release (This=0x58e6f8) returned 0x0 [0235.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x5193e8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x5193e8) returned 0x0 [0235.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x5193e8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x5193e8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.020] WbemDefPath:IUnknown:AddRef (This=0x5193e8) returned 0x3 [0235.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x5193e8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x5193e8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.020] WbemDefPath:IUnknown:QueryInterface (in: This=0x5193e8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x555a9b0) returned 0x0 [0235.020] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x555a9b0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.020] WbemDefPath:IUnknown:Release (This=0x555a9b0) returned 0x3 [0235.021] CoGetContextToken (in: pToken=0x19e2c8 | out: pToken=0x19e2c8) returned 0x0 [0235.021] CoGetContextToken (in: pToken=0x19e6d0 | out: pToken=0x19e6d0) returned 0x0 [0235.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x5193e8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.021] WbemDefPath:IUnknown:Release (This=0x5193e8) returned 0x2 [0235.021] WbemDefPath:IUnknown:Release (This=0x5193e8) returned 0x1 [0235.021] CoGetContextToken (in: pToken=0x19f058 | out: pToken=0x19f058) returned 0x0 [0235.021] CoGetContextToken (in: pToken=0x19efb8 | out: pToken=0x19efb8) returned 0x0 [0235.021] WbemDefPath:IUnknown:QueryInterface (in: This=0x5193e8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x5193e8) returned 0x0 [0235.021] WbemDefPath:IUnknown:AddRef (This=0x5193e8) returned 0x3 [0235.021] WbemDefPath:IUnknown:Release (This=0x5193e8) returned 0x2 [0235.021] WbemDefPath:IWbemPath:SetText (This=0x5193e8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4264\"") returned 0x0 [0235.021] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.021] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.021] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.021] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.021] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.021] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.021] IWbemClassObject:Get (in: This=0x5565c90, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23eb394*=0, plFlavor=0x23eb398*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="simple-company.exe", varVal2=0x0), pType=0x23eb394*=8, plFlavor=0x23eb398*=0) returned 0x0 [0235.022] SysStringByteLen (bstr="simple-company.exe") returned 0x24 [0235.022] SysStringByteLen (bstr="simple-company.exe") returned 0x24 [0235.022] IWbemClassObject:Get (in: This=0x5565c90, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23eb394*=8, plFlavor=0x23eb398*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="simple-company.exe", varVal2=0x0), pType=0x23eb394*=8, plFlavor=0x23eb398*=0) returned 0x0 [0235.022] SysStringByteLen (bstr="simple-company.exe") returned 0x24 [0235.022] SysStringByteLen (bstr="simple-company.exe") returned 0x24 [0235.022] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.022] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5564b08, puReturned=0x23de044*=0x1) returned 0x0 [0235.025] IUnknown:QueryInterface (in: This=0x5564b08, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5564b08) returned 0x0 [0235.025] IUnknown:QueryInterface (in: This=0x5564b08, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.025] IUnknown:QueryInterface (in: This=0x5564b08, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.025] IUnknown:QueryInterface (in: This=0x5564b08, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.025] IUnknown:AddRef (This=0x5564b08) returned 0x3 [0235.025] IUnknown:QueryInterface (in: This=0x5564b08, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.025] IUnknown:QueryInterface (in: This=0x5564b08, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.025] IUnknown:QueryInterface (in: This=0x5564b08, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5564b0c) returned 0x0 [0235.025] IMarshal:GetUnmarshalClass (in: This=0x5564b0c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.025] IUnknown:Release (This=0x5564b0c) returned 0x3 [0235.025] CoGetContextToken (in: pToken=0x19e178 | out: pToken=0x19e178) returned 0x0 [0235.025] CoGetContextToken (in: pToken=0x19e580 | out: pToken=0x19e580) returned 0x0 [0235.025] IUnknown:QueryInterface (in: This=0x5564b08, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.025] IUnknown:Release (This=0x5564b08) returned 0x2 [0235.025] CoGetContextToken (in: pToken=0x19eb50 | out: pToken=0x19eb50) returned 0x0 [0235.026] CoGetContextToken (in: pToken=0x19eab0 | out: pToken=0x19eab0) returned 0x0 [0235.026] IUnknown:QueryInterface (in: This=0x5564b08, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5564b08) returned 0x0 [0235.026] IUnknown:AddRef (This=0x5564b08) returned 0x4 [0235.026] IUnknown:Release (This=0x5564b08) returned 0x3 [0235.026] IUnknown:Release (This=0x5564b08) returned 0x2 [0235.026] CoTaskMemFree (pv=0x58e7e8) [0235.026] CoGetContextToken (in: pToken=0x19eeb8 | out: pToken=0x19eeb8) returned 0x0 [0235.026] IUnknown:AddRef (This=0x5564b08) returned 0x3 [0235.026] IWbemClassObject:Get (in: This=0x5564b08, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.026] IWbemClassObject:Get (in: This=0x5564b08, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4276\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.026] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4276\"") returned 0x5e [0235.026] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4276\"") returned 0x5e [0235.026] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.026] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.026] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.027] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.027] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.028] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519538) returned 0x0 [0235.028] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x519538, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519538) returned 0x0 [0235.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x519538, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x519538, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.028] WbemDefPath:IUnknown:AddRef (This=0x519538) returned 0x3 [0235.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x519538, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x519538, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x519538, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x55674b0) returned 0x0 [0235.028] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x55674b0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.028] WbemDefPath:IUnknown:Release (This=0x55674b0) returned 0x3 [0235.028] WbemDefPath:IUnknown:QueryInterface (in: This=0x519538, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.028] WbemDefPath:IUnknown:Release (This=0x519538) returned 0x2 [0235.028] WbemDefPath:IUnknown:Release (This=0x519538) returned 0x1 [0235.029] WbemDefPath:IUnknown:QueryInterface (in: This=0x519538, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519538) returned 0x0 [0235.029] WbemDefPath:IUnknown:AddRef (This=0x519538) returned 0x3 [0235.029] WbemDefPath:IUnknown:Release (This=0x519538) returned 0x2 [0235.029] WbemDefPath:IWbemPath:SetText (This=0x519538, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4276\"") returned 0x0 [0235.029] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.029] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.029] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.029] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.029] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.029] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.029] IWbemClassObject:Get (in: This=0x5564b08, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ebc18*=0, plFlavor=0x23ebc1c*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="understand.exe", varVal2=0x0), pType=0x23ebc18*=8, plFlavor=0x23ebc1c*=0) returned 0x0 [0235.029] SysStringByteLen (bstr="understand.exe") returned 0x1c [0235.029] SysStringByteLen (bstr="understand.exe") returned 0x1c [0235.029] IWbemClassObject:Get (in: This=0x5564b08, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ebc18*=8, plFlavor=0x23ebc1c*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="understand.exe", varVal2=0x0), pType=0x23ebc18*=8, plFlavor=0x23ebc1c*=0) returned 0x0 [0235.029] SysStringByteLen (bstr="understand.exe") returned 0x1c [0235.029] SysStringByteLen (bstr="understand.exe") returned 0x1c [0235.030] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.030] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5563fe0, puReturned=0x23de044*=0x1) returned 0x0 [0235.031] IUnknown:QueryInterface (in: This=0x5563fe0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5563fe0) returned 0x0 [0235.031] IUnknown:QueryInterface (in: This=0x5563fe0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.031] IUnknown:QueryInterface (in: This=0x5563fe0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.031] IUnknown:QueryInterface (in: This=0x5563fe0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.031] IUnknown:AddRef (This=0x5563fe0) returned 0x3 [0235.031] IUnknown:QueryInterface (in: This=0x5563fe0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.032] IUnknown:QueryInterface (in: This=0x5563fe0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.032] IUnknown:QueryInterface (in: This=0x5563fe0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5563fe4) returned 0x0 [0235.032] IMarshal:GetUnmarshalClass (in: This=0x5563fe4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.032] IUnknown:Release (This=0x5563fe4) returned 0x3 [0235.032] IUnknown:QueryInterface (in: This=0x5563fe0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.032] IUnknown:Release (This=0x5563fe0) returned 0x2 [0235.032] IUnknown:QueryInterface (in: This=0x5563fe0, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5563fe0) returned 0x0 [0235.032] IUnknown:AddRef (This=0x5563fe0) returned 0x4 [0235.032] IUnknown:Release (This=0x5563fe0) returned 0x3 [0235.032] IUnknown:Release (This=0x5563fe0) returned 0x2 [0235.032] CoTaskMemFree (pv=0x58e7e8) [0235.032] IUnknown:AddRef (This=0x5563fe0) returned 0x3 [0235.032] IWbemClassObject:Get (in: This=0x5563fe0, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.033] IWbemClassObject:Get (in: This=0x5563fe0, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4284\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.033] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4284\"") returned 0x5e [0235.033] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4284\"") returned 0x5e [0235.033] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.033] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.033] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.033] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.034] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6b8) returned 0x0 [0235.034] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.034] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5195a8) returned 0x0 [0235.034] WbemDefPath:IUnknown:Release (This=0x58e6b8) returned 0x0 [0235.034] WbemDefPath:IUnknown:QueryInterface (in: This=0x5195a8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x5195a8) returned 0x0 [0235.034] WbemDefPath:IUnknown:QueryInterface (in: This=0x5195a8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.034] WbemDefPath:IUnknown:QueryInterface (in: This=0x5195a8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.035] WbemDefPath:IUnknown:AddRef (This=0x5195a8) returned 0x3 [0235.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x5195a8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x5195a8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x5195a8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5566598) returned 0x0 [0235.035] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5566598, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.035] WbemDefPath:IUnknown:Release (This=0x5566598) returned 0x3 [0235.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x5195a8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.035] WbemDefPath:IUnknown:Release (This=0x5195a8) returned 0x2 [0235.035] WbemDefPath:IUnknown:Release (This=0x5195a8) returned 0x1 [0235.035] WbemDefPath:IUnknown:QueryInterface (in: This=0x5195a8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x5195a8) returned 0x0 [0235.035] WbemDefPath:IUnknown:AddRef (This=0x5195a8) returned 0x3 [0235.035] WbemDefPath:IUnknown:Release (This=0x5195a8) returned 0x2 [0235.035] WbemDefPath:IWbemPath:SetText (This=0x5195a8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4284\"") returned 0x0 [0235.036] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.036] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.036] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.036] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.036] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.036] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.036] IWbemClassObject:Get (in: This=0x5563fe0, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ec48c*=0, plFlavor=0x23ec490*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="despite.exe", varVal2=0x0), pType=0x23ec48c*=8, plFlavor=0x23ec490*=0) returned 0x0 [0235.036] SysStringByteLen (bstr="despite.exe") returned 0x16 [0235.036] SysStringByteLen (bstr="despite.exe") returned 0x16 [0235.036] IWbemClassObject:Get (in: This=0x5563fe0, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ec48c*=8, plFlavor=0x23ec490*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="despite.exe", varVal2=0x0), pType=0x23ec48c*=8, plFlavor=0x23ec490*=0) returned 0x0 [0235.036] SysStringByteLen (bstr="despite.exe") returned 0x16 [0235.036] SysStringByteLen (bstr="despite.exe") returned 0x16 [0235.036] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.036] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x55644a8, puReturned=0x23de044*=0x1) returned 0x0 [0235.038] IUnknown:QueryInterface (in: This=0x55644a8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x55644a8) returned 0x0 [0235.038] IUnknown:QueryInterface (in: This=0x55644a8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.038] IUnknown:QueryInterface (in: This=0x55644a8, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.038] IUnknown:QueryInterface (in: This=0x55644a8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.038] IUnknown:AddRef (This=0x55644a8) returned 0x3 [0235.038] IUnknown:QueryInterface (in: This=0x55644a8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.038] IUnknown:QueryInterface (in: This=0x55644a8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.038] IUnknown:QueryInterface (in: This=0x55644a8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x55644ac) returned 0x0 [0235.039] IMarshal:GetUnmarshalClass (in: This=0x55644ac, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.039] IUnknown:Release (This=0x55644ac) returned 0x3 [0235.039] IUnknown:QueryInterface (in: This=0x55644a8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.039] IUnknown:Release (This=0x55644a8) returned 0x2 [0235.039] IUnknown:QueryInterface (in: This=0x55644a8, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x55644a8) returned 0x0 [0235.039] IUnknown:AddRef (This=0x55644a8) returned 0x4 [0235.039] IUnknown:Release (This=0x55644a8) returned 0x3 [0235.039] IUnknown:Release (This=0x55644a8) returned 0x2 [0235.039] CoTaskMemFree (pv=0x58e7e8) [0235.039] IUnknown:AddRef (This=0x55644a8) returned 0x3 [0235.039] IWbemClassObject:Get (in: This=0x55644a8, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.039] IWbemClassObject:Get (in: This=0x55644a8, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4300\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.039] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4300\"") returned 0x5e [0235.039] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4300\"") returned 0x5e [0235.040] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.040] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.040] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.040] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.040] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e658) returned 0x0 [0235.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e658, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.041] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e658, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519618) returned 0x0 [0235.041] WbemDefPath:IUnknown:Release (This=0x58e658) returned 0x0 [0235.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x519618, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519618) returned 0x0 [0235.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x519618, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x519618, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.041] WbemDefPath:IUnknown:AddRef (This=0x519618) returned 0x3 [0235.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x519618, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x519618, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.041] WbemDefPath:IUnknown:QueryInterface (in: This=0x519618, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x55668e0) returned 0x0 [0235.041] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x55668e0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.041] WbemDefPath:IUnknown:Release (This=0x55668e0) returned 0x3 [0235.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x519618, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.042] WbemDefPath:IUnknown:Release (This=0x519618) returned 0x2 [0235.042] WbemDefPath:IUnknown:Release (This=0x519618) returned 0x1 [0235.042] WbemDefPath:IUnknown:QueryInterface (in: This=0x519618, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519618) returned 0x0 [0235.042] WbemDefPath:IUnknown:AddRef (This=0x519618) returned 0x3 [0235.042] WbemDefPath:IUnknown:Release (This=0x519618) returned 0x2 [0235.042] WbemDefPath:IWbemPath:SetText (This=0x519618, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4300\"") returned 0x0 [0235.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.042] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.042] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.042] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.042] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.042] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.042] IWbemClassObject:Get (in: This=0x55644a8, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23eccf0*=0, plFlavor=0x23eccf4*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="first hot son.exe", varVal2=0x0), pType=0x23eccf0*=8, plFlavor=0x23eccf4*=0) returned 0x0 [0235.042] SysStringByteLen (bstr="first hot son.exe") returned 0x22 [0235.042] SysStringByteLen (bstr="first hot son.exe") returned 0x22 [0235.042] IWbemClassObject:Get (in: This=0x55644a8, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23eccf0*=8, plFlavor=0x23eccf4*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="first hot son.exe", varVal2=0x0), pType=0x23eccf0*=8, plFlavor=0x23eccf4*=0) returned 0x0 [0235.043] SysStringByteLen (bstr="first hot son.exe") returned 0x22 [0235.043] SysStringByteLen (bstr="first hot son.exe") returned 0x22 [0235.043] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0235.043] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x55647d8, puReturned=0x23de044*=0x1) returned 0x0 [0235.044] IUnknown:QueryInterface (in: This=0x55647d8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x55647d8) returned 0x0 [0235.044] IUnknown:QueryInterface (in: This=0x55647d8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.044] IUnknown:QueryInterface (in: This=0x55647d8, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.045] IUnknown:QueryInterface (in: This=0x55647d8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.045] IUnknown:AddRef (This=0x55647d8) returned 0x3 [0235.045] IUnknown:QueryInterface (in: This=0x55647d8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.045] IUnknown:QueryInterface (in: This=0x55647d8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.045] IUnknown:QueryInterface (in: This=0x55647d8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x55647dc) returned 0x0 [0235.045] IMarshal:GetUnmarshalClass (in: This=0x55647dc, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.045] IUnknown:Release (This=0x55647dc) returned 0x3 [0235.045] IUnknown:QueryInterface (in: This=0x55647d8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.045] IUnknown:Release (This=0x55647d8) returned 0x2 [0235.045] IUnknown:QueryInterface (in: This=0x55647d8, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x55647d8) returned 0x0 [0235.045] IUnknown:AddRef (This=0x55647d8) returned 0x4 [0235.045] IUnknown:Release (This=0x55647d8) returned 0x3 [0235.045] IUnknown:Release (This=0x55647d8) returned 0x2 [0235.046] CoTaskMemFree (pv=0x58e6f8) [0235.046] IUnknown:AddRef (This=0x55647d8) returned 0x3 [0235.046] IWbemClassObject:Get (in: This=0x55647d8, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.046] IWbemClassObject:Get (in: This=0x55647d8, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4308\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.046] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4308\"") returned 0x5e [0235.046] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4308\"") returned 0x5e [0235.046] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.046] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.046] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.046] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.047] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6f8) returned 0x0 [0235.047] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6f8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.047] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6f8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519ca8) returned 0x0 [0235.048] WbemDefPath:IUnknown:Release (This=0x58e6f8) returned 0x0 [0235.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ca8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519ca8) returned 0x0 [0235.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ca8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ca8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.048] WbemDefPath:IUnknown:AddRef (This=0x519ca8) returned 0x3 [0235.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ca8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ca8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ca8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5566970) returned 0x0 [0235.048] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5566970, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.048] WbemDefPath:IUnknown:Release (This=0x5566970) returned 0x3 [0235.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ca8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.048] WbemDefPath:IUnknown:Release (This=0x519ca8) returned 0x2 [0235.048] WbemDefPath:IUnknown:Release (This=0x519ca8) returned 0x1 [0235.048] WbemDefPath:IUnknown:QueryInterface (in: This=0x519ca8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519ca8) returned 0x0 [0235.049] WbemDefPath:IUnknown:AddRef (This=0x519ca8) returned 0x3 [0235.049] WbemDefPath:IUnknown:Release (This=0x519ca8) returned 0x2 [0235.049] WbemDefPath:IWbemPath:SetText (This=0x519ca8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4308\"") returned 0x0 [0235.049] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.049] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.049] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.049] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.049] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.049] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.049] IWbemClassObject:Get (in: This=0x55647d8, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ed56c*=0, plFlavor=0x23ed570*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="energy-war.exe", varVal2=0x0), pType=0x23ed56c*=8, plFlavor=0x23ed570*=0) returned 0x0 [0235.049] SysStringByteLen (bstr="energy-war.exe") returned 0x1c [0235.049] SysStringByteLen (bstr="energy-war.exe") returned 0x1c [0235.049] IWbemClassObject:Get (in: This=0x55647d8, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ed56c*=8, plFlavor=0x23ed570*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="energy-war.exe", varVal2=0x0), pType=0x23ed56c*=8, plFlavor=0x23ed570*=0) returned 0x0 [0235.049] SysStringByteLen (bstr="energy-war.exe") returned 0x1c [0235.049] SysStringByteLen (bstr="energy-war.exe") returned 0x1c [0235.049] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.050] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5565e28, puReturned=0x23de044*=0x1) returned 0x0 [0235.051] IUnknown:QueryInterface (in: This=0x5565e28, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5565e28) returned 0x0 [0235.051] IUnknown:QueryInterface (in: This=0x5565e28, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.051] IUnknown:QueryInterface (in: This=0x5565e28, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.051] IUnknown:QueryInterface (in: This=0x5565e28, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.052] IUnknown:AddRef (This=0x5565e28) returned 0x3 [0235.052] IUnknown:QueryInterface (in: This=0x5565e28, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.052] IUnknown:QueryInterface (in: This=0x5565e28, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.052] IUnknown:QueryInterface (in: This=0x5565e28, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5565e2c) returned 0x0 [0235.053] IMarshal:GetUnmarshalClass (in: This=0x5565e2c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.053] IUnknown:Release (This=0x5565e2c) returned 0x3 [0235.053] IUnknown:QueryInterface (in: This=0x5565e28, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.053] IUnknown:Release (This=0x5565e28) returned 0x2 [0235.053] IUnknown:QueryInterface (in: This=0x5565e28, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5565e28) returned 0x0 [0235.053] IUnknown:AddRef (This=0x5565e28) returned 0x4 [0235.053] IUnknown:Release (This=0x5565e28) returned 0x3 [0235.053] IUnknown:Release (This=0x5565e28) returned 0x2 [0235.053] CoTaskMemFree (pv=0x58e7e8) [0235.053] IUnknown:AddRef (This=0x5565e28) returned 0x3 [0235.053] IWbemClassObject:Get (in: This=0x5565e28, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.053] IWbemClassObject:Get (in: This=0x5565e28, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4324\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.053] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4324\"") returned 0x5e [0235.054] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4324\"") returned 0x5e [0235.054] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.054] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.054] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.054] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.055] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.055] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519d18) returned 0x0 [0235.055] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d18, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519d18) returned 0x0 [0235.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d18, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d18, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.055] WbemDefPath:IUnknown:AddRef (This=0x519d18) returned 0x3 [0235.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d18, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.055] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d18, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d18, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5566d30) returned 0x0 [0235.056] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5566d30, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.056] WbemDefPath:IUnknown:Release (This=0x5566d30) returned 0x3 [0235.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d18, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.056] WbemDefPath:IUnknown:Release (This=0x519d18) returned 0x2 [0235.056] WbemDefPath:IUnknown:Release (This=0x519d18) returned 0x1 [0235.056] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d18, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519d18) returned 0x0 [0235.056] WbemDefPath:IUnknown:AddRef (This=0x519d18) returned 0x3 [0235.056] WbemDefPath:IUnknown:Release (This=0x519d18) returned 0x2 [0235.056] WbemDefPath:IWbemPath:SetText (This=0x519d18, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4324\"") returned 0x0 [0235.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.056] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.056] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.056] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.056] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.056] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.056] IWbemClassObject:Get (in: This=0x5565e28, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23edde0*=0, plFlavor=0x23edde4*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="middle_dead.exe", varVal2=0x0), pType=0x23edde0*=8, plFlavor=0x23edde4*=0) returned 0x0 [0235.057] SysStringByteLen (bstr="middle_dead.exe") returned 0x1e [0235.057] SysStringByteLen (bstr="middle_dead.exe") returned 0x1e [0235.057] IWbemClassObject:Get (in: This=0x5565e28, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23edde0*=8, plFlavor=0x23edde4*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="middle_dead.exe", varVal2=0x0), pType=0x23edde0*=8, plFlavor=0x23edde4*=0) returned 0x0 [0235.057] SysStringByteLen (bstr="middle_dead.exe") returned 0x1e [0235.057] SysStringByteLen (bstr="middle_dead.exe") returned 0x1e [0235.057] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.057] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5564e38, puReturned=0x23de044*=0x1) returned 0x0 [0235.059] IUnknown:QueryInterface (in: This=0x5564e38, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5564e38) returned 0x0 [0235.059] IUnknown:QueryInterface (in: This=0x5564e38, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.060] IUnknown:QueryInterface (in: This=0x5564e38, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.060] IUnknown:QueryInterface (in: This=0x5564e38, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.060] IUnknown:AddRef (This=0x5564e38) returned 0x3 [0235.060] IUnknown:QueryInterface (in: This=0x5564e38, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.060] IUnknown:QueryInterface (in: This=0x5564e38, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.060] IUnknown:QueryInterface (in: This=0x5564e38, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5564e3c) returned 0x0 [0235.060] IMarshal:GetUnmarshalClass (in: This=0x5564e3c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.060] IUnknown:Release (This=0x5564e3c) returned 0x3 [0235.060] IUnknown:QueryInterface (in: This=0x5564e38, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.060] IUnknown:Release (This=0x5564e38) returned 0x2 [0235.060] IUnknown:QueryInterface (in: This=0x5564e38, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5564e38) returned 0x0 [0235.060] IUnknown:AddRef (This=0x5564e38) returned 0x4 [0235.060] IUnknown:Release (This=0x5564e38) returned 0x3 [0235.060] IUnknown:Release (This=0x5564e38) returned 0x2 [0235.060] CoTaskMemFree (pv=0x58e7e8) [0235.060] IUnknown:AddRef (This=0x5564e38) returned 0x3 [0235.061] IWbemClassObject:Get (in: This=0x5564e38, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.061] IWbemClassObject:Get (in: This=0x5564e38, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4332\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.061] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4332\"") returned 0x5e [0235.061] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4332\"") returned 0x5e [0235.061] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.061] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.061] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.061] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.062] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.062] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519d88) returned 0x0 [0235.062] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d88, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519d88) returned 0x0 [0235.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d88, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.062] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d88, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.063] WbemDefPath:IUnknown:AddRef (This=0x519d88) returned 0x3 [0235.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d88, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d88, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d88, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5566e20) returned 0x0 [0235.063] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5566e20, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.063] WbemDefPath:IUnknown:Release (This=0x5566e20) returned 0x3 [0235.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d88, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.063] WbemDefPath:IUnknown:Release (This=0x519d88) returned 0x2 [0235.063] WbemDefPath:IUnknown:Release (This=0x519d88) returned 0x1 [0235.063] WbemDefPath:IUnknown:QueryInterface (in: This=0x519d88, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519d88) returned 0x0 [0235.063] WbemDefPath:IUnknown:AddRef (This=0x519d88) returned 0x3 [0235.063] WbemDefPath:IUnknown:Release (This=0x519d88) returned 0x2 [0235.063] WbemDefPath:IWbemPath:SetText (This=0x519d88, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4332\"") returned 0x0 [0235.063] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.063] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.063] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.063] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.064] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.064] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.064] IWbemClassObject:Get (in: This=0x5564e38, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ee654*=0, plFlavor=0x23ee658*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="conference-may.exe", varVal2=0x0), pType=0x23ee654*=8, plFlavor=0x23ee658*=0) returned 0x0 [0235.064] SysStringByteLen (bstr="conference-may.exe") returned 0x24 [0235.064] SysStringByteLen (bstr="conference-may.exe") returned 0x24 [0235.064] IWbemClassObject:Get (in: This=0x5564e38, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ee654*=8, plFlavor=0x23ee658*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="conference-may.exe", varVal2=0x0), pType=0x23ee654*=8, plFlavor=0x23ee658*=0) returned 0x0 [0235.064] SysStringByteLen (bstr="conference-may.exe") returned 0x24 [0235.064] SysStringByteLen (bstr="conference-may.exe") returned 0x24 [0235.064] CoTaskMemAlloc (cb=0x4) returned 0x58e818 [0235.064] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e818, puReturned=0x23de044 | out: apObjects=0x58e818*=0x5564fd0, puReturned=0x23de044*=0x1) returned 0x0 [0235.066] IUnknown:QueryInterface (in: This=0x5564fd0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5564fd0) returned 0x0 [0235.066] IUnknown:QueryInterface (in: This=0x5564fd0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.066] IUnknown:QueryInterface (in: This=0x5564fd0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.066] IUnknown:QueryInterface (in: This=0x5564fd0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.066] IUnknown:AddRef (This=0x5564fd0) returned 0x3 [0235.066] IUnknown:QueryInterface (in: This=0x5564fd0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.066] IUnknown:QueryInterface (in: This=0x5564fd0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.066] IUnknown:QueryInterface (in: This=0x5564fd0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5564fd4) returned 0x0 [0235.066] IMarshal:GetUnmarshalClass (in: This=0x5564fd4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.066] IUnknown:Release (This=0x5564fd4) returned 0x3 [0235.066] IUnknown:QueryInterface (in: This=0x5564fd0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.066] IUnknown:Release (This=0x5564fd0) returned 0x2 [0235.067] IUnknown:QueryInterface (in: This=0x5564fd0, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5564fd0) returned 0x0 [0235.067] IUnknown:AddRef (This=0x5564fd0) returned 0x4 [0235.067] IUnknown:Release (This=0x5564fd0) returned 0x3 [0235.067] IUnknown:Release (This=0x5564fd0) returned 0x2 [0235.067] CoTaskMemFree (pv=0x58e818) [0235.067] IUnknown:AddRef (This=0x5564fd0) returned 0x3 [0235.067] IWbemClassObject:Get (in: This=0x5564fd0, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.067] IWbemClassObject:Get (in: This=0x5564fd0, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4356\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.067] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4356\"") returned 0x5e [0235.067] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4356\"") returned 0x5e [0235.068] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.068] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.068] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.068] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.068] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.069] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x519df8) returned 0x0 [0235.069] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x519df8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x519df8) returned 0x0 [0235.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x519df8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x519df8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.069] WbemDefPath:IUnknown:AddRef (This=0x519df8) returned 0x3 [0235.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x519df8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x519df8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.069] WbemDefPath:IUnknown:QueryInterface (in: This=0x519df8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5567150) returned 0x0 [0235.069] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5567150, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.069] WbemDefPath:IUnknown:Release (This=0x5567150) returned 0x3 [0235.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x519df8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.070] WbemDefPath:IUnknown:Release (This=0x519df8) returned 0x2 [0235.070] WbemDefPath:IUnknown:Release (This=0x519df8) returned 0x1 [0235.070] WbemDefPath:IUnknown:QueryInterface (in: This=0x519df8, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x519df8) returned 0x0 [0235.081] WbemDefPath:IUnknown:AddRef (This=0x519df8) returned 0x3 [0235.081] WbemDefPath:IUnknown:Release (This=0x519df8) returned 0x2 [0235.081] WbemDefPath:IWbemPath:SetText (This=0x519df8, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4356\"") returned 0x0 [0235.081] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.081] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.081] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.082] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.082] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.082] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.082] IWbemClassObject:Get (in: This=0x5564fd0, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23eeed8*=0, plFlavor=0x23eeedc*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="middle-book.exe", varVal2=0x0), pType=0x23eeed8*=8, plFlavor=0x23eeedc*=0) returned 0x0 [0235.082] SysStringByteLen (bstr="middle-book.exe") returned 0x1e [0235.082] SysStringByteLen (bstr="middle-book.exe") returned 0x1e [0235.082] IWbemClassObject:Get (in: This=0x5564fd0, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23eeed8*=8, plFlavor=0x23eeedc*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="middle-book.exe", varVal2=0x0), pType=0x23eeed8*=8, plFlavor=0x23eeedc*=0) returned 0x0 [0235.082] SysStringByteLen (bstr="middle-book.exe") returned 0x1e [0235.082] SysStringByteLen (bstr="middle-book.exe") returned 0x1e [0235.082] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.082] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5565630, puReturned=0x23de044*=0x1) returned 0x0 [0235.083] IUnknown:QueryInterface (in: This=0x5565630, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5565630) returned 0x0 [0235.083] IUnknown:QueryInterface (in: This=0x5565630, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.083] IUnknown:QueryInterface (in: This=0x5565630, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.084] IUnknown:QueryInterface (in: This=0x5565630, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.084] IUnknown:AddRef (This=0x5565630) returned 0x3 [0235.084] IUnknown:QueryInterface (in: This=0x5565630, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.084] IUnknown:QueryInterface (in: This=0x5565630, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.084] IUnknown:QueryInterface (in: This=0x5565630, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5565634) returned 0x0 [0235.084] IMarshal:GetUnmarshalClass (in: This=0x5565634, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.084] IUnknown:Release (This=0x5565634) returned 0x3 [0235.084] IUnknown:QueryInterface (in: This=0x5565630, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.084] IUnknown:Release (This=0x5565630) returned 0x2 [0235.084] IUnknown:QueryInterface (in: This=0x5565630, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5565630) returned 0x0 [0235.084] IUnknown:AddRef (This=0x5565630) returned 0x4 [0235.084] IUnknown:Release (This=0x5565630) returned 0x3 [0235.084] IUnknown:Release (This=0x5565630) returned 0x2 [0235.084] CoTaskMemFree (pv=0x58e7e8) [0235.084] IUnknown:AddRef (This=0x5565630) returned 0x3 [0235.085] IWbemClassObject:Get (in: This=0x5565630, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.085] IWbemClassObject:Get (in: This=0x5565630, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.085] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"") returned 0x5e [0235.085] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"") returned 0x5e [0235.085] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.085] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.085] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.085] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.086] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.087] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x524260) returned 0x0 [0235.087] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x524260) returned 0x0 [0235.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.087] WbemDefPath:IUnknown:AddRef (This=0x524260) returned 0x3 [0235.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.087] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5567018) returned 0x0 [0235.087] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5567018, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.088] WbemDefPath:IUnknown:Release (This=0x5567018) returned 0x3 [0235.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.088] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x2 [0235.088] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x1 [0235.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x524260, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x524260) returned 0x0 [0235.088] WbemDefPath:IUnknown:AddRef (This=0x524260) returned 0x3 [0235.088] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x2 [0235.088] WbemDefPath:IWbemPath:SetText (This=0x524260, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4364\"") returned 0x0 [0235.088] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.088] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.088] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.088] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.088] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.088] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.088] IWbemClassObject:Get (in: This=0x5565630, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ef74c*=0, plFlavor=0x23ef750*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="song_role_treat.exe", varVal2=0x0), pType=0x23ef74c*=8, plFlavor=0x23ef750*=0) returned 0x0 [0235.088] SysStringByteLen (bstr="song_role_treat.exe") returned 0x26 [0235.089] SysStringByteLen (bstr="song_role_treat.exe") returned 0x26 [0235.089] IWbemClassObject:Get (in: This=0x5565630, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23ef74c*=8, plFlavor=0x23ef750*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="song_role_treat.exe", varVal2=0x0), pType=0x23ef74c*=8, plFlavor=0x23ef750*=0) returned 0x0 [0235.089] SysStringByteLen (bstr="song_role_treat.exe") returned 0x26 [0235.089] SysStringByteLen (bstr="song_role_treat.exe") returned 0x26 [0235.089] CoTaskMemAlloc (cb=0x4) returned 0x58e6b8 [0235.089] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6b8, puReturned=0x23de044 | out: apObjects=0x58e6b8*=0x5564178, puReturned=0x23de044*=0x1) returned 0x0 [0235.090] IUnknown:QueryInterface (in: This=0x5564178, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5564178) returned 0x0 [0235.090] IUnknown:QueryInterface (in: This=0x5564178, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.090] IUnknown:QueryInterface (in: This=0x5564178, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.090] IUnknown:QueryInterface (in: This=0x5564178, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.090] IUnknown:AddRef (This=0x5564178) returned 0x3 [0235.090] IUnknown:QueryInterface (in: This=0x5564178, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.090] IUnknown:QueryInterface (in: This=0x5564178, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.090] IUnknown:QueryInterface (in: This=0x5564178, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x556417c) returned 0x0 [0235.090] IMarshal:GetUnmarshalClass (in: This=0x556417c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.090] IUnknown:Release (This=0x556417c) returned 0x3 [0235.091] IUnknown:QueryInterface (in: This=0x5564178, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.091] IUnknown:Release (This=0x5564178) returned 0x2 [0235.091] IUnknown:QueryInterface (in: This=0x5564178, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5564178) returned 0x0 [0235.091] IUnknown:AddRef (This=0x5564178) returned 0x4 [0235.091] IUnknown:Release (This=0x5564178) returned 0x3 [0235.091] IUnknown:Release (This=0x5564178) returned 0x2 [0235.091] CoTaskMemFree (pv=0x58e6b8) [0235.091] IUnknown:AddRef (This=0x5564178) returned 0x3 [0235.091] IWbemClassObject:Get (in: This=0x5564178, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.091] IWbemClassObject:Get (in: This=0x5564178, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4376\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.091] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4376\"") returned 0x5e [0235.091] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4376\"") returned 0x5e [0235.091] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.092] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.092] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.092] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.092] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.093] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x524490) returned 0x0 [0235.093] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x524490) returned 0x0 [0235.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.093] WbemDefPath:IUnknown:AddRef (This=0x524490) returned 0x3 [0235.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.093] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x55672e8) returned 0x0 [0235.093] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x55672e8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.094] WbemDefPath:IUnknown:Release (This=0x55672e8) returned 0x3 [0235.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.094] WbemDefPath:IUnknown:Release (This=0x524490) returned 0x2 [0235.094] WbemDefPath:IUnknown:Release (This=0x524490) returned 0x1 [0235.094] WbemDefPath:IUnknown:QueryInterface (in: This=0x524490, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x524490) returned 0x0 [0235.094] WbemDefPath:IUnknown:AddRef (This=0x524490) returned 0x3 [0235.094] WbemDefPath:IUnknown:Release (This=0x524490) returned 0x2 [0235.094] WbemDefPath:IWbemPath:SetText (This=0x524490, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4376\"") returned 0x0 [0235.094] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.096] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.096] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.096] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.097] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.097] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.097] IWbemClassObject:Get (in: This=0x5564178, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23effd0*=0, plFlavor=0x23effd4*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="crime.exe", varVal2=0x0), pType=0x23effd0*=8, plFlavor=0x23effd4*=0) returned 0x0 [0235.097] SysStringByteLen (bstr="crime.exe") returned 0x12 [0235.097] SysStringByteLen (bstr="crime.exe") returned 0x12 [0235.097] IWbemClassObject:Get (in: This=0x5564178, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23effd0*=8, plFlavor=0x23effd4*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="crime.exe", varVal2=0x0), pType=0x23effd0*=8, plFlavor=0x23effd4*=0) returned 0x0 [0235.097] SysStringByteLen (bstr="crime.exe") returned 0x12 [0235.097] SysStringByteLen (bstr="crime.exe") returned 0x12 [0235.097] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0235.097] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x55657c8, puReturned=0x23de044*=0x1) returned 0x0 [0235.098] IUnknown:QueryInterface (in: This=0x55657c8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x55657c8) returned 0x0 [0235.098] IUnknown:QueryInterface (in: This=0x55657c8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.098] IUnknown:QueryInterface (in: This=0x55657c8, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.098] IUnknown:QueryInterface (in: This=0x55657c8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.099] IUnknown:AddRef (This=0x55657c8) returned 0x3 [0235.099] IUnknown:QueryInterface (in: This=0x55657c8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.099] IUnknown:QueryInterface (in: This=0x55657c8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.099] IUnknown:QueryInterface (in: This=0x55657c8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x55657cc) returned 0x0 [0235.099] IMarshal:GetUnmarshalClass (in: This=0x55657cc, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.099] IUnknown:Release (This=0x55657cc) returned 0x3 [0235.099] IUnknown:QueryInterface (in: This=0x55657c8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.100] IUnknown:Release (This=0x55657c8) returned 0x2 [0235.100] IUnknown:QueryInterface (in: This=0x55657c8, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x55657c8) returned 0x0 [0235.100] IUnknown:AddRef (This=0x55657c8) returned 0x4 [0235.100] IUnknown:Release (This=0x55657c8) returned 0x3 [0235.100] IUnknown:Release (This=0x55657c8) returned 0x2 [0235.100] CoTaskMemFree (pv=0x58e6f8) [0235.100] IUnknown:AddRef (This=0x55657c8) returned 0x3 [0235.100] IWbemClassObject:Get (in: This=0x55657c8, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.100] IWbemClassObject:Get (in: This=0x55657c8, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4396\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.100] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4396\"") returned 0x5e [0235.100] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4396\"") returned 0x5e [0235.100] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.100] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.100] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.101] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.101] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e658) returned 0x0 [0235.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e658, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.102] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e658, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5247a0) returned 0x0 [0235.102] WbemDefPath:IUnknown:Release (This=0x58e658) returned 0x0 [0235.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x5247a0) returned 0x0 [0235.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.102] WbemDefPath:IUnknown:AddRef (This=0x5247a0) returned 0x3 [0235.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.102] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x556b8b0) returned 0x0 [0235.102] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x556b8b0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.102] WbemDefPath:IUnknown:Release (This=0x556b8b0) returned 0x3 [0235.103] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.103] WbemDefPath:IUnknown:Release (This=0x5247a0) returned 0x2 [0235.103] WbemDefPath:IUnknown:Release (This=0x5247a0) returned 0x1 [0235.103] WbemDefPath:IUnknown:QueryInterface (in: This=0x5247a0, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x5247a0) returned 0x0 [0235.103] WbemDefPath:IUnknown:AddRef (This=0x5247a0) returned 0x3 [0235.103] WbemDefPath:IUnknown:Release (This=0x5247a0) returned 0x2 [0235.103] WbemDefPath:IWbemPath:SetText (This=0x5247a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4396\"") returned 0x0 [0235.103] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.103] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.103] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.103] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.103] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.103] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.103] IWbemClassObject:Get (in: This=0x55657c8, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f082c*=0, plFlavor=0x23f0830*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sure.exe", varVal2=0x0), pType=0x23f082c*=8, plFlavor=0x23f0830*=0) returned 0x0 [0235.103] SysStringByteLen (bstr="sure.exe") returned 0x10 [0235.103] SysStringByteLen (bstr="sure.exe") returned 0x10 [0235.104] IWbemClassObject:Get (in: This=0x55657c8, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f082c*=8, plFlavor=0x23f0830*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="sure.exe", varVal2=0x0), pType=0x23f082c*=8, plFlavor=0x23f0830*=0) returned 0x0 [0235.104] SysStringByteLen (bstr="sure.exe") returned 0x10 [0235.104] SysStringByteLen (bstr="sure.exe") returned 0x10 [0235.104] CoTaskMemAlloc (cb=0x4) returned 0x58e6b8 [0235.104] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6b8, puReturned=0x23de044 | out: apObjects=0x58e6b8*=0x5564310, puReturned=0x23de044*=0x1) returned 0x0 [0235.104] IUnknown:QueryInterface (in: This=0x5564310, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5564310) returned 0x0 [0235.105] IUnknown:QueryInterface (in: This=0x5564310, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.105] IUnknown:QueryInterface (in: This=0x5564310, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.105] IUnknown:QueryInterface (in: This=0x5564310, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.105] IUnknown:AddRef (This=0x5564310) returned 0x3 [0235.105] IUnknown:QueryInterface (in: This=0x5564310, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.105] IUnknown:QueryInterface (in: This=0x5564310, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.105] IUnknown:QueryInterface (in: This=0x5564310, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5564314) returned 0x0 [0235.105] IMarshal:GetUnmarshalClass (in: This=0x5564314, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.105] IUnknown:Release (This=0x5564314) returned 0x3 [0235.105] IUnknown:QueryInterface (in: This=0x5564310, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.105] IUnknown:Release (This=0x5564310) returned 0x2 [0235.105] IUnknown:QueryInterface (in: This=0x5564310, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5564310) returned 0x0 [0235.105] IUnknown:AddRef (This=0x5564310) returned 0x4 [0235.105] IUnknown:Release (This=0x5564310) returned 0x3 [0235.106] IUnknown:Release (This=0x5564310) returned 0x2 [0235.106] CoTaskMemFree (pv=0x58e6b8) [0235.106] IUnknown:AddRef (This=0x5564310) returned 0x3 [0235.106] IWbemClassObject:Get (in: This=0x5564310, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.106] IWbemClassObject:Get (in: This=0x5564310, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4404\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.106] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4404\"") returned 0x5e [0235.106] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4404\"") returned 0x5e [0235.106] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.106] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.106] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.106] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.107] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.107] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.107] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x524810) returned 0x0 [0235.107] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.107] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x524810) returned 0x0 [0235.107] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.107] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.108] WbemDefPath:IUnknown:AddRef (This=0x524810) returned 0x3 [0235.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x556b970) returned 0x0 [0235.108] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x556b970, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.108] WbemDefPath:IUnknown:Release (This=0x556b970) returned 0x3 [0235.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.108] WbemDefPath:IUnknown:Release (This=0x524810) returned 0x2 [0235.108] WbemDefPath:IUnknown:Release (This=0x524810) returned 0x1 [0235.108] WbemDefPath:IUnknown:QueryInterface (in: This=0x524810, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x524810) returned 0x0 [0235.108] WbemDefPath:IUnknown:AddRef (This=0x524810) returned 0x3 [0235.108] WbemDefPath:IUnknown:Release (This=0x524810) returned 0x2 [0235.108] WbemDefPath:IWbemPath:SetText (This=0x524810, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4404\"") returned 0x0 [0235.109] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.109] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.109] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.109] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.109] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.109] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.109] IWbemClassObject:Get (in: This=0x5564310, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f1088*=0, plFlavor=0x23f108c*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="enjoy.exe", varVal2=0x0), pType=0x23f1088*=8, plFlavor=0x23f108c*=0) returned 0x0 [0235.109] SysStringByteLen (bstr="enjoy.exe") returned 0x12 [0235.110] SysStringByteLen (bstr="enjoy.exe") returned 0x12 [0235.110] IWbemClassObject:Get (in: This=0x5564310, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f1088*=8, plFlavor=0x23f108c*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="enjoy.exe", varVal2=0x0), pType=0x23f1088*=8, plFlavor=0x23f108c*=0) returned 0x0 [0235.110] SysStringByteLen (bstr="enjoy.exe") returned 0x12 [0235.110] SysStringByteLen (bstr="enjoy.exe") returned 0x12 [0235.110] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.110] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5565af8, puReturned=0x23de044*=0x1) returned 0x0 [0235.111] IUnknown:QueryInterface (in: This=0x5565af8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5565af8) returned 0x0 [0235.111] IUnknown:QueryInterface (in: This=0x5565af8, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.111] IUnknown:QueryInterface (in: This=0x5565af8, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.111] IUnknown:QueryInterface (in: This=0x5565af8, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.111] IUnknown:AddRef (This=0x5565af8) returned 0x3 [0235.111] IUnknown:QueryInterface (in: This=0x5565af8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.111] IUnknown:QueryInterface (in: This=0x5565af8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.111] IUnknown:QueryInterface (in: This=0x5565af8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5565afc) returned 0x0 [0235.111] IMarshal:GetUnmarshalClass (in: This=0x5565afc, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.111] IUnknown:Release (This=0x5565afc) returned 0x3 [0235.111] IUnknown:QueryInterface (in: This=0x5565af8, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.111] IUnknown:Release (This=0x5565af8) returned 0x2 [0235.112] IUnknown:QueryInterface (in: This=0x5565af8, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5565af8) returned 0x0 [0235.112] IUnknown:AddRef (This=0x5565af8) returned 0x4 [0235.112] IUnknown:Release (This=0x5565af8) returned 0x3 [0235.112] IUnknown:Release (This=0x5565af8) returned 0x2 [0235.112] CoTaskMemFree (pv=0x58e7e8) [0235.112] IUnknown:AddRef (This=0x5565af8) returned 0x3 [0235.112] IWbemClassObject:Get (in: This=0x5565af8, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.112] IWbemClassObject:Get (in: This=0x5565af8, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4416\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.112] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4416\"") returned 0x5e [0235.112] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4416\"") returned 0x5e [0235.112] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.112] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.112] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.112] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.113] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e658) returned 0x0 [0235.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e658, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.115] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e658, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e840) returned 0x0 [0235.115] WbemDefPath:IUnknown:Release (This=0x58e658) returned 0x0 [0235.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e840, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556e840) returned 0x0 [0235.115] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e840, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e840, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.116] WbemDefPath:IUnknown:AddRef (This=0x556e840) returned 0x3 [0235.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e840, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e840, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e840, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x556bc58) returned 0x0 [0235.116] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x556bc58, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.116] WbemDefPath:IUnknown:Release (This=0x556bc58) returned 0x3 [0235.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e840, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.116] WbemDefPath:IUnknown:Release (This=0x556e840) returned 0x2 [0235.116] WbemDefPath:IUnknown:Release (This=0x556e840) returned 0x1 [0235.116] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e840, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556e840) returned 0x0 [0235.117] WbemDefPath:IUnknown:AddRef (This=0x556e840) returned 0x3 [0235.117] WbemDefPath:IUnknown:Release (This=0x556e840) returned 0x2 [0235.117] WbemDefPath:IWbemPath:SetText (This=0x556e840, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4416\"") returned 0x0 [0235.117] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.117] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.117] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.117] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.117] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.117] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.117] IWbemClassObject:Get (in: This=0x5565af8, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f18e4*=0, plFlavor=0x23f18e8*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="what-scientist-win.exe", varVal2=0x0), pType=0x23f18e4*=8, plFlavor=0x23f18e8*=0) returned 0x0 [0235.117] SysStringByteLen (bstr="what-scientist-win.exe") returned 0x2c [0235.117] SysStringByteLen (bstr="what-scientist-win.exe") returned 0x2c [0235.117] IWbemClassObject:Get (in: This=0x5565af8, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f18e4*=8, plFlavor=0x23f18e8*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="what-scientist-win.exe", varVal2=0x0), pType=0x23f18e4*=8, plFlavor=0x23f18e8*=0) returned 0x0 [0235.118] SysStringByteLen (bstr="what-scientist-win.exe") returned 0x2c [0235.118] SysStringByteLen (bstr="what-scientist-win.exe") returned 0x2c [0235.118] CoTaskMemAlloc (cb=0x4) returned 0x58e6b8 [0235.118] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6b8, puReturned=0x23de044 | out: apObjects=0x58e6b8*=0x5564640, puReturned=0x23de044*=0x1) returned 0x0 [0235.118] IUnknown:QueryInterface (in: This=0x5564640, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5564640) returned 0x0 [0235.118] IUnknown:QueryInterface (in: This=0x5564640, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.119] IUnknown:QueryInterface (in: This=0x5564640, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.119] IUnknown:QueryInterface (in: This=0x5564640, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.119] IUnknown:AddRef (This=0x5564640) returned 0x3 [0235.119] IUnknown:QueryInterface (in: This=0x5564640, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.119] IUnknown:QueryInterface (in: This=0x5564640, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.119] IUnknown:QueryInterface (in: This=0x5564640, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5564644) returned 0x0 [0235.119] IMarshal:GetUnmarshalClass (in: This=0x5564644, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.119] IUnknown:Release (This=0x5564644) returned 0x3 [0235.119] IUnknown:QueryInterface (in: This=0x5564640, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.119] IUnknown:Release (This=0x5564640) returned 0x2 [0235.119] IUnknown:QueryInterface (in: This=0x5564640, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5564640) returned 0x0 [0235.119] IUnknown:AddRef (This=0x5564640) returned 0x4 [0235.119] IUnknown:Release (This=0x5564640) returned 0x3 [0235.119] IUnknown:Release (This=0x5564640) returned 0x2 [0235.119] CoTaskMemFree (pv=0x58e6b8) [0235.119] IUnknown:AddRef (This=0x5564640) returned 0x3 [0235.120] IWbemClassObject:Get (in: This=0x5564640, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.120] IWbemClassObject:Get (in: This=0x5564640, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4436\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.120] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4436\"") returned 0x5e [0235.120] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4436\"") returned 0x5e [0235.120] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.120] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.120] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.120] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.121] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.121] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556eb50) returned 0x0 [0235.121] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eb50, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556eb50) returned 0x0 [0235.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eb50, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.121] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eb50, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.122] WbemDefPath:IUnknown:AddRef (This=0x556eb50) returned 0x3 [0235.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eb50, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eb50, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eb50, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x556bd00) returned 0x0 [0235.122] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x556bd00, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.122] WbemDefPath:IUnknown:Release (This=0x556bd00) returned 0x3 [0235.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eb50, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.122] WbemDefPath:IUnknown:Release (This=0x556eb50) returned 0x2 [0235.122] WbemDefPath:IUnknown:Release (This=0x556eb50) returned 0x1 [0235.122] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eb50, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556eb50) returned 0x0 [0235.122] WbemDefPath:IUnknown:AddRef (This=0x556eb50) returned 0x3 [0235.122] WbemDefPath:IUnknown:Release (This=0x556eb50) returned 0x2 [0235.122] WbemDefPath:IWbemPath:SetText (This=0x556eb50, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4436\"") returned 0x0 [0235.122] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.122] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.122] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.122] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.123] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.123] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.123] IWbemClassObject:Get (in: This=0x5564640, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f2178*=0, plFlavor=0x23f217c*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="subject.exe", varVal2=0x0), pType=0x23f2178*=8, plFlavor=0x23f217c*=0) returned 0x0 [0235.123] SysStringByteLen (bstr="subject.exe") returned 0x16 [0235.123] SysStringByteLen (bstr="subject.exe") returned 0x16 [0235.123] IWbemClassObject:Get (in: This=0x5564640, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f2178*=8, plFlavor=0x23f217c*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="subject.exe", varVal2=0x0), pType=0x23f2178*=8, plFlavor=0x23f217c*=0) returned 0x0 [0235.123] SysStringByteLen (bstr="subject.exe") returned 0x16 [0235.123] SysStringByteLen (bstr="subject.exe") returned 0x16 [0235.123] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0235.123] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x5564970, puReturned=0x23de044*=0x1) returned 0x0 [0235.155] IUnknown:QueryInterface (in: This=0x5564970, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5564970) returned 0x0 [0235.156] IUnknown:QueryInterface (in: This=0x5564970, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.156] IUnknown:QueryInterface (in: This=0x5564970, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.156] IUnknown:QueryInterface (in: This=0x5564970, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.156] IUnknown:AddRef (This=0x5564970) returned 0x3 [0235.156] IUnknown:QueryInterface (in: This=0x5564970, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.156] IUnknown:QueryInterface (in: This=0x5564970, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.156] IUnknown:QueryInterface (in: This=0x5564970, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5564974) returned 0x0 [0235.156] IMarshal:GetUnmarshalClass (in: This=0x5564974, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.156] IUnknown:Release (This=0x5564974) returned 0x3 [0235.156] IUnknown:QueryInterface (in: This=0x5564970, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.156] IUnknown:Release (This=0x5564970) returned 0x2 [0235.156] IUnknown:QueryInterface (in: This=0x5564970, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5564970) returned 0x0 [0235.157] IUnknown:AddRef (This=0x5564970) returned 0x4 [0235.157] IUnknown:Release (This=0x5564970) returned 0x3 [0235.157] IUnknown:Release (This=0x5564970) returned 0x2 [0235.157] CoTaskMemFree (pv=0x58e6f8) [0235.157] IUnknown:AddRef (This=0x5564970) returned 0x3 [0235.157] IWbemClassObject:Get (in: This=0x5564970, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.157] IWbemClassObject:Get (in: This=0x5564970, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4452\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.157] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4452\"") returned 0x5e [0235.157] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4452\"") returned 0x5e [0235.157] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.158] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.158] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.158] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.160] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e658) returned 0x0 [0235.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e658, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.160] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e658, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e220) returned 0x0 [0235.160] WbemDefPath:IUnknown:Release (This=0x58e658) returned 0x0 [0235.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e220, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556e220) returned 0x0 [0235.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e220, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e220, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.160] WbemDefPath:IUnknown:AddRef (This=0x556e220) returned 0x3 [0235.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e220, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.160] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e220, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e220, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x556c018) returned 0x0 [0235.161] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x556c018, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.161] WbemDefPath:IUnknown:Release (This=0x556c018) returned 0x3 [0235.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e220, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.161] WbemDefPath:IUnknown:Release (This=0x556e220) returned 0x2 [0235.161] WbemDefPath:IUnknown:Release (This=0x556e220) returned 0x1 [0235.161] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e220, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556e220) returned 0x0 [0235.161] WbemDefPath:IUnknown:AddRef (This=0x556e220) returned 0x3 [0235.161] WbemDefPath:IUnknown:Release (This=0x556e220) returned 0x2 [0235.161] WbemDefPath:IWbemPath:SetText (This=0x556e220, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4452\"") returned 0x0 [0235.161] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.161] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.162] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.162] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.162] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.162] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.162] IWbemClassObject:Get (in: This=0x5564970, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f29dc*=0, plFlavor=0x23f29e0*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="utg2.exe", varVal2=0x0), pType=0x23f29dc*=8, plFlavor=0x23f29e0*=0) returned 0x0 [0235.162] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0235.162] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0235.162] IWbemClassObject:Get (in: This=0x5564970, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f29dc*=8, plFlavor=0x23f29e0*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="utg2.exe", varVal2=0x0), pType=0x23f29dc*=8, plFlavor=0x23f29e0*=0) returned 0x0 [0235.162] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0235.162] SysStringByteLen (bstr="utg2.exe") returned 0x10 [0235.162] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.162] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5564ca0, puReturned=0x23de044*=0x1) returned 0x0 [0235.164] IUnknown:QueryInterface (in: This=0x5564ca0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5564ca0) returned 0x0 [0235.164] IUnknown:QueryInterface (in: This=0x5564ca0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.164] IUnknown:QueryInterface (in: This=0x5564ca0, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.164] IUnknown:QueryInterface (in: This=0x5564ca0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.164] IUnknown:AddRef (This=0x5564ca0) returned 0x3 [0235.165] IUnknown:QueryInterface (in: This=0x5564ca0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.165] IUnknown:QueryInterface (in: This=0x5564ca0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.165] IUnknown:QueryInterface (in: This=0x5564ca0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5564ca4) returned 0x0 [0235.165] IMarshal:GetUnmarshalClass (in: This=0x5564ca4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.165] IUnknown:Release (This=0x5564ca4) returned 0x3 [0235.165] IUnknown:QueryInterface (in: This=0x5564ca0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.165] IUnknown:Release (This=0x5564ca0) returned 0x2 [0235.165] IUnknown:QueryInterface (in: This=0x5564ca0, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5564ca0) returned 0x0 [0235.165] IUnknown:AddRef (This=0x5564ca0) returned 0x4 [0235.165] IUnknown:Release (This=0x5564ca0) returned 0x3 [0235.165] IUnknown:Release (This=0x5564ca0) returned 0x2 [0235.165] CoTaskMemFree (pv=0x58e7e8) [0235.165] IUnknown:AddRef (This=0x5564ca0) returned 0x3 [0235.165] IWbemClassObject:Get (in: This=0x5564ca0, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.165] IWbemClassObject:Get (in: This=0x5564ca0, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4460\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.166] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4460\"") returned 0x5e [0235.166] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4460\"") returned 0x5e [0235.166] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.166] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.166] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.166] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.167] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.168] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e370) returned 0x0 [0235.168] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e370, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556e370) returned 0x0 [0235.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e370, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e370, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.168] WbemDefPath:IUnknown:AddRef (This=0x556e370) returned 0x3 [0235.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e370, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e370, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.168] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e370, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x556c180) returned 0x0 [0235.168] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x556c180, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.168] WbemDefPath:IUnknown:Release (This=0x556c180) returned 0x3 [0235.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e370, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.169] WbemDefPath:IUnknown:Release (This=0x556e370) returned 0x2 [0235.169] WbemDefPath:IUnknown:Release (This=0x556e370) returned 0x1 [0235.169] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e370, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556e370) returned 0x0 [0235.169] WbemDefPath:IUnknown:AddRef (This=0x556e370) returned 0x3 [0235.169] WbemDefPath:IUnknown:Release (This=0x556e370) returned 0x2 [0235.169] WbemDefPath:IWbemPath:SetText (This=0x556e370, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4460\"") returned 0x0 [0235.169] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.169] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.169] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.169] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.169] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.169] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.170] IWbemClassObject:Get (in: This=0x5564ca0, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f3238*=0, plFlavor=0x23f323c*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spgagentservice.exe", varVal2=0x0), pType=0x23f3238*=8, plFlavor=0x23f323c*=0) returned 0x0 [0235.170] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0235.170] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0235.170] IWbemClassObject:Get (in: This=0x5564ca0, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f3238*=8, plFlavor=0x23f323c*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spgagentservice.exe", varVal2=0x0), pType=0x23f3238*=8, plFlavor=0x23f323c*=0) returned 0x0 [0235.170] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0235.170] SysStringByteLen (bstr="spgagentservice.exe") returned 0x26 [0235.170] CoTaskMemAlloc (cb=0x4) returned 0x58e818 [0235.170] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e818, puReturned=0x23de044 | out: apObjects=0x58e818*=0x5565300, puReturned=0x23de044*=0x1) returned 0x0 [0235.171] IUnknown:QueryInterface (in: This=0x5565300, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5565300) returned 0x0 [0235.171] IUnknown:QueryInterface (in: This=0x5565300, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.171] IUnknown:QueryInterface (in: This=0x5565300, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.171] IUnknown:QueryInterface (in: This=0x5565300, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e3f4 | out: ppvObject=0x19e3f4*=0x0) returned 0x80004002 [0235.171] IUnknown:AddRef (This=0x5565300) returned 0x3 [0235.171] IUnknown:QueryInterface (in: This=0x5565300, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.171] IUnknown:QueryInterface (in: This=0x5565300, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.172] IUnknown:QueryInterface (in: This=0x5565300, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5565304) returned 0x0 [0235.172] IMarshal:GetUnmarshalClass (in: This=0x5565304, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.172] IUnknown:Release (This=0x5565304) returned 0x3 [0235.172] IUnknown:QueryInterface (in: This=0x5565300, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e610 | out: ppvObject=0x19e610*=0x0) returned 0x80004002 [0235.172] IUnknown:Release (This=0x5565300) returned 0x2 [0235.172] IUnknown:QueryInterface (in: This=0x5565300, riid=0x19eb80*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x19eb7c | out: ppvObject=0x19eb7c*=0x5565300) returned 0x0 [0235.172] IUnknown:AddRef (This=0x5565300) returned 0x4 [0235.172] IUnknown:Release (This=0x5565300) returned 0x3 [0235.172] IUnknown:Release (This=0x5565300) returned 0x2 [0235.172] CoTaskMemFree (pv=0x58e818) [0235.172] IUnknown:AddRef (This=0x5565300) returned 0x3 [0235.172] IWbemClassObject:Get (in: This=0x5565300, wszName="__GENUS", lFlags=0, pVal=0x19f1cc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f24c*=0, plFlavor=0x19f248*=0 | out: pVal=0x19f1cc*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x19f24c*=3, plFlavor=0x19f248*=64) returned 0x0 [0235.173] IWbemClassObject:Get (in: This=0x5565300, wszName="__PATH", lFlags=0, pVal=0x19f1b0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f234*=0, plFlavor=0x19f230*=0 | out: pVal=0x19f1b0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4476\"", varVal2=0x0), pType=0x19f234*=8, plFlavor=0x19f230*=64) returned 0x0 [0235.173] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4476\"") returned 0x5e [0235.173] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4476\"") returned 0x5e [0235.173] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.173] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.173] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.173] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.174] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6b8) returned 0x0 [0235.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.174] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556ebc0) returned 0x0 [0235.174] WbemDefPath:IUnknown:Release (This=0x58e6b8) returned 0x0 [0235.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ebc0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556ebc0) returned 0x0 [0235.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ebc0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.174] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ebc0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.175] WbemDefPath:IUnknown:AddRef (This=0x556ebc0) returned 0x3 [0235.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ebc0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ebc0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ebc0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x556c318) returned 0x0 [0235.175] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x556c318, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.175] WbemDefPath:IUnknown:Release (This=0x556c318) returned 0x3 [0235.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ebc0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.175] WbemDefPath:IUnknown:Release (This=0x556ebc0) returned 0x2 [0235.175] WbemDefPath:IUnknown:Release (This=0x556ebc0) returned 0x1 [0235.175] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ebc0, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556ebc0) returned 0x0 [0235.175] WbemDefPath:IUnknown:AddRef (This=0x556ebc0) returned 0x3 [0235.175] WbemDefPath:IUnknown:Release (This=0x556ebc0) returned 0x2 [0235.175] WbemDefPath:IWbemPath:SetText (This=0x556ebc0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4476\"") returned 0x0 [0235.175] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.176] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.176] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.176] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.176] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.176] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.176] IWbemClassObject:Get (in: This=0x5565300, wszName="Name", lFlags=0, pVal=0x19f1d0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f3abc*=0, plFlavor=0x23f3ac0*=0 | out: pVal=0x19f1d0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spcwin.exe", varVal2=0x0), pType=0x23f3abc*=8, plFlavor=0x23f3ac0*=0) returned 0x0 [0235.176] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0235.176] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0235.176] IWbemClassObject:Get (in: This=0x5565300, wszName="Name", lFlags=0, pVal=0x19f1d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x23f3abc*=8, plFlavor=0x23f3ac0*=0 | out: pVal=0x19f1d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="spcwin.exe", varVal2=0x0), pType=0x23f3abc*=8, plFlavor=0x23f3ac0*=0) returned 0x0 [0235.176] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0235.177] SysStringByteLen (bstr="spcwin.exe") returned 0x14 [0235.177] CoTaskMemAlloc (cb=0x4) returned 0x58e658 [0235.177] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e658, puReturned=0x23de044 | out: apObjects=0x58e658*=0x5565498, puReturned=0x23de044*=0x1) returned 0x0 [0235.179] IUnknown:QueryInterface (in: This=0x5565498, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e840 | out: ppvObject=0x19e840*=0x5565498) returned 0x0 [0235.179] IUnknown:QueryInterface (in: This=0x5565498, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002 [0235.179] IUnknown:QueryInterface (in: This=0x5565498, riid=0x6c7afb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19e61c | out: ppvObject=0x19e61c*=0x0) returned 0x80004002 [0235.179] IUnknown:AddRef (This=0x5565498) returned 0x3 [0235.179] IUnknown:QueryInterface (in: This=0x5565498, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.179] IUnknown:QueryInterface (in: This=0x5565498, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.179] IUnknown:QueryInterface (in: This=0x5565498, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x556549c) returned 0x0 [0235.179] IMarshal:GetUnmarshalClass (in: This=0x556549c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.179] IUnknown:Release (This=0x556549c) returned 0x3 [0235.179] IUnknown:Release (This=0x5565498) returned 0x2 [0235.180] IUnknown:AddRef (This=0x5565498) returned 0x4 [0235.180] IUnknown:Release (This=0x5565498) returned 0x3 [0235.180] IUnknown:Release (This=0x5565498) returned 0x2 [0235.180] CoTaskMemFree (pv=0x58e658) [0235.180] IUnknown:AddRef (This=0x5565498) returned 0x3 [0235.180] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4484\"") returned 0x5e [0235.180] SysStringByteLen (bstr="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4484\"") returned 0x5e [0235.180] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.181] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.181] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.181] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.182] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.182] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e8b0) returned 0x0 [0235.182] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e8b0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556e8b0) returned 0x0 [0235.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e8b0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e8b0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.182] WbemDefPath:IUnknown:AddRef (This=0x556e8b0) returned 0x3 [0235.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e8b0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e8b0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.182] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e8b0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x556c3a8) returned 0x0 [0235.183] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x556c3a8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.183] WbemDefPath:IUnknown:Release (This=0x556c3a8) returned 0x3 [0235.183] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e8b0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.183] WbemDefPath:IUnknown:Release (This=0x556e8b0) returned 0x2 [0235.183] WbemDefPath:IUnknown:Release (This=0x556e8b0) returned 0x1 [0235.183] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e8b0, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556e8b0) returned 0x0 [0235.183] WbemDefPath:IUnknown:AddRef (This=0x556e8b0) returned 0x3 [0235.183] WbemDefPath:IUnknown:Release (This=0x556e8b0) returned 0x2 [0235.183] WbemDefPath:IWbemPath:SetText (This=0x556e8b0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4484\"") returned 0x0 [0235.183] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.183] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.183] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.183] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.183] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.183] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.184] SysStringByteLen (bstr="omnipos.exe") returned 0x16 [0235.184] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.184] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5565960, puReturned=0x23de044*=0x1) returned 0x0 [0235.186] IUnknown:AddRef (This=0x5565960) returned 0x3 [0235.186] IUnknown:QueryInterface (in: This=0x5565960, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.186] IUnknown:QueryInterface (in: This=0x5565960, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.186] IUnknown:QueryInterface (in: This=0x5565960, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5565964) returned 0x0 [0235.186] IMarshal:GetUnmarshalClass (in: This=0x5565964, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.186] IUnknown:Release (This=0x5565964) returned 0x3 [0235.186] CoTaskMemFree (pv=0x58e7e8) [0235.186] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.187] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.187] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.187] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.188] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.189] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.189] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e920) returned 0x0 [0235.189] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.189] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e920, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556e920) returned 0x0 [0235.189] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e920, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.189] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e920, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.189] WbemDefPath:IUnknown:AddRef (This=0x556e920) returned 0x3 [0235.189] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e920, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.189] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e920, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.189] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e920, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x556c708) returned 0x0 [0235.189] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x556c708, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.189] WbemDefPath:IUnknown:Release (This=0x556c708) returned 0x3 [0235.189] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e920, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.189] WbemDefPath:IUnknown:Release (This=0x556e920) returned 0x2 [0235.189] WbemDefPath:IUnknown:Release (This=0x556e920) returned 0x1 [0235.190] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e920, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556e920) returned 0x0 [0235.190] WbemDefPath:IUnknown:AddRef (This=0x556e920) returned 0x3 [0235.190] WbemDefPath:IUnknown:Release (This=0x556e920) returned 0x2 [0235.190] WbemDefPath:IWbemPath:SetText (This=0x556e920, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4504\"") returned 0x0 [0235.190] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.190] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.190] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.190] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.190] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.190] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.190] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.190] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x55717c0, puReturned=0x23de044*=0x1) returned 0x0 [0235.192] IUnknown:AddRef (This=0x55717c0) returned 0x3 [0235.192] IUnknown:QueryInterface (in: This=0x55717c0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.192] IUnknown:QueryInterface (in: This=0x55717c0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.192] IUnknown:QueryInterface (in: This=0x55717c0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x55717c4) returned 0x0 [0235.192] IMarshal:GetUnmarshalClass (in: This=0x55717c4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.192] IUnknown:Release (This=0x55717c4) returned 0x3 [0235.193] CoTaskMemFree (pv=0x58e7e8) [0235.193] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.193] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.193] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.193] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.194] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.194] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e450) returned 0x0 [0235.194] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e450, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556e450) returned 0x0 [0235.194] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e450, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e450, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.195] WbemDefPath:IUnknown:AddRef (This=0x556e450) returned 0x3 [0235.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e450, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e450, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e450, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x556c7b0) returned 0x0 [0235.195] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x556c7b0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.195] WbemDefPath:IUnknown:Release (This=0x556c7b0) returned 0x3 [0235.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e450, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.195] WbemDefPath:IUnknown:Release (This=0x556e450) returned 0x2 [0235.195] WbemDefPath:IUnknown:Release (This=0x556e450) returned 0x1 [0235.195] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e450, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556e450) returned 0x0 [0235.195] WbemDefPath:IUnknown:AddRef (This=0x556e450) returned 0x3 [0235.196] WbemDefPath:IUnknown:Release (This=0x556e450) returned 0x2 [0235.196] WbemDefPath:IWbemPath:SetText (This=0x556e450, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4512\"") returned 0x0 [0235.196] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.196] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.196] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.196] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.197] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.197] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.197] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.197] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5570fc8, puReturned=0x23de044*=0x1) returned 0x0 [0235.198] IUnknown:AddRef (This=0x5570fc8) returned 0x3 [0235.198] IUnknown:QueryInterface (in: This=0x5570fc8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.198] IUnknown:QueryInterface (in: This=0x5570fc8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.198] IUnknown:QueryInterface (in: This=0x5570fc8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5570fcc) returned 0x0 [0235.198] IMarshal:GetUnmarshalClass (in: This=0x5570fcc, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.198] IUnknown:Release (This=0x5570fcc) returned 0x3 [0235.198] CoTaskMemFree (pv=0x58e7e8) [0235.199] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.199] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.199] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.199] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.200] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e658) returned 0x0 [0235.200] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e658, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.200] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e658, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556ea00) returned 0x0 [0235.201] WbemDefPath:IUnknown:Release (This=0x58e658) returned 0x0 [0235.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ea00, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556ea00) returned 0x0 [0235.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ea00, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ea00, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.201] WbemDefPath:IUnknown:AddRef (This=0x556ea00) returned 0x3 [0235.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ea00, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ea00, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ea00, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x55749e8) returned 0x0 [0235.201] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x55749e8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.201] WbemDefPath:IUnknown:Release (This=0x55749e8) returned 0x3 [0235.201] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ea00, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.202] WbemDefPath:IUnknown:Release (This=0x556ea00) returned 0x2 [0235.202] WbemDefPath:IUnknown:Release (This=0x556ea00) returned 0x1 [0235.202] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ea00, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556ea00) returned 0x0 [0235.202] WbemDefPath:IUnknown:AddRef (This=0x556ea00) returned 0x3 [0235.202] WbemDefPath:IUnknown:Release (This=0x556ea00) returned 0x2 [0235.202] WbemDefPath:IWbemPath:SetText (This=0x556ea00, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4528\"") returned 0x0 [0235.202] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.202] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.202] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.202] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.202] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.202] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.203] CoTaskMemAlloc (cb=0x4) returned 0x58e6b8 [0235.203] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6b8, puReturned=0x23de044 | out: apObjects=0x58e6b8*=0x5572150, puReturned=0x23de044*=0x1) returned 0x0 [0235.203] IUnknown:AddRef (This=0x5572150) returned 0x3 [0235.204] IUnknown:QueryInterface (in: This=0x5572150, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.204] IUnknown:QueryInterface (in: This=0x5572150, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.204] IUnknown:QueryInterface (in: This=0x5572150, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5572154) returned 0x0 [0235.204] IMarshal:GetUnmarshalClass (in: This=0x5572154, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.204] IUnknown:Release (This=0x5572154) returned 0x3 [0235.204] CoTaskMemFree (pv=0x58e6b8) [0235.204] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.204] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.204] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.205] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.205] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.206] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e760) returned 0x0 [0235.206] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e760, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556e760) returned 0x0 [0235.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e760, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e760, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.206] WbemDefPath:IUnknown:AddRef (This=0x556e760) returned 0x3 [0235.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e760, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e760, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.206] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e760, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x55749d0) returned 0x0 [0235.206] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x55749d0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.207] WbemDefPath:IUnknown:Release (This=0x55749d0) returned 0x3 [0235.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e760, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.207] WbemDefPath:IUnknown:Release (This=0x556e760) returned 0x2 [0235.207] WbemDefPath:IUnknown:Release (This=0x556e760) returned 0x1 [0235.207] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e760, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556e760) returned 0x0 [0235.207] WbemDefPath:IUnknown:AddRef (This=0x556e760) returned 0x3 [0235.207] WbemDefPath:IUnknown:Release (This=0x556e760) returned 0x2 [0235.207] WbemDefPath:IWbemPath:SetText (This=0x556e760, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4536\"") returned 0x0 [0235.207] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.207] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.207] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.208] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.208] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.208] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.208] CoTaskMemAlloc (cb=0x4) returned 0x58e688 [0235.208] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e688, puReturned=0x23de044 | out: apObjects=0x58e688*=0x5571628, puReturned=0x23de044*=0x1) returned 0x0 [0235.210] IUnknown:AddRef (This=0x5571628) returned 0x3 [0235.210] IUnknown:QueryInterface (in: This=0x5571628, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.210] IUnknown:QueryInterface (in: This=0x5571628, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.211] IUnknown:QueryInterface (in: This=0x5571628, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557162c) returned 0x0 [0235.211] IMarshal:GetUnmarshalClass (in: This=0x557162c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.211] IUnknown:Release (This=0x557162c) returned 0x3 [0235.212] CoTaskMemFree (pv=0x58e688) [0235.212] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.212] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.212] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.212] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.213] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.213] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.213] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e290) returned 0x0 [0235.214] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e290, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556e290) returned 0x0 [0235.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e290, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e290, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.214] WbemDefPath:IUnknown:AddRef (This=0x556e290) returned 0x3 [0235.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e290, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e290, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e290, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5574d18) returned 0x0 [0235.214] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5574d18, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.214] WbemDefPath:IUnknown:Release (This=0x5574d18) returned 0x3 [0235.214] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e290, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.214] WbemDefPath:IUnknown:Release (This=0x556e290) returned 0x2 [0235.215] WbemDefPath:IUnknown:Release (This=0x556e290) returned 0x1 [0235.215] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e290, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556e290) returned 0x0 [0235.215] WbemDefPath:IUnknown:AddRef (This=0x556e290) returned 0x3 [0235.215] WbemDefPath:IUnknown:Release (This=0x556e290) returned 0x2 [0235.215] WbemDefPath:IWbemPath:SetText (This=0x556e290, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4552\"") returned 0x0 [0235.215] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.215] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.215] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.215] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.215] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.215] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.215] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.215] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5571c88, puReturned=0x23de044*=0x1) returned 0x0 [0235.218] IUnknown:AddRef (This=0x5571c88) returned 0x3 [0235.218] IUnknown:QueryInterface (in: This=0x5571c88, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.219] IUnknown:QueryInterface (in: This=0x5571c88, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.219] IUnknown:QueryInterface (in: This=0x5571c88, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5571c8c) returned 0x0 [0235.219] IMarshal:GetUnmarshalClass (in: This=0x5571c8c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.219] IUnknown:Release (This=0x5571c8c) returned 0x3 [0235.219] CoTaskMemFree (pv=0x58e7e8) [0235.219] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.219] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.219] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.219] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.220] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6f8) returned 0x0 [0235.220] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6f8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.220] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6f8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556ec30) returned 0x0 [0235.221] WbemDefPath:IUnknown:Release (This=0x58e6f8) returned 0x0 [0235.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ec30, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556ec30) returned 0x0 [0235.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ec30, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ec30, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.221] WbemDefPath:IUnknown:AddRef (This=0x556ec30) returned 0x3 [0235.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ec30, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ec30, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ec30, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5574dc0) returned 0x0 [0235.221] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5574dc0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.221] WbemDefPath:IUnknown:Release (This=0x5574dc0) returned 0x3 [0235.221] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ec30, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.222] WbemDefPath:IUnknown:Release (This=0x556ec30) returned 0x2 [0235.222] WbemDefPath:IUnknown:Release (This=0x556ec30) returned 0x1 [0235.222] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ec30, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556ec30) returned 0x0 [0235.222] WbemDefPath:IUnknown:AddRef (This=0x556ec30) returned 0x3 [0235.222] WbemDefPath:IUnknown:Release (This=0x556ec30) returned 0x2 [0235.222] WbemDefPath:IWbemPath:SetText (This=0x556ec30, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4560\"") returned 0x0 [0235.222] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.222] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.222] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.222] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.222] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.222] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.223] CoTaskMemAlloc (cb=0x4) returned 0x58e658 [0235.223] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e658, puReturned=0x23de044 | out: apObjects=0x58e658*=0x5572c78, puReturned=0x23de044*=0x1) returned 0x0 [0235.225] IUnknown:AddRef (This=0x5572c78) returned 0x3 [0235.225] IUnknown:QueryInterface (in: This=0x5572c78, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.225] IUnknown:QueryInterface (in: This=0x5572c78, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.225] IUnknown:QueryInterface (in: This=0x5572c78, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5572c7c) returned 0x0 [0235.225] IMarshal:GetUnmarshalClass (in: This=0x5572c7c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.225] IUnknown:Release (This=0x5572c7c) returned 0x3 [0235.225] CoTaskMemFree (pv=0x58e658) [0235.225] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.225] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.225] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.226] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.226] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6f8) returned 0x0 [0235.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6f8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.227] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6f8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e530) returned 0x0 [0235.227] WbemDefPath:IUnknown:Release (This=0x58e6f8) returned 0x0 [0235.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e530, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556e530) returned 0x0 [0235.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e530, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e530, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.227] WbemDefPath:IUnknown:AddRef (This=0x556e530) returned 0x3 [0235.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e530, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e530, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.227] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e530, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5575090) returned 0x0 [0235.227] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5575090, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.228] WbemDefPath:IUnknown:Release (This=0x5575090) returned 0x3 [0235.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e530, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.228] WbemDefPath:IUnknown:Release (This=0x556e530) returned 0x2 [0235.228] WbemDefPath:IUnknown:Release (This=0x556e530) returned 0x1 [0235.228] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e530, riid=0x19f088*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f084 | out: ppvObject=0x19f084*=0x556e530) returned 0x0 [0235.228] WbemDefPath:IUnknown:AddRef (This=0x556e530) returned 0x3 [0235.228] WbemDefPath:IUnknown:Release (This=0x556e530) returned 0x2 [0235.228] WbemDefPath:IWbemPath:SetText (This=0x556e530, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4580\"") returned 0x0 [0235.228] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.228] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.229] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.229] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.229] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.229] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.229] CoTaskMemAlloc (cb=0x4) returned 0x58e818 [0235.229] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e818, puReturned=0x23de044 | out: apObjects=0x58e818*=0x5572480, puReturned=0x23de044*=0x1) returned 0x0 [0235.231] IUnknown:AddRef (This=0x5572480) returned 0x3 [0235.231] IUnknown:QueryInterface (in: This=0x5572480, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.231] IUnknown:QueryInterface (in: This=0x5572480, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.231] IUnknown:QueryInterface (in: This=0x5572480, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5572484) returned 0x0 [0235.231] IMarshal:GetUnmarshalClass (in: This=0x5572484, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.231] IUnknown:Release (This=0x5572484) returned 0x3 [0235.231] CoTaskMemFree (pv=0x58e818) [0235.232] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.232] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.232] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.232] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.233] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.233] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556eca0) returned 0x0 [0235.233] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eca0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e994 | out: ppvObject=0x19e994*=0x556eca0) returned 0x0 [0235.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eca0, riid=0x6c7afdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19e950 | out: ppvObject=0x19e950*=0x0) returned 0x80004002 [0235.233] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eca0, riid=0x6c7b056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e544 | out: ppvObject=0x19e544*=0x0) returned 0x80004002 [0235.233] WbemDefPath:IUnknown:AddRef (This=0x556eca0) returned 0x3 [0235.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eca0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eca0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eca0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5575108) returned 0x0 [0235.234] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5575108, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.234] WbemDefPath:IUnknown:Release (This=0x5575108) returned 0x3 [0235.234] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eca0, riid=0x6c7b0448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e760 | out: ppvObject=0x19e760*=0x0) returned 0x80004002 [0235.234] WbemDefPath:IUnknown:Release (This=0x556eca0) returned 0x2 [0235.234] WbemDefPath:IUnknown:Release (This=0x556eca0) returned 0x1 [0235.234] WbemDefPath:IUnknown:Release (This=0x556eca0) returned 0x2 [0235.234] WbemDefPath:IWbemPath:SetText (This=0x556eca0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4588\"") returned 0x0 [0235.234] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.234] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.235] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.235] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.235] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.235] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.235] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.235] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5572948, puReturned=0x23de044*=0x1) returned 0x0 [0235.238] IUnknown:AddRef (This=0x5572948) returned 0x3 [0235.238] IUnknown:QueryInterface (in: This=0x5572948, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.238] IUnknown:QueryInterface (in: This=0x5572948, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.238] IUnknown:QueryInterface (in: This=0x5572948, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557294c) returned 0x0 [0235.239] IMarshal:GetUnmarshalClass (in: This=0x557294c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.239] IUnknown:Release (This=0x557294c) returned 0x3 [0235.239] CoTaskMemFree (pv=0x58e7e8) [0235.239] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.239] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.239] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.239] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.240] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6b8) returned 0x0 [0235.241] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.241] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e990) returned 0x0 [0235.241] WbemDefPath:IUnknown:Release (This=0x58e6b8) returned 0x0 [0235.241] WbemDefPath:IUnknown:AddRef (This=0x556e990) returned 0x3 [0235.241] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e990, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.241] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e990, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.241] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e990, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5573560) returned 0x0 [0235.241] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5573560, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.241] WbemDefPath:IUnknown:Release (This=0x5573560) returned 0x3 [0235.241] WbemDefPath:IUnknown:Release (This=0x556e990) returned 0x2 [0235.241] WbemDefPath:IUnknown:Release (This=0x556e990) returned 0x1 [0235.242] WbemDefPath:IUnknown:Release (This=0x556e990) returned 0x2 [0235.242] WbemDefPath:IWbemPath:SetText (This=0x556e990, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4604\"") returned 0x0 [0235.242] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.242] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.242] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.242] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.242] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.242] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.242] CoTaskMemAlloc (cb=0x4) returned 0x58e688 [0235.242] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e688, puReturned=0x23de044 | out: apObjects=0x58e688*=0x5571160, puReturned=0x23de044*=0x1) returned 0x0 [0235.244] IUnknown:AddRef (This=0x5571160) returned 0x3 [0235.244] IUnknown:QueryInterface (in: This=0x5571160, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.244] IUnknown:QueryInterface (in: This=0x5571160, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.244] IUnknown:QueryInterface (in: This=0x5571160, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5571164) returned 0x0 [0235.244] IMarshal:GetUnmarshalClass (in: This=0x5571164, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.244] IUnknown:Release (This=0x5571164) returned 0x3 [0235.245] CoTaskMemFree (pv=0x58e688) [0235.245] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.245] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.245] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.245] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.246] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6f8) returned 0x0 [0235.246] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6f8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.246] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6f8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556ea70) returned 0x0 [0235.246] WbemDefPath:IUnknown:Release (This=0x58e6f8) returned 0x0 [0235.246] WbemDefPath:IUnknown:AddRef (This=0x556ea70) returned 0x3 [0235.246] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ea70, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.246] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ea70, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.247] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ea70, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5573470) returned 0x0 [0235.247] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5573470, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.247] WbemDefPath:IUnknown:Release (This=0x5573470) returned 0x3 [0235.247] WbemDefPath:IUnknown:Release (This=0x556ea70) returned 0x2 [0235.247] WbemDefPath:IUnknown:Release (This=0x556ea70) returned 0x1 [0235.247] WbemDefPath:IUnknown:Release (This=0x556ea70) returned 0x2 [0235.247] WbemDefPath:IWbemPath:SetText (This=0x556ea70, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4612\"") returned 0x0 [0235.247] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.247] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.247] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.247] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.247] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.247] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.248] CoTaskMemAlloc (cb=0x4) returned 0x58e688 [0235.248] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e688, puReturned=0x23de044 | out: apObjects=0x58e688*=0x55727b0, puReturned=0x23de044*=0x1) returned 0x0 [0235.250] IUnknown:AddRef (This=0x55727b0) returned 0x3 [0235.250] IUnknown:QueryInterface (in: This=0x55727b0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.250] IUnknown:QueryInterface (in: This=0x55727b0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.250] IUnknown:QueryInterface (in: This=0x55727b0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x55727b4) returned 0x0 [0235.250] IMarshal:GetUnmarshalClass (in: This=0x55727b4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.250] IUnknown:Release (This=0x55727b4) returned 0x3 [0235.251] CoTaskMemFree (pv=0x58e688) [0235.251] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.251] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.251] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.251] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.252] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.252] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.252] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e7d0) returned 0x0 [0235.252] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.253] WbemDefPath:IUnknown:AddRef (This=0x556e7d0) returned 0x3 [0235.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e7d0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e7d0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.253] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e7d0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5573608) returned 0x0 [0235.253] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5573608, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.253] WbemDefPath:IUnknown:Release (This=0x5573608) returned 0x3 [0235.253] WbemDefPath:IUnknown:Release (This=0x556e7d0) returned 0x2 [0235.253] WbemDefPath:IUnknown:Release (This=0x556e7d0) returned 0x1 [0235.253] WbemDefPath:IUnknown:Release (This=0x556e7d0) returned 0x2 [0235.254] WbemDefPath:IWbemPath:SetText (This=0x556e7d0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4628\"") returned 0x0 [0235.254] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.254] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.254] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.254] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.255] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.255] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.255] CoTaskMemAlloc (cb=0x4) returned 0x58e6b8 [0235.255] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6b8, puReturned=0x23de044 | out: apObjects=0x58e6b8*=0x5571e20, puReturned=0x23de044*=0x1) returned 0x0 [0235.256] IUnknown:AddRef (This=0x5571e20) returned 0x3 [0235.256] IUnknown:QueryInterface (in: This=0x5571e20, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.256] IUnknown:QueryInterface (in: This=0x5571e20, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.256] IUnknown:QueryInterface (in: This=0x5571e20, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5571e24) returned 0x0 [0235.256] IMarshal:GetUnmarshalClass (in: This=0x5571e24, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.256] IUnknown:Release (This=0x5571e24) returned 0x3 [0235.256] CoTaskMemFree (pv=0x58e6b8) [0235.256] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.256] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.256] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.256] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.257] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e818) returned 0x0 [0235.257] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e818, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.257] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e818, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556eae0) returned 0x0 [0235.257] WbemDefPath:IUnknown:Release (This=0x58e818) returned 0x0 [0235.258] WbemDefPath:IUnknown:AddRef (This=0x556eae0) returned 0x3 [0235.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eae0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eae0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.258] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eae0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5573788) returned 0x0 [0235.258] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5573788, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.258] WbemDefPath:IUnknown:Release (This=0x5573788) returned 0x3 [0235.258] WbemDefPath:IUnknown:Release (This=0x556eae0) returned 0x2 [0235.258] WbemDefPath:IUnknown:Release (This=0x556eae0) returned 0x1 [0235.258] WbemDefPath:IUnknown:Release (This=0x556eae0) returned 0x2 [0235.258] WbemDefPath:IWbemPath:SetText (This=0x556eae0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4636\"") returned 0x0 [0235.258] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.258] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.258] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.258] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.258] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.258] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.259] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0235.259] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x55712f8, puReturned=0x23de044*=0x1) returned 0x0 [0235.259] IUnknown:AddRef (This=0x55712f8) returned 0x3 [0235.259] IUnknown:QueryInterface (in: This=0x55712f8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.260] IUnknown:QueryInterface (in: This=0x55712f8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.260] IUnknown:QueryInterface (in: This=0x55712f8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x55712fc) returned 0x0 [0235.260] IMarshal:GetUnmarshalClass (in: This=0x55712fc, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.260] IUnknown:Release (This=0x55712fc) returned 0x3 [0235.260] CoTaskMemFree (pv=0x58e6f8) [0235.260] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.260] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.260] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.260] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.261] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6f8) returned 0x0 [0235.261] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6f8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.261] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6f8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e4c0) returned 0x0 [0235.261] WbemDefPath:IUnknown:Release (This=0x58e6f8) returned 0x0 [0235.261] WbemDefPath:IUnknown:AddRef (This=0x556e4c0) returned 0x3 [0235.261] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e4c0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.261] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e4c0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.261] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e4c0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5573b90) returned 0x0 [0235.261] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5573b90, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.261] WbemDefPath:IUnknown:Release (This=0x5573b90) returned 0x3 [0235.262] WbemDefPath:IUnknown:Release (This=0x556e4c0) returned 0x2 [0235.262] WbemDefPath:IUnknown:Release (This=0x556e4c0) returned 0x1 [0235.262] WbemDefPath:IUnknown:Release (This=0x556e4c0) returned 0x2 [0235.262] WbemDefPath:IWbemPath:SetText (This=0x556e4c0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4656\"") returned 0x0 [0235.262] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.262] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.262] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.262] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.262] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.262] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.262] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.262] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5571490, puReturned=0x23de044*=0x1) returned 0x0 [0235.263] IUnknown:AddRef (This=0x5571490) returned 0x3 [0235.263] IUnknown:QueryInterface (in: This=0x5571490, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.263] IUnknown:QueryInterface (in: This=0x5571490, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.263] IUnknown:QueryInterface (in: This=0x5571490, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5571494) returned 0x0 [0235.263] IMarshal:GetUnmarshalClass (in: This=0x5571494, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.263] IUnknown:Release (This=0x5571494) returned 0x3 [0235.263] CoTaskMemFree (pv=0x58e7e8) [0235.263] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.263] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.264] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.264] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.264] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.264] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.264] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556ed10) returned 0x0 [0235.264] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.264] WbemDefPath:IUnknown:AddRef (This=0x556ed10) returned 0x3 [0235.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ed10, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ed10, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.265] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ed10, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5573d10) returned 0x0 [0235.266] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5573d10, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.266] WbemDefPath:IUnknown:Release (This=0x5573d10) returned 0x3 [0235.266] WbemDefPath:IUnknown:Release (This=0x556ed10) returned 0x2 [0235.266] WbemDefPath:IUnknown:Release (This=0x556ed10) returned 0x1 [0235.266] WbemDefPath:IUnknown:Release (This=0x556ed10) returned 0x2 [0235.266] WbemDefPath:IWbemPath:SetText (This=0x556ed10, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4664\"") returned 0x0 [0235.266] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.266] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.266] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.266] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.266] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.266] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.266] CoTaskMemAlloc (cb=0x4) returned 0x58e688 [0235.266] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e688, puReturned=0x23de044 | out: apObjects=0x58e688*=0x5571fb8, puReturned=0x23de044*=0x1) returned 0x0 [0235.267] IUnknown:AddRef (This=0x5571fb8) returned 0x3 [0235.267] IUnknown:QueryInterface (in: This=0x5571fb8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.267] IUnknown:QueryInterface (in: This=0x5571fb8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.267] IUnknown:QueryInterface (in: This=0x5571fb8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5571fbc) returned 0x0 [0235.267] IMarshal:GetUnmarshalClass (in: This=0x5571fbc, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.267] IUnknown:Release (This=0x5571fbc) returned 0x3 [0235.268] CoTaskMemFree (pv=0x58e688) [0235.268] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.268] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.268] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.268] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.268] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e818) returned 0x0 [0235.268] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e818, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.269] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e818, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e5a0) returned 0x0 [0235.269] WbemDefPath:IUnknown:Release (This=0x58e818) returned 0x0 [0235.269] WbemDefPath:IUnknown:AddRef (This=0x556e5a0) returned 0x3 [0235.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e5a0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e5a0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.269] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e5a0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5573e18) returned 0x0 [0235.269] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5573e18, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.269] WbemDefPath:IUnknown:Release (This=0x5573e18) returned 0x3 [0235.269] WbemDefPath:IUnknown:Release (This=0x556e5a0) returned 0x2 [0235.269] WbemDefPath:IUnknown:Release (This=0x556e5a0) returned 0x1 [0235.269] WbemDefPath:IUnknown:Release (This=0x556e5a0) returned 0x2 [0235.269] WbemDefPath:IWbemPath:SetText (This=0x556e5a0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4680\"") returned 0x0 [0235.270] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.270] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.270] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.270] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.270] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.270] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.270] CoTaskMemAlloc (cb=0x4) returned 0x58e688 [0235.271] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e688, puReturned=0x23de044 | out: apObjects=0x58e688*=0x55722e8, puReturned=0x23de044*=0x1) returned 0x0 [0235.271] IUnknown:AddRef (This=0x55722e8) returned 0x3 [0235.271] IUnknown:QueryInterface (in: This=0x55722e8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.271] IUnknown:QueryInterface (in: This=0x55722e8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.271] IUnknown:QueryInterface (in: This=0x55722e8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x55722ec) returned 0x0 [0235.272] IMarshal:GetUnmarshalClass (in: This=0x55722ec, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.272] IUnknown:Release (This=0x55722ec) returned 0x3 [0235.272] CoTaskMemFree (pv=0x58e688) [0235.272] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.272] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.272] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.272] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.273] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e688) returned 0x0 [0235.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e688, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.273] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e688, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556ed80) returned 0x0 [0235.273] WbemDefPath:IUnknown:Release (This=0x58e688) returned 0x0 [0235.273] WbemDefPath:IUnknown:AddRef (This=0x556ed80) returned 0x3 [0235.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ed80, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ed80, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.273] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ed80, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5573ef0) returned 0x0 [0235.273] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5573ef0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.273] WbemDefPath:IUnknown:Release (This=0x5573ef0) returned 0x3 [0235.273] WbemDefPath:IUnknown:Release (This=0x556ed80) returned 0x2 [0235.273] WbemDefPath:IUnknown:Release (This=0x556ed80) returned 0x1 [0235.273] WbemDefPath:IUnknown:Release (This=0x556ed80) returned 0x2 [0235.274] WbemDefPath:IWbemPath:SetText (This=0x556ed80, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4688\"") returned 0x0 [0235.274] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.274] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.274] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.274] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.274] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.274] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.274] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0235.274] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x5572618, puReturned=0x23de044*=0x1) returned 0x0 [0235.275] IUnknown:AddRef (This=0x5572618) returned 0x3 [0235.275] IUnknown:QueryInterface (in: This=0x5572618, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.275] IUnknown:QueryInterface (in: This=0x5572618, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.275] IUnknown:QueryInterface (in: This=0x5572618, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557261c) returned 0x0 [0235.275] IMarshal:GetUnmarshalClass (in: This=0x557261c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.275] IUnknown:Release (This=0x557261c) returned 0x3 [0235.275] CoTaskMemFree (pv=0x58e6f8) [0235.275] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.275] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.275] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.275] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.276] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.276] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.276] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e610) returned 0x0 [0235.276] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.276] WbemDefPath:IUnknown:AddRef (This=0x556e610) returned 0x3 [0235.276] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e610, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.276] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e610, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.276] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e610, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5573ec0) returned 0x0 [0235.276] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5573ec0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.276] WbemDefPath:IUnknown:Release (This=0x5573ec0) returned 0x3 [0235.277] WbemDefPath:IUnknown:Release (This=0x556e610) returned 0x2 [0235.277] WbemDefPath:IUnknown:Release (This=0x556e610) returned 0x1 [0235.277] WbemDefPath:IUnknown:Release (This=0x556e610) returned 0x2 [0235.277] WbemDefPath:IWbemPath:SetText (This=0x556e610, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4704\"") returned 0x0 [0235.277] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.277] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.277] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.277] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.277] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.277] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.277] CoTaskMemAlloc (cb=0x4) returned 0x58e658 [0235.277] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e658, puReturned=0x23de044 | out: apObjects=0x58e658*=0x5572ae0, puReturned=0x23de044*=0x1) returned 0x0 [0235.278] IUnknown:AddRef (This=0x5572ae0) returned 0x3 [0235.278] IUnknown:QueryInterface (in: This=0x5572ae0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.278] IUnknown:QueryInterface (in: This=0x5572ae0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.278] IUnknown:QueryInterface (in: This=0x5572ae0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5572ae4) returned 0x0 [0235.278] IMarshal:GetUnmarshalClass (in: This=0x5572ae4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.278] IUnknown:Release (This=0x5572ae4) returned 0x3 [0235.278] CoTaskMemFree (pv=0x58e658) [0235.278] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.279] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.279] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.279] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.279] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e658) returned 0x0 [0235.279] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e658, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.280] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e658, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e680) returned 0x0 [0235.280] WbemDefPath:IUnknown:Release (This=0x58e658) returned 0x0 [0235.280] WbemDefPath:IUnknown:AddRef (This=0x556e680) returned 0x3 [0235.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e680, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e680, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.280] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e680, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x55743a0) returned 0x0 [0235.280] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x55743a0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.280] WbemDefPath:IUnknown:Release (This=0x55743a0) returned 0x3 [0235.280] WbemDefPath:IUnknown:Release (This=0x556e680) returned 0x2 [0235.280] WbemDefPath:IUnknown:Release (This=0x556e680) returned 0x1 [0235.280] WbemDefPath:IUnknown:Release (This=0x556e680) returned 0x2 [0235.280] WbemDefPath:IWbemPath:SetText (This=0x556e680, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4712\"") returned 0x0 [0235.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.280] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.280] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.280] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.281] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.281] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f1d0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.281] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0235.281] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x5571958, puReturned=0x23de044*=0x1) returned 0x0 [0235.281] IUnknown:AddRef (This=0x5571958) returned 0x3 [0235.281] IUnknown:QueryInterface (in: This=0x5571958, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.281] IUnknown:QueryInterface (in: This=0x5571958, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.281] IUnknown:QueryInterface (in: This=0x5571958, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557195c) returned 0x0 [0235.282] IMarshal:GetUnmarshalClass (in: This=0x557195c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.282] IUnknown:Release (This=0x557195c) returned 0x3 [0235.282] CoTaskMemFree (pv=0x58e6f8) [0235.282] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.282] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.282] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.282] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.282] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.283] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556edf0) returned 0x0 [0235.283] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.283] WbemDefPath:IUnknown:AddRef (This=0x556edf0) returned 0x3 [0235.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x556edf0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x556edf0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.283] WbemDefPath:IUnknown:QueryInterface (in: This=0x556edf0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5574478) returned 0x0 [0235.283] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5574478, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.283] WbemDefPath:IUnknown:Release (This=0x5574478) returned 0x3 [0235.283] WbemDefPath:IUnknown:Release (This=0x556edf0) returned 0x2 [0235.283] WbemDefPath:IUnknown:Release (This=0x556edf0) returned 0x1 [0235.283] WbemDefPath:IUnknown:Release (This=0x556edf0) returned 0x2 [0235.284] WbemDefPath:IWbemPath:SetText (This=0x556edf0, uMode=0x4, pszPath="\\\\XC64ZB\\root\\cimv2:Win32_Process.Handle=\"4720\"") returned 0x0 [0235.284] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f208 | out: puCount=0x19f208*=0x2) returned 0x0 [0235.284] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0x0, pszText=0x0 | out: puBuffLength=0x19f204*=0xf, pszText=0x0) returned 0x0 [0235.284] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f204*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f204*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0235.284] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x524340, puCount=0x19f1d4 | out: puCount=0x19f1d4*=0x2) returned 0x0 [0235.284] WbemDefPath:IWbemPath:GetText (in: This=0x524340, lFlags=4, puBuffLength=0x19f1d0*=0x0, pszText=0x0 | out: puBuffLength=0x19f1d0*=0xf, pszText=0x0) returned 0x0 [0235.284] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.284] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x5572e10, puReturned=0x23de044*=0x1) returned 0x0 [0235.286] IUnknown:AddRef (This=0x5572e10) returned 0x3 [0235.286] IUnknown:QueryInterface (in: This=0x5572e10, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.286] IUnknown:QueryInterface (in: This=0x5572e10, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.286] IUnknown:QueryInterface (in: This=0x5572e10, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5572e14) returned 0x0 [0235.286] IMarshal:GetUnmarshalClass (in: This=0x5572e14, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.286] IUnknown:Release (This=0x5572e14) returned 0x3 [0235.286] CoTaskMemFree (pv=0x58e7e8) [0235.286] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.286] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.286] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.286] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.287] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.287] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556ee60) returned 0x0 [0235.287] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.287] WbemDefPath:IUnknown:AddRef (This=0x556ee60) returned 0x3 [0235.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ee60, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ee60, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.287] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ee60, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5574748) returned 0x0 [0235.288] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5574748, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.288] WbemDefPath:IUnknown:Release (This=0x5574748) returned 0x3 [0235.288] CoTaskMemAlloc (cb=0x4) returned 0x58e688 [0235.288] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e688, puReturned=0x23de044 | out: apObjects=0x58e688*=0x5571af0, puReturned=0x23de044*=0x1) returned 0x0 [0235.290] IUnknown:AddRef (This=0x5571af0) returned 0x3 [0235.290] IUnknown:QueryInterface (in: This=0x5571af0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.290] IUnknown:QueryInterface (in: This=0x5571af0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.290] IUnknown:QueryInterface (in: This=0x5571af0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x5571af4) returned 0x0 [0235.290] IMarshal:GetUnmarshalClass (in: This=0x5571af4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.290] IUnknown:Release (This=0x5571af4) returned 0x3 [0235.290] CoTaskMemFree (pv=0x58e688) [0235.290] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.290] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.290] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.290] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.291] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e658) returned 0x0 [0235.291] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e658, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.291] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e658, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556eed0) returned 0x0 [0235.291] WbemDefPath:IUnknown:Release (This=0x58e658) returned 0x0 [0235.291] WbemDefPath:IUnknown:AddRef (This=0x556eed0) returned 0x3 [0235.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eed0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eed0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.292] WbemDefPath:IUnknown:QueryInterface (in: This=0x556eed0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x5574610) returned 0x0 [0235.292] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5574610, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.292] WbemDefPath:IUnknown:Release (This=0x5574610) returned 0x3 [0235.293] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.293] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x557cc18, puReturned=0x23de044*=0x1) returned 0x0 [0235.294] IUnknown:AddRef (This=0x557cc18) returned 0x3 [0235.294] IUnknown:QueryInterface (in: This=0x557cc18, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.294] IUnknown:QueryInterface (in: This=0x557cc18, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.294] IUnknown:QueryInterface (in: This=0x557cc18, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557cc1c) returned 0x0 [0235.294] IMarshal:GetUnmarshalClass (in: This=0x557cc1c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.294] IUnknown:Release (This=0x557cc1c) returned 0x3 [0235.295] CoTaskMemFree (pv=0x58e7e8) [0235.295] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.295] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.295] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.295] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.295] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e658) returned 0x0 [0235.295] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e658, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.295] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e658, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e6f0) returned 0x0 [0235.296] WbemDefPath:IUnknown:Release (This=0x58e658) returned 0x0 [0235.296] WbemDefPath:IUnknown:AddRef (This=0x556e6f0) returned 0x3 [0235.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e6f0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e6f0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.296] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e6f0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x557c270) returned 0x0 [0235.296] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x557c270, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.296] WbemDefPath:IUnknown:Release (This=0x557c270) returned 0x3 [0235.296] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0235.296] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x557e8c8, puReturned=0x23de044*=0x1) returned 0x0 [0235.297] IUnknown:AddRef (This=0x557e8c8) returned 0x3 [0235.297] IUnknown:QueryInterface (in: This=0x557e8c8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.297] IUnknown:QueryInterface (in: This=0x557e8c8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.297] IUnknown:QueryInterface (in: This=0x557e8c8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557e8cc) returned 0x0 [0235.297] IMarshal:GetUnmarshalClass (in: This=0x557e8cc, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.297] IUnknown:Release (This=0x557e8cc) returned 0x3 [0235.298] CoTaskMemFree (pv=0x58e6f8) [0235.298] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.298] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.298] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.298] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.298] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.298] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.299] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556ef40) returned 0x0 [0235.299] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.299] WbemDefPath:IUnknown:AddRef (This=0x556ef40) returned 0x3 [0235.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ef40, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ef40, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.299] WbemDefPath:IUnknown:QueryInterface (in: This=0x556ef40, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x557c570) returned 0x0 [0235.299] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x557c570, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.299] WbemDefPath:IUnknown:Release (This=0x557c570) returned 0x3 [0235.299] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.299] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x557d740, puReturned=0x23de044*=0x1) returned 0x0 [0235.300] IUnknown:AddRef (This=0x557d740) returned 0x3 [0235.300] IUnknown:QueryInterface (in: This=0x557d740, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.300] IUnknown:QueryInterface (in: This=0x557d740, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.301] IUnknown:QueryInterface (in: This=0x557d740, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557d744) returned 0x0 [0235.301] IMarshal:GetUnmarshalClass (in: This=0x557d744, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.301] IUnknown:Release (This=0x557d744) returned 0x3 [0235.301] CoTaskMemFree (pv=0x58e7e8) [0235.301] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.301] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.301] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.301] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.302] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.302] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.302] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556efb0) returned 0x0 [0235.302] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.303] WbemDefPath:IUnknown:AddRef (This=0x556efb0) returned 0x3 [0235.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x556efb0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x556efb0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.303] WbemDefPath:IUnknown:QueryInterface (in: This=0x556efb0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x557c558) returned 0x0 [0235.303] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x557c558, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.303] WbemDefPath:IUnknown:Release (This=0x557c558) returned 0x3 [0235.303] CoTaskMemAlloc (cb=0x4) returned 0x58e688 [0235.303] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e688, puReturned=0x23de044 | out: apObjects=0x58e688*=0x557d278, puReturned=0x23de044*=0x1) returned 0x0 [0235.306] IUnknown:AddRef (This=0x557d278) returned 0x3 [0235.306] IUnknown:QueryInterface (in: This=0x557d278, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.306] IUnknown:QueryInterface (in: This=0x557d278, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.306] IUnknown:QueryInterface (in: This=0x557d278, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557d27c) returned 0x0 [0235.306] IMarshal:GetUnmarshalClass (in: This=0x557d27c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.306] IUnknown:Release (This=0x557d27c) returned 0x3 [0235.306] CoTaskMemFree (pv=0x58e688) [0235.306] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.306] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.306] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.306] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.307] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e658) returned 0x0 [0235.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e658, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.307] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e658, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e300) returned 0x0 [0235.307] WbemDefPath:IUnknown:Release (This=0x58e658) returned 0x0 [0235.307] WbemDefPath:IUnknown:AddRef (This=0x556e300) returned 0x3 [0235.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e300, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e300, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.307] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e300, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x557c888) returned 0x0 [0235.307] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x557c888, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.307] WbemDefPath:IUnknown:Release (This=0x557c888) returned 0x3 [0235.308] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.308] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x557dc08, puReturned=0x23de044*=0x1) returned 0x0 [0235.309] IUnknown:AddRef (This=0x557dc08) returned 0x3 [0235.309] IUnknown:QueryInterface (in: This=0x557dc08, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.309] IUnknown:QueryInterface (in: This=0x557dc08, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.309] IUnknown:QueryInterface (in: This=0x557dc08, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557dc0c) returned 0x0 [0235.310] IMarshal:GetUnmarshalClass (in: This=0x557dc0c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.310] IUnknown:Release (This=0x557dc0c) returned 0x3 [0235.310] CoTaskMemFree (pv=0x58e7e8) [0235.310] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.310] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.310] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.310] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.311] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.311] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.311] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556e3e0) returned 0x0 [0235.312] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.312] WbemDefPath:IUnknown:AddRef (This=0x556e3e0) returned 0x3 [0235.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e3e0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e3e0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.312] WbemDefPath:IUnknown:QueryInterface (in: This=0x556e3e0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x557c6f0) returned 0x0 [0235.312] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x557c6f0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.312] WbemDefPath:IUnknown:Release (This=0x557c6f0) returned 0x3 [0235.312] CoTaskMemAlloc (cb=0x4) returned 0x58e658 [0235.312] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e658, puReturned=0x23de044 | out: apObjects=0x58e658*=0x557e598, puReturned=0x23de044*=0x1) returned 0x0 [0235.315] IUnknown:AddRef (This=0x557e598) returned 0x3 [0235.315] IUnknown:QueryInterface (in: This=0x557e598, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.315] IUnknown:QueryInterface (in: This=0x557e598, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.315] IUnknown:QueryInterface (in: This=0x557e598, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557e59c) returned 0x0 [0235.315] IMarshal:GetUnmarshalClass (in: This=0x557e59c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.315] IUnknown:Release (This=0x557e59c) returned 0x3 [0235.316] CoTaskMemFree (pv=0x58e658) [0235.316] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.316] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.316] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.316] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.316] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e688) returned 0x0 [0235.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e688, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.317] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e688, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556f170) returned 0x0 [0235.317] WbemDefPath:IUnknown:Release (This=0x58e688) returned 0x0 [0235.317] WbemDefPath:IUnknown:AddRef (This=0x556f170) returned 0x3 [0235.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x556f170, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x556f170, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.317] WbemDefPath:IUnknown:QueryInterface (in: This=0x556f170, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x557c9c0) returned 0x0 [0235.317] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x557c9c0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.317] WbemDefPath:IUnknown:Release (This=0x557c9c0) returned 0x3 [0235.318] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.318] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x557d8d8, puReturned=0x23de044*=0x1) returned 0x0 [0235.323] IUnknown:AddRef (This=0x557d8d8) returned 0x3 [0235.323] IUnknown:QueryInterface (in: This=0x557d8d8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.323] IUnknown:QueryInterface (in: This=0x557d8d8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.323] IUnknown:QueryInterface (in: This=0x557d8d8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557d8dc) returned 0x0 [0235.323] IMarshal:GetUnmarshalClass (in: This=0x557d8dc, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.323] IUnknown:Release (This=0x557d8dc) returned 0x3 [0235.323] CoTaskMemFree (pv=0x58e7e8) [0235.323] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.323] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.323] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.324] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.324] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.324] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.324] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556f090) returned 0x0 [0235.324] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.325] WbemDefPath:IUnknown:AddRef (This=0x556f090) returned 0x3 [0235.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x556f090, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.325] WbemDefPath:IUnknown:QueryInterface (in: This=0x556f090, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.339] WbemDefPath:IUnknown:QueryInterface (in: This=0x556f090, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x557ad40) returned 0x0 [0235.339] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x557ad40, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.339] WbemDefPath:IUnknown:Release (This=0x557ad40) returned 0x3 [0235.340] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.340] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x557e0d0, puReturned=0x23de044*=0x1) returned 0x0 [0235.342] IUnknown:AddRef (This=0x557e0d0) returned 0x3 [0235.342] IUnknown:QueryInterface (in: This=0x557e0d0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.342] IUnknown:QueryInterface (in: This=0x557e0d0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.342] IUnknown:QueryInterface (in: This=0x557e0d0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557e0d4) returned 0x0 [0235.342] IMarshal:GetUnmarshalClass (in: This=0x557e0d4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.342] IUnknown:Release (This=0x557e0d4) returned 0x3 [0235.342] CoTaskMemFree (pv=0x58e7e8) [0235.342] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.342] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.343] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.343] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.343] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.343] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.343] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556f020) returned 0x0 [0235.344] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.344] WbemDefPath:IUnknown:AddRef (This=0x556f020) returned 0x3 [0235.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x556f020, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x556f020, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.344] WbemDefPath:IUnknown:QueryInterface (in: This=0x556f020, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x557abf0) returned 0x0 [0235.344] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x557abf0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.344] WbemDefPath:IUnknown:Release (This=0x557abf0) returned 0x3 [0235.344] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.345] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x557e400, puReturned=0x23de044*=0x1) returned 0x0 [0235.345] IUnknown:AddRef (This=0x557e400) returned 0x3 [0235.345] IUnknown:QueryInterface (in: This=0x557e400, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.345] IUnknown:QueryInterface (in: This=0x557e400, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.345] IUnknown:QueryInterface (in: This=0x557e400, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557e404) returned 0x0 [0235.346] IMarshal:GetUnmarshalClass (in: This=0x557e404, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.346] IUnknown:Release (This=0x557e404) returned 0x3 [0235.346] CoTaskMemFree (pv=0x58e7e8) [0235.346] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.346] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.346] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.346] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.347] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e658) returned 0x0 [0235.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e658, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.347] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e658, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x556f100) returned 0x0 [0235.347] WbemDefPath:IUnknown:Release (This=0x58e658) returned 0x0 [0235.347] WbemDefPath:IUnknown:AddRef (This=0x556f100) returned 0x3 [0235.347] WbemDefPath:IUnknown:QueryInterface (in: This=0x556f100, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.348] WbemDefPath:IUnknown:QueryInterface (in: This=0x556f100, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.348] WbemDefPath:IUnknown:QueryInterface (in: This=0x556f100, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x557aff8) returned 0x0 [0235.348] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x557aff8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.348] WbemDefPath:IUnknown:Release (This=0x557aff8) returned 0x3 [0235.348] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0235.348] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x557cdb0, puReturned=0x23de044*=0x1) returned 0x0 [0235.349] IUnknown:AddRef (This=0x557cdb0) returned 0x3 [0235.349] IUnknown:QueryInterface (in: This=0x557cdb0, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.349] IUnknown:QueryInterface (in: This=0x557cdb0, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.349] IUnknown:QueryInterface (in: This=0x557cdb0, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557cdb4) returned 0x0 [0235.349] IMarshal:GetUnmarshalClass (in: This=0x557cdb4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.349] IUnknown:Release (This=0x557cdb4) returned 0x3 [0235.349] CoTaskMemFree (pv=0x58e6f8) [0235.350] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.350] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.350] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.350] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.350] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.350] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.351] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5584a48) returned 0x0 [0235.351] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.352] WbemDefPath:IUnknown:AddRef (This=0x5584a48) returned 0x3 [0235.352] WbemDefPath:IUnknown:QueryInterface (in: This=0x5584a48, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.352] WbemDefPath:IUnknown:QueryInterface (in: This=0x5584a48, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.352] WbemDefPath:IUnknown:QueryInterface (in: This=0x5584a48, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x557b370) returned 0x0 [0235.352] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x557b370, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.352] WbemDefPath:IUnknown:Release (This=0x557b370) returned 0x3 [0235.352] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.352] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x557da70, puReturned=0x23de044*=0x1) returned 0x0 [0235.354] IUnknown:AddRef (This=0x557da70) returned 0x3 [0235.354] IUnknown:QueryInterface (in: This=0x557da70, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.354] IUnknown:QueryInterface (in: This=0x557da70, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.354] IUnknown:QueryInterface (in: This=0x557da70, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557da74) returned 0x0 [0235.354] IMarshal:GetUnmarshalClass (in: This=0x557da74, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.355] IUnknown:Release (This=0x557da74) returned 0x3 [0235.355] CoTaskMemFree (pv=0x58e7e8) [0235.355] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.355] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.355] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.355] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.356] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.356] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x55848f8) returned 0x0 [0235.356] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.356] WbemDefPath:IUnknown:AddRef (This=0x55848f8) returned 0x3 [0235.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x55848f8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x55848f8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.356] WbemDefPath:IUnknown:QueryInterface (in: This=0x55848f8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x557b328) returned 0x0 [0235.356] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x557b328, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.357] WbemDefPath:IUnknown:Release (This=0x557b328) returned 0x3 [0235.357] CoTaskMemAlloc (cb=0x4) returned 0x58e688 [0235.357] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e688, puReturned=0x23de044 | out: apObjects=0x58e688*=0x557cf48, puReturned=0x23de044*=0x1) returned 0x0 [0235.361] IUnknown:AddRef (This=0x557cf48) returned 0x3 [0235.361] IUnknown:QueryInterface (in: This=0x557cf48, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e15c | out: ppvObject=0x19e15c*=0x0) returned 0x80004002 [0235.361] IUnknown:QueryInterface (in: This=0x557cf48, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e10c | out: ppvObject=0x19e10c*=0x0) returned 0x80004002 [0235.361] IUnknown:QueryInterface (in: This=0x557cf48, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e118 | out: ppvObject=0x19e118*=0x557cf4c) returned 0x0 [0235.361] IMarshal:GetUnmarshalClass (in: This=0x557cf4c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.361] IUnknown:Release (This=0x557cf4c) returned 0x3 [0235.362] CoTaskMemFree (pv=0x58e688) [0235.362] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.362] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.362] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.362] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.362] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6b8) returned 0x0 [0235.363] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.363] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x55849d8) returned 0x0 [0235.363] WbemDefPath:IUnknown:Release (This=0x58e6b8) returned 0x0 [0235.363] WbemDefPath:IUnknown:AddRef (This=0x55849d8) returned 0x3 [0235.363] WbemDefPath:IUnknown:QueryInterface (in: This=0x55849d8, riid=0x6c7b0208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e2ac | out: ppvObject=0x19e2ac*=0x0) returned 0x80004002 [0235.363] WbemDefPath:IUnknown:QueryInterface (in: This=0x55849d8, riid=0x6c7b015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e25c | out: ppvObject=0x19e25c*=0x0) returned 0x80004002 [0235.364] WbemDefPath:IUnknown:QueryInterface (in: This=0x55849d8, riid=0x6c6840e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e268 | out: ppvObject=0x19e268*=0x557b4d8) returned 0x0 [0235.364] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x557b4d8, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e270 | out: pCid=0x19e270*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0235.364] WbemDefPath:IUnknown:Release (This=0x557b4d8) returned 0x3 [0235.364] CoTaskMemAlloc (cb=0x4) returned 0x58e658 [0235.364] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e658, puReturned=0x23de044 | out: apObjects=0x58e658*=0x557dda0, puReturned=0x23de044*=0x1) returned 0x0 [0235.366] IMarshal:GetUnmarshalClass (in: This=0x557dda4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.367] IUnknown:Release (This=0x557dda4) returned 0x3 [0235.367] CoTaskMemFree (pv=0x58e658) [0235.367] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.367] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.367] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.367] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.368] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e688) returned 0x0 [0235.368] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e688, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.368] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e688, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x55851b8) returned 0x0 [0235.368] WbemDefPath:IUnknown:Release (This=0x58e688) returned 0x0 [0235.369] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0235.369] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x557d0e0, puReturned=0x23de044*=0x1) returned 0x0 [0235.371] IMarshal:GetUnmarshalClass (in: This=0x557d0e4, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.371] IUnknown:Release (This=0x557d0e4) returned 0x3 [0235.371] CoTaskMemFree (pv=0x58e6f8) [0235.371] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.372] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.372] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.372] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.372] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6b8) returned 0x0 [0235.373] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.373] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5585228) returned 0x0 [0235.373] WbemDefPath:IUnknown:Release (This=0x58e6b8) returned 0x0 [0235.373] CoTaskMemAlloc (cb=0x4) returned 0x58e6f8 [0235.373] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e6f8, puReturned=0x23de044 | out: apObjects=0x58e6f8*=0x557df38, puReturned=0x23de044*=0x1) returned 0x0 [0235.376] IMarshal:GetUnmarshalClass (in: This=0x557df3c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.376] IUnknown:Release (This=0x557df3c) returned 0x3 [0235.377] CoTaskMemFree (pv=0x58e6f8) [0235.382] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.382] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.382] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.382] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.382] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e818) returned 0x0 [0235.383] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e818, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.383] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e818, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5585068) returned 0x0 [0235.383] WbemDefPath:IUnknown:Release (This=0x58e818) returned 0x0 [0235.383] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.383] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x557e730, puReturned=0x23de044*=0x1) returned 0x0 [0235.387] IMarshal:GetUnmarshalClass (in: This=0x557e734, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.387] IUnknown:Release (This=0x557e734) returned 0x3 [0235.387] CoTaskMemFree (pv=0x58e7e8) [0235.387] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.387] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.387] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.387] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.388] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.388] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.388] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x55850d8) returned 0x0 [0235.388] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.389] CoTaskMemAlloc (cb=0x4) returned 0x58e658 [0235.389] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e658, puReturned=0x23de044 | out: apObjects=0x58e658*=0x557d410, puReturned=0x23de044*=0x1) returned 0x0 [0235.390] IMarshal:GetUnmarshalClass (in: This=0x557d414, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.390] IUnknown:Release (This=0x557d414) returned 0x3 [0235.391] CoTaskMemFree (pv=0x58e658) [0235.391] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.391] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.391] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.391] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.391] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6b8) returned 0x0 [0235.392] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6b8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.392] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6b8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5585148) returned 0x0 [0235.392] WbemDefPath:IUnknown:Release (This=0x58e6b8) returned 0x0 [0235.392] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.392] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x557d5a8, puReturned=0x23de044*=0x1) returned 0x0 [0235.394] IMarshal:GetUnmarshalClass (in: This=0x557d5ac, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.394] IUnknown:Release (This=0x557d5ac) returned 0x3 [0235.394] CoTaskMemFree (pv=0x58e7e8) [0235.394] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.394] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.394] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.395] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.395] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e6f8) returned 0x0 [0235.395] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e6f8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.395] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e6f8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5584968) returned 0x0 [0235.395] WbemDefPath:IUnknown:Release (This=0x58e6f8) returned 0x0 [0235.396] CoTaskMemAlloc (cb=0x4) returned 0x58e818 [0235.396] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e818, puReturned=0x23de044 | out: apObjects=0x58e818*=0x557ca80, puReturned=0x23de044*=0x1) returned 0x0 [0235.398] IMarshal:GetUnmarshalClass (in: This=0x557ca84, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.398] IUnknown:Release (This=0x557ca84) returned 0x3 [0235.398] CoTaskMemFree (pv=0x58e818) [0235.398] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.398] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.398] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.398] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.399] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e818) returned 0x0 [0235.399] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e818, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.399] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e818, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5584b98) returned 0x0 [0235.399] WbemDefPath:IUnknown:Release (This=0x58e818) returned 0x0 [0235.399] CoTaskMemAlloc (cb=0x4) returned 0x58e7e8 [0235.400] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e7e8, puReturned=0x23de044 | out: apObjects=0x58e7e8*=0x557e268, puReturned=0x23de044*=0x1) returned 0x0 [0235.401] IMarshal:GetUnmarshalClass (in: This=0x557e26c, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e120 | out: pCid=0x19e120*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0235.401] IUnknown:Release (This=0x557e26c) returned 0x3 [0235.401] CoTaskMemFree (pv=0x58e7e8) [0235.401] CoGetObjectContext (in: riid=0x2320010*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1dc | out: ppv=0x19f1dc*=0x4d0cbc) returned 0x0 [0235.401] IComThreadingInfo:GetCurrentApartmentType (in: This=0x4d0cbc, pAptType=0x19f1d4 | out: pAptType=0x19f1d4*=1) returned 0x0 [0235.401] IUnknown:QueryInterface (in: This=0x4d0cbc, riid=0x231fff8*(Data1=0x51372ae0, Data2=0xcae7, Data3=0x11cf, Data4=([0]=0xbe, [1]=0x81, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0xa2, [6]=0xfa, [7]=0x25)), ppvObject=0x19f1d8 | out: ppvObject=0x19f1d8*=0x0) returned 0x80004002 [0235.401] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0235.402] CoGetClassObject (in: rclsid=0x5256a4*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c7254e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19eb48 | out: ppv=0x19eb48*=0x58e7e8) returned 0x0 [0235.402] WbemDefPath:IUnknown:QueryInterface (in: This=0x58e7e8, riid=0x6c6d95e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed60 | out: ppvObject=0x19ed60*=0x0) returned 0x80004002 [0235.402] WbemDefPath:IClassFactory:CreateInstance (in: This=0x58e7e8, pUnkOuter=0x0, riid=0x6c676c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed74 | out: ppvObject=0x19ed74*=0x5584ab8) returned 0x0 [0235.402] WbemDefPath:IUnknown:Release (This=0x58e7e8) returned 0x0 [0235.403] CoTaskMemAlloc (cb=0x4) returned 0x58e658 [0235.403] IEnumWbemClassObject:Next (in: This=0x58c6b8, lTimeout=-1, uCount=0x1, apObjects=0x58e658, puReturned=0x23de044 | out: apObjects=0x58e658*=0x0, puReturned=0x23de044*=0x0) returned 0x1 [0235.403] CoTaskMemFree (pv=0x58e658) [0235.403] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x1 [0235.403] IUnknown:Release (This=0x58c6b8) returned 0x0 [0235.404] WbemLocator:IUnknown:Release (This=0x4e5fc0) returned 0x1 [0235.404] IUnknown:Release (This=0x58d1a8) returned 0x0 [0235.422] CoTaskMemAlloc (cb=0x20c) returned 0x5146b0 [0235.422] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x5146b0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0235.422] CoTaskMemFree (pv=0x5146b0) [0235.423] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19ecf0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25 [0235.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f25c) returned 1 [0235.423] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", nBufferLength=0x105, lpBuffer=0x19ed64, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", lpFilePart=0x0) returned 0x3c [0235.423] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata\\", nBufferLength=0x105, lpBuffer=0x19ed38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata\\", lpFilePart=0x0) returned 0x3d [0235.423] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata\\*", lpFindFileData=0x19ef84 | out: lpFindFileData=0x19ef84*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0235.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f220) returned 1 [0235.427] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", nBufferLength=0x105, lpBuffer=0x19ede4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", lpFilePart=0x0) returned 0x3c [0235.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f298) returned 1 [0235.427] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", nBufferLength=0x105, lpBuffer=0x19eda0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata", lpFilePart=0x0) returned 0x3c [0235.427] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata\\", nBufferLength=0x105, lpBuffer=0x19ed74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata\\", lpFilePart=0x0) returned 0x3d [0235.427] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\tdata\\*", lpFindFileData=0x19efc0 | out: lpFindFileData=0x19efc0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0235.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f25c) returned 1 [0235.437] CoCreateGuid (in: pguid=0x19efcc | out: pguid=0x19efcc*(Data1=0x6e091d4b, Data2=0xe996, Data3=0x4dd5, Data4=([0]=0x98, [1]=0x22, [2]=0xb5, [3]=0x32, [4]=0x25, [5]=0xd0, [6]=0x89, [7]=0x6e))) returned 0x0 [0235.437] CoCreateGuid (in: pguid=0x19eefc | out: pguid=0x19eefc*(Data1=0xb18076b6, Data2=0xfa99, Data3=0x453d, Data4=([0]=0xa6, [1]=0x6, [2]=0xbc, [3]=0xac, [4]=0xd9, [5]=0x18, [6]=0x56, [7]=0x87))) returned 0x0 [0235.437] send (s=0x2cc, buf=0x35f4087*, len=167, flags=0) returned 167 [0235.559] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 132 [0235.563] CoCreateGuid (in: pguid=0x19f01c | out: pguid=0x19f01c*(Data1=0x3b3022a5, Data2=0xc141, Data3=0x409a, Data4=([0]=0x84, [1]=0x23, [2]=0xc0, [3]=0x3, [4]=0xac, [5]=0xc1, [6]=0xcc, [7]=0xd4))) returned 0x0 [0235.563] CoCreateGuid (in: pguid=0x19ef4c | out: pguid=0x19ef4c*(Data1=0xb466d2e5, Data2=0xb3e8, Data3=0x4eab, Data4=([0]=0x80, [1]=0x49, [2]=0xf9, [3]=0xfd, [4]=0x66, [5]=0x87, [6]=0x74, [7]=0x61))) returned 0x0 [0235.564] send (s=0x2cc, buf=0x240c843*, len=156, flags=0) returned 156 [0235.564] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 112 [0235.619] CoCreateGuid (in: pguid=0x19efe4 | out: pguid=0x19efe4*(Data1=0xb4da5dca, Data2=0x2d3, Data3=0x4d73, Data4=([0]=0xae, [1]=0x8e, [2]=0x16, [3]=0xe8, [4]=0x3d, [5]=0xd7, [6]=0xe9, [7]=0x4e))) returned 0x0 [0235.619] CoCreateGuid (in: pguid=0x19ef14 | out: pguid=0x19ef14*(Data1=0x9ab54d24, Data2=0x147a, Data3=0x43fc, Data4=([0]=0x92, [1]=0xd0, [2]=0x72, [3]=0xb3, [4]=0x14, [5]=0x47, [6]=0x28, [7]=0xe0))) returned 0x0 [0235.620] send (s=0x2cc, buf=0x240d92b*, len=565, flags=0) returned 565 [0235.621] recv (in: s=0x2cc, buf=0x22f99e4, len=8192, flags=0 | out: buf=0x22f99e4*) returned 349 [0235.794] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x270 [0235.794] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x2d0 [0235.799] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e4ac | out: phkResult=0x19e4ac*=0x274) returned 0x0 [0235.799] RegQueryValueExW (in: hKey=0x274, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19e4cc, lpData=0x0, lpcbData=0x19e4c8*=0x0 | out: lpType=0x19e4cc*=0x1, lpData=0x0, lpcbData=0x19e4c8*=0xe) returned 0x0 [0235.799] RegQueryValueExW (in: hKey=0x274, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19e4cc, lpData=0x2417778, lpcbData=0x19e4c8*=0xe | out: lpType=0x19e4cc*=0x1, lpData="Client", lpcbData=0x19e4c8*=0xe) returned 0x0 [0235.799] RegCloseKey (hKey=0x274) returned 0x0 [0235.813] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x19dd90 | out: phkResult=0x19dd90*=0x0) returned 0x2 [0235.816] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f2a8 | out: phkResult=0x19f2a8*=0x274) returned 0x0 [0235.816] RegQueryValueExW (in: hKey=0x274, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x19f2c4, lpData=0x0, lpcbData=0x19f2c0*=0x0 | out: lpType=0x19f2c4*=0x0, lpData=0x0, lpcbData=0x19f2c0*=0x0) returned 0x2 [0235.816] RegCloseKey (hKey=0x274) returned 0x0 [0235.916] GetACP () returned 0x4e4 [0235.918] ExpandEnvironmentStringsW (in: lpSrc="%tmp%", lpDst=0x19f1dc, nSize=0x64 | out: lpDst="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp") returned 0x25 [0235.918] ExpandEnvironmentStringsW (in: lpSrc="%tmp%/build.exe", lpDst=0x19f1dc, nSize=0x64 | out: lpDst="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp/build.exe") returned 0x2f [0235.927] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x19ed04, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16 [0235.928] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", nBufferLength=0x105, lpBuffer=0x19ed18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", lpFilePart=0x0) returned 0x32 [0235.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f20c) returned 1 [0235.928] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x27c [0235.930] GetFileType (hFile=0x27c) returned 0x1 [0235.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f208) returned 1 [0235.930] GetFileType (hFile=0x27c) returned 0x1 [0235.959] GetCurrentProcess () returned 0xffffffff [0235.959] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ee80 | out: TokenHandle=0x19ee80*=0x2d4) returned 1 [0235.963] GetCurrentProcess () returned 0xffffffff [0235.963] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ee94 | out: TokenHandle=0x19ee94*=0x280) returned 1 [0235.981] QueryPerformanceFrequency (in: lpFrequency=0x485e30 | out: lpFrequency=0x485e30*=100000000) returned 1 [0235.983] QueryPerformanceCounter (in: lpPerformanceCount=0x19f29c | out: lpPerformanceCount=0x19f29c*=1215619289597) returned 1 [0235.992] GetCurrentProcess () returned 0xffffffff [0235.993] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ee64 | out: TokenHandle=0x19ee64*=0x42c) returned 1 [0236.006] GetCurrentProcess () returned 0xffffffff [0236.006] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ee78 | out: TokenHandle=0x19ee78*=0x284) returned 1 [0236.022] GetCurrentProcess () returned 0xffffffff [0236.023] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f184 | out: TokenHandle=0x19f184*=0x2c4) returned 1 [0236.755] CoTaskMemAlloc (cb=0xcc0) returned 0x558ee78 [0236.755] RasEnumConnectionsW (in: param_1=0x558ee78, param_2=0x19f194, param_3=0x19f198 | out: param_1=0x558ee78, param_2=0x19f194, param_3=0x19f198) returned 0x0 [0236.968] CoTaskMemFree (pv=0x558ee78) [0236.968] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x464 [0236.969] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x468 [0236.969] ioctlsocket (in: s=0x464, cmd=-2147195266, argp=0x19f19c | out: argp=0x19f19c) returned 0 [0236.969] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x46c [0236.970] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x470 [0236.970] ioctlsocket (in: s=0x46c, cmd=-2147195266, argp=0x19f19c | out: argp=0x19f19c) returned 0 [0236.971] WSAIoctl (in: s=0x464, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19f184, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19f184, lpOverlapped=0x0) returned -1 [0236.972] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19eeb4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0236.989] WSAEventSelect (s=0x464, hEventObject=0x468, lNetworkEvents=512) returned 0 [0236.989] WSAIoctl (in: s=0x46c, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19f184, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19f184, lpOverlapped=0x0) returned -1 [0236.989] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19eeb4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0236.989] WSAEventSelect (s=0x46c, hEventObject=0x470, lNetworkEvents=512) returned 0 [0236.989] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x478 [0236.990] RasConnectionNotificationW (param_1=0xffffffff, param_2=0x478, param_3=0x3) returned 0x0 [0236.999] RegOpenCurrentUser (in: samDesired=0x20019, phkResult=0x19f1b0 | out: phkResult=0x19f1b0*=0x490) returned 0x0 [0236.999] RegOpenKeyExW (in: hKey=0x490, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f160 | out: phkResult=0x19f160*=0x494) returned 0x0 [0237.000] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x498 [0237.000] RegNotifyChangeKeyValue (hKey=0x494, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x498, fAsynchronous=1) returned 0x0 [0237.001] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f164 | out: phkResult=0x19f164*=0x49c) returned 0x0 [0237.001] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a0 [0237.001] RegNotifyChangeKeyValue (hKey=0x49c, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4a0, fAsynchronous=1) returned 0x0 [0237.002] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f164 | out: phkResult=0x19f164*=0x4a4) returned 0x0 [0237.002] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x4a8 [0237.002] RegNotifyChangeKeyValue (hKey=0x4a4, bWatchSubtree=1, dwNotifyFilter=0x4, hEvent=0x4a8, fAsynchronous=1) returned 0x0 [0237.002] GetCurrentProcess () returned 0xffffffff [0237.002] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19f158 | out: TokenHandle=0x19f158*=0x4ac) returned 1 [0237.016] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ea68 | out: phkResult=0x19ea68*=0x4bc) returned 0x0 [0237.017] RegQueryValueExW (in: hKey=0x4bc, lpValueName="LegacyWPADSupport", lpReserved=0x0, lpType=0x19ea84, lpData=0x0, lpcbData=0x19ea80*=0x0 | out: lpType=0x19ea84*=0x0, lpData=0x0, lpcbData=0x19ea80*=0x0) returned 0x2 [0237.017] RegCloseKey (hKey=0x4bc) returned 0x0 [0237.382] WinHttpOpen (pszAgentW=0x0, dwAccessType=0x1, pszProxyW=0x0, pszProxyBypassW=0x0, dwFlags=0x0) returned 0x5558060 [0237.808] WinHttpSetTimeouts (hInternet=0x5558060, nResolveTimeout=60000, nConnectTimeout=60000, nSendTimeout=60000, nReceiveTimeout=60000) returned 1 [0237.809] WinHttpGetIEProxyConfigForCurrentUser (in: pProxyConfig=0x19f164 | out: pProxyConfig=0x19f164) returned 1 [0238.195] CoTaskMemAlloc (cb=0x20c) returned 0x529fc8 [0238.195] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_Disabled", lpBuffer=0x529fc8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0238.195] CoTaskMemFree (pv=0x529fc8) [0238.195] CoTaskMemAlloc (cb=0x20c) returned 0x529fc8 [0238.195] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.HttpWebRequest_MinCount", lpBuffer=0x529fc8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0238.196] CoTaskMemFree (pv=0x529fc8) [0238.198] EtwEventRegister (in: ProviderId=0x241f424, EnableCallback=0x4e007ce, CallbackContext=0x0, RegHandle=0x241f400 | out: RegHandle=0x241f400) returned 0x0 [0238.198] EtwEventSetInformation (RegHandle=0x518378, InformationClass=0x52, EventInformation=0x2, InformationLength=0x241f3c0) returned 0x0 [0238.200] GetCurrentProcess () returned 0xffffffff [0238.200] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ee2c | out: TokenHandle=0x19ee2c*=0x4f4) returned 1 [0238.202] GetCurrentProcess () returned 0xffffffff [0238.202] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ee40 | out: TokenHandle=0x19ee40*=0x500) returned 1 [0238.206] SetEvent (hEvent=0x270) returned 1 [0238.218] GetCurrentProcess () returned 0xffffffff [0238.218] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ed80 | out: TokenHandle=0x19ed80*=0x518) returned 1 [0238.219] GetCurrentProcess () returned 0xffffffff [0238.219] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ed94 | out: TokenHandle=0x19ed94*=0x51c) returned 1 [0238.220] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19ef98 | out: lpTimeZoneInformation=0x19ef98) returned 0x1 [0238.221] SetEvent (hEvent=0x270) returned 1 [0238.229] GetNetworkParams (in: pFixedInfo=0x0, pOutBufLen=0x19f0f4 | out: pFixedInfo=0x0, pOutBufLen=0x19f0f4) returned 0x6f [0238.696] LocalAlloc (uFlags=0x0, uBytes=0x248) returned 0x529fc8 [0238.696] GetNetworkParams (in: pFixedInfo=0x529fc8, pOutBufLen=0x19f0f4 | out: pFixedInfo=0x529fc8, pOutBufLen=0x19f0f4) returned 0x0 [0238.708] LocalFree (hMem=0x529fc8) returned 0x0 [0238.709] CoTaskMemAlloc (cb=0x20c) returned 0x529fc8 [0238.709] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_Disabled", lpBuffer=0x529fc8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0238.709] CoTaskMemFree (pv=0x529fc8) [0238.709] CoTaskMemAlloc (cb=0x20c) returned 0x529fc8 [0238.709] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.Connection_MinCount", lpBuffer=0x529fc8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0238.710] CoTaskMemFree (pv=0x529fc8) [0238.714] WSASocketW (af=2, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x55c [0238.715] WSASocketW (af=23, type=1, protocol=6, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x534 [0238.716] GetAddrInfoW (in: pNodeName="cdn.discordapp.com", pServiceName=0x0, pHints=0x19efe4*(ai_flags=2, ai_family=0, ai_socktype=0, ai_protocol=0, ai_addrlen=0x0, ai_canonname=0x0, ai_addr=0x0, ai_next=0x0), ppResult=0x19ef8c | out: ppResult=0x19ef8c*=0x521b30*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="cdn.discordapp.com", ai_addr=0x5588800*(sa_family=2, sin_port=0x0, sin_addr="162.159.135.233"), ai_next=0x521b58*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5588878*(sa_family=2, sin_port=0x0, sin_addr="162.159.133.233"), ai_next=0x521bf8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x55887a0*(sa_family=2, sin_port=0x0, sin_addr="162.159.129.233"), ai_next=0x521c20*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5588770*(sa_family=2, sin_port=0x0, sin_addr="162.159.130.233"), ai_next=0x521810*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x55888a8*(sa_family=2, sin_port=0x0, sin_addr="162.159.134.233"), ai_next=0x0)))))) returned 0 [0239.074] FreeAddrInfoW (pAddrInfo=0x521b30*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname="cdn.discordapp.com", ai_addr=0x5588800*(sa_family=2, sin_port=0x0, sin_addr="162.159.135.233"), ai_next=0x521b58*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5588878*(sa_family=2, sin_port=0x0, sin_addr="162.159.133.233"), ai_next=0x521bf8*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x55887a0*(sa_family=2, sin_port=0x0, sin_addr="162.159.129.233"), ai_next=0x521c20*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x5588770*(sa_family=2, sin_port=0x0, sin_addr="162.159.130.233"), ai_next=0x521810*(ai_flags=0, ai_family=2, ai_socktype=0, ai_protocol=0, ai_addrlen=0x10, ai_canonname=0x0, ai_addr=0x55888a8*(sa_family=2, sin_port=0x0, sin_addr="162.159.134.233"), ai_next=0x0)))))) [0239.075] WSASocketW (af=2, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x564 [0239.076] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x56c [0239.076] ioctlsocket (in: s=0x564, cmd=-2147195266, argp=0x19efbc | out: argp=0x19efbc) returned 0 [0239.076] WSASocketW (af=23, type=2, protocol=0, lpProtocolInfo=0x0, g=0x0, dwFlags=0x1) returned 0x570 [0239.077] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x574 [0239.077] ioctlsocket (in: s=0x570, cmd=-2147195266, argp=0x19efbc | out: argp=0x19efbc) returned 0 [0239.077] WSAIoctl (in: s=0x564, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19efa4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19efa4, lpOverlapped=0x0) returned -1 [0239.077] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ecd4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0239.077] WSAEventSelect (s=0x564, hEventObject=0x56c, lNetworkEvents=512) returned 0 [0239.077] WSAIoctl (in: s=0x570, dwIoControlCode=0x28000017, lpvInBuffer=0x0, cbInBuffer=0x0, lpvOutBuffer=0x0, cbOutBuffer=0x0, lpcbBytesReturned=0x19efa4, lpOverlapped=0x0, lpCompletionRoutine=0x0 | out: lpvOutBuffer=0x0, lpcbBytesReturned=0x19efa4, lpOverlapped=0x0) returned -1 [0239.077] FormatMessageW (in: dwFlags=0x3200, lpSource=0x0, dwMessageId=0x2733, dwLanguageId=0x0, lpBuffer=0x19ecd4, nSize=0x101, Arguments=0x0 | out: lpBuffer="A non-blocking socket operation could not be completed immediately.\r\n") returned 0x45 [0239.077] WSAEventSelect (s=0x570, hEventObject=0x574, lNetworkEvents=512) returned 0 [0239.078] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x19efa0*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x19efa0*=0xa78) returned 0x6f [0239.084] LocalAlloc (uFlags=0x0, uBytes=0xa78) returned 0x559e5c0 [0239.084] GetAdaptersAddresses (in: Family=0x0, Flags=0x2e, Reserved=0x0, AdapterAddresses=0x559e5c0, SizePointer=0x19efa0*=0xa78 | out: AdapterAddresses=0x559e5c0*(Alignment=0x500000178, Length=0x178, IfIndex=0x5, Next=0x559e868, AdapterName="{E25A642B-6CEB-4194-8F83-8BC82AF94F5A}", FirstUnicastAddress=0x559e7dc, FirstAnycastAddress=0x0, FirstMulticastAddress=0x0, FirstDnsServerAddress=0x0, DnsSuffix="", Description="Intel(R) 82574L Gigabit Network Connection", FriendlyName="Ethernet", PhysicalAddress=([0]=0x0, [1]=0x1, [2]=0x4a, [3]=0x5a, [4]=0x8a, [5]=0xda, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x1c5, DdnsEnabled=0x1c5, RegisterAdapterSuffix=0x1c5, Dhcpv4Enabled=0x1c5, ReceiveOnly=0x1c5, NoMulticast=0x1c5, Ipv6OtherStatefulConfig=0x1c5, NetbiosOverTcpipEnabled=0x1c5, Ipv4Enabled=0x1c5, Ipv6Enabled=0x1c5, Ipv6ManagedAddressConfigurationSupported=0x1c5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x5, ZoneIndices=([0]=0x5, [1]=0x5, [2]=0x5, [3]=0x5, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6008000000000, Dhcpv4Server.lpSockaddr=0x559e738*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11eb6c9dc20d55b0, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x28, [5]=0xb6, [6]=0x28, [7]=0x5e, [8]=0x0, [9]=0xf, [10]=0xf3, [11]=0xe1, [12]=0x61, [13]=0x38, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x300053a, FirstDnsSuffix=0x0), SizePointer=0x19efa0*=0xa78) returned 0x0 [0239.091] LocalFree (hMem=0x559e5c0) returned 0x0 [0239.093] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19efb0 | out: phkResult=0x19efb0*=0x568) returned 0x0 [0239.093] RegQueryValueExW (in: hKey=0x568, lpValueName="HWRPortReuseOnSocketBind", lpReserved=0x0, lpType=0x19efcc, lpData=0x0, lpcbData=0x19efc8*=0x0 | out: lpType=0x19efcc*=0x0, lpData=0x0, lpcbData=0x19efc8*=0x0) returned 0x2 [0239.093] RegCloseKey (hKey=0x568) returned 0x0 [0239.093] WSAConnect (in: s=0x55c, name=0x242a8fc*(sa_family=2, sin_port=0x1bb, sin_addr="162.159.135.233"), namelen=16, lpCallerData=0x0, lpCalleeData=0x0, lpSQOS=0x0, lpGQOS=0x0 | out: lpCalleeData=0x0) returned 0 [0239.112] closesocket (s=0x534) returned 0 [0239.122] EnumerateSecurityPackagesW (in: pcPackages=0x19ef34, ppPackageInfo=0x19eec8 | out: pcPackages=0x19ef34, ppPackageInfo=0x19eec8) returned 0x0 [0239.129] FreeContextBuffer (in: pvContextBuffer=0x558f668 | out: pvContextBuffer=0x558f668) returned 0x0 [0239.136] GetCurrentProcess () returned 0xffffffff [0239.136] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19ed14 | out: TokenHandle=0x19ed14*=0x568) returned 1 [0239.138] AcquireCredentialsHandleW (in: pPrincipal=0x0, pPackage=0x242b9bc, fCredentialUse=0x2, pvLogonId=0x0, pAuthData=0x19ed68, pGetKeyFn=0x0, pvGetKeyArgument=0x0, phCredential=0x242cf34, ptsExpiry=0x19ecec | out: phCredential=0x242cf34, ptsExpiry=0x19ecec) returned 0x0 [0240.214] InitializeSecurityContextW (in: phCredential=0x19ed2c, phContext=0x0, pTargetName=0x242a9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x0, Reserved2=0x0, phNewContext=0x242d138, pOutput=0x242d0d0, pfContextAttr=0x242b990, ptsExpiry=0x19ed24 | out: phNewContext=0x242d138, pOutput=0x242d0d0, pfContextAttr=0x242b990, ptsExpiry=0x19ed24) returned 0x90312 [0240.215] FreeContextBuffer (in: pvContextBuffer=0x5539b8 | out: pvContextBuffer=0x5539b8) returned 0x0 [0240.219] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74f30000 [0240.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="GetCurrentPackageId", cchWideChar=19, lpMultiByteStr=0x19ed74, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentPackageId\x9a`ϸjÏÓ&\x9a «flhö\x19", lpUsedDefaultChar=0x0) returned 19 [0240.220] GetProcAddress (hModule=0x74f30000, lpProcName="GetCurrentPackageId") returned 0x76b8ded0 [0240.221] GetCurrentPackageId () returned 0x3d54 [0240.223] send (s=0x55c, buf=0x242d14c*, len=186, flags=0) returned 186 [0240.224] recv (in: s=0x55c, buf=0x242d14c, len=5, flags=0 | out: buf=0x242d14c*) returned 5 [0240.245] recv (in: s=0x55c, buf=0x242d151, len=67, flags=0 | out: buf=0x242d151*) returned 67 [0240.246] InitializeSecurityContextW (in: phCredential=0x19ec90, phContext=0x19ed1c, pTargetName=0x242a9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x242d460, Reserved2=0x0, phNewContext=0x242d138, pOutput=0x242d474, pfContextAttr=0x242b990, ptsExpiry=0x19ec88 | out: phNewContext=0x242d138, pOutput=0x242d474, pfContextAttr=0x242b990, ptsExpiry=0x19ec88) returned 0x90312 [0240.247] recv (in: s=0x55c, buf=0x242d504, len=5, flags=0 | out: buf=0x242d504*) returned 5 [0240.247] recv (in: s=0x55c, buf=0x242d51d, len=2334, flags=0 | out: buf=0x242d51d*) returned 2334 [0240.247] InitializeSecurityContextW (in: phCredential=0x19ebf8, phContext=0x19ec84, pTargetName=0x242a9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x242deac, Reserved2=0x0, phNewContext=0x242d138, pOutput=0x242dec0, pfContextAttr=0x242b990, ptsExpiry=0x19ebf0 | out: phNewContext=0x242d138, pOutput=0x242dec0, pfContextAttr=0x242b990, ptsExpiry=0x19ebf0) returned 0x90312 [0240.249] recv (in: s=0x55c, buf=0x242df50, len=5, flags=0 | out: buf=0x242df50*) returned 5 [0240.249] recv (in: s=0x55c, buf=0x242df69, len=147, flags=0 | out: buf=0x242df69*) returned 147 [0240.249] InitializeSecurityContextW (in: phCredential=0x19eb60, phContext=0x19ebec, pTargetName=0x242a9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x242e06c, Reserved2=0x0, phNewContext=0x242d138, pOutput=0x242e080, pfContextAttr=0x242b990, ptsExpiry=0x19eb58 | out: phNewContext=0x242d138, pOutput=0x242e080, pfContextAttr=0x242b990, ptsExpiry=0x19eb58) returned 0x90312 [0240.249] recv (in: s=0x55c, buf=0x242e110, len=5, flags=0 | out: buf=0x242e110*) returned 5 [0240.249] recv (in: s=0x55c, buf=0x242e129, len=4, flags=0 | out: buf=0x242e129*) returned 4 [0240.250] InitializeSecurityContextW (in: phCredential=0x19eac8, phContext=0x19eb54, pTargetName=0x242a9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x242e1a0, Reserved2=0x0, phNewContext=0x242d138, pOutput=0x242e1b4, pfContextAttr=0x242b990, ptsExpiry=0x19eac0 | out: phNewContext=0x242d138, pOutput=0x242e1b4, pfContextAttr=0x242b990, ptsExpiry=0x19eac0) returned 0x90312 [0240.264] FreeContextBuffer (in: pvContextBuffer=0x5005e8 | out: pvContextBuffer=0x5005e8) returned 0x0 [0240.264] send (s=0x55c, buf=0x242e230*, len=126, flags=0) returned 126 [0240.265] recv (in: s=0x55c, buf=0x242e230, len=5, flags=0 | out: buf=0x242e230*) returned 5 [0240.281] recv (in: s=0x55c, buf=0x242e2d5, len=202, flags=0 | out: buf=0x242e2d5*) returned 202 [0240.281] InitializeSecurityContextW (in: phCredential=0x19ea30, phContext=0x19eabc, pTargetName=0x242a9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x242e410, Reserved2=0x0, phNewContext=0x242d138, pOutput=0x242e424, pfContextAttr=0x242b990, ptsExpiry=0x19ea28 | out: phNewContext=0x242d138, pOutput=0x242e424, pfContextAttr=0x242b990, ptsExpiry=0x19ea28) returned 0x90312 [0240.281] recv (in: s=0x55c, buf=0x242e4b4, len=5, flags=0 | out: buf=0x242e4b4*) returned 5 [0240.281] recv (in: s=0x55c, buf=0x242e4cd, len=1, flags=0 | out: buf=0x242e4cd*) returned 1 [0240.282] InitializeSecurityContextW (in: phCredential=0x19e998, phContext=0x19ea24, pTargetName=0x242a9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x242e540, Reserved2=0x0, phNewContext=0x242d138, pOutput=0x242e554, pfContextAttr=0x242b990, ptsExpiry=0x19e990 | out: phNewContext=0x242d138, pOutput=0x242e554, pfContextAttr=0x242b990, ptsExpiry=0x19e990) returned 0x90312 [0240.282] recv (in: s=0x55c, buf=0x242e5e4, len=5, flags=0 | out: buf=0x242e5e4*) returned 5 [0240.282] recv (in: s=0x55c, buf=0x242e5fd, len=40, flags=0 | out: buf=0x242e5fd*) returned 40 [0240.282] InitializeSecurityContextW (in: phCredential=0x19e900, phContext=0x19e98c, pTargetName=0x242a9dc, fContextReq=0x8011c, Reserved1=0x0, TargetDataRep=0x10, pInput=0x242e698, Reserved2=0x0, phNewContext=0x242d138, pOutput=0x242e6ac, pfContextAttr=0x242b990, ptsExpiry=0x19e8f8 | out: phNewContext=0x242d138, pOutput=0x242e6ac, pfContextAttr=0x242b990, ptsExpiry=0x19e8f8) returned 0x0 [0240.856] QueryContextAttributesW (in: phContext=0x242d138, ulAttribute=0x4, pBuffer=0x242e758 | out: pBuffer=0x242e758) returned 0x0 [0240.856] QueryContextAttributesW (in: phContext=0x242d138, ulAttribute=0x5a, pBuffer=0x242e7b0 | out: pBuffer=0x242e7b0) returned 0x0 [0240.863] QueryContextAttributesW (in: phContext=0x242d138, ulAttribute=0x53, pBuffer=0x242ea64 | out: pBuffer=0x242ea64) returned 0x0 [0240.869] CertDuplicateCertificateContext (pCertContext=0x55931b0) returned 0x55931b0 [0240.869] CertDuplicateStore (hCertStore=0x544530) returned 0x544530 [0240.870] CertEnumCertificatesInStore (hCertStore=0x544530, pPrevCertContext=0x0) returned 0x5593200 [0240.870] CertDuplicateCertificateContext (pCertContext=0x5593200) returned 0x5593200 [0240.870] CertEnumCertificatesInStore (hCertStore=0x544530, pPrevCertContext=0x5593200) returned 0x55931b0 [0240.870] CertDuplicateCertificateContext (pCertContext=0x55931b0) returned 0x55931b0 [0240.870] CertEnumCertificatesInStore (hCertStore=0x544530, pPrevCertContext=0x55931b0) returned 0x0 [0240.870] CertCloseStore (hCertStore=0x544530, dwFlags=0x0) returned 1 [0240.870] CertFreeCertificateContext (pCertContext=0x55931b0) returned 1 [0240.881] CertOpenStore (lpszStoreProvider=0x2, dwEncodingType=0x10001, hCryptProv=0x0, dwFlags=0x2204, pvPara=0x0) returned 0x5442d8 [0240.883] CertAddCRLLinkToStore (in: hCertStore=0x5442d8, pCrlContext=0x5593200, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0240.884] CertAddCRLLinkToStore (in: hCertStore=0x5442d8, pCrlContext=0x55931b0, dwAddDisposition=0x4, ppStoreContext=0x0 | out: ppStoreContext=0x0) returned 1 [0240.887] CertGetCertificateChain (in: hChainEngine=0x0, pCertContext=0x55931b0, pTime=0x19e90c, hAdditionalStore=0x5442d8, pChainPara=0x19e84c, dwFlags=0x0, pvReserved=0x0, ppChainContext=0x19e840 | out: ppChainContext=0x19e840) returned 1 [0240.898] CertDuplicateCertificateChain (pChainContext=0x55a76e8) returned 0x55a76e8 [0240.899] CertDuplicateCertificateContext (pCertContext=0x55931b0) returned 0x55931b0 [0240.899] CertDuplicateCertificateContext (pCertContext=0x5593750) returned 0x5593750 [0240.899] CertDuplicateCertificateContext (pCertContext=0x5593250) returned 0x5593250 [0240.899] CertFreeCertificateChain (pChainContext=0x55a76e8) [0240.900] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x1, pChainContext=0x55a76e8, pPolicyPara=0x19e9ec, pPolicyStatus=0x19e9d8 | out: pPolicyStatus=0x19e9d8) returned 1 [0240.900] SetLastError (dwErrCode=0x0) [0240.902] CertVerifyCertificateChainPolicy (in: pszPolicyOID=0x4, pChainContext=0x55a76e8, pPolicyPara=0x19ea58, pPolicyStatus=0x19ea00 | out: pPolicyStatus=0x19ea00) returned 1 [0240.935] CertFreeCertificateChain (pChainContext=0x55a76e8) [0240.935] CertFreeCertificateContext (pCertContext=0x55931b0) returned 1 [0240.937] CoTaskMemAlloc (cb=0x20c) returned 0x55a76e8 [0240.937] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x55a76e8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0240.937] CoTaskMemFree (pv=0x55a76e8) [0240.937] CoTaskMemAlloc (cb=0x20c) returned 0x55a76e8 [0240.937] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x55a76e8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0240.937] CoTaskMemFree (pv=0x55a76e8) [0240.937] CoTaskMemAlloc (cb=0x20c) returned 0x55a76e8 [0240.938] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_Disabled", lpBuffer=0x55a76e8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0240.938] CoTaskMemFree (pv=0x55a76e8) [0240.938] CoTaskMemAlloc (cb=0x20c) returned 0x55a76e8 [0240.938] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Net.SslStream_MinCount", lpBuffer=0x55a76e8, nSize=0x104 | out: lpBuffer="") returned 0x0 [0240.938] CoTaskMemFree (pv=0x55a76e8) [0240.939] EncryptMessage (in: phContext=0x242d138, fQOP=0x0, pMessage=0x2436c4c, MessageSeqNo=0x0 | out: pMessage=0x2436c4c) returned 0x0 [0240.939] send (s=0x55c, buf=0x2435724*, len=163, flags=0) returned 163 [0240.940] setsockopt (s=0x55c, level=65535, optname=4102, optval=" \x86\x01", optlen=4) returned 0 [0240.940] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.974] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.977] DecryptMessage (in: phContext=0x242d138, pMessage=0x2446ff0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2446ff0, pfQOP=0x0) returned 0x0 [0240.981] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.981] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.981] DecryptMessage (in: phContext=0x242d138, pMessage=0x2449728, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2449728, pfQOP=0x0) returned 0x0 [0240.984] setsockopt (s=0x55c, level=65535, optname=4102, optval="à\x93\x04", optlen=4) returned 0 [0240.984] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.985] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.985] DecryptMessage (in: phContext=0x242d138, pMessage=0x245b404, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245b404, pfQOP=0x0) returned 0x0 [0240.985] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.985] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.985] DecryptMessage (in: phContext=0x242d138, pMessage=0x245b518, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245b518, pfQOP=0x0) returned 0x0 [0240.985] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.985] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.985] DecryptMessage (in: phContext=0x242d138, pMessage=0x245b62c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245b62c, pfQOP=0x0) returned 0x0 [0240.985] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0240.987] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.987] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.987] DecryptMessage (in: phContext=0x242d138, pMessage=0x245b740, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245b740, pfQOP=0x0) returned 0x0 [0240.987] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.987] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.987] DecryptMessage (in: phContext=0x242d138, pMessage=0x245b854, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245b854, pfQOP=0x0) returned 0x0 [0240.987] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.987] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.987] DecryptMessage (in: phContext=0x242d138, pMessage=0x245b968, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245b968, pfQOP=0x0) returned 0x0 [0240.987] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0240.988] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.988] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.988] DecryptMessage (in: phContext=0x242d138, pMessage=0x245ba7c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245ba7c, pfQOP=0x0) returned 0x0 [0240.988] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.988] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.988] DecryptMessage (in: phContext=0x242d138, pMessage=0x245bb90, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245bb90, pfQOP=0x0) returned 0x0 [0240.988] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.988] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.988] DecryptMessage (in: phContext=0x242d138, pMessage=0x245bca4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245bca4, pfQOP=0x0) returned 0x0 [0240.988] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0240.989] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.989] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.989] DecryptMessage (in: phContext=0x242d138, pMessage=0x245bdb8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245bdb8, pfQOP=0x0) returned 0x0 [0240.989] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.989] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.989] DecryptMessage (in: phContext=0x242d138, pMessage=0x245becc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245becc, pfQOP=0x0) returned 0x0 [0240.989] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.989] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.989] DecryptMessage (in: phContext=0x242d138, pMessage=0x245bfe0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245bfe0, pfQOP=0x0) returned 0x0 [0240.989] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0240.990] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.990] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.990] DecryptMessage (in: phContext=0x242d138, pMessage=0x245c0f4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245c0f4, pfQOP=0x0) returned 0x0 [0240.990] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.990] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.990] DecryptMessage (in: phContext=0x242d138, pMessage=0x245c208, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245c208, pfQOP=0x0) returned 0x0 [0240.990] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.990] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.990] DecryptMessage (in: phContext=0x242d138, pMessage=0x245c31c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245c31c, pfQOP=0x0) returned 0x0 [0240.990] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0240.991] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.991] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.991] DecryptMessage (in: phContext=0x242d138, pMessage=0x245c430, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245c430, pfQOP=0x0) returned 0x0 [0240.991] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.991] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.991] DecryptMessage (in: phContext=0x242d138, pMessage=0x245c544, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245c544, pfQOP=0x0) returned 0x0 [0240.991] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.991] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.991] DecryptMessage (in: phContext=0x242d138, pMessage=0x245c658, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245c658, pfQOP=0x0) returned 0x0 [0240.991] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0240.992] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.992] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.992] DecryptMessage (in: phContext=0x242d138, pMessage=0x245c76c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245c76c, pfQOP=0x0) returned 0x0 [0240.992] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.992] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.992] DecryptMessage (in: phContext=0x242d138, pMessage=0x245c880, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245c880, pfQOP=0x0) returned 0x0 [0240.992] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.992] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.992] DecryptMessage (in: phContext=0x242d138, pMessage=0x245c994, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245c994, pfQOP=0x0) returned 0x0 [0240.993] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0240.993] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.993] recv (in: s=0x55c, buf=0x2442f35, len=1153, flags=0 | out: buf=0x2442f35*) returned 1153 [0240.993] DecryptMessage (in: phContext=0x242d138, pMessage=0x245caa8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245caa8, pfQOP=0x0) returned 0x0 [0240.993] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.993] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.993] DecryptMessage (in: phContext=0x242d138, pMessage=0x245cbbc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245cbbc, pfQOP=0x0) returned 0x0 [0240.993] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.993] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.993] DecryptMessage (in: phContext=0x242d138, pMessage=0x245ccd0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245ccd0, pfQOP=0x0) returned 0x0 [0240.993] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0240.994] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.994] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.994] DecryptMessage (in: phContext=0x242d138, pMessage=0x245cde4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245cde4, pfQOP=0x0) returned 0x0 [0240.994] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.994] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.994] DecryptMessage (in: phContext=0x242d138, pMessage=0x245cef8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245cef8, pfQOP=0x0) returned 0x0 [0240.994] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.994] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.994] DecryptMessage (in: phContext=0x242d138, pMessage=0x245d00c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245d00c, pfQOP=0x0) returned 0x0 [0240.994] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0240.995] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.995] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.995] DecryptMessage (in: phContext=0x242d138, pMessage=0x245d120, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245d120, pfQOP=0x0) returned 0x0 [0240.995] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.995] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.995] DecryptMessage (in: phContext=0x242d138, pMessage=0x245d234, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245d234, pfQOP=0x0) returned 0x0 [0240.995] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.995] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.995] DecryptMessage (in: phContext=0x242d138, pMessage=0x245d348, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245d348, pfQOP=0x0) returned 0x0 [0240.995] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0240.996] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.996] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.996] DecryptMessage (in: phContext=0x242d138, pMessage=0x245d45c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245d45c, pfQOP=0x0) returned 0x0 [0240.996] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.996] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.996] DecryptMessage (in: phContext=0x242d138, pMessage=0x245d570, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245d570, pfQOP=0x0) returned 0x0 [0240.996] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.996] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.996] DecryptMessage (in: phContext=0x242d138, pMessage=0x245d684, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245d684, pfQOP=0x0) returned 0x0 [0240.996] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0240.997] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.997] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.997] DecryptMessage (in: phContext=0x242d138, pMessage=0x245d798, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245d798, pfQOP=0x0) returned 0x0 [0240.997] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.997] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.997] DecryptMessage (in: phContext=0x242d138, pMessage=0x245d8ac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245d8ac, pfQOP=0x0) returned 0x0 [0240.998] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.998] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.998] DecryptMessage (in: phContext=0x242d138, pMessage=0x245d9c0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245d9c0, pfQOP=0x0) returned 0x0 [0240.998] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0240.999] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0240.999] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0240.999] DecryptMessage (in: phContext=0x242d138, pMessage=0x245dad4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245dad4, pfQOP=0x0) returned 0x0 [0241.000] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.000] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0241.000] DecryptMessage (in: phContext=0x242d138, pMessage=0x245dbe8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245dbe8, pfQOP=0x0) returned 0x0 [0241.000] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.000] recv (in: s=0x55c, buf=0x2442f35, len=1393, flags=0 | out: buf=0x2442f35*) returned 1393 [0241.000] DecryptMessage (in: phContext=0x242d138, pMessage=0x245dcfc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245dcfc, pfQOP=0x0) returned 0x0 [0241.000] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.000] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.001] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.001] DecryptMessage (in: phContext=0x242d138, pMessage=0x245de10, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245de10, pfQOP=0x0) returned 0x0 [0241.001] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.001] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.001] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.001] DecryptMessage (in: phContext=0x242d138, pMessage=0x245df24, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245df24, pfQOP=0x0) returned 0x0 [0241.002] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.002] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.002] recv (in: s=0x55c, buf=0x2442f35, len=1061, flags=0 | out: buf=0x2442f35*) returned 1061 [0241.002] DecryptMessage (in: phContext=0x242d138, pMessage=0x245e038, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245e038, pfQOP=0x0) returned 0x0 [0241.002] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.002] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.002] DecryptMessage (in: phContext=0x242d138, pMessage=0x245e14c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245e14c, pfQOP=0x0) returned 0x0 [0241.003] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.003] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.003] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.003] DecryptMessage (in: phContext=0x242d138, pMessage=0x245e260, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245e260, pfQOP=0x0) returned 0x0 [0241.003] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.003] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.003] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.003] DecryptMessage (in: phContext=0x242d138, pMessage=0x245e374, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245e374, pfQOP=0x0) returned 0x0 [0241.004] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.004] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.004] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.004] DecryptMessage (in: phContext=0x242d138, pMessage=0x245e488, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245e488, pfQOP=0x0) returned 0x0 [0241.004] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.004] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.004] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.004] DecryptMessage (in: phContext=0x242d138, pMessage=0x245e59c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245e59c, pfQOP=0x0) returned 0x0 [0241.005] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.005] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.005] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.005] DecryptMessage (in: phContext=0x242d138, pMessage=0x245e6b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245e6b0, pfQOP=0x0) returned 0x0 [0241.005] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.005] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.005] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.005] DecryptMessage (in: phContext=0x242d138, pMessage=0x245e7c4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245e7c4, pfQOP=0x0) returned 0x0 [0241.005] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.006] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.006] recv (in: s=0x55c, buf=0x2442f35, len=3189, flags=0 | out: buf=0x2442f35*) returned 3189 [0241.006] DecryptMessage (in: phContext=0x242d138, pMessage=0x245e8d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245e8d8, pfQOP=0x0) returned 0x0 [0241.006] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.006] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.006] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.006] DecryptMessage (in: phContext=0x242d138, pMessage=0x245e9ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245e9ec, pfQOP=0x0) returned 0x0 [0241.006] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.007] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.007] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.007] DecryptMessage (in: phContext=0x242d138, pMessage=0x245eb00, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245eb00, pfQOP=0x0) returned 0x0 [0241.007] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.007] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.007] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.007] DecryptMessage (in: phContext=0x242d138, pMessage=0x245ec14, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245ec14, pfQOP=0x0) returned 0x0 [0241.007] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.007] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.008] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.008] DecryptMessage (in: phContext=0x242d138, pMessage=0x245ed28, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245ed28, pfQOP=0x0) returned 0x0 [0241.008] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.008] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.008] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.008] DecryptMessage (in: phContext=0x242d138, pMessage=0x245ee3c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245ee3c, pfQOP=0x0) returned 0x0 [0241.008] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.008] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.008] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.009] DecryptMessage (in: phContext=0x242d138, pMessage=0x245ef50, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245ef50, pfQOP=0x0) returned 0x0 [0241.009] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.009] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.009] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 2161 [0241.009] recv (in: s=0x55c, buf=0x24437a6, len=2092, flags=0 | out: buf=0x24437a6*) returned 2092 [0241.011] DecryptMessage (in: phContext=0x242d138, pMessage=0x245f064, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245f064, pfQOP=0x0) returned 0x0 [0241.011] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.012] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.012] recv (in: s=0x55c, buf=0x2442f35, len=3189, flags=0 | out: buf=0x2442f35*) returned 3189 [0241.012] DecryptMessage (in: phContext=0x242d138, pMessage=0x245f178, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245f178, pfQOP=0x0) returned 0x0 [0241.012] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.012] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.013] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.013] DecryptMessage (in: phContext=0x242d138, pMessage=0x245f28c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245f28c, pfQOP=0x0) returned 0x0 [0241.013] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.013] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.013] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.014] DecryptMessage (in: phContext=0x242d138, pMessage=0x245f3a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245f3a0, pfQOP=0x0) returned 0x0 [0241.014] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.014] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.014] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.014] DecryptMessage (in: phContext=0x242d138, pMessage=0x245f4b4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245f4b4, pfQOP=0x0) returned 0x0 [0241.014] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.014] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.014] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.014] DecryptMessage (in: phContext=0x242d138, pMessage=0x245f5c8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245f5c8, pfQOP=0x0) returned 0x0 [0241.015] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.015] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.015] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.015] DecryptMessage (in: phContext=0x242d138, pMessage=0x245f6dc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245f6dc, pfQOP=0x0) returned 0x0 [0241.015] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.015] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.015] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.015] DecryptMessage (in: phContext=0x242d138, pMessage=0x245f7f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245f7f0, pfQOP=0x0) returned 0x0 [0241.016] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.016] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.016] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.016] DecryptMessage (in: phContext=0x242d138, pMessage=0x245f904, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245f904, pfQOP=0x0) returned 0x0 [0241.016] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.016] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.016] recv (in: s=0x55c, buf=0x2442f35, len=3189, flags=0 | out: buf=0x2442f35*) returned 3189 [0241.016] DecryptMessage (in: phContext=0x242d138, pMessage=0x245fa18, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245fa18, pfQOP=0x0) returned 0x0 [0241.016] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.017] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.017] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.017] DecryptMessage (in: phContext=0x242d138, pMessage=0x245fb2c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245fb2c, pfQOP=0x0) returned 0x0 [0241.017] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.017] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.017] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.017] DecryptMessage (in: phContext=0x242d138, pMessage=0x245fc40, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245fc40, pfQOP=0x0) returned 0x0 [0241.017] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.017] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.018] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.018] DecryptMessage (in: phContext=0x242d138, pMessage=0x245fd54, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245fd54, pfQOP=0x0) returned 0x0 [0241.018] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.018] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.018] recv (in: s=0x55c, buf=0x2442f35, len=4075, flags=0 | out: buf=0x2442f35*) returned 4075 [0241.018] DecryptMessage (in: phContext=0x242d138, pMessage=0x245fe68, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245fe68, pfQOP=0x0) returned 0x0 [0241.018] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.018] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.018] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.018] DecryptMessage (in: phContext=0x242d138, pMessage=0x245ff7c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x245ff7c, pfQOP=0x0) returned 0x0 [0241.019] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.019] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.019] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 3469 [0241.019] recv (in: s=0x55c, buf=0x2443cc2, len=784, flags=0 | out: buf=0x2443cc2*) returned 784 [0241.019] DecryptMessage (in: phContext=0x242d138, pMessage=0x2460090, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2460090, pfQOP=0x0) returned 0x0 [0241.020] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.020] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.020] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 2131 [0241.020] recv (in: s=0x55c, buf=0x2443788, len=2122, flags=0 | out: buf=0x2443788*) returned 2122 [0241.025] DecryptMessage (in: phContext=0x242d138, pMessage=0x24601a4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24601a4, pfQOP=0x0) returned 0x0 [0241.025] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.026] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.026] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.026] DecryptMessage (in: phContext=0x242d138, pMessage=0x24602b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24602b8, pfQOP=0x0) returned 0x0 [0241.026] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.027] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.027] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.027] DecryptMessage (in: phContext=0x242d138, pMessage=0x24603cc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24603cc, pfQOP=0x0) returned 0x0 [0241.027] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.028] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.028] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.029] DecryptMessage (in: phContext=0x242d138, pMessage=0x24604e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24604e0, pfQOP=0x0) returned 0x0 [0241.029] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.030] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.030] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.031] DecryptMessage (in: phContext=0x242d138, pMessage=0x24605f4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24605f4, pfQOP=0x0) returned 0x0 [0241.032] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.033] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.033] recv (in: s=0x55c, buf=0x2442f35, len=3189, flags=0 | out: buf=0x2442f35*) returned 3189 [0241.035] DecryptMessage (in: phContext=0x242d138, pMessage=0x2460708, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2460708, pfQOP=0x0) returned 0x0 [0241.036] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.036] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.036] recv (in: s=0x55c, buf=0x2442f35, len=4253, flags=0 | out: buf=0x2442f35*) returned 4253 [0241.036] DecryptMessage (in: phContext=0x242d138, pMessage=0x246081c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246081c, pfQOP=0x0) returned 0x0 [0241.036] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.036] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.036] recv (in: s=0x55c, buf=0x2442f35, len=11305, flags=0 | out: buf=0x2442f35*) returned 11305 [0241.037] DecryptMessage (in: phContext=0x242d138, pMessage=0x2460930, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2460930, pfQOP=0x0) returned 0x0 [0241.037] WriteFile (in: hFile=0x27c, lpBuffer=0x245a370*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x245a370*, lpNumberOfBytesWritten=0x19f25c*=0x1000, lpOverlapped=0x0) returned 1 [0241.037] WriteFile (in: hFile=0x27c, lpBuffer=0x244a745*, nNumberOfBytesToWrite=0x279c, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a745*, lpNumberOfBytesWritten=0x19f25c*=0x279c, lpOverlapped=0x0) returned 1 [0241.037] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.037] recv (in: s=0x55c, buf=0x2442f35, len=5127, flags=0 | out: buf=0x2442f35*) returned 5127 [0241.037] DecryptMessage (in: phContext=0x242d138, pMessage=0x2460a44, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2460a44, pfQOP=0x0) returned 0x0 [0241.037] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x13ef, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x13ef, lpOverlapped=0x0) returned 1 [0241.038] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.038] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.038] DecryptMessage (in: phContext=0x242d138, pMessage=0x2460b58, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2460b58, pfQOP=0x0) returned 0x0 [0241.038] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.038] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.039] recv (in: s=0x55c, buf=0x2442f35, len=11305, flags=0 | out: buf=0x2442f35*) returned 11305 [0241.039] DecryptMessage (in: phContext=0x242d138, pMessage=0x2460c6c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2460c6c, pfQOP=0x0) returned 0x0 [0241.039] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x2c11, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x2c11, lpOverlapped=0x0) returned 1 [0241.041] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.041] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.041] DecryptMessage (in: phContext=0x242d138, pMessage=0x2460d80, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2460d80, pfQOP=0x0) returned 0x0 [0241.041] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.042] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.043] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.043] DecryptMessage (in: phContext=0x242d138, pMessage=0x2460e94, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2460e94, pfQOP=0x0) returned 0x0 [0241.043] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.044] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.044] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.046] DecryptMessage (in: phContext=0x242d138, pMessage=0x2460fa8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2460fa8, pfQOP=0x0) returned 0x0 [0241.046] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.047] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.047] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.047] DecryptMessage (in: phContext=0x242d138, pMessage=0x24610bc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24610bc, pfQOP=0x0) returned 0x0 [0241.047] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.047] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.047] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.048] DecryptMessage (in: phContext=0x242d138, pMessage=0x24611d0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24611d0, pfQOP=0x0) returned 0x0 [0241.048] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.048] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.048] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.048] DecryptMessage (in: phContext=0x242d138, pMessage=0x24612e4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24612e4, pfQOP=0x0) returned 0x0 [0241.048] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.049] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.049] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.049] DecryptMessage (in: phContext=0x242d138, pMessage=0x24613f8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24613f8, pfQOP=0x0) returned 0x0 [0241.049] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.050] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.050] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.054] DecryptMessage (in: phContext=0x242d138, pMessage=0x246150c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246150c, pfQOP=0x0) returned 0x0 [0241.054] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.055] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.055] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.055] DecryptMessage (in: phContext=0x242d138, pMessage=0x2461620, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2461620, pfQOP=0x0) returned 0x0 [0241.056] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.057] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.057] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.058] DecryptMessage (in: phContext=0x242d138, pMessage=0x2461734, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2461734, pfQOP=0x0) returned 0x0 [0241.058] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.058] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.058] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.058] DecryptMessage (in: phContext=0x242d138, pMessage=0x2461848, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2461848, pfQOP=0x0) returned 0x0 [0241.058] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.059] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.059] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.059] DecryptMessage (in: phContext=0x242d138, pMessage=0x246195c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246195c, pfQOP=0x0) returned 0x0 [0241.059] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.060] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.060] recv (in: s=0x55c, buf=0x2442f35, len=8216, flags=0 | out: buf=0x2442f35*) returned 8216 [0241.060] DecryptMessage (in: phContext=0x242d138, pMessage=0x2461a70, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2461a70, pfQOP=0x0) returned 0x0 [0241.060] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x2000, lpOverlapped=0x0) returned 1 [0241.061] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.061] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.061] DecryptMessage (in: phContext=0x242d138, pMessage=0x2461b84, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2461b84, pfQOP=0x0) returned 0x0 [0241.061] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.061] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.062] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.062] DecryptMessage (in: phContext=0x242d138, pMessage=0x2461c98, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2461c98, pfQOP=0x0) returned 0x0 [0241.062] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.063] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.063] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.065] DecryptMessage (in: phContext=0x242d138, pMessage=0x2461dac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2461dac, pfQOP=0x0) returned 0x0 [0241.066] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.067] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.067] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.067] DecryptMessage (in: phContext=0x242d138, pMessage=0x2461ec0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2461ec0, pfQOP=0x0) returned 0x0 [0241.068] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.071] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.071] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.072] DecryptMessage (in: phContext=0x242d138, pMessage=0x2461fd4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2461fd4, pfQOP=0x0) returned 0x0 [0241.072] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.072] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.072] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.072] DecryptMessage (in: phContext=0x242d138, pMessage=0x24620e8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24620e8, pfQOP=0x0) returned 0x0 [0241.072] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.073] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.073] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.073] DecryptMessage (in: phContext=0x242d138, pMessage=0x24621fc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24621fc, pfQOP=0x0) returned 0x0 [0241.073] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.073] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.073] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.074] DecryptMessage (in: phContext=0x242d138, pMessage=0x2462310, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2462310, pfQOP=0x0) returned 0x0 [0241.074] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.074] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.074] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.074] DecryptMessage (in: phContext=0x242d138, pMessage=0x2462424, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2462424, pfQOP=0x0) returned 0x0 [0241.074] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.075] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.075] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.075] DecryptMessage (in: phContext=0x242d138, pMessage=0x2462538, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2462538, pfQOP=0x0) returned 0x0 [0241.075] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.075] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.076] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.076] DecryptMessage (in: phContext=0x242d138, pMessage=0x246264c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246264c, pfQOP=0x0) returned 0x0 [0241.076] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.076] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.076] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.077] DecryptMessage (in: phContext=0x242d138, pMessage=0x2462760, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2462760, pfQOP=0x0) returned 0x0 [0241.077] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.079] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.079] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.079] DecryptMessage (in: phContext=0x242d138, pMessage=0x2462874, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2462874, pfQOP=0x0) returned 0x0 [0241.079] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.080] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.080] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.080] DecryptMessage (in: phContext=0x242d138, pMessage=0x2462988, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2462988, pfQOP=0x0) returned 0x0 [0241.080] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.081] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.082] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.082] DecryptMessage (in: phContext=0x242d138, pMessage=0x2462a9c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2462a9c, pfQOP=0x0) returned 0x0 [0241.082] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.084] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.084] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.084] DecryptMessage (in: phContext=0x242d138, pMessage=0x2462bb0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2462bb0, pfQOP=0x0) returned 0x0 [0241.084] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.084] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.084] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.084] DecryptMessage (in: phContext=0x242d138, pMessage=0x2462cc4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2462cc4, pfQOP=0x0) returned 0x0 [0241.084] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.085] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.085] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.085] DecryptMessage (in: phContext=0x242d138, pMessage=0x2462dd8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2462dd8, pfQOP=0x0) returned 0x0 [0241.085] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.085] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.085] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.086] DecryptMessage (in: phContext=0x242d138, pMessage=0x2462eec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2462eec, pfQOP=0x0) returned 0x0 [0241.086] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.086] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.086] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.086] DecryptMessage (in: phContext=0x242d138, pMessage=0x2463000, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2463000, pfQOP=0x0) returned 0x0 [0241.086] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.090] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.090] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.092] DecryptMessage (in: phContext=0x242d138, pMessage=0x2463114, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2463114, pfQOP=0x0) returned 0x0 [0241.092] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.094] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.094] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.094] DecryptMessage (in: phContext=0x242d138, pMessage=0x2463228, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2463228, pfQOP=0x0) returned 0x0 [0241.094] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.096] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.096] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.096] DecryptMessage (in: phContext=0x242d138, pMessage=0x246333c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246333c, pfQOP=0x0) returned 0x0 [0241.096] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.097] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.097] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.098] DecryptMessage (in: phContext=0x242d138, pMessage=0x2463450, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2463450, pfQOP=0x0) returned 0x0 [0241.098] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.098] recv (in: s=0x55c, buf=0x2442f30, len=5, flags=0 | out: buf=0x2442f30*) returned 5 [0241.098] recv (in: s=0x55c, buf=0x2442f35, len=16408, flags=0 | out: buf=0x2442f35*) returned 16408 [0241.100] DecryptMessage (in: phContext=0x242d138, pMessage=0x2463564, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2463564, pfQOP=0x0) returned 0x0 [0241.100] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.101] DecryptMessage (in: phContext=0x242d138, pMessage=0x2463678, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2463678, pfQOP=0x0) returned 0x0 [0241.101] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.101] DecryptMessage (in: phContext=0x242d138, pMessage=0x246378c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246378c, pfQOP=0x0) returned 0x0 [0241.101] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.102] DecryptMessage (in: phContext=0x242d138, pMessage=0x24638a0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24638a0, pfQOP=0x0) returned 0x0 [0241.102] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.102] DecryptMessage (in: phContext=0x242d138, pMessage=0x24639b4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24639b4, pfQOP=0x0) returned 0x0 [0241.102] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.103] DecryptMessage (in: phContext=0x242d138, pMessage=0x2463ac8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2463ac8, pfQOP=0x0) returned 0x0 [0241.103] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.103] DecryptMessage (in: phContext=0x242d138, pMessage=0x2463bdc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2463bdc, pfQOP=0x0) returned 0x0 [0241.104] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.104] DecryptMessage (in: phContext=0x242d138, pMessage=0x2463cf0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2463cf0, pfQOP=0x0) returned 0x0 [0241.104] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.105] DecryptMessage (in: phContext=0x242d138, pMessage=0x2463e04, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2463e04, pfQOP=0x0) returned 0x0 [0241.105] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.105] DecryptMessage (in: phContext=0x242d138, pMessage=0x2463f18, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2463f18, pfQOP=0x0) returned 0x0 [0241.105] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.114] DecryptMessage (in: phContext=0x242d138, pMessage=0x246402c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246402c, pfQOP=0x0) returned 0x0 [0241.115] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.118] DecryptMessage (in: phContext=0x242d138, pMessage=0x2464140, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2464140, pfQOP=0x0) returned 0x0 [0241.119] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.134] DecryptMessage (in: phContext=0x242d138, pMessage=0x2464254, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2464254, pfQOP=0x0) returned 0x0 [0241.134] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.136] DecryptMessage (in: phContext=0x242d138, pMessage=0x2464368, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2464368, pfQOP=0x0) returned 0x0 [0241.136] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.136] DecryptMessage (in: phContext=0x242d138, pMessage=0x246447c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246447c, pfQOP=0x0) returned 0x0 [0241.136] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.149] DecryptMessage (in: phContext=0x242d138, pMessage=0x2464590, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2464590, pfQOP=0x0) returned 0x0 [0241.149] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.150] DecryptMessage (in: phContext=0x242d138, pMessage=0x24646a4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24646a4, pfQOP=0x0) returned 0x0 [0241.150] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.150] DecryptMessage (in: phContext=0x242d138, pMessage=0x24647b8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24647b8, pfQOP=0x0) returned 0x0 [0241.151] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.151] DecryptMessage (in: phContext=0x242d138, pMessage=0x24648cc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24648cc, pfQOP=0x0) returned 0x0 [0241.151] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.152] DecryptMessage (in: phContext=0x242d138, pMessage=0x24649e0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24649e0, pfQOP=0x0) returned 0x0 [0241.152] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.152] DecryptMessage (in: phContext=0x242d138, pMessage=0x2464af4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2464af4, pfQOP=0x0) returned 0x0 [0241.152] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.153] DecryptMessage (in: phContext=0x242d138, pMessage=0x2464c08, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2464c08, pfQOP=0x0) returned 0x0 [0241.153] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.153] DecryptMessage (in: phContext=0x242d138, pMessage=0x2464d1c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2464d1c, pfQOP=0x0) returned 0x0 [0241.153] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.154] DecryptMessage (in: phContext=0x242d138, pMessage=0x2464e30, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2464e30, pfQOP=0x0) returned 0x0 [0241.154] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.154] DecryptMessage (in: phContext=0x242d138, pMessage=0x2464f44, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2464f44, pfQOP=0x0) returned 0x0 [0241.154] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.169] DecryptMessage (in: phContext=0x242d138, pMessage=0x2465058, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2465058, pfQOP=0x0) returned 0x0 [0241.169] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.170] DecryptMessage (in: phContext=0x242d138, pMessage=0x246516c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246516c, pfQOP=0x0) returned 0x0 [0241.170] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.171] DecryptMessage (in: phContext=0x242d138, pMessage=0x2465280, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2465280, pfQOP=0x0) returned 0x0 [0241.171] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.174] DecryptMessage (in: phContext=0x242d138, pMessage=0x2465394, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2465394, pfQOP=0x0) returned 0x0 [0241.174] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.174] DecryptMessage (in: phContext=0x242d138, pMessage=0x24654a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24654a8, pfQOP=0x0) returned 0x0 [0241.174] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.175] DecryptMessage (in: phContext=0x242d138, pMessage=0x24655bc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24655bc, pfQOP=0x0) returned 0x0 [0241.175] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.175] DecryptMessage (in: phContext=0x242d138, pMessage=0x24656d0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24656d0, pfQOP=0x0) returned 0x0 [0241.175] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.176] DecryptMessage (in: phContext=0x242d138, pMessage=0x24657e4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24657e4, pfQOP=0x0) returned 0x0 [0241.176] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.176] DecryptMessage (in: phContext=0x242d138, pMessage=0x24658f8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24658f8, pfQOP=0x0) returned 0x0 [0241.176] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.177] DecryptMessage (in: phContext=0x242d138, pMessage=0x2465a0c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2465a0c, pfQOP=0x0) returned 0x0 [0241.177] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.178] DecryptMessage (in: phContext=0x242d138, pMessage=0x2465b20, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2465b20, pfQOP=0x0) returned 0x0 [0241.178] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.186] DecryptMessage (in: phContext=0x242d138, pMessage=0x2465c34, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2465c34, pfQOP=0x0) returned 0x0 [0241.187] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.190] DecryptMessage (in: phContext=0x242d138, pMessage=0x2465d48, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2465d48, pfQOP=0x0) returned 0x0 [0241.190] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.193] DecryptMessage (in: phContext=0x242d138, pMessage=0x2465e5c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2465e5c, pfQOP=0x0) returned 0x0 [0241.194] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.195] DecryptMessage (in: phContext=0x242d138, pMessage=0x2465f70, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2465f70, pfQOP=0x0) returned 0x0 [0241.196] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.198] DecryptMessage (in: phContext=0x242d138, pMessage=0x2466084, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2466084, pfQOP=0x0) returned 0x0 [0241.198] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.199] DecryptMessage (in: phContext=0x242d138, pMessage=0x2466198, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2466198, pfQOP=0x0) returned 0x0 [0241.200] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.202] DecryptMessage (in: phContext=0x242d138, pMessage=0x24662ac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24662ac, pfQOP=0x0) returned 0x0 [0241.202] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.207] DecryptMessage (in: phContext=0x242d138, pMessage=0x24663c0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24663c0, pfQOP=0x0) returned 0x0 [0241.208] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.213] DecryptMessage (in: phContext=0x242d138, pMessage=0x24664d4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24664d4, pfQOP=0x0) returned 0x0 [0241.214] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.214] DecryptMessage (in: phContext=0x242d138, pMessage=0x24665e8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24665e8, pfQOP=0x0) returned 0x0 [0241.214] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.218] DecryptMessage (in: phContext=0x242d138, pMessage=0x24666fc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24666fc, pfQOP=0x0) returned 0x0 [0241.218] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.220] DecryptMessage (in: phContext=0x242d138, pMessage=0x2466810, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2466810, pfQOP=0x0) returned 0x0 [0241.220] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.221] DecryptMessage (in: phContext=0x242d138, pMessage=0x2466924, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2466924, pfQOP=0x0) returned 0x0 [0241.221] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.222] DecryptMessage (in: phContext=0x242d138, pMessage=0x2466a38, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2466a38, pfQOP=0x0) returned 0x0 [0241.222] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.222] DecryptMessage (in: phContext=0x242d138, pMessage=0x2466b4c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2466b4c, pfQOP=0x0) returned 0x0 [0241.222] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.223] DecryptMessage (in: phContext=0x242d138, pMessage=0x2466c60, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2466c60, pfQOP=0x0) returned 0x0 [0241.223] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.224] DecryptMessage (in: phContext=0x242d138, pMessage=0x2466d74, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2466d74, pfQOP=0x0) returned 0x0 [0241.224] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.225] DecryptMessage (in: phContext=0x242d138, pMessage=0x2466e88, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2466e88, pfQOP=0x0) returned 0x0 [0241.225] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x3000, lpOverlapped=0x0) returned 1 [0241.225] DecryptMessage (in: phContext=0x242d138, pMessage=0x2466f9c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2466f9c, pfQOP=0x0) returned 0x0 [0241.226] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.226] DecryptMessage (in: phContext=0x242d138, pMessage=0x24670b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24670b0, pfQOP=0x0) returned 0x0 [0241.226] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.227] DecryptMessage (in: phContext=0x242d138, pMessage=0x24671c4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24671c4, pfQOP=0x0) returned 0x0 [0241.227] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.228] DecryptMessage (in: phContext=0x242d138, pMessage=0x24672d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24672d8, pfQOP=0x0) returned 0x0 [0241.228] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.228] DecryptMessage (in: phContext=0x242d138, pMessage=0x24673ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24673ec, pfQOP=0x0) returned 0x0 [0241.228] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.229] DecryptMessage (in: phContext=0x242d138, pMessage=0x2467500, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2467500, pfQOP=0x0) returned 0x0 [0241.229] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.231] DecryptMessage (in: phContext=0x242d138, pMessage=0x2467614, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2467614, pfQOP=0x0) returned 0x0 [0241.231] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.232] DecryptMessage (in: phContext=0x242d138, pMessage=0x2467728, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2467728, pfQOP=0x0) returned 0x0 [0241.232] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.232] DecryptMessage (in: phContext=0x242d138, pMessage=0x246783c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246783c, pfQOP=0x0) returned 0x0 [0241.232] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.233] DecryptMessage (in: phContext=0x242d138, pMessage=0x2467950, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2467950, pfQOP=0x0) returned 0x0 [0241.233] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.234] DecryptMessage (in: phContext=0x242d138, pMessage=0x2467a64, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2467a64, pfQOP=0x0) returned 0x0 [0241.234] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.235] DecryptMessage (in: phContext=0x242d138, pMessage=0x2467b78, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2467b78, pfQOP=0x0) returned 0x0 [0241.235] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.236] DecryptMessage (in: phContext=0x242d138, pMessage=0x2467c8c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2467c8c, pfQOP=0x0) returned 0x0 [0241.236] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.237] DecryptMessage (in: phContext=0x242d138, pMessage=0x2467da0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2467da0, pfQOP=0x0) returned 0x0 [0241.237] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.238] DecryptMessage (in: phContext=0x242d138, pMessage=0x2467eb4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2467eb4, pfQOP=0x0) returned 0x0 [0241.238] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.238] DecryptMessage (in: phContext=0x242d138, pMessage=0x2467fc8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2467fc8, pfQOP=0x0) returned 0x0 [0241.239] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.239] DecryptMessage (in: phContext=0x242d138, pMessage=0x24680dc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24680dc, pfQOP=0x0) returned 0x0 [0241.239] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.240] DecryptMessage (in: phContext=0x242d138, pMessage=0x24681f0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24681f0, pfQOP=0x0) returned 0x0 [0241.240] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.246] DecryptMessage (in: phContext=0x242d138, pMessage=0x2468304, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2468304, pfQOP=0x0) returned 0x0 [0241.246] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.247] DecryptMessage (in: phContext=0x242d138, pMessage=0x2468418, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2468418, pfQOP=0x0) returned 0x0 [0241.247] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.248] DecryptMessage (in: phContext=0x242d138, pMessage=0x246852c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246852c, pfQOP=0x0) returned 0x0 [0241.248] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.249] DecryptMessage (in: phContext=0x242d138, pMessage=0x2468640, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2468640, pfQOP=0x0) returned 0x0 [0241.249] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.258] DecryptMessage (in: phContext=0x242d138, pMessage=0x2468754, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2468754, pfQOP=0x0) returned 0x0 [0241.259] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.259] DecryptMessage (in: phContext=0x242d138, pMessage=0x2468868, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2468868, pfQOP=0x0) returned 0x0 [0241.259] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.259] DecryptMessage (in: phContext=0x242d138, pMessage=0x246897c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246897c, pfQOP=0x0) returned 0x0 [0241.260] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.268] DecryptMessage (in: phContext=0x242d138, pMessage=0x2468a90, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2468a90, pfQOP=0x0) returned 0x0 [0241.269] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.275] DecryptMessage (in: phContext=0x242d138, pMessage=0x2468ba4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2468ba4, pfQOP=0x0) returned 0x0 [0241.275] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.276] DecryptMessage (in: phContext=0x242d138, pMessage=0x2468cb8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2468cb8, pfQOP=0x0) returned 0x0 [0241.277] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.278] DecryptMessage (in: phContext=0x242d138, pMessage=0x2468dcc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2468dcc, pfQOP=0x0) returned 0x0 [0241.278] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.279] DecryptMessage (in: phContext=0x242d138, pMessage=0x2468ee0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2468ee0, pfQOP=0x0) returned 0x0 [0241.279] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.281] DecryptMessage (in: phContext=0x242d138, pMessage=0x2468ff4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2468ff4, pfQOP=0x0) returned 0x0 [0241.281] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.282] DecryptMessage (in: phContext=0x242d138, pMessage=0x2469108, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2469108, pfQOP=0x0) returned 0x0 [0241.282] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.283] DecryptMessage (in: phContext=0x242d138, pMessage=0x246921c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246921c, pfQOP=0x0) returned 0x0 [0241.283] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.284] DecryptMessage (in: phContext=0x242d138, pMessage=0x2469330, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2469330, pfQOP=0x0) returned 0x0 [0241.284] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.286] DecryptMessage (in: phContext=0x242d138, pMessage=0x2469444, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2469444, pfQOP=0x0) returned 0x0 [0241.286] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.287] DecryptMessage (in: phContext=0x242d138, pMessage=0x2469558, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2469558, pfQOP=0x0) returned 0x0 [0241.288] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.289] DecryptMessage (in: phContext=0x242d138, pMessage=0x246966c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246966c, pfQOP=0x0) returned 0x0 [0241.289] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.291] DecryptMessage (in: phContext=0x242d138, pMessage=0x2469780, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2469780, pfQOP=0x0) returned 0x0 [0241.291] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.296] DecryptMessage (in: phContext=0x242d138, pMessage=0x2469894, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2469894, pfQOP=0x0) returned 0x0 [0241.296] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.298] DecryptMessage (in: phContext=0x242d138, pMessage=0x24699a8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x24699a8, pfQOP=0x0) returned 0x0 [0241.298] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.300] DecryptMessage (in: phContext=0x242d138, pMessage=0x2469abc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2469abc, pfQOP=0x0) returned 0x0 [0241.300] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.301] DecryptMessage (in: phContext=0x242d138, pMessage=0x2469bd0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2469bd0, pfQOP=0x0) returned 0x0 [0241.301] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.301] DecryptMessage (in: phContext=0x242d138, pMessage=0x2469ce4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2469ce4, pfQOP=0x0) returned 0x0 [0241.301] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.302] DecryptMessage (in: phContext=0x242d138, pMessage=0x2469df8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2469df8, pfQOP=0x0) returned 0x0 [0241.302] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.302] DecryptMessage (in: phContext=0x242d138, pMessage=0x2469f0c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x2469f0c, pfQOP=0x0) returned 0x0 [0241.302] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.303] DecryptMessage (in: phContext=0x242d138, pMessage=0x246a020, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246a020, pfQOP=0x0) returned 0x0 [0241.303] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.304] DecryptMessage (in: phContext=0x242d138, pMessage=0x246a134, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246a134, pfQOP=0x0) returned 0x0 [0241.304] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.305] DecryptMessage (in: phContext=0x242d138, pMessage=0x246a248, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246a248, pfQOP=0x0) returned 0x0 [0241.305] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.305] DecryptMessage (in: phContext=0x242d138, pMessage=0x246a35c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246a35c, pfQOP=0x0) returned 0x0 [0241.305] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.306] DecryptMessage (in: phContext=0x242d138, pMessage=0x246a470, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246a470, pfQOP=0x0) returned 0x0 [0241.306] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.306] DecryptMessage (in: phContext=0x242d138, pMessage=0x246a584, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246a584, pfQOP=0x0) returned 0x0 [0241.307] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.307] DecryptMessage (in: phContext=0x242d138, pMessage=0x246a698, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246a698, pfQOP=0x0) returned 0x0 [0241.307] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.308] DecryptMessage (in: phContext=0x242d138, pMessage=0x246a7ac, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246a7ac, pfQOP=0x0) returned 0x0 [0241.308] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.308] DecryptMessage (in: phContext=0x242d138, pMessage=0x246a8c0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246a8c0, pfQOP=0x0) returned 0x0 [0241.308] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.310] DecryptMessage (in: phContext=0x242d138, pMessage=0x246a9d4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246a9d4, pfQOP=0x0) returned 0x0 [0241.310] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.310] DecryptMessage (in: phContext=0x242d138, pMessage=0x246aae8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246aae8, pfQOP=0x0) returned 0x0 [0241.310] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.311] DecryptMessage (in: phContext=0x242d138, pMessage=0x246abfc, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246abfc, pfQOP=0x0) returned 0x0 [0241.311] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.311] DecryptMessage (in: phContext=0x242d138, pMessage=0x246ad10, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246ad10, pfQOP=0x0) returned 0x0 [0241.311] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.312] DecryptMessage (in: phContext=0x242d138, pMessage=0x246ae24, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246ae24, pfQOP=0x0) returned 0x0 [0241.312] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.314] DecryptMessage (in: phContext=0x242d138, pMessage=0x246af38, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246af38, pfQOP=0x0) returned 0x0 [0241.314] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.314] DecryptMessage (in: phContext=0x242d138, pMessage=0x246b04c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246b04c, pfQOP=0x0) returned 0x0 [0241.314] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.315] DecryptMessage (in: phContext=0x242d138, pMessage=0x246b160, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246b160, pfQOP=0x0) returned 0x0 [0241.315] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.321] DecryptMessage (in: phContext=0x242d138, pMessage=0x246b274, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246b274, pfQOP=0x0) returned 0x0 [0241.321] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.322] DecryptMessage (in: phContext=0x242d138, pMessage=0x246b388, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246b388, pfQOP=0x0) returned 0x0 [0241.322] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.322] DecryptMessage (in: phContext=0x242d138, pMessage=0x246b49c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246b49c, pfQOP=0x0) returned 0x0 [0241.322] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.323] DecryptMessage (in: phContext=0x242d138, pMessage=0x246b5b0, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246b5b0, pfQOP=0x0) returned 0x0 [0241.323] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.323] DecryptMessage (in: phContext=0x242d138, pMessage=0x246b6c4, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246b6c4, pfQOP=0x0) returned 0x0 [0241.323] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.324] DecryptMessage (in: phContext=0x242d138, pMessage=0x246b7d8, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246b7d8, pfQOP=0x0) returned 0x0 [0241.324] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x3000, lpOverlapped=0x0) returned 1 [0241.324] DecryptMessage (in: phContext=0x242d138, pMessage=0x246b8ec, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246b8ec, pfQOP=0x0) returned 0x0 [0241.324] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.325] DecryptMessage (in: phContext=0x242d138, pMessage=0x246ba00, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246ba00, pfQOP=0x0) returned 0x0 [0241.325] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.325] DecryptMessage (in: phContext=0x242d138, pMessage=0x246bb14, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246bb14, pfQOP=0x0) returned 0x0 [0241.325] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.326] DecryptMessage (in: phContext=0x242d138, pMessage=0x246bc28, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246bc28, pfQOP=0x0) returned 0x0 [0241.326] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.327] DecryptMessage (in: phContext=0x242d138, pMessage=0x246bd3c, MessageSeqNo=0x0, pfQOP=0x0 | out: pMessage=0x246bd3c, pfQOP=0x0) returned 0x0 [0241.327] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.328] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.328] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.330] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.331] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.335] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.338] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.339] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.339] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.340] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.340] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.341] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.341] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.342] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.342] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.358] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.362] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.365] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.365] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.368] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.368] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.369] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.370] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.370] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.371] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.372] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.372] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.373] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.374] WriteFile (in: hFile=0x27c, lpBuffer=0x244a2d0*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x19f25c, lpOverlapped=0x0 | out: lpBuffer=0x244a2d0*, lpNumberOfBytesWritten=0x19f25c*=0x4000, lpOverlapped=0x0) returned 1 [0241.823] SetEvent (hEvent=0x270) returned 1 [0241.824] CloseHandle (hObject=0x27c) returned 1 [0242.141] ExpandEnvironmentStringsW (in: lpSrc="%tmp%", lpDst=0x19f1dc, nSize=0x64 | out: lpDst="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp") returned 0x25 [0242.141] ExpandEnvironmentStringsW (in: lpSrc="%tmp%/build.exe", lpDst=0x19f1dc, nSize=0x64 | out: lpDst="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp/build.exe") returned 0x2f [0242.144] ExpandEnvironmentStringsW (in: lpSrc="%tmp%", lpDst=0x19f1dc, nSize=0x64 | out: lpDst="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp") returned 0x25 [0242.144] ExpandEnvironmentStringsW (in: lpSrc="%tmp%/build.exe", lpDst=0x19f1dc, nSize=0x64 | out: lpDst="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp/build.exe") returned 0x2f [0242.144] LocalAlloc (uFlags=0x0, uBytes=0x5e) returned 0x55792b0 [0242.144] LocalAlloc (uFlags=0x0, uBytes=0x52) returned 0x546640 [0247.950] CoCreateGuid (in: pguid=0x19efe8 | out: pguid=0x19efe8*(Data1=0x30a40f05, Data2=0x5a5a, Data3=0x4e3e, Data4=([0]=0x8d, [1]=0xf4, [2]=0xb5, [3]=0xfd, [4]=0x76, [5]=0xf0, [6]=0xaf, [7]=0x85))) returned 0x0 [0247.951] CoCreateGuid (in: pguid=0x19ef18 | out: pguid=0x19ef18*(Data1=0x73c04dbd, Data2=0x78ea, Data3=0x40a8, Data4=([0]=0xa9, [1]=0x6a, [2]=0xb5, [3]=0xa2, [4]=0x6b, [5]=0x9c, [6]=0xe0, [7]=0x66))) returned 0x0 [0247.952] send (s=0x2cc, buf=0x2369863*, len=577, flags=0) returned 577 [0249.448] CoGetContextToken (in: pToken=0x19fdc0 | out: pToken=0x19fdc0) returned 0x0 [0249.448] IUnknown:QueryInterface (in: This=0x4d0cb0, riid=0x6c6f4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fde4 | out: ppvObject=0x19fde4*=0x4d0cbc) returned 0x0 [0249.449] IComThreadingInfo:GetCurrentThreadType (in: This=0x4d0cbc, pThreadType=0x19fe44 | out: pThreadType=0x19fe44*=0) returned 0x0 [0249.449] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0249.450] CoGetContextToken (in: pToken=0x19fadc | out: pToken=0x19fadc) returned 0x0 [0249.450] IUnknown:QueryInterface (in: This=0x4d0cb0, riid=0x6c6f4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fb00 | out: ppvObject=0x19fb00*=0x4d0cbc) returned 0x0 [0249.450] IComThreadingInfo:GetCurrentThreadType (in: This=0x4d0cbc, pThreadType=0x19fb2c | out: pThreadType=0x19fb2c*=0) returned 0x0 [0249.450] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0249.458] CoGetContextToken (in: pToken=0x19fadc | out: pToken=0x19fadc) returned 0x0 [0249.458] IUnknown:QueryInterface (in: This=0x4d0cb0, riid=0x6c6f4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fb00 | out: ppvObject=0x19fb00*=0x4d0cbc) returned 0x0 [0249.458] IComThreadingInfo:GetCurrentThreadType (in: This=0x4d0cbc, pThreadType=0x19fb2c | out: pThreadType=0x19fb2c*=0) returned 0x0 [0249.458] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0249.511] CoGetContextToken (in: pToken=0x19fadc | out: pToken=0x19fadc) returned 0x0 [0249.511] IUnknown:QueryInterface (in: This=0x4d0cb0, riid=0x6c6f4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fb00 | out: ppvObject=0x19fb00*=0x4d0cbc) returned 0x0 [0249.511] IComThreadingInfo:GetCurrentThreadType (in: This=0x4d0cbc, pThreadType=0x19fb2c | out: pThreadType=0x19fb2c*=0) returned 0x0 [0249.512] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0249.541] CoGetContextToken (in: pToken=0x19faf4 | out: pToken=0x19faf4) returned 0x0 [0249.541] IUnknown:QueryInterface (in: This=0x4d0cb0, riid=0x6c6f4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19fb18 | out: ppvObject=0x19fb18*=0x4d0cbc) returned 0x0 [0249.541] IComThreadingInfo:GetCurrentThreadType (in: This=0x4d0cbc, pThreadType=0x19fb44 | out: pThreadType=0x19fb44*=0) returned 0x0 [0249.541] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0249.594] CoUninitialize () Thread: id = 5 os_tid = 0x814 Thread: id = 6 os_tid = 0x84 Thread: id = 7 os_tid = 0xf7c [0179.944] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0179.944] RoInitialize () returned 0x1 [0179.944] RoUninitialize () returned 0x0 [0214.773] CoGetContextToken (in: pToken=0x436fc30 | out: pToken=0x436fc30) returned 0x0 [0214.773] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0214.773] WbemLocator:IUnknown:Release (This=0x544d80) returned 0x1 [0214.773] WbemLocator:IUnknown:Release (This=0x544d80) returned 0x0 [0214.773] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0214.773] IUnknown:Release (This=0x4fe590) returned 0x2 [0214.773] IUnknown:Release (This=0x4fe590) returned 0x1 [0214.773] IUnknown:Release (This=0x4fe590) returned 0x0 [0214.773] CloseHandle (hObject=0x2c8) returned 1 [0214.774] CloseHandle (hObject=0x28c) returned 1 [0214.774] RegCloseKey (hKey=0x434) returned 0x0 [0214.774] CloseHandle (hObject=0x288) returned 1 [0214.774] CloseHandle (hObject=0x2c4) returned 1 [0214.774] CloseHandle (hObject=0x284) returned 1 [0214.774] RegCloseKey (hKey=0x42c) returned 0x0 [0214.774] CloseHandle (hObject=0x280) returned 1 [0214.775] CloseHandle (hObject=0x2d4) returned 1 [0214.775] CloseHandle (hObject=0x27c) returned 1 [0214.775] CloseHandle (hObject=0x278) returned 1 [0214.775] CloseHandle (hObject=0x298) returned 1 [0214.775] CloseHandle (hObject=0x274) returned 1 [0214.775] CloseHandle (hObject=0x2d0) returned 1 [0214.776] CloseHandle (hObject=0x270) returned 1 [0214.776] CloseHandle (hObject=0x294) returned 1 [0214.776] CloseHandle (hObject=0x290) returned 1 [0214.776] CloseHandle (hObject=0x268) returned 1 [0218.212] CoGetContextToken (in: pToken=0x436fc30 | out: pToken=0x436fc30) returned 0x0 [0218.213] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0218.213] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x1 [0218.213] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x0 [0218.213] CoGetContextToken (in: pToken=0x436fc30 | out: pToken=0x436fc30) returned 0x0 [0218.213] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0218.213] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x1 [0218.213] WbemLocator:IUnknown:Release (This=0x4e11b0) returned 0x0 [0218.214] IUnknown:Release (This=0x4d0cb0) returned 0x0 [0231.907] CoGetContextToken (in: pToken=0x436fc30 | out: pToken=0x436fc30) returned 0x0 [0231.908] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.908] WbemLocator:IUnknown:Release (This=0x4e6bc0) returned 0x1 [0231.908] WbemLocator:IUnknown:Release (This=0x579308) returned 0x0 [0231.910] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.910] WbemLocator:IUnknown:Release (This=0x544d70) returned 0x1 [0231.910] WbemLocator:IUnknown:Release (This=0x544d70) returned 0x0 [0231.910] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.910] WbemLocator:IUnknown:Release (This=0x544d60) returned 0x1 [0231.910] WbemLocator:IUnknown:Release (This=0x544d60) returned 0x0 [0231.910] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.910] WbemLocator:IUnknown:Release (This=0x4e6cc0) returned 0x1 [0231.911] WbemLocator:IUnknown:Release (This=0x579178) returned 0x0 [0231.911] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.911] WbemLocator:IUnknown:Release (This=0x544e00) returned 0x1 [0231.911] WbemLocator:IUnknown:Release (This=0x544e00) returned 0x0 [0231.911] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.911] WbemLocator:IUnknown:Release (This=0x4e5ec0) returned 0x1 [0231.911] WbemLocator:IUnknown:Release (This=0x579268) returned 0x0 [0231.912] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.912] WbemLocator:IUnknown:Release (This=0x58e7c8) returned 0x1 [0231.912] WbemLocator:IUnknown:Release (This=0x58e7c8) returned 0x0 [0231.912] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.912] IUnknown:Release (This=0x4febf0) returned 0x2 [0231.912] IUnknown:Release (This=0x4febf0) returned 0x1 [0231.912] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.912] WbemLocator:IUnknown:Release (This=0x58e838) returned 0x1 [0231.912] WbemLocator:IUnknown:Release (This=0x58e838) returned 0x0 [0231.912] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.912] IUnknown:Release (This=0x4fe728) returned 0x2 [0231.912] IUnknown:Release (This=0x4fe728) returned 0x1 [0231.912] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.913] WbemLocator:IUnknown:Release (This=0x58e798) returned 0x1 [0231.913] WbemLocator:IUnknown:Release (This=0x58e798) returned 0x0 [0231.913] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.913] WbemLocator:IUnknown:Release (This=0x4e6dc0) returned 0x1 [0231.913] WbemLocator:IUnknown:Release (This=0x579c68) returned 0x0 [0231.913] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.913] WbemLocator:IUnknown:Release (This=0x58e778) returned 0x1 [0231.913] WbemLocator:IUnknown:Release (This=0x58e778) returned 0x0 [0231.913] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.913] IUnknown:Release (This=0x5141a0) returned 0x2 [0231.913] IUnknown:Release (This=0x5141a0) returned 0x1 [0231.913] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.913] WbemLocator:IUnknown:Release (This=0x58e808) returned 0x1 [0231.914] WbemLocator:IUnknown:Release (This=0x58e808) returned 0x0 [0231.914] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.914] IUnknown:Release (This=0x513cd8) returned 0x2 [0231.914] IUnknown:Release (This=0x513cd8) returned 0x1 [0231.914] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.914] WbemLocator:IUnknown:Release (This=0x58e7d8) returned 0x1 [0231.914] WbemLocator:IUnknown:Release (This=0x58e7d8) returned 0x0 [0231.914] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.914] IUnknown:Release (This=0x513678) returned 0x2 [0231.914] IUnknown:Release (This=0x513678) returned 0x1 [0231.914] CoGetContextToken (in: pToken=0x436fc30 | out: pToken=0x436fc30) returned 0x0 [0231.914] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.914] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x1 [0231.914] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x0 [0231.914] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.914] WbemDefPath:IUnknown:Release (This=0x5247a0) returned 0x1 [0231.914] WbemDefPath:IUnknown:Release (This=0x5247a0) returned 0x0 [0231.915] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.915] WbemDefPath:IUnknown:Release (This=0x524490) returned 0x1 [0231.915] WbemDefPath:IUnknown:Release (This=0x524490) returned 0x0 [0231.915] CoGetContextToken (in: pToken=0x436fbb8 | out: pToken=0x436fbb8) returned 0x0 [0231.915] WbemDefPath:IUnknown:Release (This=0x524810) returned 0x1 [0231.915] WbemDefPath:IUnknown:Release (This=0x524810) returned 0x0 [0231.915] IUnknown:Release (This=0x513678) returned 0x0 [0231.915] IUnknown:Release (This=0x4fe728) returned 0x0 [0231.915] IUnknown:Release (This=0x5141a0) returned 0x0 [0231.916] IUnknown:Release (This=0x513cd8) returned 0x0 [0231.916] IUnknown:Release (This=0x4febf0) returned 0x0 [0231.917] GdipDisposeImage (image=0x53c1f08) returned 0x0 [0232.027] RegCloseKey (hKey=0x2d0) returned 0x0 [0232.027] RegCloseKey (hKey=0x270) returned 0x0 [0232.027] RegCloseKey (hKey=0x294) returned 0x0 [0249.451] EtwEventUnregister (RegHandle=0x4fb0d0) returned 0x0 [0249.453] EtwEventUnregister (RegHandle=0x518378) returned 0x0 [0249.457] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x4fc [0249.457] PostMessageW (hWnd=0x901f6, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0249.458] CoGetContextToken (in: pToken=0x436f80c | out: pToken=0x436f80c) returned 0x0 [0249.458] IUnknown:QueryInterface (in: This=0x4d0cb0, riid=0x6c6f4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x436f830 | out: ppvObject=0x436f830*=0x4d0cbc) returned 0x0 [0249.458] IComThreadingInfo:GetCurrentThreadType (in: This=0x4d0cbc, pThreadType=0x436f85c | out: pThreadType=0x436f85c*=0) returned 0x0 [0249.458] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0249.468] CoGetContextToken (in: pToken=0x436f824 | out: pToken=0x436f824) returned 0x0 [0249.468] IUnknown:QueryInterface (in: This=0x4d0cb0, riid=0x6c6f4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x436f848 | out: ppvObject=0x436f848*=0x4d0cbc) returned 0x0 [0249.469] IComThreadingInfo:GetCurrentThreadType (in: This=0x4d0cbc, pThreadType=0x436f874 | out: pThreadType=0x436f874*=0) returned 0x0 [0249.469] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0249.490] IUnknown:Release (This=0x557e268) returned 0x2 [0249.490] IUnknown:Release (This=0x557ca80) returned 0x2 [0249.490] IUnknown:Release (This=0x557d5a8) returned 0x2 [0249.490] IUnknown:Release (This=0x557d410) returned 0x2 [0249.491] IUnknown:Release (This=0x557e730) returned 0x2 [0249.491] IUnknown:Release (This=0x557df38) returned 0x2 [0249.491] IUnknown:Release (This=0x557d0e0) returned 0x2 [0249.491] IUnknown:Release (This=0x557dda0) returned 0x2 [0249.491] IUnknown:Release (This=0x557cf48) returned 0x2 [0249.492] IUnknown:Release (This=0x557da70) returned 0x2 [0249.492] IUnknown:Release (This=0x557cdb0) returned 0x2 [0249.492] IUnknown:Release (This=0x557e400) returned 0x2 [0249.492] IUnknown:Release (This=0x557e0d0) returned 0x2 [0249.492] IUnknown:Release (This=0x557d8d8) returned 0x2 [0249.493] IUnknown:Release (This=0x557e598) returned 0x2 [0249.493] IUnknown:Release (This=0x557dc08) returned 0x2 [0249.493] IUnknown:Release (This=0x557d278) returned 0x2 [0249.493] IUnknown:Release (This=0x557d740) returned 0x2 [0249.493] IUnknown:Release (This=0x557e8c8) returned 0x2 [0249.494] IUnknown:Release (This=0x557cc18) returned 0x2 [0249.494] IUnknown:Release (This=0x5571af0) returned 0x2 [0249.494] IUnknown:Release (This=0x5572e10) returned 0x2 [0249.494] IUnknown:Release (This=0x5571958) returned 0x2 [0249.494] IUnknown:Release (This=0x5572ae0) returned 0x2 [0249.495] IUnknown:Release (This=0x5572618) returned 0x2 [0249.495] IUnknown:Release (This=0x55722e8) returned 0x2 [0249.495] IUnknown:Release (This=0x5571fb8) returned 0x2 [0249.495] IUnknown:Release (This=0x5571490) returned 0x2 [0249.495] IUnknown:Release (This=0x55712f8) returned 0x2 [0249.495] IUnknown:Release (This=0x5571e20) returned 0x2 [0249.496] IUnknown:Release (This=0x55727b0) returned 0x2 [0249.496] IUnknown:Release (This=0x5571160) returned 0x2 [0249.496] IUnknown:Release (This=0x5572948) returned 0x2 [0249.496] IUnknown:Release (This=0x5572480) returned 0x2 [0249.496] IUnknown:Release (This=0x5572c78) returned 0x2 [0249.496] IUnknown:Release (This=0x5571c88) returned 0x2 [0249.497] IUnknown:Release (This=0x5571628) returned 0x2 [0249.497] IUnknown:Release (This=0x5572150) returned 0x2 [0249.497] IUnknown:Release (This=0x5570fc8) returned 0x2 [0249.497] IUnknown:Release (This=0x55717c0) returned 0x2 [0249.497] IUnknown:Release (This=0x5565960) returned 0x2 [0249.498] IUnknown:Release (This=0x5565498) returned 0x2 [0249.498] IUnknown:Release (This=0x5565300) returned 0x2 [0249.498] IUnknown:Release (This=0x5564ca0) returned 0x2 [0249.498] IUnknown:Release (This=0x5564970) returned 0x2 [0249.498] IUnknown:Release (This=0x5564640) returned 0x2 [0249.498] IUnknown:Release (This=0x5565af8) returned 0x2 [0249.499] IUnknown:Release (This=0x5564310) returned 0x2 [0249.499] IUnknown:Release (This=0x55657c8) returned 0x2 [0249.499] IUnknown:Release (This=0x5564178) returned 0x2 [0249.499] IUnknown:Release (This=0x5565630) returned 0x2 [0249.499] IUnknown:Release (This=0x5564fd0) returned 0x2 [0249.500] IUnknown:Release (This=0x5564e38) returned 0x2 [0249.500] IUnknown:Release (This=0x5565e28) returned 0x2 [0249.500] IUnknown:Release (This=0x55647d8) returned 0x2 [0249.500] IUnknown:Release (This=0x55644a8) returned 0x2 [0249.500] IUnknown:Release (This=0x5563fe0) returned 0x2 [0249.501] IUnknown:Release (This=0x5564b08) returned 0x2 [0249.501] IUnknown:Release (This=0x5565c90) returned 0x2 [0249.501] IUnknown:Release (This=0x5565168) returned 0x2 [0249.501] IUnknown:Release (This=0x53f750) returned 0x2 [0249.501] IUnknown:Release (This=0x53f5b8) returned 0x2 [0249.501] IUnknown:Release (This=0x53f420) returned 0x2 [0249.502] IUnknown:Release (This=0x53f288) returned 0x2 [0249.502] IUnknown:Release (This=0x53f0f0) returned 0x2 [0249.502] IUnknown:Release (This=0x53ea90) returned 0x2 [0249.502] IUnknown:Release (This=0x53e8f8) returned 0x2 [0249.502] IUnknown:Release (This=0x53e760) returned 0x2 [0249.503] IUnknown:Release (This=0x53fdb0) returned 0x2 [0249.503] IUnknown:Release (This=0x540278) returned 0x2 [0249.503] IUnknown:Release (This=0x5400e0) returned 0x2 [0249.503] IUnknown:Release (This=0x53ef58) returned 0x2 [0249.503] IUnknown:Release (This=0x53edc0) returned 0x2 [0249.503] IUnknown:Release (This=0x53ff48) returned 0x2 [0249.504] IUnknown:Release (This=0x53ec28) returned 0x2 [0249.504] IUnknown:Release (This=0x53fc18) returned 0x2 [0249.504] IUnknown:Release (This=0x53e5c8) returned 0x2 [0249.504] IUnknown:Release (This=0x53fa80) returned 0x2 [0249.504] IUnknown:Release (This=0x53e430) returned 0x2 [0249.504] IUnknown:Release (This=0x53f8e8) returned 0x2 [0249.505] IUnknown:Release (This=0x4febf0) returned 0x2 [0249.505] IUnknown:Release (This=0x4fe8c0) returned 0x2 [0249.505] IUnknown:Release (This=0x4fe590) returned 0x2 [0249.508] CloseHandle (hObject=0x428) returned 1 [0249.509] EtwEventUnregister (RegHandle=0x4fb750) returned 0x0 [0249.512] CertFreeCertificateContext (pCertContext=0x55931b0) returned 1 [0249.513] CertCloseStore (hCertStore=0x5442d8, dwFlags=0x0) returned 1 [0249.513] CertFreeCertificateContext (pCertContext=0x55931b0) returned 1 [0249.514] CertFreeCertificateContext (pCertContext=0x5593200) returned 1 [0249.515] FreeCredentialsHandle (phCredential=0x242cf34) returned 0x0 [0249.515] DeleteSecurityContext (phContext=0x242d138) returned 0x0 [0249.516] CloseHandle (hObject=0x568) returned 1 [0249.517] setsockopt (s=0x570, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0249.518] closesocket (s=0x570) returned 0 [0249.518] CloseHandle (hObject=0x574) returned 1 [0249.518] setsockopt (s=0x564, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0249.519] closesocket (s=0x564) returned 0 [0249.519] CloseHandle (hObject=0x56c) returned 1 [0249.519] CloseHandle (hObject=0x4fc) returned 1 [0249.520] setsockopt (s=0x55c, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0249.520] closesocket (s=0x55c) returned 0 [0249.522] CloseHandle (hObject=0x848) returned 1 [0249.522] setsockopt (s=0x2cc, level=65535, optname=128, optval="\x01", optlen=4) returned 0 [0249.522] closesocket (s=0x2cc) returned 0 [0249.523] CloseHandle (hObject=0x51c) returned 1 [0249.523] CloseHandle (hObject=0x518) returned 1 [0249.524] CloseHandle (hObject=0x500) returned 1 [0249.524] CloseHandle (hObject=0x4f4) returned 1 [0249.524] CertFreeCertificateContext (pCertContext=0x5593250) returned 1 [0249.525] WinHttpCloseHandle (hInternet=0x5558060) returned 1 [0249.525] CloseHandle (hObject=0x3fc) returned 1 [0249.525] CloseHandle (hObject=0x4ac) returned 1 [0249.526] CloseHandle (hObject=0x4a8) returned 1 [0249.526] RegCloseKey (hKey=0x4a4) returned 0x0 [0249.527] CloseHandle (hObject=0x4a0) returned 1 [0249.527] RegCloseKey (hKey=0x49c) returned 0x0 [0249.527] CloseHandle (hObject=0x498) returned 1 [0249.527] RegCloseKey (hKey=0x80000004) returned 0x0 [0249.528] RegCloseKey (hKey=0x494) returned 0x0 [0249.528] RegCloseKey (hKey=0x490) returned 0x0 [0249.529] CloseHandle (hObject=0x478) returned 1 [0249.529] setsockopt (s=0x46c, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0249.529] closesocket (s=0x46c) returned 0 [0249.529] CloseHandle (hObject=0x470) returned 1 [0249.530] CloseHandle (hObject=0x354) returned 1 [0249.530] setsockopt (s=0x464, level=65535, optname=128, optval="\x01", optlen=4) returned -1 [0249.530] closesocket (s=0x464) returned 0 [0249.531] CloseHandle (hObject=0x468) returned 1 [0249.531] CloseHandle (hObject=0x2c4) returned 1 [0249.531] CloseHandle (hObject=0x284) returned 1 [0249.531] CloseHandle (hObject=0x42c) returned 1 [0249.532] CloseHandle (hObject=0x280) returned 1 [0249.532] CloseHandle (hObject=0x2d4) returned 1 [0249.532] CloseHandle (hObject=0x43c) returned 1 [0249.532] UnmapViewOfFile (lpBaseAddress=0x5620000) returned 1 [0249.533] CertFreeCertificateContext (pCertContext=0x5593750) returned 1 [0249.533] CloseHandle (hObject=0x274) returned 1 [0249.533] UnmapViewOfFile (lpBaseAddress=0x5680000) returned 1 [0249.535] CoGetContextToken (in: pToken=0x436f878 | out: pToken=0x436f878) returned 0x0 [0249.535] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.535] IUnknown:Release (This=0x5564b08) returned 0x1 [0249.536] IUnknown:Release (This=0x5564b08) returned 0x0 [0249.536] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.536] WbemLocator:IUnknown:Release (This=0x4e60c0) returned 0x1 [0249.536] WbemLocator:IUnknown:Release (This=0x4e0cb0) returned 0x0 [0249.537] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.537] IUnknown:Release (This=0x5572e10) returned 0x1 [0249.537] IUnknown:Release (This=0x5572e10) returned 0x0 [0249.537] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.537] IUnknown:Release (This=0x557d0e0) returned 0x1 [0249.537] IUnknown:Release (This=0x557d0e0) returned 0x0 [0249.537] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.537] IUnknown:Release (This=0x53e760) returned 0x1 [0249.537] IUnknown:Release (This=0x53e760) returned 0x0 [0249.537] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.537] IUnknown:Release (This=0x557d740) returned 0x1 [0249.537] IUnknown:Release (This=0x557d740) returned 0x0 [0249.537] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.537] IUnknown:Release (This=0x5565300) returned 0x1 [0249.537] IUnknown:Release (This=0x5565300) returned 0x0 [0249.538] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.538] IUnknown:Release (This=0x557df38) returned 0x1 [0249.538] IUnknown:Release (This=0x557df38) returned 0x0 [0249.538] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.538] IUnknown:Release (This=0x5565af8) returned 0x1 [0249.538] IUnknown:Release (This=0x5565af8) returned 0x0 [0249.538] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.538] IUnknown:Release (This=0x557d8d8) returned 0x1 [0249.538] IUnknown:Release (This=0x557d8d8) returned 0x0 [0249.538] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.538] IUnknown:Release (This=0x5570fc8) returned 0x1 [0249.538] IUnknown:Release (This=0x5570fc8) returned 0x0 [0249.538] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.538] IUnknown:Release (This=0x53f750) returned 0x1 [0249.538] IUnknown:Release (This=0x53f750) returned 0x0 [0249.539] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.539] IUnknown:Release (This=0x557e0d0) returned 0x1 [0249.539] IUnknown:Release (This=0x557e0d0) returned 0x0 [0249.539] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.539] IUnknown:Release (This=0x55717c0) returned 0x1 [0249.539] IUnknown:Release (This=0x55717c0) returned 0x0 [0249.539] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.539] IUnknown:Release (This=0x53ff48) returned 0x1 [0249.539] IUnknown:Release (This=0x53ff48) returned 0x0 [0249.539] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.539] IUnknown:Release (This=0x5400e0) returned 0x1 [0249.539] IUnknown:Release (This=0x5400e0) returned 0x0 [0249.539] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.539] IUnknown:Release (This=0x5571fb8) returned 0x1 [0249.539] IUnknown:Release (This=0x5571fb8) returned 0x0 [0249.540] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.540] IUnknown:Release (This=0x5564640) returned 0x1 [0249.540] IUnknown:Release (This=0x5564640) returned 0x0 [0249.540] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.540] IUnknown:Release (This=0x557e8c8) returned 0x1 [0249.540] IUnknown:Release (This=0x557e8c8) returned 0x0 [0249.540] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.540] IUnknown:Release (This=0x55727b0) returned 0x1 [0249.540] IUnknown:Release (This=0x55727b0) returned 0x0 [0249.540] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.540] IUnknown:Release (This=0x5564e38) returned 0x1 [0249.540] IUnknown:Release (This=0x5564e38) returned 0x0 [0249.540] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.540] IUnknown:Release (This=0x557dc08) returned 0x1 [0249.540] IUnknown:Release (This=0x557dc08) returned 0x0 [0249.541] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.541] IUnknown:Release (This=0x557d278) returned 0x1 [0249.541] IUnknown:Release (This=0x557d278) returned 0x0 [0249.541] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.541] IUnknown:Release (This=0x53ea90) returned 0x1 [0249.541] IUnknown:Release (This=0x53ea90) returned 0x0 [0249.541] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.541] WbemLocator:IUnknown:Release (This=0x4e5ac0) returned 0x1 [0249.541] WbemLocator:IUnknown:Release (This=0x57a028) returned 0x0 [0249.542] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.542] IUnknown:Release (This=0x53f288) returned 0x1 [0249.542] IUnknown:Release (This=0x53f288) returned 0x0 [0249.542] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.542] IUnknown:Release (This=0x5565e28) returned 0x1 [0249.542] IUnknown:Release (This=0x5565e28) returned 0x0 [0249.542] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.542] IUnknown:Release (This=0x4fe590) returned 0x1 [0249.542] IUnknown:Release (This=0x4fe590) returned 0x0 [0249.543] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.543] IUnknown:Release (This=0x53fa80) returned 0x1 [0249.543] IUnknown:Release (This=0x53fa80) returned 0x0 [0249.543] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.543] IUnknown:Release (This=0x557da70) returned 0x1 [0249.543] IUnknown:Release (This=0x557da70) returned 0x0 [0249.543] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.543] IUnknown:Release (This=0x5571af0) returned 0x1 [0249.543] IUnknown:Release (This=0x5571af0) returned 0x0 [0249.543] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.543] IUnknown:Release (This=0x5564178) returned 0x1 [0249.543] IUnknown:Release (This=0x5564178) returned 0x0 [0249.543] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.543] IUnknown:Release (This=0x540278) returned 0x1 [0249.543] IUnknown:Release (This=0x540278) returned 0x0 [0249.543] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.544] IUnknown:Release (This=0x53e430) returned 0x1 [0249.544] IUnknown:Release (This=0x53e430) returned 0x0 [0249.544] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.544] IUnknown:Release (This=0x55722e8) returned 0x1 [0249.544] IUnknown:Release (This=0x55722e8) returned 0x0 [0249.544] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.544] IUnknown:Release (This=0x5564970) returned 0x1 [0249.544] IUnknown:Release (This=0x5564970) returned 0x0 [0249.544] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.544] IUnknown:Release (This=0x557cc18) returned 0x1 [0249.544] IUnknown:Release (This=0x557cc18) returned 0x0 [0249.544] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.544] IUnknown:Release (This=0x5565168) returned 0x1 [0249.544] IUnknown:Release (This=0x5565168) returned 0x0 [0249.544] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.544] IUnknown:Release (This=0x55712f8) returned 0x1 [0249.544] IUnknown:Release (This=0x55712f8) returned 0x0 [0249.545] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.545] IUnknown:Release (This=0x53edc0) returned 0x1 [0249.545] IUnknown:Release (This=0x53edc0) returned 0x0 [0249.545] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.545] IUnknown:Release (This=0x5565960) returned 0x1 [0249.545] IUnknown:Release (This=0x5565960) returned 0x0 [0249.545] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.545] IUnknown:Release (This=0x53f420) returned 0x1 [0249.545] IUnknown:Release (This=0x53f420) returned 0x0 [0249.545] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.545] IUnknown:Release (This=0x53f5b8) returned 0x1 [0249.545] IUnknown:Release (This=0x53f5b8) returned 0x0 [0249.545] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.545] WbemLocator:IUnknown:Release (This=0x4e54c0) returned 0x1 [0249.545] WbemLocator:IUnknown:Release (This=0x579cb8) returned 0x0 [0249.547] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.547] IUnknown:Release (This=0x4fe8c0) returned 0x1 [0249.547] IUnknown:Release (This=0x4fe8c0) returned 0x0 [0249.547] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.547] IUnknown:Release (This=0x5571628) returned 0x1 [0249.547] IUnknown:Release (This=0x5571628) returned 0x0 [0249.547] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.547] IUnknown:Release (This=0x53fdb0) returned 0x1 [0249.547] IUnknown:Release (This=0x53fdb0) returned 0x0 [0249.548] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.548] IUnknown:Release (This=0x557e400) returned 0x1 [0249.548] IUnknown:Release (This=0x557e400) returned 0x0 [0249.548] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.548] IUnknown:Release (This=0x557d5a8) returned 0x1 [0249.548] IUnknown:Release (This=0x557d5a8) returned 0x0 [0249.548] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.548] IUnknown:Release (This=0x5571e20) returned 0x1 [0249.548] IUnknown:Release (This=0x5571e20) returned 0x0 [0249.548] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.548] IUnknown:Release (This=0x55644a8) returned 0x1 [0249.548] IUnknown:Release (This=0x55644a8) returned 0x0 [0249.548] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.548] IUnknown:Release (This=0x53e5c8) returned 0x1 [0249.548] IUnknown:Release (This=0x53e5c8) returned 0x0 [0249.548] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.548] IUnknown:Release (This=0x5564ca0) returned 0x1 [0249.548] IUnknown:Release (This=0x5564ca0) returned 0x0 [0249.549] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.549] IUnknown:Release (This=0x557e268) returned 0x1 [0249.549] IUnknown:Release (This=0x557e268) returned 0x0 [0249.549] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.549] IUnknown:Release (This=0x53e8f8) returned 0x1 [0249.549] IUnknown:Release (This=0x53e8f8) returned 0x0 [0249.550] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.550] IUnknown:Release (This=0x5565498) returned 0x1 [0249.550] IUnknown:Release (This=0x5565498) returned 0x0 [0249.550] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.550] IUnknown:Release (This=0x557ca80) returned 0x1 [0249.550] IUnknown:Release (This=0x557ca80) returned 0x0 [0249.550] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.550] IUnknown:Release (This=0x5572ae0) returned 0x1 [0249.550] IUnknown:Release (This=0x5572ae0) returned 0x0 [0249.550] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.550] IUnknown:Release (This=0x53f0f0) returned 0x1 [0249.550] IUnknown:Release (This=0x53f0f0) returned 0x0 [0249.550] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.550] IUnknown:Release (This=0x557d410) returned 0x1 [0249.550] IUnknown:Release (This=0x557d410) returned 0x0 [0249.550] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.550] IUnknown:Release (This=0x5565c90) returned 0x1 [0249.550] IUnknown:Release (This=0x5565c90) returned 0x0 [0249.551] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.551] IUnknown:Release (This=0x5571160) returned 0x1 [0249.551] IUnknown:Release (This=0x5571160) returned 0x0 [0249.551] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.551] IUnknown:Release (This=0x5571c88) returned 0x1 [0249.551] IUnknown:Release (This=0x5571c88) returned 0x0 [0249.551] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.551] IUnknown:Release (This=0x557dda0) returned 0x1 [0249.551] IUnknown:Release (This=0x557dda0) returned 0x0 [0249.551] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.551] IUnknown:Release (This=0x53f8e8) returned 0x1 [0249.551] IUnknown:Release (This=0x53f8e8) returned 0x0 [0249.551] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.551] IUnknown:Release (This=0x4febf0) returned 0x1 [0249.551] IUnknown:Release (This=0x4febf0) returned 0x0 [0249.552] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.552] IUnknown:Release (This=0x5571958) returned 0x1 [0249.552] IUnknown:Release (This=0x5571958) returned 0x0 [0249.552] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.552] IUnknown:Release (This=0x5563fe0) returned 0x1 [0249.552] IUnknown:Release (This=0x5563fe0) returned 0x0 [0249.552] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.552] IUnknown:Release (This=0x557e598) returned 0x1 [0249.552] IUnknown:Release (This=0x557e598) returned 0x0 [0249.552] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.552] WbemLocator:IUnknown:Release (This=0x4e5ec0) returned 0x1 [0249.552] WbemLocator:IUnknown:Release (This=0x555e8d0) returned 0x0 [0249.553] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.553] IUnknown:Release (This=0x5572150) returned 0x1 [0249.553] IUnknown:Release (This=0x5572150) returned 0x0 [0249.553] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.553] IUnknown:Release (This=0x55647d8) returned 0x1 [0249.553] IUnknown:Release (This=0x55647d8) returned 0x0 [0249.553] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.553] IUnknown:Release (This=0x557cdb0) returned 0x1 [0249.553] IUnknown:Release (This=0x557cdb0) returned 0x0 [0249.553] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.553] WbemLocator:IUnknown:Release (This=0x58e738) returned 0x1 [0249.553] WbemLocator:IUnknown:Release (This=0x58e738) returned 0x0 [0249.554] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.554] IUnknown:Release (This=0x5572c78) returned 0x1 [0249.554] IUnknown:Release (This=0x5572c78) returned 0x0 [0249.554] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.554] IUnknown:Release (This=0x5572948) returned 0x1 [0249.554] IUnknown:Release (This=0x5572948) returned 0x0 [0249.554] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.554] IUnknown:Release (This=0x5565630) returned 0x1 [0249.554] IUnknown:Release (This=0x5565630) returned 0x0 [0249.554] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.554] IUnknown:Release (This=0x5564fd0) returned 0x1 [0249.554] IUnknown:Release (This=0x5564fd0) returned 0x0 [0249.554] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.554] IUnknown:Release (This=0x53ef58) returned 0x1 [0249.554] IUnknown:Release (This=0x53ef58) returned 0x0 [0249.554] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.554] IUnknown:Release (This=0x53ec28) returned 0x1 [0249.554] IUnknown:Release (This=0x53ec28) returned 0x0 [0249.555] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.555] IUnknown:Release (This=0x55657c8) returned 0x1 [0249.555] IUnknown:Release (This=0x55657c8) returned 0x0 [0249.555] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.555] WbemLocator:IUnknown:Release (This=0x4e57c0) returned 0x1 [0249.555] WbemLocator:IUnknown:Release (This=0x579d58) returned 0x0 [0249.555] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.555] WbemLocator:IUnknown:Release (This=0x4e6fc0) returned 0x1 [0249.555] WbemLocator:IUnknown:Release (This=0x579d08) returned 0x0 [0249.556] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.556] IUnknown:Release (This=0x5571490) returned 0x1 [0249.556] IUnknown:Release (This=0x5571490) returned 0x0 [0249.556] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.556] IUnknown:Release (This=0x53fc18) returned 0x1 [0249.556] IUnknown:Release (This=0x53fc18) returned 0x0 [0249.556] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.556] IUnknown:Release (This=0x557cf48) returned 0x1 [0249.556] IUnknown:Release (This=0x557cf48) returned 0x0 [0249.556] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.556] IUnknown:Release (This=0x5564310) returned 0x1 [0249.556] IUnknown:Release (This=0x5564310) returned 0x0 [0249.557] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.557] IUnknown:Release (This=0x5572618) returned 0x1 [0249.557] IUnknown:Release (This=0x5572618) returned 0x0 [0249.557] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.557] IUnknown:Release (This=0x557e730) returned 0x1 [0249.557] IUnknown:Release (This=0x557e730) returned 0x0 [0249.557] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.557] IUnknown:Release (This=0x5572480) returned 0x1 [0249.557] IUnknown:Release (This=0x5572480) returned 0x0 [0249.560] IUnknown:Release (This=0x4d0cb0) returned 0x0 [0249.560] CoGetContextToken (in: pToken=0x436f878 | out: pToken=0x436f878) returned 0x0 [0249.560] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.560] WbemDefPath:IUnknown:Release (This=0x519768) returned 0x1 [0249.560] WbemDefPath:IUnknown:Release (This=0x519768) returned 0x0 [0249.560] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.560] WbemDefPath:IUnknown:Release (This=0x519688) returned 0x1 [0249.560] WbemDefPath:IUnknown:Release (This=0x519688) returned 0x0 [0249.560] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.561] WbemDefPath:IUnknown:Release (This=0x5584968) returned 0x1 [0249.561] WbemDefPath:IUnknown:Release (This=0x5584968) returned 0x0 [0249.561] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.561] WbemDefPath:IUnknown:Release (This=0x5246c0) returned 0x1 [0249.561] WbemDefPath:IUnknown:Release (This=0x5246c0) returned 0x0 [0249.581] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.581] WbemDefPath:IUnknown:Release (This=0x556ed80) returned 0x1 [0249.581] WbemDefPath:IUnknown:Release (This=0x556ed80) returned 0x0 [0249.581] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.581] WbemDefPath:IUnknown:Release (This=0x519308) returned 0x1 [0249.581] WbemDefPath:IUnknown:Release (This=0x519308) returned 0x0 [0249.582] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.582] WbemDefPath:IUnknown:Release (This=0x5198b8) returned 0x1 [0249.582] WbemDefPath:IUnknown:Release (This=0x5198b8) returned 0x0 [0249.582] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.582] WbemDefPath:IUnknown:Release (This=0x524340) returned 0x1 [0249.582] WbemDefPath:IUnknown:Release (This=0x524340) returned 0x0 [0249.582] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.582] WbemDefPath:IUnknown:Release (This=0x519ca8) returned 0x1 [0249.582] WbemDefPath:IUnknown:Release (This=0x519ca8) returned 0x0 [0249.582] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.582] WbemDefPath:IUnknown:Release (This=0x556e450) returned 0x1 [0249.582] WbemDefPath:IUnknown:Release (This=0x556e450) returned 0x0 [0249.582] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.582] WbemDefPath:IUnknown:Release (This=0x5193e8) returned 0x1 [0249.582] WbemDefPath:IUnknown:Release (This=0x5193e8) returned 0x0 [0249.583] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.583] WbemDefPath:IUnknown:Release (This=0x518f88) returned 0x1 [0249.583] WbemDefPath:IUnknown:Release (This=0x518f88) returned 0x0 [0249.583] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.583] WbemDefPath:IUnknown:Release (This=0x556efb0) returned 0x1 [0249.583] WbemDefPath:IUnknown:Release (This=0x556efb0) returned 0x0 [0249.583] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.583] WbemDefPath:IUnknown:Release (This=0x556f170) returned 0x1 [0249.583] WbemDefPath:IUnknown:Release (This=0x556f170) returned 0x0 [0249.583] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.583] WbemDefPath:IUnknown:Release (This=0x519538) returned 0x1 [0249.583] WbemDefPath:IUnknown:Release (This=0x519538) returned 0x0 [0249.583] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.583] WbemDefPath:IUnknown:Release (This=0x556e680) returned 0x1 [0249.583] WbemDefPath:IUnknown:Release (This=0x556e680) returned 0x0 [0249.583] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.583] WbemDefPath:IUnknown:Release (This=0x55848f8) returned 0x1 [0249.584] WbemDefPath:IUnknown:Release (This=0x55848f8) returned 0x0 [0249.584] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.584] WbemDefPath:IUnknown:Release (This=0x519ae8) returned 0x1 [0249.584] WbemDefPath:IUnknown:Release (This=0x519ae8) returned 0x0 [0249.584] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.584] WbemDefPath:IUnknown:Release (This=0x524570) returned 0x1 [0249.584] WbemDefPath:IUnknown:Release (This=0x524570) returned 0x0 [0249.584] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.584] WbemDefPath:IUnknown:Release (This=0x556ec30) returned 0x1 [0249.584] WbemDefPath:IUnknown:Release (This=0x556ec30) returned 0x0 [0249.584] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.584] WbemDefPath:IUnknown:Release (This=0x556e300) returned 0x1 [0249.584] WbemDefPath:IUnknown:Release (This=0x556e300) returned 0x0 [0249.584] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.584] WbemDefPath:IUnknown:Release (This=0x556e8b0) returned 0x1 [0249.584] WbemDefPath:IUnknown:Release (This=0x556e8b0) returned 0x0 [0249.584] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.585] WbemDefPath:IUnknown:Release (This=0x5585148) returned 0x1 [0249.585] WbemDefPath:IUnknown:Release (This=0x5585148) returned 0x0 [0249.585] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.585] WbemDefPath:IUnknown:Release (This=0x556edf0) returned 0x1 [0249.585] WbemDefPath:IUnknown:Release (This=0x556edf0) returned 0x0 [0249.585] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.585] WbemDefPath:IUnknown:Release (This=0x556ea00) returned 0x1 [0249.585] WbemDefPath:IUnknown:Release (This=0x556ea00) returned 0x0 [0249.585] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.585] WbemDefPath:IUnknown:Release (This=0x5584b98) returned 0x1 [0249.585] WbemDefPath:IUnknown:Release (This=0x5584b98) returned 0x0 [0249.585] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.585] WbemDefPath:IUnknown:Release (This=0x519d18) returned 0x1 [0249.585] WbemDefPath:IUnknown:Release (This=0x519d18) returned 0x0 [0249.585] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.585] WbemDefPath:IUnknown:Release (This=0x5247a0) returned 0x1 [0249.585] WbemDefPath:IUnknown:Release (This=0x5247a0) returned 0x0 [0249.586] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.586] WbemDefPath:IUnknown:Release (This=0x519618) returned 0x1 [0249.586] WbemDefPath:IUnknown:Release (This=0x519618) returned 0x0 [0249.586] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.586] WbemDefPath:IUnknown:Release (This=0x556e530) returned 0x1 [0249.586] WbemDefPath:IUnknown:Release (This=0x556e530) returned 0x0 [0249.586] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.586] WbemDefPath:IUnknown:Release (This=0x519998) returned 0x1 [0249.586] WbemDefPath:IUnknown:Release (This=0x519998) returned 0x0 [0249.586] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.586] WbemDefPath:IUnknown:Release (This=0x556eae0) returned 0x1 [0249.586] WbemDefPath:IUnknown:Release (This=0x556eae0) returned 0x0 [0249.586] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.586] WbemDefPath:IUnknown:Release (This=0x519068) returned 0x1 [0249.586] WbemDefPath:IUnknown:Release (This=0x519068) returned 0x0 [0249.586] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.586] WbemDefPath:IUnknown:Release (This=0x556f090) returned 0x1 [0249.586] WbemDefPath:IUnknown:Release (This=0x556f090) returned 0x0 [0249.586] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.587] WbemDefPath:IUnknown:Release (This=0x55850d8) returned 0x1 [0249.587] WbemDefPath:IUnknown:Release (This=0x55850d8) returned 0x0 [0249.587] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.587] WbemDefPath:IUnknown:Release (This=0x556e760) returned 0x1 [0249.587] WbemDefPath:IUnknown:Release (This=0x556e760) returned 0x0 [0249.587] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.587] WbemDefPath:IUnknown:Release (This=0x519a08) returned 0x1 [0249.587] WbemDefPath:IUnknown:Release (This=0x519a08) returned 0x0 [0249.587] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.587] WbemDefPath:IUnknown:Release (This=0x519b58) returned 0x1 [0249.587] WbemDefPath:IUnknown:Release (This=0x519b58) returned 0x0 [0249.587] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.587] WbemDefPath:IUnknown:Release (This=0x556ef40) returned 0x1 [0249.587] WbemDefPath:IUnknown:Release (This=0x556ef40) returned 0x0 [0249.587] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.587] WbemDefPath:IUnknown:Release (This=0x519bc8) returned 0x1 [0249.587] WbemDefPath:IUnknown:Release (This=0x519bc8) returned 0x0 [0249.587] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.587] WbemDefPath:IUnknown:Release (This=0x519298) returned 0x1 [0249.587] WbemDefPath:IUnknown:Release (This=0x519298) returned 0x0 [0249.587] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.587] WbemDefPath:IUnknown:Release (This=0x55849d8) returned 0x1 [0249.587] WbemDefPath:IUnknown:Release (This=0x55849d8) returned 0x0 [0249.587] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.587] WbemDefPath:IUnknown:Release (This=0x556e3e0) returned 0x1 [0249.587] WbemDefPath:IUnknown:Release (This=0x556e3e0) returned 0x0 [0249.587] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.587] WbemDefPath:IUnknown:Release (This=0x519848) returned 0x1 [0249.587] WbemDefPath:IUnknown:Release (This=0x519848) returned 0x0 [0249.587] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.587] WbemDefPath:IUnknown:Release (This=0x556e990) returned 0x1 [0249.588] WbemDefPath:IUnknown:Release (This=0x556e990) returned 0x0 [0249.588] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.588] WbemDefPath:IUnknown:Release (This=0x55851b8) returned 0x1 [0249.588] WbemDefPath:IUnknown:Release (This=0x55851b8) returned 0x0 [0249.588] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.588] WbemDefPath:IUnknown:Release (This=0x518f18) returned 0x1 [0249.588] WbemDefPath:IUnknown:Release (This=0x518f18) returned 0x0 [0249.588] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.588] WbemDefPath:IUnknown:Release (This=0x519df8) returned 0x1 [0249.588] WbemDefPath:IUnknown:Release (This=0x519df8) returned 0x0 [0249.588] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.588] WbemDefPath:IUnknown:Release (This=0x524880) returned 0x1 [0249.588] WbemDefPath:IUnknown:Release (This=0x524880) returned 0x0 [0249.588] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.588] WbemDefPath:IUnknown:Release (This=0x5194c8) returned 0x1 [0249.588] WbemDefPath:IUnknown:Release (This=0x5194c8) returned 0x0 [0249.588] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.588] WbemDefPath:IUnknown:Release (This=0x556e610) returned 0x1 [0249.588] WbemDefPath:IUnknown:Release (This=0x556e610) returned 0x0 [0249.588] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.588] WbemDefPath:IUnknown:Release (This=0x5584ab8) returned 0x1 [0249.588] WbemDefPath:IUnknown:Release (This=0x5584ab8) returned 0x0 [0249.588] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.588] WbemDefPath:IUnknown:Release (This=0x519a78) returned 0x1 [0249.588] WbemDefPath:IUnknown:Release (This=0x519a78) returned 0x0 [0249.588] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.588] WbemDefPath:IUnknown:Release (This=0x556ebc0) returned 0x1 [0249.588] WbemDefPath:IUnknown:Release (This=0x556ebc0) returned 0x0 [0249.589] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.589] WbemDefPath:IUnknown:Release (This=0x556e5a0) returned 0x1 [0249.589] WbemDefPath:IUnknown:Release (This=0x556e5a0) returned 0x0 [0249.589] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.589] WbemDefPath:IUnknown:Release (This=0x519148) returned 0x1 [0249.589] WbemDefPath:IUnknown:Release (This=0x519148) returned 0x0 [0249.589] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.589] WbemDefPath:IUnknown:Release (This=0x5245e0) returned 0x1 [0249.589] WbemDefPath:IUnknown:Release (This=0x5245e0) returned 0x0 [0249.589] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.589] WbemDefPath:IUnknown:Release (This=0x556e290) returned 0x1 [0249.589] WbemDefPath:IUnknown:Release (This=0x556e290) returned 0x0 [0249.589] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.589] WbemDefPath:IUnknown:Release (This=0x5585068) returned 0x1 [0249.589] WbemDefPath:IUnknown:Release (This=0x5585068) returned 0x0 [0249.589] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.589] WbemDefPath:IUnknown:Release (This=0x5196f8) returned 0x1 [0249.589] WbemDefPath:IUnknown:Release (This=0x5196f8) returned 0x0 [0249.589] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.589] WbemDefPath:IUnknown:Release (This=0x556e840) returned 0x1 [0249.589] WbemDefPath:IUnknown:Release (This=0x556e840) returned 0x0 [0249.589] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.589] WbemDefPath:IUnknown:Release (This=0x524730) returned 0x1 [0249.589] WbemDefPath:IUnknown:Release (This=0x524730) returned 0x0 [0249.589] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.589] WbemDefPath:IUnknown:Release (This=0x519378) returned 0x1 [0249.589] WbemDefPath:IUnknown:Release (This=0x519378) returned 0x0 [0249.589] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.589] WbemDefPath:IUnknown:Release (This=0x556e4c0) returned 0x1 [0249.589] WbemDefPath:IUnknown:Release (This=0x556e4c0) returned 0x0 [0249.590] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.590] WbemDefPath:IUnknown:Release (This=0x519928) returned 0x1 [0249.590] WbemDefPath:IUnknown:Release (This=0x519928) returned 0x0 [0249.590] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.590] WbemDefPath:IUnknown:Release (This=0x556ee60) returned 0x1 [0249.590] WbemDefPath:IUnknown:Release (This=0x556ee60) returned 0x0 [0249.590] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.590] WbemDefPath:IUnknown:Release (This=0x556ea70) returned 0x1 [0249.590] WbemDefPath:IUnknown:Release (This=0x556ea70) returned 0x0 [0249.590] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.590] WbemDefPath:IUnknown:Release (This=0x5585228) returned 0x1 [0249.590] WbemDefPath:IUnknown:Release (This=0x5585228) returned 0x0 [0249.590] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.590] WbemDefPath:IUnknown:Release (This=0x518ff8) returned 0x1 [0249.590] WbemDefPath:IUnknown:Release (This=0x518ff8) returned 0x0 [0249.590] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.590] WbemDefPath:IUnknown:Release (This=0x556f020) returned 0x1 [0249.590] WbemDefPath:IUnknown:Release (This=0x556f020) returned 0x0 [0249.590] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.590] WbemDefPath:IUnknown:Release (This=0x5195a8) returned 0x1 [0249.590] WbemDefPath:IUnknown:Release (This=0x5195a8) returned 0x0 [0249.590] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.590] WbemDefPath:IUnknown:Release (This=0x556e6f0) returned 0x1 [0249.590] WbemDefPath:IUnknown:Release (This=0x556e6f0) returned 0x0 [0249.590] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.590] WbemDefPath:IUnknown:Release (This=0x556ed10) returned 0x1 [0249.590] WbemDefPath:IUnknown:Release (This=0x556ed10) returned 0x0 [0249.591] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.591] WbemDefPath:IUnknown:Release (This=0x556eca0) returned 0x1 [0249.591] WbemDefPath:IUnknown:Release (This=0x556eca0) returned 0x0 [0249.591] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.591] WbemDefPath:IUnknown:Release (This=0x519228) returned 0x1 [0249.591] WbemDefPath:IUnknown:Release (This=0x519228) returned 0x0 [0249.591] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.591] WbemDefPath:IUnknown:Release (This=0x556e370) returned 0x1 [0249.591] WbemDefPath:IUnknown:Release (This=0x556e370) returned 0x0 [0249.591] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.591] WbemDefPath:IUnknown:Release (This=0x5197d8) returned 0x1 [0249.591] WbemDefPath:IUnknown:Release (This=0x5197d8) returned 0x0 [0249.591] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.591] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x1 [0249.591] WbemDefPath:IUnknown:Release (This=0x524260) returned 0x0 [0249.591] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.591] WbemDefPath:IUnknown:Release (This=0x556e920) returned 0x1 [0249.591] WbemDefPath:IUnknown:Release (This=0x556e920) returned 0x0 [0249.591] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.591] WbemDefPath:IUnknown:Release (This=0x518ea8) returned 0x1 [0249.591] WbemDefPath:IUnknown:Release (This=0x518ea8) returned 0x0 [0249.591] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.591] WbemDefPath:IUnknown:Release (This=0x519d88) returned 0x1 [0249.591] WbemDefPath:IUnknown:Release (This=0x519d88) returned 0x0 [0249.591] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.591] WbemDefPath:IUnknown:Release (This=0x524810) returned 0x1 [0249.591] WbemDefPath:IUnknown:Release (This=0x524810) returned 0x0 [0249.592] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.592] WbemDefPath:IUnknown:Release (This=0x556eed0) returned 0x1 [0249.592] WbemDefPath:IUnknown:Release (This=0x556eed0) returned 0x0 [0249.592] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.592] WbemDefPath:IUnknown:Release (This=0x519458) returned 0x1 [0249.592] WbemDefPath:IUnknown:Release (This=0x519458) returned 0x0 [0249.592] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.592] WbemDefPath:IUnknown:Release (This=0x556e7d0) returned 0x1 [0249.592] WbemDefPath:IUnknown:Release (This=0x556e7d0) returned 0x0 [0249.592] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.592] WbemDefPath:IUnknown:Release (This=0x5584a48) returned 0x1 [0249.592] WbemDefPath:IUnknown:Release (This=0x5584a48) returned 0x0 [0249.592] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.592] WbemDefPath:IUnknown:Release (This=0x5191b8) returned 0x1 [0249.592] WbemDefPath:IUnknown:Release (This=0x5191b8) returned 0x0 [0249.592] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.592] WbemDefPath:IUnknown:Release (This=0x524490) returned 0x1 [0249.592] WbemDefPath:IUnknown:Release (This=0x524490) returned 0x0 [0249.592] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.592] WbemDefPath:IUnknown:Release (This=0x556eb50) returned 0x1 [0249.592] WbemDefPath:IUnknown:Release (This=0x556eb50) returned 0x0 [0249.592] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.592] WbemDefPath:IUnknown:Release (This=0x5190d8) returned 0x1 [0249.593] WbemDefPath:IUnknown:Release (This=0x5190d8) returned 0x0 [0249.593] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.593] WbemDefPath:IUnknown:Release (This=0x556e220) returned 0x1 [0249.593] WbemDefPath:IUnknown:Release (This=0x556e220) returned 0x0 [0249.593] CoGetContextToken (in: pToken=0x436f800 | out: pToken=0x436f800) returned 0x0 [0249.593] WbemDefPath:IUnknown:Release (This=0x556f100) returned 0x1 [0249.593] WbemDefPath:IUnknown:Release (This=0x556f100) returned 0x0 Thread: id = 8 os_tid = 0xf14 Thread: id = 9 os_tid = 0x33c Thread: id = 10 os_tid = 0xe90 Thread: id = 115 os_tid = 0x5b0 Thread: id = 116 os_tid = 0xcb8 [0213.768] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0213.768] RoInitialize () returned 0x1 [0213.768] RoUninitialize () returned 0x0 [0213.773] SetConsoleCtrlHandler (HandlerRoutine=0x4e007f6, Add=1) returned 1 [0213.774] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0213.774] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0213.775] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.3ce0bb8.0", lpWndClass=0x239867c | out: lpWndClass=0x239867c) returned 0 [0213.777] CoTaskMemAlloc (cb=0x58) returned 0x546520 [0213.777] RegisterClassW (lpWndClass=0x550f884) returned 0xc1d8 [0213.779] CoTaskMemFree (pv=0x546520) [0213.780] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.3ce0bb8.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.3ce0bb8.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x901f6 [0213.780] NtdllDefWindowProc_W (hWnd=0x901f6, Msg=0x81, wParam=0x0, lParam=0x550f3c0) returned 0x1 [0213.784] NtdllDefWindowProc_W (hWnd=0x901f6, Msg=0x83, wParam=0x0, lParam=0x550f3ac) returned 0x0 [0213.785] NtdllDefWindowProc_W (hWnd=0x901f6, Msg=0x1, wParam=0x0, lParam=0x550f3c0) returned 0x0 [0213.786] NtdllDefWindowProc_W (hWnd=0x901f6, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0213.786] NtdllDefWindowProc_W (hWnd=0x901f6, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0213.787] SetEvent (hEvent=0x3fc) returned 1 [0213.788] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0213.937] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0214.125] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0214.305] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0214.564] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0214.823] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0215.089] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0215.232] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0215.352] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0215.482] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0215.607] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0215.737] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0215.886] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0216.115] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0216.243] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0216.347] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0216.548] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0216.651] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0216.790] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0216.892] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0216.997] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0217.217] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0217.399] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0217.501] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0217.604] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0217.721] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0217.824] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0217.927] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.126] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.302] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.500] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.642] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0218.928] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.054] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.159] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.320] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.432] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.548] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.737] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0219.937] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.299] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0220.626] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0221.807] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.207] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.536] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0222.738] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0224.418] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0224.575] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0224.715] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0225.438] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0225.745] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0226.692] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0226.869] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0227.084] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0227.640] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0227.866] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0228.021] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0228.170] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0228.354] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0228.514] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0229.027] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0229.135] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0229.272] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0229.375] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0229.479] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0229.584] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0229.696] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0229.810] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0229.913] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0230.025] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0230.174] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0230.328] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0230.468] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0230.639] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0230.800] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0230.903] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0231.069] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0231.341] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0231.775] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0232.069] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0232.171] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0232.284] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0232.392] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0232.495] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0232.599] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0232.701] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0232.802] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0233.086] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0233.187] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0233.289] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0233.391] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0233.492] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0233.594] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0233.696] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0233.797] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0233.899] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0234.002] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0234.104] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0234.216] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0234.318] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0234.443] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0234.609] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0234.797] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0234.970] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0235.116] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0235.239] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0235.363] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0235.596] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0235.808] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0235.995] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0236.548] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0236.986] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0237.585] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0237.852] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0238.178] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0238.562] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0238.689] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0239.057] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0240.125] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0240.226] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0240.695] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0240.882] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0241.020] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0241.203] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0241.366] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0241.541] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0241.748] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0241.952] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0242.138] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0242.733] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0243.069] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0243.408] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0243.599] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0244.232] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0244.335] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0244.437] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0244.594] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0245.088] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0245.202] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0245.304] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0245.406] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0245.508] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0245.769] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0245.926] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0247.328] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0247.519] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0247.699] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0247.876] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0248.723] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x102 [0249.459] MsgWaitForMultipleObjectsEx (nCount=0x0, pHandles=0x0, dwMilliseconds=0x64, dwWakeMask=0xff, dwFlags=0x4) returned 0x0 [0249.459] PeekMessageW (in: lpMsg=0x550f974, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x550f974) returned 1 [0249.460] IsWindow (hWnd=0x901f6) returned 1 [0249.461] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750d0000 [0249.462] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x550f880, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW¸jÏÓ&\x9a «flPùP\x05\x08EX", lpUsedDefaultChar=0x0) returned 14 [0249.462] GetProcAddress (hModule=0x750d0000, lpProcName="DefWindowProcW") returned 0x77c1aee0 [0249.462] SetWindowLongW (hWnd=0x901f6, nIndex=-4, dwNewLong=2009181920) returned 81791006 [0249.463] SetClassLongW (hWnd=0x901f6, nIndex=-24, dwNewLong=2009181920) returned 0x4e0081e [0249.463] IsWindow (hWnd=0x901f6) returned 1 [0249.463] DestroyWindow (hWnd=0x901f6) returned 1 [0249.468] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0249.468] UnregisterClassW (lpClassName=".NET-BroadcastEventWindow.4.0.0.0.3ce0bb8.0", hInstance=0x400000) returned 1 [0249.468] SetConsoleCtrlHandler (HandlerRoutine=0x4e007f6, Add=0) returned 1 [0249.468] SetEvent (hEvent=0x4fc) returned 1 [0249.469] CoGetContextToken (in: pToken=0x550fcbc | out: pToken=0x550fcbc) returned 0x0 [0249.469] IUnknown:QueryInterface (in: This=0x4d0cb0, riid=0x6c6f4564*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x550fce0 | out: ppvObject=0x550fce0*=0x4d0cbc) returned 0x0 [0249.469] IComThreadingInfo:GetCurrentThreadType (in: This=0x4d0cbc, pThreadType=0x550fd0c | out: pThreadType=0x550fd0c*=0) returned 0x0 [0249.469] IUnknown:Release (This=0x4d0cbc) returned 0x1 [0249.470] CoUninitialize () Thread: id = 117 os_tid = 0x1114 Thread: id = 118 os_tid = 0x1120 [0238.210] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0238.210] RoInitialize () returned 0x1 [0238.210] RoUninitialize () returned 0x0 [0238.211] ResetEvent (hEvent=0x270) returned 1 Thread: id = 119 os_tid = 0x1124 Thread: id = 120 os_tid = 0x1128 [0242.148] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0242.152] RoInitialize () returned 0x1 [0242.152] RoUninitialize () returned 0x0 [0242.153] ShellExecuteExW (in: pExecInfo=0x2483d60*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp/build.exe", lpParameters=0x0, lpDirectory="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x2483d60*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp/build.exe", lpParameters=0x0, lpDirectory="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x848)) returned 1 [0247.872] CoGetContextToken (in: pToken=0x5dcfc20 | out: pToken=0x5dcfc20) returned 0x0 [0247.873] CoUninitialize () Thread: id = 121 os_tid = 0x113c Thread: id = 122 os_tid = 0x1148 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x76459000" os_pid = "0x35c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x214" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000a860" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 2707 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2708 start_va = 0x20000 end_va = 0x21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 2709 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 2710 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 2711 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 2712 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2713 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 2714 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2715 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 2716 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 2717 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 2718 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 2719 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 2720 start_va = 0x400000 end_va = 0x400fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 2721 start_va = 0x410000 end_va = 0x410fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000410000" filename = "" Region: id = 2722 start_va = 0x420000 end_va = 0x420fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2723 start_va = 0x430000 end_va = 0x431fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 2724 start_va = 0x450000 end_va = 0x460fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 2725 start_va = 0x470000 end_va = 0x476fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000470000" filename = "" Region: id = 2726 start_va = 0x480000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 2727 start_va = 0x540000 end_va = 0x546fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 2728 start_va = 0x550000 end_va = 0x550fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 2729 start_va = 0x560000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 2730 start_va = 0x5e0000 end_va = 0x5e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005e0000" filename = "" Region: id = 2731 start_va = 0x5f0000 end_va = 0x5f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 2732 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 2733 start_va = 0x700000 end_va = 0x887fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 2734 start_va = 0x890000 end_va = 0x890fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 2735 start_va = 0x8a0000 end_va = 0x8a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 2736 start_va = 0x8b0000 end_va = 0x8b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008b0000" filename = "" Region: id = 2737 start_va = 0x8c0000 end_va = 0x8c0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usocore.dll.mui" filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui") Region: id = 2738 start_va = 0x8d0000 end_va = 0x8d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2739 start_va = 0x8e0000 end_va = 0x8e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 2740 start_va = 0x8f0000 end_va = 0x8f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 2741 start_va = 0x900000 end_va = 0x9fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000900000" filename = "" Region: id = 2742 start_va = 0xa00000 end_va = 0xb80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 2743 start_va = 0xb90000 end_va = 0xf8afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b90000" filename = "" Region: id = 2744 start_va = 0xf90000 end_va = 0x100ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f90000" filename = "" Region: id = 2745 start_va = 0x1010000 end_va = 0x1054fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 2746 start_va = 0x1070000 end_va = 0x1076fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001070000" filename = "" Region: id = 2747 start_va = 0x1090000 end_va = 0x1096fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001090000" filename = "" Region: id = 2748 start_va = 0x1100000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 2749 start_va = 0x1200000 end_va = 0x127ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 2750 start_va = 0x1280000 end_va = 0x1290fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 2751 start_va = 0x12a0000 end_va = 0x12a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000012a0000" filename = "" Region: id = 2752 start_va = 0x12b0000 end_va = 0x12b6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012b0000" filename = "" Region: id = 2753 start_va = 0x12c0000 end_va = 0x12d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 2754 start_va = 0x12e0000 end_va = 0x12f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 2755 start_va = 0x1300000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 2756 start_va = 0x1400000 end_va = 0x1736fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2757 start_va = 0x1740000 end_va = 0x183ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001740000" filename = "" Region: id = 2758 start_va = 0x1840000 end_va = 0x193ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001840000" filename = "" Region: id = 2759 start_va = 0x19c0000 end_va = 0x19d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 2760 start_va = 0x19e0000 end_va = 0x19f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 2761 start_va = 0x1a00000 end_va = 0x1afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 2762 start_va = 0x1b00000 end_va = 0x1bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001b00000" filename = "" Region: id = 2763 start_va = 0x1c00000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 2764 start_va = 0x1d00000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 2765 start_va = 0x1e00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 2766 start_va = 0x1f00000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 2767 start_va = 0x2000000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 2768 start_va = 0x2100000 end_va = 0x21fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002100000" filename = "" Region: id = 2769 start_va = 0x2200000 end_va = 0x227ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 2770 start_va = 0x2280000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002280000" filename = "" Region: id = 2771 start_va = 0x2300000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 2772 start_va = 0x2400000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 2773 start_va = 0x2500000 end_va = 0x25dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 2774 start_va = 0x25e0000 end_va = 0x25f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 2775 start_va = 0x2600000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 2776 start_va = 0x2700000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 2777 start_va = 0x2800000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 2778 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 2779 start_va = 0x2a00000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 2780 start_va = 0x2b00000 end_va = 0x2bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b00000" filename = "" Region: id = 2781 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 2782 start_va = 0x2d00000 end_va = 0x2dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 2783 start_va = 0x2e00000 end_va = 0x2e8dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 2784 start_va = 0x2e90000 end_va = 0x2f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e90000" filename = "" Region: id = 2785 start_va = 0x3110000 end_va = 0x318ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003110000" filename = "" Region: id = 2786 start_va = 0x3190000 end_va = 0x328ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 2787 start_va = 0x32a0000 end_va = 0x32c7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 2788 start_va = 0x32d0000 end_va = 0x32e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 2789 start_va = 0x3400000 end_va = 0x34fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003400000" filename = "" Region: id = 2790 start_va = 0x3500000 end_va = 0x35fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003500000" filename = "" Region: id = 2791 start_va = 0x3600000 end_va = 0x36fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003600000" filename = "" Region: id = 2792 start_va = 0x3700000 end_va = 0x37fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 2793 start_va = 0x3880000 end_va = 0x38fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003880000" filename = "" Region: id = 2794 start_va = 0x3900000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 2795 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 2796 start_va = 0x3b00000 end_va = 0x3bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 2797 start_va = 0x3c00000 end_va = 0x3cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 2798 start_va = 0x3d00000 end_va = 0x3dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d00000" filename = "" Region: id = 2799 start_va = 0x3e00000 end_va = 0x3efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 2800 start_va = 0x4000000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004000000" filename = "" Region: id = 2801 start_va = 0x4100000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 2802 start_va = 0x4200000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 2803 start_va = 0x4300000 end_va = 0x4330fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 2804 start_va = 0x4340000 end_va = 0x4350fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 2805 start_va = 0x4360000 end_va = 0x4390fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 2806 start_va = 0x43a0000 end_va = 0x43d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 2807 start_va = 0x4400000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 2808 start_va = 0x4500000 end_va = 0x457ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004500000" filename = "" Region: id = 2809 start_va = 0x4580000 end_va = 0x45fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004580000" filename = "" Region: id = 2810 start_va = 0x4600000 end_va = 0x46fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 2811 start_va = 0x4700000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 2812 start_va = 0x4800000 end_va = 0x487ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004800000" filename = "" Region: id = 2813 start_va = 0x4a20000 end_va = 0x4a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a20000" filename = "" Region: id = 2814 start_va = 0x4aa0000 end_va = 0x4aa1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 2815 start_va = 0x4ac0000 end_va = 0x4ac0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ac0000" filename = "" Region: id = 2816 start_va = 0x4ad0000 end_va = 0x4bcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ad0000" filename = "" Region: id = 2817 start_va = 0x4cd0000 end_va = 0x4dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cd0000" filename = "" Region: id = 2818 start_va = 0x4e00000 end_va = 0x4efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 2819 start_va = 0x4f00000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 2820 start_va = 0x5080000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005080000" filename = "" Region: id = 2821 start_va = 0x5100000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 2822 start_va = 0x5200000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 2823 start_va = 0x5300000 end_va = 0x53fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 2824 start_va = 0x5490000 end_va = 0x558ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005490000" filename = "" Region: id = 2825 start_va = 0x55a0000 end_va = 0x561ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055a0000" filename = "" Region: id = 2826 start_va = 0x5620000 end_va = 0x5624fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 2827 start_va = 0x5630000 end_va = 0x563ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 2828 start_va = 0x5650000 end_va = 0x5656fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005650000" filename = "" Region: id = 2829 start_va = 0x5660000 end_va = 0x575ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005660000" filename = "" Region: id = 2830 start_va = 0x5760000 end_va = 0x585ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005760000" filename = "" Region: id = 2831 start_va = 0x5860000 end_va = 0x58dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005860000" filename = "" Region: id = 2832 start_va = 0x5900000 end_va = 0x59fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005900000" filename = "" Region: id = 2833 start_va = 0x5a20000 end_va = 0x5a6efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000005a20000" filename = "" Region: id = 2834 start_va = 0x5a80000 end_va = 0x5b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a80000" filename = "" Region: id = 2835 start_va = 0x5b80000 end_va = 0x5c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b80000" filename = "" Region: id = 2836 start_va = 0x5d00000 end_va = 0x5dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d00000" filename = "" Region: id = 2837 start_va = 0x5e00000 end_va = 0x5efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e00000" filename = "" Region: id = 2838 start_va = 0x5f00000 end_va = 0x5ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f00000" filename = "" Region: id = 2839 start_va = 0x6090000 end_va = 0x6096fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006090000" filename = "" Region: id = 2840 start_va = 0x6100000 end_va = 0x61fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006100000" filename = "" Region: id = 2841 start_va = 0x6200000 end_va = 0x62fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006200000" filename = "" Region: id = 2842 start_va = 0x6300000 end_va = 0x63fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006300000" filename = "" Region: id = 2843 start_va = 0x64c0000 end_va = 0x64c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000064c0000" filename = "" Region: id = 2844 start_va = 0x6570000 end_va = 0x6576fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006570000" filename = "" Region: id = 2845 start_va = 0x6580000 end_va = 0x667ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006580000" filename = "" Region: id = 2846 start_va = 0x6700000 end_va = 0x67fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006700000" filename = "" Region: id = 2847 start_va = 0x6800000 end_va = 0x68fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006800000" filename = "" Region: id = 2848 start_va = 0x6900000 end_va = 0x69fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006900000" filename = "" Region: id = 2849 start_va = 0x6a00000 end_va = 0x6afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 2850 start_va = 0x6b00000 end_va = 0x6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b00000" filename = "" Region: id = 2851 start_va = 0x6c00000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 2852 start_va = 0x6d00000 end_va = 0x6dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 2853 start_va = 0x6e00000 end_va = 0x6efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006e00000" filename = "" Region: id = 2854 start_va = 0x6f00000 end_va = 0x6ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 2855 start_va = 0x7000000 end_va = 0x70fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 2856 start_va = 0x7100000 end_va = 0x71fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007100000" filename = "" Region: id = 2857 start_va = 0x7200000 end_va = 0x72fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 2858 start_va = 0x7310000 end_va = 0x740ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007310000" filename = "" Region: id = 2859 start_va = 0x7500000 end_va = 0x75fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007500000" filename = "" Region: id = 2860 start_va = 0x7600000 end_va = 0x76fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007600000" filename = "" Region: id = 2861 start_va = 0x7810000 end_va = 0x790ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007810000" filename = "" Region: id = 2862 start_va = 0x7910000 end_va = 0x7a0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007910000" filename = "" Region: id = 2863 start_va = 0x7a10000 end_va = 0x7b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007a10000" filename = "" Region: id = 2864 start_va = 0x7b10000 end_va = 0x7c0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007b10000" filename = "" Region: id = 2865 start_va = 0x7c10000 end_va = 0x7d0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007c10000" filename = "" Region: id = 2866 start_va = 0x8200000 end_va = 0x82fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008200000" filename = "" Region: id = 2867 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2868 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 2869 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 2870 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 2871 start_va = 0x7ff661bf0000 end_va = 0x7ff661bfcfff monitored = 0 entry_point = 0x7ff661bf3980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 2872 start_va = 0x7ffd31bb0000 end_va = 0x7ffd31bc7fff monitored = 0 entry_point = 0x7ffd31bb1b10 region_type = mapped_file name = "locationframeworkinternalps.dll" filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll") Region: id = 2873 start_va = 0x7ffd31ed0000 end_va = 0x7ffd31ed7fff monitored = 0 entry_point = 0x7ffd31ed13b0 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 2874 start_va = 0x7ffd31fa0000 end_va = 0x7ffd31fb6fff monitored = 0 entry_point = 0x7ffd31fa7520 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 2875 start_va = 0x7ffd31fd0000 end_va = 0x7ffd32013fff monitored = 0 entry_point = 0x7ffd31ff83e0 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 2876 start_va = 0x7ffd32020000 end_va = 0x7ffd3207cfff monitored = 0 entry_point = 0x7ffd3204e510 region_type = mapped_file name = "usocore.dll" filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll") Region: id = 2877 start_va = 0x7ffd338c0000 end_va = 0x7ffd338d7fff monitored = 0 entry_point = 0x7ffd338cb850 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 2878 start_va = 0x7ffd34fb0000 end_va = 0x7ffd3525ffff monitored = 0 entry_point = 0x7ffd34fb1cf0 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 2879 start_va = 0x7ffd35c30000 end_va = 0x7ffd35c40fff monitored = 0 entry_point = 0x7ffd35c328d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 2880 start_va = 0x7ffd35c50000 end_va = 0x7ffd35c81fff monitored = 0 entry_point = 0x7ffd35c5b0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 2881 start_va = 0x7ffd36050000 end_va = 0x7ffd36061fff monitored = 0 entry_point = 0x7ffd36051a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 2882 start_va = 0x7ffd36070000 end_va = 0x7ffd360aefff monitored = 0 entry_point = 0x7ffd360982d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 2883 start_va = 0x7ffd36590000 end_va = 0x7ffd3669efff monitored = 0 entry_point = 0x7ffd365cc010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 2884 start_va = 0x7ffd36820000 end_va = 0x7ffd36886fff monitored = 0 entry_point = 0x7ffd3682b160 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 2885 start_va = 0x7ffd38030000 end_va = 0x7ffd3804cfff monitored = 0 entry_point = 0x7ffd38034f60 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 2886 start_va = 0x7ffd38670000 end_va = 0x7ffd3878cfff monitored = 0 entry_point = 0x7ffd3869fe60 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 2887 start_va = 0x7ffd3af10000 end_va = 0x7ffd3af45fff monitored = 0 entry_point = 0x7ffd3af127f0 region_type = mapped_file name = "windows.networking.hostname.dll" filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll") Region: id = 2888 start_va = 0x7ffd3c980000 end_va = 0x7ffd3c990fff monitored = 0 entry_point = 0x7ffd3c987480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 2889 start_va = 0x7ffd3c9a0000 end_va = 0x7ffd3ca23fff monitored = 0 entry_point = 0x7ffd3c9b8d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 2890 start_va = 0x7ffd3ca30000 end_va = 0x7ffd3ca45fff monitored = 0 entry_point = 0x7ffd3ca31af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 2891 start_va = 0x7ffd3ca50000 end_va = 0x7ffd3ca69fff monitored = 0 entry_point = 0x7ffd3ca52330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 2892 start_va = 0x7ffd3ca70000 end_va = 0x7ffd3ca7cfff monitored = 0 entry_point = 0x7ffd3ca71420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 2893 start_va = 0x7ffd3cb30000 end_va = 0x7ffd3cb45fff monitored = 0 entry_point = 0x7ffd3cb355e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 2894 start_va = 0x7ffd3cb50000 end_va = 0x7ffd3cc25fff monitored = 0 entry_point = 0x7ffd3cb7a800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 2895 start_va = 0x7ffd3cc30000 end_va = 0x7ffd3cc93fff monitored = 0 entry_point = 0x7ffd3cc4bed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 2896 start_va = 0x7ffd3cca0000 end_va = 0x7ffd3ccc4fff monitored = 0 entry_point = 0x7ffd3cca9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 2897 start_va = 0x7ffd3ccd0000 end_va = 0x7ffd3cdc5fff monitored = 0 entry_point = 0x7ffd3cd09590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 2898 start_va = 0x7ffd3cdd0000 end_va = 0x7ffd3cf06fff monitored = 0 entry_point = 0x7ffd3ce10480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 2899 start_va = 0x7ffd3cf30000 end_va = 0x7ffd3cf3efff monitored = 0 entry_point = 0x7ffd3cf34960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 2900 start_va = 0x7ffd3d070000 end_va = 0x7ffd3d080fff monitored = 0 entry_point = 0x7ffd3d072fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 2901 start_va = 0x7ffd3d090000 end_va = 0x7ffd3d0adfff monitored = 0 entry_point = 0x7ffd3d093a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 2902 start_va = 0x7ffd3d0b0000 end_va = 0x7ffd3d131fff monitored = 0 entry_point = 0x7ffd3d0b2a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 2903 start_va = 0x7ffd3d150000 end_va = 0x7ffd3d163fff monitored = 0 entry_point = 0x7ffd3d151800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 2904 start_va = 0x7ffd3d170000 end_va = 0x7ffd3d1e3fff monitored = 0 entry_point = 0x7ffd3d185eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 2905 start_va = 0x7ffd3dd00000 end_va = 0x7ffd3dd3ffff monitored = 0 entry_point = 0x7ffd3dd0cbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 2906 start_va = 0x7ffd3dd40000 end_va = 0x7ffd3dd86fff monitored = 0 entry_point = 0x7ffd3dd41d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 2907 start_va = 0x7ffd3dd90000 end_va = 0x7ffd3ddd1fff monitored = 0 entry_point = 0x7ffd3dd93670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 2908 start_va = 0x7ffd3e040000 end_va = 0x7ffd3e05efff monitored = 0 entry_point = 0x7ffd3e0437e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 2909 start_va = 0x7ffd3e060000 end_va = 0x7ffd3e0d8fff monitored = 0 entry_point = 0x7ffd3e0676a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 2910 start_va = 0x7ffd3e330000 end_va = 0x7ffd3e347fff monitored = 0 entry_point = 0x7ffd3e334e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 2911 start_va = 0x7ffd3e350000 end_va = 0x7ffd3e374fff monitored = 0 entry_point = 0x7ffd3e355ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 2912 start_va = 0x7ffd3e380000 end_va = 0x7ffd3e422fff monitored = 0 entry_point = 0x7ffd3e382c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 2913 start_va = 0x7ffd3e430000 end_va = 0x7ffd3e481fff monitored = 0 entry_point = 0x7ffd3e435770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 2914 start_va = 0x7ffd3e490000 end_va = 0x7ffd3e4bdfff monitored = 1 entry_point = 0x7ffd3e492300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 2915 start_va = 0x7ffd3e4c0000 end_va = 0x7ffd3e51dfff monitored = 0 entry_point = 0x7ffd3e4c5080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 2916 start_va = 0x7ffd3e520000 end_va = 0x7ffd3e53ffff monitored = 0 entry_point = 0x7ffd3e521f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 2917 start_va = 0x7ffd3e540000 end_va = 0x7ffd3e548fff monitored = 0 entry_point = 0x7ffd3e5418f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 2918 start_va = 0x7ffd3e550000 end_va = 0x7ffd3e560fff monitored = 0 entry_point = 0x7ffd3e551d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 2919 start_va = 0x7ffd3e570000 end_va = 0x7ffd3e5b0fff monitored = 0 entry_point = 0x7ffd3e573750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 2920 start_va = 0x7ffd3e5c0000 end_va = 0x7ffd3e6b2fff monitored = 0 entry_point = 0x7ffd3e5e5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 2921 start_va = 0x7ffd3e700000 end_va = 0x7ffd3e74bfff monitored = 0 entry_point = 0x7ffd3e715310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 2922 start_va = 0x7ffd3e990000 end_va = 0x7ffd3e9a3fff monitored = 0 entry_point = 0x7ffd3e993710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 2923 start_va = 0x7ffd3e9b0000 end_va = 0x7ffd3e9d7fff monitored = 0 entry_point = 0x7ffd3e9befc0 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Region: id = 2924 start_va = 0x7ffd3ea40000 end_va = 0x7ffd3ea5dfff monitored = 0 entry_point = 0x7ffd3ea4ef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 2925 start_va = 0x7ffd3ea60000 end_va = 0x7ffd3ea77fff monitored = 0 entry_point = 0x7ffd3ea62000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 2926 start_va = 0x7ffd3ea80000 end_va = 0x7ffd3ec01fff monitored = 0 entry_point = 0x7ffd3ea982a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 2927 start_va = 0x7ffd3ec90000 end_va = 0x7ffd3ed0efff monitored = 0 entry_point = 0x7ffd3eca7110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 2928 start_va = 0x7ffd3ed10000 end_va = 0x7ffd3ed4bfff monitored = 0 entry_point = 0x7ffd3ed16aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 2929 start_va = 0x7ffd3ed50000 end_va = 0x7ffd3ed5bfff monitored = 0 entry_point = 0x7ffd3ed535c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 2930 start_va = 0x7ffd40230000 end_va = 0x7ffd40275fff monitored = 0 entry_point = 0x7ffd402379a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 2931 start_va = 0x7ffd40280000 end_va = 0x7ffd40293fff monitored = 0 entry_point = 0x7ffd40282a00 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 2932 start_va = 0x7ffd402d0000 end_va = 0x7ffd40304fff monitored = 0 entry_point = 0x7ffd402da270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 2933 start_va = 0x7ffd40310000 end_va = 0x7ffd4038ffff monitored = 0 entry_point = 0x7ffd4033d280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 2934 start_va = 0x7ffd403c0000 end_va = 0x7ffd403fffff monitored = 0 entry_point = 0x7ffd403d6c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 2935 start_va = 0x7ffd40b80000 end_va = 0x7ffd40ba1fff monitored = 0 entry_point = 0x7ffd40b92540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 2936 start_va = 0x7ffd40bb0000 end_va = 0x7ffd40c84fff monitored = 0 entry_point = 0x7ffd40bccf80 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 2937 start_va = 0x7ffd40d50000 end_va = 0x7ffd40d58fff monitored = 0 entry_point = 0x7ffd40d521d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 2938 start_va = 0x7ffd410e0000 end_va = 0x7ffd410f5fff monitored = 0 entry_point = 0x7ffd410e1d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 2939 start_va = 0x7ffd41d70000 end_va = 0x7ffd41d79fff monitored = 0 entry_point = 0x7ffd41d71350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 2940 start_va = 0x7ffd422e0000 end_va = 0x7ffd422f1fff monitored = 0 entry_point = 0x7ffd422e3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 2941 start_va = 0x7ffd44840000 end_va = 0x7ffd4485afff monitored = 0 entry_point = 0x7ffd44841040 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll") Region: id = 2942 start_va = 0x7ffd44af0000 end_va = 0x7ffd44af9fff monitored = 0 entry_point = 0x7ffd44af14c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 2943 start_va = 0x7ffd44b00000 end_va = 0x7ffd44b0dfff monitored = 0 entry_point = 0x7ffd44b01460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 2944 start_va = 0x7ffd44b30000 end_va = 0x7ffd44b44fff monitored = 0 entry_point = 0x7ffd44b32dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 2945 start_va = 0x7ffd44b50000 end_va = 0x7ffd44b5bfff monitored = 0 entry_point = 0x7ffd44b52830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 2946 start_va = 0x7ffd45150000 end_va = 0x7ffd4515ffff monitored = 0 entry_point = 0x7ffd45151700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 2947 start_va = 0x7ffd45160000 end_va = 0x7ffd45168fff monitored = 0 entry_point = 0x7ffd45161ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 2948 start_va = 0x7ffd45170000 end_va = 0x7ffd4519cfff monitored = 0 entry_point = 0x7ffd45172290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 2949 start_va = 0x7ffd451a0000 end_va = 0x7ffd451f1fff monitored = 0 entry_point = 0x7ffd451a38e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 2950 start_va = 0x7ffd452a0000 end_va = 0x7ffd452b4fff monitored = 0 entry_point = 0x7ffd452a3460 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 2951 start_va = 0x7ffd45390000 end_va = 0x7ffd45429fff monitored = 0 entry_point = 0x7ffd453aada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 2952 start_va = 0x7ffd45440000 end_va = 0x7ffd454a6fff monitored = 0 entry_point = 0x7ffd454463e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 2953 start_va = 0x7ffd45500000 end_va = 0x7ffd455bffff monitored = 0 entry_point = 0x7ffd4552fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 2954 start_va = 0x7ffd455c0000 end_va = 0x7ffd4566dfff monitored = 0 entry_point = 0x7ffd455d80c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 2955 start_va = 0x7ffd45670000 end_va = 0x7ffd45681fff monitored = 0 entry_point = 0x7ffd45679260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 2956 start_va = 0x7ffd45690000 end_va = 0x7ffd45740fff monitored = 0 entry_point = 0x7ffd457088b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 2957 start_va = 0x7ffd45750000 end_va = 0x7ffd4575afff monitored = 0 entry_point = 0x7ffd45751d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 2958 start_va = 0x7ffd45760000 end_va = 0x7ffd45784fff monitored = 0 entry_point = 0x7ffd45772f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 2959 start_va = 0x7ffd45790000 end_va = 0x7ffd457a0fff monitored = 0 entry_point = 0x7ffd45797ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 2960 start_va = 0x7ffd45870000 end_va = 0x7ffd4587afff monitored = 0 entry_point = 0x7ffd45871de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 2961 start_va = 0x7ffd458a0000 end_va = 0x7ffd458b9fff monitored = 0 entry_point = 0x7ffd458a2cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 2962 start_va = 0x7ffd458c0000 end_va = 0x7ffd45914fff monitored = 0 entry_point = 0x7ffd458c3fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 2963 start_va = 0x7ffd45920000 end_va = 0x7ffd45956fff monitored = 0 entry_point = 0x7ffd45926020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 2964 start_va = 0x7ffd45960000 end_va = 0x7ffd4597ffff monitored = 0 entry_point = 0x7ffd459639a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 2965 start_va = 0x7ffd45a10000 end_va = 0x7ffd45a29fff monitored = 0 entry_point = 0x7ffd45a12430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 2966 start_va = 0x7ffd45a30000 end_va = 0x7ffd45a45fff monitored = 0 entry_point = 0x7ffd45a319f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 2967 start_va = 0x7ffd45aa0000 end_va = 0x7ffd45ae0fff monitored = 0 entry_point = 0x7ffd45aa4840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 2968 start_va = 0x7ffd45b60000 end_va = 0x7ffd45b73fff monitored = 0 entry_point = 0x7ffd45b62d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 2969 start_va = 0x7ffd45e60000 end_va = 0x7ffd45ef2fff monitored = 0 entry_point = 0x7ffd45e69680 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 2970 start_va = 0x7ffd460b0000 end_va = 0x7ffd460e7fff monitored = 0 entry_point = 0x7ffd460c8cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 2971 start_va = 0x7ffd46190000 end_va = 0x7ffd461a8fff monitored = 0 entry_point = 0x7ffd46194520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 2972 start_va = 0x7ffd46650000 end_va = 0x7ffd4665bfff monitored = 0 entry_point = 0x7ffd466514d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 2973 start_va = 0x7ffd46840000 end_va = 0x7ffd4685efff monitored = 0 entry_point = 0x7ffd46844960 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 2974 start_va = 0x7ffd46920000 end_va = 0x7ffd469e7fff monitored = 0 entry_point = 0x7ffd469613f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 2975 start_va = 0x7ffd469f0000 end_va = 0x7ffd46a50fff monitored = 0 entry_point = 0x7ffd469f4b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 2976 start_va = 0x7ffd46a60000 end_va = 0x7ffd46bdbfff monitored = 0 entry_point = 0x7ffd46ab1650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 2977 start_va = 0x7ffd46be0000 end_va = 0x7ffd46beafff monitored = 0 entry_point = 0x7ffd46be1770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 2978 start_va = 0x7ffd46dd0000 end_va = 0x7ffd46eb5fff monitored = 0 entry_point = 0x7ffd46decf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 2979 start_va = 0x7ffd47080000 end_va = 0x7ffd47401fff monitored = 0 entry_point = 0x7ffd470d1220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 2980 start_va = 0x7ffd47410000 end_va = 0x7ffd47545fff monitored = 0 entry_point = 0x7ffd4743f350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 2981 start_va = 0x7ffd48640000 end_va = 0x7ffd4874dfff monitored = 0 entry_point = 0x7ffd4868eaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 2982 start_va = 0x7ffd48a50000 end_va = 0x7ffd48a66fff monitored = 0 entry_point = 0x7ffd48a55630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 2983 start_va = 0x7ffd48a70000 end_va = 0x7ffd48ab9fff monitored = 0 entry_point = 0x7ffd48a7ac30 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 2984 start_va = 0x7ffd48b10000 end_va = 0x7ffd48b4dfff monitored = 0 entry_point = 0x7ffd48b1a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 2985 start_va = 0x7ffd48b50000 end_va = 0x7ffd48b76fff monitored = 0 entry_point = 0x7ffd48b53bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 2986 start_va = 0x7ffd48b80000 end_va = 0x7ffd48bf9fff monitored = 0 entry_point = 0x7ffd48ba7630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 2987 start_va = 0x7ffd48c00000 end_va = 0x7ffd48c12fff monitored = 0 entry_point = 0x7ffd48c057f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 2988 start_va = 0x7ffd48c20000 end_va = 0x7ffd48c74fff monitored = 0 entry_point = 0x7ffd48c2fc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 2989 start_va = 0x7ffd48c80000 end_va = 0x7ffd48cadfff monitored = 0 entry_point = 0x7ffd48c87550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 2990 start_va = 0x7ffd48cb0000 end_va = 0x7ffd48cc5fff monitored = 0 entry_point = 0x7ffd48cb1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 2991 start_va = 0x7ffd48cd0000 end_va = 0x7ffd48d33fff monitored = 0 entry_point = 0x7ffd48ce5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 2992 start_va = 0x7ffd48d80000 end_va = 0x7ffd48e11fff monitored = 0 entry_point = 0x7ffd48dca780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 2993 start_va = 0x7ffd49080000 end_va = 0x7ffd4908ffff monitored = 0 entry_point = 0x7ffd49082c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 2994 start_va = 0x7ffd49090000 end_va = 0x7ffd4909cfff monitored = 0 entry_point = 0x7ffd49092ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 2995 start_va = 0x7ffd490a0000 end_va = 0x7ffd490cefff monitored = 0 entry_point = 0x7ffd490a8910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 2996 start_va = 0x7ffd490d0000 end_va = 0x7ffd4913dfff monitored = 0 entry_point = 0x7ffd490d7f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 2997 start_va = 0x7ffd49140000 end_va = 0x7ffd49150fff monitored = 0 entry_point = 0x7ffd49143320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 2998 start_va = 0x7ffd49160000 end_va = 0x7ffd491a0fff monitored = 0 entry_point = 0x7ffd49177eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 2999 start_va = 0x7ffd491b0000 end_va = 0x7ffd492abfff monitored = 0 entry_point = 0x7ffd491e6df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 3000 start_va = 0x7ffd492b0000 end_va = 0x7ffd4936efff monitored = 0 entry_point = 0x7ffd492d1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 3001 start_va = 0x7ffd493a0000 end_va = 0x7ffd493d5fff monitored = 0 entry_point = 0x7ffd493b0070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 3002 start_va = 0x7ffd49c30000 end_va = 0x7ffd49c39fff monitored = 0 entry_point = 0x7ffd49c31660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 3003 start_va = 0x7ffd49c40000 end_va = 0x7ffd49c57fff monitored = 0 entry_point = 0x7ffd49c45910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 3004 start_va = 0x7ffd49c60000 end_va = 0x7ffd49dacfff monitored = 0 entry_point = 0x7ffd49ca3da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 3005 start_va = 0x7ffd4a3c0000 end_va = 0x7ffd4a3c7fff monitored = 0 entry_point = 0x7ffd4a3c13e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 3006 start_va = 0x7ffd4a880000 end_va = 0x7ffd4a8f8fff monitored = 0 entry_point = 0x7ffd4a89fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3007 start_va = 0x7ffd4aab0000 end_va = 0x7ffd4af42fff monitored = 0 entry_point = 0x7ffd4aabf760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 3008 start_va = 0x7ffd4af50000 end_va = 0x7ffd4afb6fff monitored = 0 entry_point = 0x7ffd4af6e710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 3009 start_va = 0x7ffd4b010000 end_va = 0x7ffd4b195fff monitored = 0 entry_point = 0x7ffd4b05d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3010 start_va = 0x7ffd4b1a0000 end_va = 0x7ffd4b1bbfff monitored = 0 entry_point = 0x7ffd4b1a37a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 3011 start_va = 0x7ffd4b200000 end_va = 0x7ffd4b212fff monitored = 0 entry_point = 0x7ffd4b202760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3012 start_va = 0x7ffd4b3a0000 end_va = 0x7ffd4b3dffff monitored = 0 entry_point = 0x7ffd4b3b1960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 3013 start_va = 0x7ffd4b530000 end_va = 0x7ffd4b556fff monitored = 0 entry_point = 0x7ffd4b537940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3014 start_va = 0x7ffd4b560000 end_va = 0x7ffd4b591fff monitored = 0 entry_point = 0x7ffd4b572340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 3015 start_va = 0x7ffd4b5a0000 end_va = 0x7ffd4b5abfff monitored = 0 entry_point = 0x7ffd4b5a2480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 3016 start_va = 0x7ffd4b670000 end_va = 0x7ffd4b719fff monitored = 0 entry_point = 0x7ffd4b697910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 3017 start_va = 0x7ffd4b720000 end_va = 0x7ffd4b81ffff monitored = 0 entry_point = 0x7ffd4b760f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 3018 start_va = 0x7ffd4bae0000 end_va = 0x7ffd4baebfff monitored = 0 entry_point = 0x7ffd4bae2790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 3019 start_va = 0x7ffd4baf0000 end_va = 0x7ffd4bb13fff monitored = 0 entry_point = 0x7ffd4baf3260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 3020 start_va = 0x7ffd4bc90000 end_va = 0x7ffd4bd83fff monitored = 0 entry_point = 0x7ffd4bc9a960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 3021 start_va = 0x7ffd4bde0000 end_va = 0x7ffd4be28fff monitored = 0 entry_point = 0x7ffd4bdea090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 3022 start_va = 0x7ffd4bf00000 end_va = 0x7ffd4bf0bfff monitored = 0 entry_point = 0x7ffd4bf027e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 3023 start_va = 0x7ffd4bfe0000 end_va = 0x7ffd4c010fff monitored = 0 entry_point = 0x7ffd4bfe7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3024 start_va = 0x7ffd4c040000 end_va = 0x7ffd4c0b9fff monitored = 0 entry_point = 0x7ffd4c061a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 3025 start_va = 0x7ffd4c100000 end_va = 0x7ffd4c133fff monitored = 0 entry_point = 0x7ffd4c11ae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 3026 start_va = 0x7ffd4c140000 end_va = 0x7ffd4c149fff monitored = 0 entry_point = 0x7ffd4c141830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 3027 start_va = 0x7ffd4c250000 end_va = 0x7ffd4c26efff monitored = 0 entry_point = 0x7ffd4c255d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 3028 start_va = 0x7ffd4c3c0000 end_va = 0x7ffd4c41bfff monitored = 0 entry_point = 0x7ffd4c3d6f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 3029 start_va = 0x7ffd4c470000 end_va = 0x7ffd4c486fff monitored = 0 entry_point = 0x7ffd4c4779d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 3030 start_va = 0x7ffd4c590000 end_va = 0x7ffd4c59afff monitored = 0 entry_point = 0x7ffd4c5919a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 3031 start_va = 0x7ffd4c5d0000 end_va = 0x7ffd4c5f0fff monitored = 0 entry_point = 0x7ffd4c5e0250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 3032 start_va = 0x7ffd4c620000 end_va = 0x7ffd4c659fff monitored = 0 entry_point = 0x7ffd4c628d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 3033 start_va = 0x7ffd4c660000 end_va = 0x7ffd4c686fff monitored = 0 entry_point = 0x7ffd4c670aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 3034 start_va = 0x7ffd4c770000 end_va = 0x7ffd4c79cfff monitored = 0 entry_point = 0x7ffd4c789d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3035 start_va = 0x7ffd4c900000 end_va = 0x7ffd4c955fff monitored = 0 entry_point = 0x7ffd4c910bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3036 start_va = 0x7ffd4c960000 end_va = 0x7ffd4c978fff monitored = 0 entry_point = 0x7ffd4c965e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 3037 start_va = 0x7ffd4c980000 end_va = 0x7ffd4c9a8fff monitored = 0 entry_point = 0x7ffd4c994530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3038 start_va = 0x7ffd4c9b0000 end_va = 0x7ffd4ca48fff monitored = 0 entry_point = 0x7ffd4c9df4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 3039 start_va = 0x7ffd4caf0000 end_va = 0x7ffd4cb03fff monitored = 0 entry_point = 0x7ffd4caf52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3040 start_va = 0x7ffd4cb10000 end_va = 0x7ffd4cb5afff monitored = 0 entry_point = 0x7ffd4cb135f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3041 start_va = 0x7ffd4cb60000 end_va = 0x7ffd4cb6ffff monitored = 0 entry_point = 0x7ffd4cb656e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3042 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3043 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3044 start_va = 0x7ffd4cc80000 end_va = 0x7ffd4ccd4fff monitored = 0 entry_point = 0x7ffd4cc97970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 3045 start_va = 0x7ffd4cce0000 end_va = 0x7ffd4d323fff monitored = 0 entry_point = 0x7ffd4cea64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 3046 start_va = 0x7ffd4d330000 end_va = 0x7ffd4d346fff monitored = 0 entry_point = 0x7ffd4d331390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 3047 start_va = 0x7ffd4d350000 end_va = 0x7ffd4d516fff monitored = 0 entry_point = 0x7ffd4d3adb80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3048 start_va = 0x7ffd4d520000 end_va = 0x7ffd4d5a5fff monitored = 0 entry_point = 0x7ffd4d52d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 3049 start_va = 0x7ffd4d5b0000 end_va = 0x7ffd4d664fff monitored = 0 entry_point = 0x7ffd4d5f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 3050 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3051 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3052 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3053 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3054 start_va = 0x7ffd4db80000 end_va = 0x7ffd4dc40fff monitored = 0 entry_point = 0x7ffd4dba0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3055 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3056 start_va = 0x7ffd4def0000 end_va = 0x7ffd4def7fff monitored = 0 entry_point = 0x7ffd4def1ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 3057 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3058 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3059 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3060 start_va = 0x7ffd4e270000 end_va = 0x7ffd4e2dafff monitored = 0 entry_point = 0x7ffd4e2890c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3061 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3062 start_va = 0x7ffd4e530000 end_va = 0x7ffd4e958fff monitored = 0 entry_point = 0x7ffd4e558740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 3063 start_va = 0x7ffd4e970000 end_va = 0x7ffd4e9cbfff monitored = 0 entry_point = 0x7ffd4e98b720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 3064 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3065 start_va = 0x7ffd4eb30000 end_va = 0x7ffd5008efff monitored = 0 entry_point = 0x7ffd4ec911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3066 start_va = 0x7ffd500f0000 end_va = 0x7ffd50141fff monitored = 0 entry_point = 0x7ffd500ff530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3067 start_va = 0x7ffd50150000 end_va = 0x7ffd501f6fff monitored = 0 entry_point = 0x7ffd5015b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3068 start_va = 0x7ffd50380000 end_va = 0x7ffd504c2fff monitored = 0 entry_point = 0x7ffd503a8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3069 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3072 start_va = 0x7700000 end_va = 0x77fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007700000" filename = "" Region: id = 3073 start_va = 0x7d10000 end_va = 0x7e0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007d10000" filename = "" Region: id = 3074 start_va = 0x7e10000 end_va = 0x7f0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007e10000" filename = "" Region: id = 3075 start_va = 0x7f10000 end_va = 0x800ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007f10000" filename = "" Region: id = 3076 start_va = 0x8010000 end_va = 0x810ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008010000" filename = "" Region: id = 3077 start_va = 0x8300000 end_va = 0x83fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008300000" filename = "" Region: id = 3172 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3300 start_va = 0x440000 end_va = 0x444fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3653 start_va = 0x440000 end_va = 0x442fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3656 start_va = 0x440000 end_va = 0x442fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3658 start_va = 0x440000 end_va = 0x442fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3669 start_va = 0x440000 end_va = 0x441fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3677 start_va = 0x1060000 end_va = 0x1061fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001060000" filename = "" Region: id = 3679 start_va = 0x440000 end_va = 0x442fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3680 start_va = 0x440000 end_va = 0x447fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3683 start_va = 0x440000 end_va = 0x445fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3684 start_va = 0x440000 end_va = 0x445fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3686 start_va = 0x440000 end_va = 0x442fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3823 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 3895 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 4377 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 4656 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 5065 start_va = 0x440000 end_va = 0x440fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000440000" filename = "" Region: id = 5102 start_va = 0x8400000 end_va = 0x84fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008400000" filename = "" Region: id = 5103 start_va = 0x8500000 end_va = 0x85fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008500000" filename = "" Region: id = 5104 start_va = 0x1940000 end_va = 0x19bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001940000" filename = "" Region: id = 5105 start_va = 0x2f10000 end_va = 0x2f8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f10000" filename = "" Region: id = 5106 start_va = 0x440000 end_va = 0x441fff monitored = 0 entry_point = 0x445630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Thread: id = 11 os_tid = 0xd00 Thread: id = 12 os_tid = 0xf90 Thread: id = 13 os_tid = 0x940 Thread: id = 14 os_tid = 0xca4 Thread: id = 15 os_tid = 0x13d4 Thread: id = 16 os_tid = 0x6a4 Thread: id = 17 os_tid = 0x22c Thread: id = 18 os_tid = 0xaec Thread: id = 19 os_tid = 0xc10 Thread: id = 20 os_tid = 0xdd4 Thread: id = 21 os_tid = 0xdd0 Thread: id = 22 os_tid = 0x650 Thread: id = 23 os_tid = 0x424 Thread: id = 24 os_tid = 0x4b0 Thread: id = 25 os_tid = 0xe8 Thread: id = 26 os_tid = 0x3f8 Thread: id = 27 os_tid = 0x374 Thread: id = 28 os_tid = 0xbb4 Thread: id = 29 os_tid = 0xb4c Thread: id = 30 os_tid = 0x440 Thread: id = 31 os_tid = 0xfa8 Thread: id = 32 os_tid = 0xa54 Thread: id = 33 os_tid = 0x514 Thread: id = 34 os_tid = 0x994 Thread: id = 35 os_tid = 0x9a0 Thread: id = 36 os_tid = 0x534 Thread: id = 37 os_tid = 0xb54 Thread: id = 38 os_tid = 0xafc Thread: id = 39 os_tid = 0xabc Thread: id = 40 os_tid = 0x92c Thread: id = 41 os_tid = 0x8a4 Thread: id = 42 os_tid = 0xfcc Thread: id = 43 os_tid = 0xfc4 Thread: id = 44 os_tid = 0xfb8 Thread: id = 45 os_tid = 0xfb4 Thread: id = 46 os_tid = 0xfac Thread: id = 47 os_tid = 0xf9c Thread: id = 48 os_tid = 0xe28 Thread: id = 49 os_tid = 0xe24 Thread: id = 50 os_tid = 0xe1c Thread: id = 51 os_tid = 0xc28 Thread: id = 52 os_tid = 0xa04 Thread: id = 53 os_tid = 0xa84 Thread: id = 54 os_tid = 0xa80 Thread: id = 55 os_tid = 0xa7c Thread: id = 56 os_tid = 0x9c8 Thread: id = 57 os_tid = 0x9b8 Thread: id = 58 os_tid = 0x94c Thread: id = 59 os_tid = 0x8e4 Thread: id = 60 os_tid = 0x8e0 Thread: id = 61 os_tid = 0x8d8 Thread: id = 62 os_tid = 0x8c0 Thread: id = 63 os_tid = 0x8a8 Thread: id = 64 os_tid = 0x8a0 Thread: id = 65 os_tid = 0x898 Thread: id = 66 os_tid = 0x878 Thread: id = 67 os_tid = 0x868 Thread: id = 68 os_tid = 0x830 Thread: id = 69 os_tid = 0x560 Thread: id = 70 os_tid = 0x598 Thread: id = 71 os_tid = 0x190 Thread: id = 72 os_tid = 0x7cc Thread: id = 73 os_tid = 0x7ac Thread: id = 74 os_tid = 0x6e0 Thread: id = 75 os_tid = 0x448 Thread: id = 76 os_tid = 0x5b4 Thread: id = 77 os_tid = 0x50c Thread: id = 78 os_tid = 0x4d4 Thread: id = 79 os_tid = 0x484 Thread: id = 80 os_tid = 0x464 Thread: id = 81 os_tid = 0x414 Thread: id = 82 os_tid = 0x2f4 Thread: id = 83 os_tid = 0x284 Thread: id = 84 os_tid = 0x264 Thread: id = 85 os_tid = 0x210 Thread: id = 86 os_tid = 0x144 Thread: id = 87 os_tid = 0x140 Thread: id = 88 os_tid = 0x120 Thread: id = 89 os_tid = 0x11c Thread: id = 90 os_tid = 0x60 Thread: id = 91 os_tid = 0x3fc Thread: id = 92 os_tid = 0x360 Thread: id = 109 os_tid = 0x13dc Thread: id = 110 os_tid = 0x808 Thread: id = 111 os_tid = 0xf10 Thread: id = 112 os_tid = 0x520 Thread: id = 113 os_tid = 0x6a0 Thread: id = 114 os_tid = 0x250 Thread: id = 157 os_tid = 0x5f4 Thread: id = 158 os_tid = 0xe60 Thread: id = 159 os_tid = 0x9cc Process: id = "4" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x4beb3000" os_pid = "0x234" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x270" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xe], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xe], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000a860" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 3177 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3178 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3179 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3180 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3181 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3182 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3183 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3184 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3185 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3186 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3187 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3188 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 3189 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3190 start_va = 0x480000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000480000" filename = "" Region: id = 3191 start_va = 0x540000 end_va = 0x540fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 3192 start_va = 0x550000 end_va = 0x554fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 3193 start_va = 0x560000 end_va = 0x560fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 3194 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 3195 start_va = 0x580000 end_va = 0x580fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 3196 start_va = 0x5e0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 3197 start_va = 0x6e0000 end_va = 0x867fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006e0000" filename = "" Region: id = 3198 start_va = 0x8c0000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 3199 start_va = 0x8d0000 end_va = 0xc06fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3200 start_va = 0xc10000 end_va = 0xd90fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c10000" filename = "" Region: id = 3201 start_va = 0xda0000 end_va = 0xe1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 3202 start_va = 0xe20000 end_va = 0xf1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 3203 start_va = 0xf20000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000f20000" filename = "" Region: id = 3204 start_va = 0xfa0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 3205 start_va = 0x1020000 end_va = 0x109ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 3206 start_va = 0x10a0000 end_va = 0x111ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010a0000" filename = "" Region: id = 3207 start_va = 0x1120000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 3208 start_va = 0x11a0000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011a0000" filename = "" Region: id = 3209 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3210 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 3211 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 3212 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 3213 start_va = 0x7ff73c190000 end_va = 0x7ff73c20ffff monitored = 0 entry_point = 0x7ff73c1a5f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 3214 start_va = 0x7ffd31ee0000 end_va = 0x7ffd31f2cfff monitored = 0 entry_point = 0x7ffd31eeb470 region_type = mapped_file name = "pdh.dll" filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll") Region: id = 3215 start_va = 0x7ffd31f30000 end_va = 0x7ffd31f54fff monitored = 0 entry_point = 0x7ffd31f45dc0 region_type = mapped_file name = "wmiperfclass.dll" filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll") Region: id = 3216 start_va = 0x7ffd36900000 end_va = 0x7ffd3693cfff monitored = 0 entry_point = 0x7ffd3690b760 region_type = mapped_file name = "wmiprov.dll" filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll") Region: id = 3217 start_va = 0x7ffd3cb30000 end_va = 0x7ffd3cb45fff monitored = 0 entry_point = 0x7ffd3cb355e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 3218 start_va = 0x7ffd3cca0000 end_va = 0x7ffd3ccc4fff monitored = 0 entry_point = 0x7ffd3cca9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 3219 start_va = 0x7ffd3ccd0000 end_va = 0x7ffd3cdc5fff monitored = 0 entry_point = 0x7ffd3cd09590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 3220 start_va = 0x7ffd3d070000 end_va = 0x7ffd3d080fff monitored = 0 entry_point = 0x7ffd3d072fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 3221 start_va = 0x7ffd3d150000 end_va = 0x7ffd3d163fff monitored = 0 entry_point = 0x7ffd3d151800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3222 start_va = 0x7ffd3ec90000 end_va = 0x7ffd3ed0efff monitored = 0 entry_point = 0x7ffd3eca7110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 3223 start_va = 0x7ffd48cd0000 end_va = 0x7ffd48d33fff monitored = 0 entry_point = 0x7ffd48ce5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 3224 start_va = 0x7ffd49140000 end_va = 0x7ffd49150fff monitored = 0 entry_point = 0x7ffd49143320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 3225 start_va = 0x7ffd4bfe0000 end_va = 0x7ffd4c010fff monitored = 0 entry_point = 0x7ffd4bfe7d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 3226 start_va = 0x7ffd4c980000 end_va = 0x7ffd4c9a8fff monitored = 0 entry_point = 0x7ffd4c994530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3227 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3228 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3229 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3230 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3231 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3232 start_va = 0x7ffd4db80000 end_va = 0x7ffd4dc40fff monitored = 0 entry_point = 0x7ffd4dba0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3233 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3234 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3235 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3236 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3237 start_va = 0x7ffd4e270000 end_va = 0x7ffd4e2dafff monitored = 0 entry_point = 0x7ffd4e2890c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3238 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3239 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3240 start_va = 0x7ffd50150000 end_va = 0x7ffd501f6fff monitored = 0 entry_point = 0x7ffd5015b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3241 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Thread: id = 93 os_tid = 0xdac Thread: id = 94 os_tid = 0xac8 Thread: id = 95 os_tid = 0x900 Thread: id = 96 os_tid = 0xda0 Thread: id = 97 os_tid = 0xda4 Thread: id = 98 os_tid = 0xc50 Thread: id = 99 os_tid = 0x678 Thread: id = 100 os_tid = 0x6f4 Process: id = "5" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x39820000" os_pid = "0xd3c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x270" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00031c30" [0xc000000f] Region: id = 3078 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3079 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3080 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3081 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3082 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3083 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 3084 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 3085 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3086 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 3087 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3088 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3089 start_va = 0x1f0000 end_va = 0x1f1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 3090 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3091 start_va = 0x400000 end_va = 0x400fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000400000" filename = "" Region: id = 3092 start_va = 0x410000 end_va = 0x414fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 3093 start_va = 0x420000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 3094 start_va = 0x530000 end_va = 0x532fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "security.dll" filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll") Region: id = 3095 start_va = 0x5a0000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 3096 start_va = 0x660000 end_va = 0x660fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 3097 start_va = 0x670000 end_va = 0x670fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 3098 start_va = 0x680000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 3099 start_va = 0x690000 end_va = 0x692fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cimwin32.dll.mui" filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui") Region: id = 3100 start_va = 0x6b0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 3101 start_va = 0x6c0000 end_va = 0x9f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3102 start_va = 0xa00000 end_va = 0xb87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a00000" filename = "" Region: id = 3103 start_va = 0xb90000 end_va = 0xd10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b90000" filename = "" Region: id = 3104 start_va = 0xda0000 end_va = 0xe9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000da0000" filename = "" Region: id = 3105 start_va = 0xea0000 end_va = 0xf9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ea0000" filename = "" Region: id = 3106 start_va = 0xfa0000 end_va = 0x101ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000fa0000" filename = "" Region: id = 3107 start_va = 0x1020000 end_va = 0x109ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 3108 start_va = 0x1120000 end_va = 0x119ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001120000" filename = "" Region: id = 3109 start_va = 0x11a0000 end_va = 0x121ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000011a0000" filename = "" Region: id = 3110 start_va = 0x1220000 end_va = 0x129ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 3111 start_va = 0x12a0000 end_va = 0x131ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000012a0000" filename = "" Region: id = 3112 start_va = 0x13a0000 end_va = 0x141ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000013a0000" filename = "" Region: id = 3113 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3114 start_va = 0x180000000 end_va = 0x180002fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "wmi.dll" filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll") Region: id = 3115 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 3116 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 3117 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 3118 start_va = 0x7ff73c190000 end_va = 0x7ff73c20ffff monitored = 0 entry_point = 0x7ff73c1a5f50 region_type = mapped_file name = "wmiprvse.exe" filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe") Region: id = 3119 start_va = 0x7ffd31ec0000 end_va = 0x7ffd31ecdfff monitored = 0 entry_point = 0x7ffd31ec1da0 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 3120 start_va = 0x7ffd31fc0000 end_va = 0x7ffd31fcafff monitored = 0 entry_point = 0x7ffd31fc12b0 region_type = mapped_file name = "schedcli.dll" filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll") Region: id = 3121 start_va = 0x7ffd338a0000 end_va = 0x7ffd338b3fff monitored = 0 entry_point = 0x7ffd338a1310 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll") Region: id = 3122 start_va = 0x7ffd36b30000 end_va = 0x7ffd36b7dfff monitored = 0 entry_point = 0x7ffd36b41ce0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll") Region: id = 3123 start_va = 0x7ffd36b80000 end_va = 0x7ffd36d4efff monitored = 0 entry_point = 0x7ffd36ba7df0 region_type = mapped_file name = "cimwin32.dll" filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll") Region: id = 3124 start_va = 0x7ffd3cb30000 end_va = 0x7ffd3cb45fff monitored = 0 entry_point = 0x7ffd3cb355e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 3125 start_va = 0x7ffd3cca0000 end_va = 0x7ffd3ccc4fff monitored = 0 entry_point = 0x7ffd3cca9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 3126 start_va = 0x7ffd3ccd0000 end_va = 0x7ffd3cdc5fff monitored = 0 entry_point = 0x7ffd3cd09590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 3127 start_va = 0x7ffd3d150000 end_va = 0x7ffd3d163fff monitored = 0 entry_point = 0x7ffd3d151800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 3128 start_va = 0x7ffd3ec90000 end_va = 0x7ffd3ed0efff monitored = 0 entry_point = 0x7ffd3eca7110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 3129 start_va = 0x7ffd3ed50000 end_va = 0x7ffd3ed5bfff monitored = 0 entry_point = 0x7ffd3ed535c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 3130 start_va = 0x7ffd422e0000 end_va = 0x7ffd422f1fff monitored = 0 entry_point = 0x7ffd422e3580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 3131 start_va = 0x7ffd42420000 end_va = 0x7ffd42445fff monitored = 0 entry_point = 0x7ffd42421cf0 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 3132 start_va = 0x7ffd46190000 end_va = 0x7ffd461a8fff monitored = 0 entry_point = 0x7ffd46194520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 3133 start_va = 0x7ffd48b10000 end_va = 0x7ffd48b4dfff monitored = 0 entry_point = 0x7ffd48b1a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 3134 start_va = 0x7ffd48cb0000 end_va = 0x7ffd48cc5fff monitored = 0 entry_point = 0x7ffd48cb1b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 3135 start_va = 0x7ffd49140000 end_va = 0x7ffd49150fff monitored = 0 entry_point = 0x7ffd49143320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 3136 start_va = 0x7ffd49c30000 end_va = 0x7ffd49c39fff monitored = 0 entry_point = 0x7ffd49c31660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 3137 start_va = 0x7ffd4b200000 end_va = 0x7ffd4b212fff monitored = 0 entry_point = 0x7ffd4b202760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3138 start_va = 0x7ffd4b530000 end_va = 0x7ffd4b556fff monitored = 0 entry_point = 0x7ffd4b537940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 3139 start_va = 0x7ffd4bf00000 end_va = 0x7ffd4bf0bfff monitored = 0 entry_point = 0x7ffd4bf027e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 3140 start_va = 0x7ffd4c040000 end_va = 0x7ffd4c0b9fff monitored = 0 entry_point = 0x7ffd4c061a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 3141 start_va = 0x7ffd4c770000 end_va = 0x7ffd4c79cfff monitored = 0 entry_point = 0x7ffd4c789d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3142 start_va = 0x7ffd4c900000 end_va = 0x7ffd4c955fff monitored = 0 entry_point = 0x7ffd4c910bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3143 start_va = 0x7ffd4c980000 end_va = 0x7ffd4c9a8fff monitored = 0 entry_point = 0x7ffd4c994530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 3144 start_va = 0x7ffd4cb10000 end_va = 0x7ffd4cb5afff monitored = 0 entry_point = 0x7ffd4cb135f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3145 start_va = 0x7ffd4cb60000 end_va = 0x7ffd4cb6ffff monitored = 0 entry_point = 0x7ffd4cb656e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 3146 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3147 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3148 start_va = 0x7ffd4d330000 end_va = 0x7ffd4d346fff monitored = 0 entry_point = 0x7ffd4d331390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 3149 start_va = 0x7ffd4d350000 end_va = 0x7ffd4d516fff monitored = 0 entry_point = 0x7ffd4d3adb80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 3150 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3151 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3152 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3153 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3154 start_va = 0x7ffd4db80000 end_va = 0x7ffd4dc40fff monitored = 0 entry_point = 0x7ffd4dba0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3155 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3156 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3157 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3158 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3159 start_va = 0x7ffd4e270000 end_va = 0x7ffd4e2dafff monitored = 0 entry_point = 0x7ffd4e2890c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 3160 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3161 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3162 start_va = 0x7ffd50150000 end_va = 0x7ffd501f6fff monitored = 0 entry_point = 0x7ffd5015b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 3163 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3301 start_va = 0x520000 end_va = 0x524fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 3302 start_va = 0x1420000 end_va = 0x151ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001420000" filename = "" Region: id = 3303 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 3304 start_va = 0x540000 end_va = 0x555fff monitored = 0 entry_point = 0x550420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 3305 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 3306 start_va = 0x540000 end_va = 0x555fff monitored = 0 entry_point = 0x550420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 3307 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 3308 start_va = 0x540000 end_va = 0x555fff monitored = 0 entry_point = 0x550420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 3309 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 3310 start_va = 0x540000 end_va = 0x555fff monitored = 0 entry_point = 0x550420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 3311 start_va = 0x520000 end_va = 0x525fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 3312 start_va = 0x540000 end_va = 0x559fff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 3313 start_va = 0x520000 end_va = 0x525fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 3314 start_va = 0x540000 end_va = 0x559fff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 3315 start_va = 0x520000 end_va = 0x524fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 3316 start_va = 0x540000 end_va = 0x56afff monitored = 0 entry_point = 0x55d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 3317 start_va = 0x15e0000 end_va = 0x19dafff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015e0000" filename = "" Region: id = 3318 start_va = 0x520000 end_va = 0x524fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 3319 start_va = 0x540000 end_va = 0x56afff monitored = 0 entry_point = 0x55d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 3320 start_va = 0x520000 end_va = 0x524fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 3321 start_va = 0x540000 end_va = 0x56afff monitored = 0 entry_point = 0x55d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 3322 start_va = 0x520000 end_va = 0x524fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 3323 start_va = 0x540000 end_va = 0x56afff monitored = 0 entry_point = 0x55d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 3324 start_va = 0x540000 end_va = 0x568fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 3325 start_va = 0x19e0000 end_va = 0x1ac3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 3326 start_va = 0x540000 end_va = 0x568fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 3327 start_va = 0x19e0000 end_va = 0x1ac3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 3328 start_va = 0x520000 end_va = 0x525fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 3329 start_va = 0x1520000 end_va = 0x15b2fff monitored = 0 entry_point = 0x1599000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 3330 start_va = 0x520000 end_va = 0x525fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 3331 start_va = 0x1520000 end_va = 0x15b2fff monitored = 0 entry_point = 0x1599000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 3332 start_va = 0x520000 end_va = 0x525fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 3333 start_va = 0x1520000 end_va = 0x15c0fff monitored = 0 entry_point = 0x15b3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 3334 start_va = 0x520000 end_va = 0x525fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 3335 start_va = 0x1520000 end_va = 0x15c0fff monitored = 0 entry_point = 0x15b3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 3336 start_va = 0x520000 end_va = 0x52afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 3337 start_va = 0x1520000 end_va = 0x15a5fff monitored = 0 entry_point = 0x1591000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 3338 start_va = 0x520000 end_va = 0x52afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 3339 start_va = 0x1520000 end_va = 0x15a5fff monitored = 0 entry_point = 0x1591000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 3340 start_va = 0x520000 end_va = 0x52afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 3341 start_va = 0x1520000 end_va = 0x15a5fff monitored = 0 entry_point = 0x1591000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 3342 start_va = 0x520000 end_va = 0x52afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 3343 start_va = 0x1520000 end_va = 0x15a5fff monitored = 0 entry_point = 0x1591000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 3344 start_va = 0x520000 end_va = 0x52efff monitored = 0 entry_point = 0x5236e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 3345 start_va = 0x540000 end_va = 0x541fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 3346 start_va = 0x520000 end_va = 0x52efff monitored = 0 entry_point = 0x5236e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 3347 start_va = 0x540000 end_va = 0x541fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 3348 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3349 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3350 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3351 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3352 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3353 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3354 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3355 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3356 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3357 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3358 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3359 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3360 start_va = 0x520000 end_va = 0x521fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 3361 start_va = 0x19e0000 end_va = 0x1aeefff monitored = 0 entry_point = 0x1a1c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 3362 start_va = 0x520000 end_va = 0x521fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 3363 start_va = 0x19e0000 end_va = 0x1aeefff monitored = 0 entry_point = 0x1a1c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 3364 start_va = 0x540000 end_va = 0x556fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 3365 start_va = 0x19e0000 end_va = 0x1c36fff monitored = 0 entry_point = 0x1bece10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 3366 start_va = 0x540000 end_va = 0x556fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 3367 start_va = 0x19e0000 end_va = 0x1c36fff monitored = 0 entry_point = 0x1bece10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 3368 start_va = 0x520000 end_va = 0x529fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 3369 start_va = 0x19e0000 end_va = 0x1af0fff monitored = 0 entry_point = 0x1ad1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 3370 start_va = 0x520000 end_va = 0x529fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 3371 start_va = 0x19e0000 end_va = 0x1af0fff monitored = 0 entry_point = 0x1ad1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 3372 start_va = 0x520000 end_va = 0x529fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 3373 start_va = 0x19e0000 end_va = 0x1af0fff monitored = 0 entry_point = 0x1ad1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 3374 start_va = 0x520000 end_va = 0x529fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 3375 start_va = 0x19e0000 end_va = 0x1af0fff monitored = 0 entry_point = 0x1ad1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 3376 start_va = 0x520000 end_va = 0x529fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 3377 start_va = 0x19e0000 end_va = 0x1af0fff monitored = 0 entry_point = 0x1ad1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 3378 start_va = 0x520000 end_va = 0x529fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 3379 start_va = 0x19e0000 end_va = 0x1af0fff monitored = 0 entry_point = 0x1ad1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 3380 start_va = 0x520000 end_va = 0x52ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 3381 start_va = 0x540000 end_va = 0x54dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 3382 start_va = 0x520000 end_va = 0x52ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 3383 start_va = 0x540000 end_va = 0x54dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 3384 start_va = 0x540000 end_va = 0x551fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 3385 start_va = 0x1520000 end_va = 0x15cefff monitored = 0 entry_point = 0x1597000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 3386 start_va = 0x540000 end_va = 0x551fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 3387 start_va = 0x1520000 end_va = 0x15cefff monitored = 0 entry_point = 0x1597000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 3388 start_va = 0x540000 end_va = 0x551fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 3389 start_va = 0x1520000 end_va = 0x15cefff monitored = 0 entry_point = 0x1597000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 3390 start_va = 0x540000 end_va = 0x551fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 3391 start_va = 0x1520000 end_va = 0x15cefff monitored = 0 entry_point = 0x1597000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 3392 start_va = 0x540000 end_va = 0x551fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 3393 start_va = 0x1520000 end_va = 0x15cefff monitored = 0 entry_point = 0x1597000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 3394 start_va = 0x540000 end_va = 0x551fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 3395 start_va = 0x1520000 end_va = 0x15cefff monitored = 0 entry_point = 0x1597000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 3396 start_va = 0x520000 end_va = 0x523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 3397 start_va = 0xd20000 end_va = 0xd80fff monitored = 0 entry_point = 0xd30770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 3398 start_va = 0x520000 end_va = 0x523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 3399 start_va = 0xd20000 end_va = 0xd80fff monitored = 0 entry_point = 0xd30770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 3400 start_va = 0x520000 end_va = 0x523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 3401 start_va = 0xd20000 end_va = 0xd80fff monitored = 0 entry_point = 0xd30770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 3402 start_va = 0x520000 end_va = 0x523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 3403 start_va = 0xd20000 end_va = 0xd80fff monitored = 0 entry_point = 0xd30770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 3404 start_va = 0x520000 end_va = 0x523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 3405 start_va = 0xd20000 end_va = 0xd80fff monitored = 0 entry_point = 0xd30770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 3406 start_va = 0x520000 end_va = 0x523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 3407 start_va = 0xd20000 end_va = 0xd80fff monitored = 0 entry_point = 0xd30770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 3408 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3409 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3410 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3411 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3412 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3413 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3414 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3415 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3416 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3417 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3418 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3419 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3420 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3421 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3422 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3423 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3424 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3425 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3426 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3427 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3428 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3429 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3430 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3431 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3432 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3433 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3434 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3435 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3436 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3437 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3438 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3439 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3440 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3441 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3442 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3443 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3444 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3445 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3446 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3447 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3448 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3449 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3450 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3451 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3452 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3453 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3454 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3455 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3456 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3457 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3458 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3459 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3460 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3461 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3462 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3463 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3464 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3465 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3466 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3467 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3468 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3469 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3470 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3471 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3472 start_va = 0x520000 end_va = 0x52ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 3473 start_va = 0xd20000 end_va = 0xd91fff monitored = 0 entry_point = 0xd77000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 3474 start_va = 0x520000 end_va = 0x52ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 3475 start_va = 0xd20000 end_va = 0xd91fff monitored = 0 entry_point = 0xd77000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 3476 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 3477 start_va = 0x540000 end_va = 0x555fff monitored = 0 entry_point = 0x550420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 3478 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 3479 start_va = 0x540000 end_va = 0x555fff monitored = 0 entry_point = 0x550420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 3480 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 3481 start_va = 0x540000 end_va = 0x555fff monitored = 0 entry_point = 0x550420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 3482 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "synth3dvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui") Region: id = 3483 start_va = 0x540000 end_va = 0x555fff monitored = 0 entry_point = 0x550420 region_type = mapped_file name = "synth3dvsc.sys" filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys") Region: id = 3484 start_va = 0x520000 end_va = 0x525fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 3485 start_va = 0x540000 end_va = 0x559fff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 3486 start_va = 0x520000 end_va = 0x525fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "workflowservicehostperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui") Region: id = 3487 start_va = 0x540000 end_va = 0x559fff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "workflowservicehostperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll") Region: id = 3488 start_va = 0x520000 end_va = 0x524fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 3489 start_va = 0x540000 end_va = 0x56afff monitored = 0 entry_point = 0x55d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 3490 start_va = 0x520000 end_va = 0x524fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 3491 start_va = 0x540000 end_va = 0x56afff monitored = 0 entry_point = 0x55d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 3492 start_va = 0x520000 end_va = 0x524fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 3493 start_va = 0x540000 end_va = 0x56afff monitored = 0 entry_point = 0x55d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 3494 start_va = 0x520000 end_va = 0x524fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "pacer.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui") Region: id = 3495 start_va = 0x540000 end_va = 0x56afff monitored = 0 entry_point = 0x55d000 region_type = mapped_file name = "pacer.sys" filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys") Region: id = 3496 start_va = 0x540000 end_va = 0x568fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 3497 start_va = 0x19e0000 end_va = 0x1ac3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 3498 start_va = 0x540000 end_va = 0x568fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll.mui" filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui") Region: id = 3499 start_va = 0x19e0000 end_va = 0x1ac3fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fxsresm.dll" filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll") Region: id = 3500 start_va = 0x520000 end_va = 0x525fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 3501 start_va = 0x1520000 end_va = 0x15b2fff monitored = 0 entry_point = 0x1599000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 3502 start_va = 0x520000 end_va = 0x525fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "afd.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui") Region: id = 3503 start_va = 0x1520000 end_va = 0x15b2fff monitored = 0 entry_point = 0x1599000 region_type = mapped_file name = "afd.sys" filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys") Region: id = 3504 start_va = 0x520000 end_va = 0x525fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 3505 start_va = 0x1520000 end_va = 0x15c0fff monitored = 0 entry_point = 0x15b3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 3506 start_va = 0x520000 end_va = 0x525fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "fvevol.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui") Region: id = 3507 start_va = 0x1520000 end_va = 0x15c0fff monitored = 0 entry_point = 0x15b3000 region_type = mapped_file name = "fvevol.sys" filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys") Region: id = 3508 start_va = 0x520000 end_va = 0x52afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 3509 start_va = 0x1520000 end_va = 0x15a5fff monitored = 0 entry_point = 0x1591000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 3510 start_va = 0x520000 end_va = 0x52afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 3511 start_va = 0x1520000 end_va = 0x15a5fff monitored = 0 entry_point = 0x1591000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 3512 start_va = 0x520000 end_va = 0x52afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 3513 start_va = 0x1520000 end_va = 0x15a5fff monitored = 0 entry_point = 0x1591000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 3514 start_va = 0x520000 end_va = 0x52afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "spaceport.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui") Region: id = 3515 start_va = 0x1520000 end_va = 0x15a5fff monitored = 0 entry_point = 0x1591000 region_type = mapped_file name = "spaceport.sys" filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys") Region: id = 3516 start_va = 0x520000 end_va = 0x52efff monitored = 0 entry_point = 0x5236e0 region_type = mapped_file name = "dmvsc.sys" filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys") Region: id = 3517 start_va = 0x540000 end_va = 0x541fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dmvsc.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui") Region: id = 3518 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3519 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3520 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3521 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3522 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3523 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3524 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3525 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3526 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3527 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3528 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3529 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3530 start_va = 0x520000 end_va = 0x52bfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "servicemodelperformancecounters.dll.mui" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui") Region: id = 3531 start_va = 0x540000 end_va = 0x55afff monitored = 1 entry_point = 0x541190 region_type = mapped_file name = "servicemodelperformancecounters.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll") Region: id = 3532 start_va = 0x520000 end_va = 0x521fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 3533 start_va = 0x19e0000 end_va = 0x1aeefff monitored = 0 entry_point = 0x1a1c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 3534 start_va = 0x520000 end_va = 0x521fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 3535 start_va = 0x19e0000 end_va = 0x1aeefff monitored = 0 entry_point = 0x1a1c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 3536 start_va = 0x540000 end_va = 0x556fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 3537 start_va = 0x19e0000 end_va = 0x1c36fff monitored = 0 entry_point = 0x1bece10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 3538 start_va = 0x540000 end_va = 0x556fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tcpip.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui") Region: id = 3539 start_va = 0x19e0000 end_va = 0x1c36fff monitored = 0 entry_point = 0x1bece10 region_type = mapped_file name = "tcpip.sys" filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys") Region: id = 3540 start_va = 0x520000 end_va = 0x529fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 3541 start_va = 0x19e0000 end_va = 0x1af0fff monitored = 0 entry_point = 0x1ad1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 3542 start_va = 0x520000 end_va = 0x529fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 3543 start_va = 0x19e0000 end_va = 0x1af0fff monitored = 0 entry_point = 0x1ad1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 3544 start_va = 0x520000 end_va = 0x529fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 3545 start_va = 0x19e0000 end_va = 0x1af0fff monitored = 0 entry_point = 0x1ad1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 3546 start_va = 0x520000 end_va = 0x529fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 3547 start_va = 0x19e0000 end_va = 0x1af0fff monitored = 0 entry_point = 0x1ad1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 3548 start_va = 0x520000 end_va = 0x529fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 3549 start_va = 0x19e0000 end_va = 0x1af0fff monitored = 0 entry_point = 0x1ad1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 3550 start_va = 0x520000 end_va = 0x529fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "http.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui") Region: id = 3551 start_va = 0x19e0000 end_va = 0x1af0fff monitored = 0 entry_point = 0x1ad1bf0 region_type = mapped_file name = "http.sys" filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys") Region: id = 3552 start_va = 0x520000 end_va = 0x52ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 3553 start_va = 0x540000 end_va = 0x54dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 3554 start_va = 0x520000 end_va = 0x52ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 3555 start_va = 0x540000 end_va = 0x54dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 3556 start_va = 0x520000 end_va = 0x52ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll") Region: id = 3557 start_va = 0x540000 end_va = 0x54dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "psevents.dll.mui" filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui") Region: id = 3558 start_va = 0x540000 end_va = 0x551fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 3559 start_va = 0x1520000 end_va = 0x15cefff monitored = 0 entry_point = 0x1597000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 3560 start_va = 0x540000 end_va = 0x551fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 3561 start_va = 0x1520000 end_va = 0x15cefff monitored = 0 entry_point = 0x1597000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 3562 start_va = 0x540000 end_va = 0x551fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 3563 start_va = 0x1520000 end_va = 0x15cefff monitored = 0 entry_point = 0x1597000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 3564 start_va = 0x540000 end_va = 0x551fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 3565 start_va = 0x1520000 end_va = 0x15cefff monitored = 0 entry_point = 0x1597000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 3566 start_va = 0x540000 end_va = 0x551fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 3567 start_va = 0x1520000 end_va = 0x15cefff monitored = 0 entry_point = 0x1597000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 3568 start_va = 0x540000 end_va = 0x551fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "srv2.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui") Region: id = 3569 start_va = 0x1520000 end_va = 0x15cefff monitored = 0 entry_point = 0x1597000 region_type = mapped_file name = "srv2.sys" filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys") Region: id = 3570 start_va = 0x520000 end_va = 0x523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 3571 start_va = 0xd20000 end_va = 0xd80fff monitored = 0 entry_point = 0xd30770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 3572 start_va = 0x520000 end_va = 0x523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 3573 start_va = 0xd20000 end_va = 0xd80fff monitored = 0 entry_point = 0xd30770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 3574 start_va = 0x520000 end_va = 0x523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 3575 start_va = 0xd20000 end_va = 0xd80fff monitored = 0 entry_point = 0xd30770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 3576 start_va = 0x520000 end_va = 0x523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 3577 start_va = 0xd20000 end_va = 0xd80fff monitored = 0 entry_point = 0xd30770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 3578 start_va = 0x520000 end_va = 0x523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 3579 start_va = 0xd20000 end_va = 0xd80fff monitored = 0 entry_point = 0xd30770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 3580 start_va = 0x520000 end_va = 0x523fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usbxhci.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui") Region: id = 3581 start_va = 0xd20000 end_va = 0xd80fff monitored = 0 entry_point = 0xd30770 region_type = mapped_file name = "usbxhci.sys" filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys") Region: id = 3582 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3583 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3584 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3585 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3586 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3587 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3588 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3589 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3590 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3591 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3592 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3593 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3594 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3595 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3596 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3597 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3598 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3599 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3600 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3601 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3602 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3603 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3604 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3605 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3606 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3607 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3608 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3609 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3610 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3611 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3612 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3613 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3614 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3615 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3616 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ndis.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui") Region: id = 3617 start_va = 0x19e0000 end_va = 0x1afffff monitored = 0 entry_point = 0x1adc040 region_type = mapped_file name = "ndis.sys" filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys") Region: id = 3618 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3619 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3620 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3621 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3622 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3623 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3624 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3625 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3626 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3627 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3628 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3629 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3630 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3631 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3632 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3633 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3634 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3635 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3636 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3637 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3638 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3639 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3640 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3641 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3642 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3643 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3644 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3645 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3646 start_va = 0x520000 end_va = 0x522fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll" filename = "\\Windows\\System32\\advapi32res.dll" (normalized: "c:\\windows\\system32\\advapi32res.dll") Region: id = 3647 start_va = 0x540000 end_va = 0x550fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "advapi32res.dll.mui" filename = "\\Windows\\System32\\en-US\\advapi32res.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\advapi32res.dll.mui") Region: id = 3648 start_va = 0x520000 end_va = 0x52ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 3649 start_va = 0xd20000 end_va = 0xd91fff monitored = 0 entry_point = 0xd77000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 3650 start_va = 0x520000 end_va = 0x52ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mrxsmb.sys.mui" filename = "\\Windows\\System32\\drivers\\en-US\\mrxsmb.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\mrxsmb.sys.mui") Region: id = 3651 start_va = 0xd20000 end_va = 0xd91fff monitored = 0 entry_point = 0xd77000 region_type = mapped_file name = "mrxsmb.sys" filename = "\\Windows\\System32\\drivers\\mrxsmb.sys" (normalized: "c:\\windows\\system32\\drivers\\mrxsmb.sys") Region: id = 3652 start_va = 0x7ffd45f90000 end_va = 0x7ffd45f9dfff monitored = 0 entry_point = 0x7ffd45f92b10 region_type = mapped_file name = "perfos.dll" filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll") Region: id = 3678 start_va = 0x520000 end_va = 0x522fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 3681 start_va = 0x530000 end_va = 0x537fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 3682 start_va = 0x19e0000 end_va = 0x1bdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000019e0000" filename = "" Region: id = 3685 start_va = 0x540000 end_va = 0x545fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Thread: id = 101 os_tid = 0xaa0 Thread: id = 102 os_tid = 0x6c8 Thread: id = 103 os_tid = 0xfb0 Thread: id = 104 os_tid = 0xd64 Thread: id = 105 os_tid = 0xd60 Thread: id = 106 os_tid = 0xd58 Thread: id = 107 os_tid = 0xd54 Thread: id = 108 os_tid = 0xd40 Process: id = "6" image_name = "build.exe" filename = "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe" page_root = "0x3b645000" os_pid = "0x115c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xdb0" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3755 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3756 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3757 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3758 start_va = 0x60000 end_va = 0x61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 3759 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3760 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 3761 start_va = 0x600000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 3762 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3763 start_va = 0x7ff5fffd0000 end_va = 0x7ff5ffff2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffd0000" filename = "" Region: id = 3764 start_va = 0x7ff67c4a0000 end_va = 0x7ff67db4dfff monitored = 1 entry_point = 0x7ff67db4c474 region_type = mapped_file name = "build.exe" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe") Region: id = 3765 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3766 start_va = 0x8f0000 end_va = 0xaeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 3767 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3768 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3769 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3770 start_va = 0x7ff5ffed0000 end_va = 0x7ff5fffcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffed0000" filename = "" Region: id = 3771 start_va = 0x70000 end_va = 0x12dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3855 start_va = 0x7ffd4a880000 end_va = 0x7ffd4a8f8fff monitored = 0 entry_point = 0x7ffd4a89fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 3856 start_va = 0x7ff5ffe50000 end_va = 0x7ff5ffecdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 3857 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3858 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3859 start_va = 0xaf0000 end_va = 0xceffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000af0000" filename = "" Region: id = 3860 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3861 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3862 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3863 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3864 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3865 start_va = 0x7ffd4db80000 end_va = 0x7ffd4dc40fff monitored = 0 entry_point = 0x7ffd4dba0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3866 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3867 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3868 start_va = 0x7ffd4eb30000 end_va = 0x7ffd5008efff monitored = 0 entry_point = 0x7ffd4ec911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3869 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3870 start_va = 0x7ffd4cce0000 end_va = 0x7ffd4d323fff monitored = 0 entry_point = 0x7ffd4cea64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 3871 start_va = 0x7ffd500f0000 end_va = 0x7ffd50141fff monitored = 0 entry_point = 0x7ffd500ff530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3872 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3873 start_va = 0x7ffd4d5b0000 end_va = 0x7ffd4d664fff monitored = 0 entry_point = 0x7ffd4d5f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 3874 start_va = 0x7ffd4cb10000 end_va = 0x7ffd4cb5afff monitored = 0 entry_point = 0x7ffd4cb135f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3875 start_va = 0x7ffd4caf0000 end_va = 0x7ffd4cb03fff monitored = 0 entry_point = 0x7ffd4caf52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3876 start_va = 0x7ffd50380000 end_va = 0x7ffd504c2fff monitored = 0 entry_point = 0x7ffd503a8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3877 start_va = 0x7ffd41d70000 end_va = 0x7ffd41d79fff monitored = 0 entry_point = 0x7ffd41d71350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 3878 start_va = 0x130000 end_va = 0x168fff monitored = 0 entry_point = 0x1312f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3879 start_va = 0xcf0000 end_va = 0xe77fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000cf0000" filename = "" Region: id = 3880 start_va = 0x7ffd4e2e0000 end_va = 0x7ffd4e31afff monitored = 0 entry_point = 0x7ffd4e2e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3881 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 3882 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 3883 start_va = 0x150000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3884 start_va = 0xe80000 end_va = 0x1000fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e80000" filename = "" Region: id = 3885 start_va = 0x1010000 end_va = 0x240ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001010000" filename = "" Region: id = 3886 start_va = 0x150000 end_va = 0x156fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 3887 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3888 start_va = 0x800000 end_va = 0x8a5fff monitored = 0 entry_point = 0x8093e0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll") Region: id = 3889 start_va = 0x7ffd40ab0000 end_va = 0x7ffd40b59fff monitored = 0 entry_point = 0x7ffd40ab93e0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll") Region: id = 3890 start_va = 0x2410000 end_va = 0x25cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 3891 start_va = 0x7ffd4e960000 end_va = 0x7ffd4e967fff monitored = 0 entry_point = 0x7ffd4e9610b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 3892 start_va = 0x7ffd4b470000 end_va = 0x7ffd4b505fff monitored = 0 entry_point = 0x7ffd4b495570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3893 start_va = 0x2410000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 3894 start_va = 0x25c0000 end_va = 0x25cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025c0000" filename = "" Region: id = 3896 start_va = 0x25d0000 end_va = 0x27d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025d0000" filename = "" Region: id = 3897 start_va = 0x2410000 end_va = 0x250ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002410000" filename = "" Region: id = 3898 start_va = 0x2550000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 3899 start_va = 0x7ff5ffaf0000 end_va = 0x7ff5ffec0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffaf0000" filename = "" Region: id = 3900 start_va = 0x27e0000 end_va = 0x29dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027e0000" filename = "" Region: id = 3901 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 3902 start_va = 0x7ffd45f80000 end_va = 0x7ffd45f86fff monitored = 0 entry_point = 0x7ffd45f812f0 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\System32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll") Region: id = 3903 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 3904 start_va = 0x180000 end_va = 0x181fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 3905 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 3906 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "comctl32.dll.mui" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.10586.0_en-us_4f79d20e846e2d12\\comctl32.dll.mui" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.10586.0_en-us_4f79d20e846e2d12\\comctl32.dll.mui") Region: id = 3907 start_va = 0x7ffd31cc0000 end_va = 0x7ffd31cc6fff monitored = 0 entry_point = 0x7ffd31cc1220 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 3908 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 3909 start_va = 0x800000 end_va = 0x8bbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 3910 start_va = 0x1c0000 end_va = 0x1c3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 3911 start_va = 0x1d0000 end_va = 0x1d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3912 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 3913 start_va = 0x25d0000 end_va = 0x26acfff monitored = 0 entry_point = 0x262e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3914 start_va = 0x2750000 end_va = 0x27d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002750000" filename = "" Region: id = 3915 start_va = 0x29e0000 end_va = 0x2c47fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Region: id = 3916 start_va = 0x2c50000 end_va = 0x2f86fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3917 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 3918 start_va = 0x7ffd4c770000 end_va = 0x7ffd4c79cfff monitored = 0 entry_point = 0x7ffd4c789d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 3919 start_va = 0x2f90000 end_va = 0x378ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002f90000" filename = "" Region: id = 3920 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3921 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3922 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3923 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3924 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3925 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3926 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3927 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3928 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3929 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3930 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3931 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3932 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3933 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3934 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3935 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3936 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3937 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3938 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3939 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3940 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3941 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3942 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3943 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3944 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3945 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3946 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3947 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3948 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3949 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3950 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3951 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3952 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3953 start_va = 0x2f90000 end_va = 0x318ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f90000" filename = "" Region: id = 3954 start_va = 0x3190000 end_va = 0x398ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003190000" filename = "" Region: id = 3955 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3956 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3957 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3958 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3959 start_va = 0x7ffd4e270000 end_va = 0x7ffd4e27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffd4e270000" filename = "" Region: id = 3960 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3961 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3962 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3963 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3964 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3965 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3966 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3967 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3968 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3969 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3970 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3971 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3972 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3973 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3974 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3975 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3976 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3977 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3978 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3979 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3980 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3981 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3982 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3983 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3984 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3985 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3986 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3987 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3988 start_va = 0x8c0000 end_va = 0x8c8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 3989 start_va = 0x3190000 end_va = 0x3692fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 3990 start_va = 0x3190000 end_va = 0x358ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003190000" filename = "" Region: id = 3991 start_va = 0x3590000 end_va = 0x3db6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003590000" filename = "" Region: id = 3994 start_va = 0x7ff5ffa70000 end_va = 0x7ff5ffaedfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4007 start_va = 0x8c0000 end_va = 0x8c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 4021 start_va = 0x8d0000 end_va = 0x8d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Thread: id = 123 os_tid = 0x1160 [0253.728] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0253.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetLastError") returned 0x7ffd4e1db710 [0253.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetLastError") returned 0x7ffd4e1db730 [0253.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetTickCount") returned 0x7ffd4e1db4c0 [0253.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ExitProcess") returned 0x7ffd4e1e4d80 [0253.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetStartupInfoA") returned 0x7ffd4e1e5d70 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetStdHandle") returned 0x7ffd4e1e3e80 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCommandLineA") returned 0x7ffd4e1e6d00 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentProcessId") returned 0x7ffd4e1db4a0 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentThreadId") returned 0x7ffd4e1db460 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentProcess") returned 0x7ffd4e1db7c0 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ReadProcessMemory") returned 0x7ffd4e1e3680 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetModuleFileNameA") returned 0x7ffd4e1e6e30 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetModuleHandleA") returned 0x7ffd4e1e4c90 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WriteFile") returned 0x7ffd4e1edcc0 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ReadFile") returned 0x7ffd4e1edbd0 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CloseHandle") returned 0x7ffd4e1ed650 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetFilePointer") returned 0x7ffd4e1edc60 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetFileSize") returned 0x7ffd4e1eda90 [0253.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetEndOfFile") returned 0x7ffd4e1edc20 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FreeLibrary") returned 0x7ffd4e1e4810 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetSystemInfo") returned 0x7ffd4e1e6720 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryA") returned 0x7ffd4e1e74d0 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetProcAddress") returned 0x7ffd4e1e0b80 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="DeleteFileW") returned 0x7ffd4e1ed8e0 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileW") returned 0x7ffd4e1ed8b0 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetFileAttributesW") returned 0x7ffd4e1eda70 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateDirectoryW") returned 0x7ffd4e1ed880 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RemoveDirectoryW") returned 0x7ffd4e1edc10 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetCurrentDirectoryW") returned 0x7ffd4e1ea310 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentDirectoryW") returned 0x7ffd4e1e6e90 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetFullPathNameW") returned 0x7ffd4e1edb00 [0253.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetEnvironmentVariableW") returned 0x7ffd4e1e7500 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetConsoleMode") returned 0x7ffd4e1edfa0 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetConsoleOutputCP") returned 0x7ffd4e1edfb0 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetOEMCP") returned 0x7ffd4e1ec840 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetProcessHeap") returned 0x7ffd4e1dd4f0 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="HeapAlloc") returned 0x7ffd504f52d0 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="HeapFree") returned 0x7ffd4e1db480 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TlsAlloc") returned 0x7ffd4e1e3ad0 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TlsFree") returned 0x7ffd4e1e3e40 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TlsGetValue") returned 0x7ffd4e1db450 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TlsSetValue") returned 0x7ffd4e1db7d0 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateThread") returned 0x7ffd4e1e16f0 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ExitThread") returned 0x7ffd5052c2a0 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LocalAlloc") returned 0x7ffd4e1ddd20 [0253.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LocalFree") returned 0x7ffd4e1ddd10 [0253.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Sleep") returned 0x7ffd4e1db7b0 [0253.791] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SuspendThread") returned 0x7ffd4e1e6730 [0253.791] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ResumeThread") returned 0x7ffd4e1e4e70 [0253.791] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TerminateThread") returned 0x7ffd4e1e7250 [0253.792] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WaitForSingleObject") returned 0x7ffd4e1ed840 [0253.792] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetThreadPriority") returned 0x7ffd4e1e45a0 [0253.792] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetThreadPriority") returned 0x7ffd4e1e45b0 [0253.792] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateEventA") returned 0x7ffd4e1ed6a0 [0253.792] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ResetEvent") returned 0x7ffd4e1ed7e0 [0253.792] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetEvent") returned 0x7ffd4e1ed7f0 [0253.792] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="InitializeCriticalSection") returned 0x7ffd5053ced0 [0253.793] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="DeleteCriticalSection") returned 0x7ffd505299d0 [0253.793] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="EnterCriticalSection") returned 0x7ffd504fe600 [0253.793] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LeaveCriticalSection") returned 0x7ffd504feb00 [0253.793] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TryEnterCriticalSection") returned 0x7ffd50520d20 [0253.793] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RaiseException") returned 0x7ffd4e1e4d70 [0253.793] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="MultiByteToWideChar") returned 0x7ffd4e1dd500 [0253.793] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WideCharToMultiByte") returned 0x7ffd4e1db490 [0253.793] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetACP") returned 0x7ffd4e1dd720 [0253.794] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetConsoleCP") returned 0x7ffd4e1edf90 [0253.794] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RtlCaptureContext") returned 0x7ffd4e1ed410 [0253.794] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RtlLookupFunctionEntry") returned 0x7ffd4e1e6e60 [0253.794] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RtlVirtualUnwind") returned 0x7ffd4e1ea410 [0253.794] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RtlUnwindEx") returned 0x7ffd4e1e6ba0 [0253.794] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="AddVectoredExceptionHandler") returned 0x7ffd50542650 [0253.794] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="EnumResourceTypesA") returned 0x7ffd4e2031a0 [0253.794] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="EnumResourceNamesA") returned 0x7ffd4e203170 [0253.794] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="EnumResourceLanguagesA") returned 0x7ffd4e203110 [0253.794] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FindResourceA") returned 0x7ffd4e1cb6b0 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FindResourceExA") returned 0x7ffd4e1cb6d0 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadResource") returned 0x7ffd4e1e3e60 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SizeofResource") returned 0x7ffd4e1e4460 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LockResource") returned 0x7ffd4e1e4450 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FreeResource") returned 0x7ffd4e1e8ee0 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FormatMessageA") returned 0x7ffd4e1ea9c0 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileMappingA") returned 0x7ffd4e1e1810 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryExA") returned 0x7ffd4e1e6b80 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetEnvironmentVariableA") returned 0x7ffd4e1e3e50 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalAddAtomA") returned 0x7ffd4e1cb940 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WritePrivateProfileStringA") returned 0x7ffd4e1fff50 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetDriveTypeA") returned 0x7ffd4e1eda20 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetWindowsDirectoryA") returned 0x7ffd4e1eb190 [0253.795] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileA") returned 0x7ffd4e1ed8a0 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetVolumeInformationA") returned 0x7ffd4e1edb60 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetComputerNameA") returned 0x7ffd4e1e20c0 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetVersionExA") returned 0x7ffd4e1e7450 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CompareStringA") returned 0x7ffd4e1e6740 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetLocaleInfoA") returned 0x7ffd4e1e3700 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetDateFormatA") returned 0x7ffd4e1ea460 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="EnumCalendarInfoA") returned 0x7ffd4e217f10 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetEnvironmentStringsW") returned 0x7ffd4e1e6790 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FreeEnvironmentStringsW") returned 0x7ffd4e1e67a0 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FormatMessageW") returned 0x7ffd4e1e45c0 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileMappingW") returned 0x7ffd4e1e3af0 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetLogicalDriveStringsW") returned 0x7ffd4e1edb10 [0253.796] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryW") returned 0x7ffd4e1e50f0 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryExW") returned 0x7ffd4e1e0dd0 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetModuleFileNameW") returned 0x7ffd4e1e4840 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetModuleHandleW") returned 0x7ffd4e1e3d40 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCommandLineW") returned 0x7ffd4e1e6a00 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetPrivateProfileStringW") returned 0x7ffd4e1ce1d0 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WritePrivateProfileStringW") returned 0x7ffd4e1da430 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetSystemDirectoryW") returned 0x7ffd4e1e03c0 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetTempPathW") returned 0x7ffd4e1edb50 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetTempFileNameW") returned 0x7ffd4e1edb30 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetWindowsDirectoryW") returned 0x7ffd4e1e8ed0 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="QueryDosDeviceW") returned 0x7ffd4e1edbc0 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetFileAttributesW") returned 0x7ffd4e1edc40 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetFileAttributesExW") returned 0x7ffd4e1eda60 [0253.797] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetVolumeInformationW") returned 0x7ffd4e1edb80 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetComputerNameW") returned 0x7ffd4e1e2230 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FindFirstFileW") returned 0x7ffd4e1ed980 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FindNextFileW") returned 0x7ffd4e1ed9c0 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CompareStringW") returned 0x7ffd4e1e2ce0 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetLocaleInfoW") returned 0x7ffd4e1e72a0 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetVersion") returned 0x7ffd4e1e7550 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalAlloc") returned 0x7ffd4e1e0de0 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalReAlloc") returned 0x7ffd4e1dd7c0 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalSize") returned 0x7ffd4e1e02a0 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalLock") returned 0x7ffd4e1db590 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalUnlock") returned 0x7ffd4e1db4e0 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FlushInstructionCache") returned 0x7ffd4e1e0c70 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualAlloc") returned 0x7ffd4e1e28c0 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualAllocEx") returned 0x7ffd4e1ea400 [0253.798] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualFree") returned 0x7ffd4e1e32a0 [0253.799] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualProtect") returned 0x7ffd4e1e3a90 [0253.799] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualProtectEx") returned 0x7ffd4e206a60 [0253.799] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="HeapCreate") returned 0x7ffd4e1e72b0 [0253.799] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="HeapDestroy") returned 0x7ffd4e1e90c0 [0253.799] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="OpenProcess") returned 0x7ffd4e1deb80 [0253.799] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetExitCodeProcess") returned 0x7ffd4e1e3c20 [0253.799] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateRemoteThread") returned 0x7ffd4e205b10 [0253.799] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentThread") returned 0x7ffd4e1db7a0 [0253.799] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetExitCodeThread") returned 0x7ffd4e1e67b0 [0253.799] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetErrorMode") returned 0x7ffd4e1e3ac0 [0253.799] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WriteProcessMemory") returned 0x7ffd4e1ea3f0 [0253.799] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetThreadContext") returned 0x7ffd4e1e6780 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalDeleteAtom") returned 0x7ffd4e1cd180 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FlushFileBuffers") returned 0x7ffd4e1ed9d0 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="DeviceIoControl") returned 0x7ffd4e1db2d0 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FindClose") returned 0x7ffd4e1ed900 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetFileTime") returned 0x7ffd4e1edc80 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="MulDiv") returned 0x7ffd4e1edcf0 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetLocalTime") returned 0x7ffd4e1e4830 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetTimeZoneInformation") returned 0x7ffd4e1e3ab0 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SystemTimeToFileTime") returned 0x7ffd4e1e7290 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FileTimeToLocalFileTime") returned 0x7ffd4e1ed8f0 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FileTimeToDosDateTime") returned 0x7ffd4e1cd940 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="PeekNamedPipe") returned 0x7ffd4e206350 [0253.800] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="MapViewOfFile") returned 0x7ffd4e1e4860 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="UnmapViewOfFile") returned 0x7ffd4e1e4ce0 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualLock") returned 0x7ffd4e206a50 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualUnlock") returned 0x7ffd4e1e4330 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="MapViewOfFileEx") returned 0x7ffd4e1e1f30 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="IsBadReadPtr") returned 0x7ffd4e1db680 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="IsBadWritePtr") returned 0x7ffd4e204980 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="QueryPerformanceCounter") returned 0x7ffd4e1db720 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetThreadLocale") returned 0x7ffd4e1e0db0 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetThreadLocale") returned 0x7ffd4e1e0dc0 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetUserDefaultLCID") returned 0x7ffd4e1e3a70 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="PostQueuedCompletionStatus") returned 0x7ffd4e1e31f0 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetThreadContext") returned 0x7ffd4e1ec890 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RemoveVectoredExceptionHandler") returned 0x7ffd50551f70 [0253.801] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7ffd4e1ee800 [0253.802] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Process32FirstW") returned 0x7ffd4e1e6a40 [0253.802] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Process32NextW") returned 0x7ffd4e1e1040 [0253.802] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Process32Next") returned 0x7ffd4e2086c0 [0253.802] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Module32First") returned 0x7ffd4e208390 [0253.802] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Module32Next") returned 0x7ffd4e2084b0 [0253.802] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="DebugBreak") returned 0x7ffd4e205b90 [0253.802] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Thread32First") returned 0x7ffd4e1e8b30 [0253.802] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Thread32Next") returned 0x7ffd4e1e0aa0 [0253.802] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x7ffd4db80000 [0253.802] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SysAllocStringLen") returned 0x7ffd4db8e5b0 [0253.802] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SysFreeString") returned 0x7ffd4db90ae0 [0253.802] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SysReAllocStringLen") returned 0x7ffd4db92880 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayCreate") returned 0x7ffd4db826b0 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayRedim") returned 0x7ffd4db93510 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayGetUBound") returned 0x7ffd4db98350 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayGetLBound") returned 0x7ffd4db98820 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayAccessData") returned 0x7ffd4db94be0 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayUnaccessData") returned 0x7ffd4db983c0 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayGetElement") returned 0x7ffd4db91bd0 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayPutElement") returned 0x7ffd4db91870 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayPtrOfIndex") returned 0x7ffd4db993c0 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="VariantChangeTypeEx") returned 0x7ffd4db8e680 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="VariantClear") returned 0x7ffd4dc0c230 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="VariantCopy") returned 0x7ffd4dc0c910 [0253.803] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="VariantInit") returned 0x7ffd4dc0cbc0 [0253.803] GetModuleHandleA (lpModuleName="user32.dll") returned 0x7ffd4e9d0000 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="MessageBoxA") returned 0x7ffd4ea4e0a0 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharUpperBuffW") returned 0x7ffd4e9d19d0 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharLowerBuffW") returned 0x7ffd4e9ff5d0 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="PeekMessageA") returned 0x7ffd4e9ec540 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SendMessageA") returned 0x7ffd4e9e5eb0 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="PostMessageA") returned 0x7ffd4e9f7640 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="DefWindowProcA") returned 0x7ffd50574a30 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CallWindowProcA") returned 0x7ffd4ea01400 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="RegisterClassA") returned 0x7ffd4e9f38c0 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="UnregisterClassA") returned 0x7ffd4e9f3750 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetClassInfoA") returned 0x7ffd4e9f34f0 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CreateWindowExA") returned 0x7ffd4e9f8a40 [0253.804] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="RegisterClipboardFormatA") returned 0x7ffd4e9f3d50 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetClipboardFormatNameA") returned 0x7ffd4ea587f0 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharToOemA") returned 0x7ffd4e9f59d0 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharUpperA") returned 0x7ffd4e9f6af0 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharUpperBuffA") returned 0x7ffd4ea01460 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharLowerA") returned 0x7ffd4e9fa5f0 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharLowerBuffA") returned 0x7ffd4ea59ab0 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetMenuItemInfoA") returned 0x7ffd4e9efd50 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetPropA") returned 0x7ffd4ea58d60 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetPropA") returned 0x7ffd4e9f3270 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="RemovePropA") returned 0x7ffd4ea58ab0 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="EnumPropsA") returned 0x7ffd4ea21590 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetWindowTextA") returned 0x7ffd4e9e5640 [0253.805] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetWindowLongA") returned 0x7ffd4e9df770 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetWindowLongA") returned 0x7ffd4e9e6fc0 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetClassLongPtrA") returned 0x7ffd4ea58c30 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="FindWindowA") returned 0x7ffd4ea587a0 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetClassNameA") returned 0x7ffd4ea002b0 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="LoadBitmapA") returned 0x7ffd4e9fe680 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="LoadCursorA") returned 0x7ffd4e9d5740 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="LoadIconA") returned 0x7ffd4e9faa30 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="LoadImageA") returned 0x7ffd4e9d5020 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SystemParametersInfoA") returned 0x7ffd4e9f2140 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="DispatchMessageW") returned 0x7ffd4e9e0ae0 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="PeekMessageW") returned 0x7ffd4e9ec670 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SendMessageW") returned 0x7ffd4e9e0560 [0253.806] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="DefWindowProcW") returned 0x7ffd50574a40 [0253.807] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CallWindowProcW") returned 0x7ffd4e9e09b0 [0253.807] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="RegisterClassW") returned 0x7ffd4e9da6a0 [0253.807] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="UnregisterClassW") returned 0x7ffd4e9dc510 [0253.807] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetClassInfoW") returned 0x7ffd4e9da410 [0253.807] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CreateWindowExW") returned 0x7ffd4e9db4e0 [0253.807] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="InsertMenuItemW") returned 0x7ffd4e9f0070 [0253.807] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetMenuItemInfoW") returned 0x7ffd4e9f0220 [0253.807] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetMenuItemInfoW") returned 0x7ffd4e9efce0 [0253.807] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="DrawTextW") returned 0x7ffd4e9edaf0 [0253.807] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="DrawStateW") returned 0x7ffd4e9f8720 [0253.808] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetWindowTextW") returned 0x7ffd4e9e59f0 [0253.808] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetWindowTextW") returned 0x7ffd4e9dde10 [0253.808] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetWindowTextLengthW") returned 0x7ffd4e9e5780 [0253.808] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="MessageBoxW") returned 0x7ffd4ea4e600 [0253.808] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetWindowLongPtrW") returned 0x7ffd4e9dfaf0 [0253.808] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetWindowLongPtrW") returned 0x7ffd4e9e5ac0 [0253.809] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x7ffd4e480000 [0253.809] GetModuleHandleA (lpModuleName="gdi32.dll") returned 0x7ffd4d8d0000 [0253.809] GetModuleHandleA (lpModuleName="version.dll") returned 0x7ffd41d70000 [0253.809] GetModuleHandleA (lpModuleName="shell32.dll") returned 0x7ffd4eb30000 [0253.809] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x7ffd50380000 [0253.809] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0253.810] GetModuleHandleA (lpModuleName="shlwapi.dll") returned 0x7ffd500f0000 [0253.810] GetModuleHandleA (lpModuleName="comctl32.dll") returned 0x0 [0254.510] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x7ffd40ab0000 [0254.532] GetModuleHandleA (lpModuleName="psapi.dll") returned 0x0 [0254.533] LoadLibraryA (lpLibFileName="psapi.dll") returned 0x7ffd4e960000 [0254.618] GetCurrentThreadId () returned 0x1160 [0254.618] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff67c4a0000 [0254.619] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff67c4a0000 [0254.619] GetStartupInfoA (in: lpStartupInfo=0x7ff67d0ef3f0 | out: lpStartupInfo=0x7ff67d0ef3f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffffffffffff, hStdOutput=0xffffffffffffffff, hStdError=0xffffffffffffffff)) [0254.619] GetCurrentThreadId () returned 0x1160 [0254.619] GetLastError () returned 0x7e [0254.619] LocalAlloc (uFlags=0x40, uBytes=0x12a2) returned 0x907ba0 [0254.619] SetLastError (dwErrCode=0x7e) [0254.619] GetLastError () returned 0x7e [0254.619] SetLastError (dwErrCode=0x7e) [0254.619] GetLastError () returned 0x7e [0254.619] SetLastError (dwErrCode=0x7e) [0254.619] GetLastError () returned 0x7e [0254.619] SetLastError (dwErrCode=0x7e) [0254.619] GetLastError () returned 0x7e [0254.619] SetLastError (dwErrCode=0x7e) [0254.620] GetLastError () returned 0x7e [0254.620] SetLastError (dwErrCode=0x7e) [0254.620] GetLastError () returned 0x7e [0254.620] SetLastError (dwErrCode=0x7e) [0254.620] GetLastError () returned 0x7e [0254.620] SetLastError (dwErrCode=0x7e) [0254.620] GetLastError () returned 0x7e [0254.620] SetLastError (dwErrCode=0x7e) [0254.620] GetLastError () returned 0x7e [0254.620] SetLastError (dwErrCode=0x7e) [0254.620] GetLastError () returned 0x7e [0254.620] SetLastError (dwErrCode=0x7e) [0254.620] GetLastError () returned 0x7e [0254.620] SetLastError (dwErrCode=0x7e) [0254.620] GetLastError () returned 0x7e [0254.620] SetLastError (dwErrCode=0x7e) [0254.620] GetLastError () returned 0x7e [0254.620] SetLastError (dwErrCode=0x7e) [0254.620] GetLastError () returned 0x7e [0254.620] SetLastError (dwErrCode=0x7e) [0254.620] GetLastError () returned 0x7e [0254.620] SetLastError (dwErrCode=0x7e) [0254.620] GetLastError () returned 0x7e [0254.620] SetLastError (dwErrCode=0x7e) [0254.621] GetLastError () returned 0x7e [0254.621] SetLastError (dwErrCode=0x7e) [0254.621] GetLastError () returned 0x7e [0254.621] SetLastError (dwErrCode=0x7e) [0254.621] GetLastError () returned 0x7e [0254.621] SetLastError (dwErrCode=0x7e) [0254.621] GetACP () returned 0x4e4 [0254.621] GetStdHandle (nStdHandle=0xfffffff6) returned 0x20 [0254.621] GetStdHandle (nStdHandle=0xfffffff5) returned 0x24 [0254.621] GetStdHandle (nStdHandle=0xfffffff4) returned 0x28 [0254.621] GetLastError () returned 0x7e [0254.621] SetLastError (dwErrCode=0x7e) [0254.621] GetConsoleCP () returned 0x1b5 [0254.622] GetLastError () returned 0x7e [0254.622] SetLastError (dwErrCode=0x7e) [0254.622] GetConsoleOutputCP () returned 0x1b5 [0254.622] GetLastError () returned 0x7e [0254.622] SetLastError (dwErrCode=0x7e) [0254.622] GetConsoleOutputCP () returned 0x1b5 [0254.623] GetLastError () returned 0x7e [0254.623] SetLastError (dwErrCode=0x7e) [0254.623] GetConsoleOutputCP () returned 0x1b5 [0254.623] GetLastError () returned 0x7e [0254.623] SetLastError (dwErrCode=0x7e) [0254.623] GetConsoleOutputCP () returned 0x1b5 [0254.623] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x7ffc28, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe")) returned 0x32 [0254.624] GetLastError () returned 0x0 [0254.624] SetLastError (dwErrCode=0x0) [0254.624] GetProcessHeap () returned 0x8f0000 [0254.624] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x908e50 [0254.625] GetLastError () returned 0x0 [0254.625] SetLastError (dwErrCode=0x0) [0254.625] GetProcessHeap () returned 0x8f0000 [0254.625] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x910e60 [0254.626] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe\" " [0254.626] GetLastError () returned 0x0 [0254.626] SetLastError (dwErrCode=0x0) [0254.626] GetCurrentProcessId () returned 0x115c [0254.626] GetLastError () returned 0x0 [0254.626] SetLastError (dwErrCode=0x0) [0254.626] GetLastError () returned 0x0 [0254.626] SetLastError (dwErrCode=0x0) [0254.626] GetUserDefaultLCID () returned 0x409 [0254.627] SetThreadLocale (Locale=0x409) returned 1 [0254.627] GetSystemMetrics (nIndex=42) returned 0 [0254.834] GetSystemMetrics (nIndex=74) returned 0 [0254.834] GetThreadLocale () returned 0x409 [0254.834] GetThreadLocale () returned 0x409 [0254.834] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Jan") returned 4 [0254.834] GetLastError () returned 0x0 [0254.834] SetLastError (dwErrCode=0x0) [0254.834] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x7ff990, cchData=256 | out: lpLCData="January") returned 8 [0254.834] GetLastError () returned 0x0 [0254.834] SetLastError (dwErrCode=0x0) [0254.834] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Feb") returned 4 [0254.834] GetLastError () returned 0x0 [0254.834] SetLastError (dwErrCode=0x0) [0254.834] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x7ff990, cchData=256 | out: lpLCData="February") returned 9 [0254.835] GetLastError () returned 0x0 [0254.835] SetLastError (dwErrCode=0x0) [0254.835] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Mar") returned 4 [0254.835] GetLastError () returned 0x0 [0254.835] SetLastError (dwErrCode=0x0) [0254.835] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x7ff990, cchData=256 | out: lpLCData="March") returned 6 [0254.835] GetLastError () returned 0x0 [0254.835] SetLastError (dwErrCode=0x0) [0254.835] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Apr") returned 4 [0254.835] GetLastError () returned 0x0 [0254.835] SetLastError (dwErrCode=0x0) [0254.835] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x7ff990, cchData=256 | out: lpLCData="April") returned 6 [0254.835] GetLastError () returned 0x0 [0254.835] SetLastError (dwErrCode=0x0) [0254.835] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x7ff990, cchData=256 | out: lpLCData="May") returned 4 [0254.835] GetLastError () returned 0x0 [0254.835] SetLastError (dwErrCode=0x0) [0254.835] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x7ff990, cchData=256 | out: lpLCData="May") returned 4 [0254.835] GetLastError () returned 0x0 [0254.835] SetLastError (dwErrCode=0x0) [0254.835] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Jun") returned 4 [0254.836] GetLastError () returned 0x0 [0254.836] SetLastError (dwErrCode=0x0) [0254.836] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x7ff990, cchData=256 | out: lpLCData="June") returned 5 [0254.836] GetLastError () returned 0x0 [0254.836] SetLastError (dwErrCode=0x0) [0254.836] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Jul") returned 4 [0254.836] GetLastError () returned 0x0 [0254.836] SetLastError (dwErrCode=0x0) [0254.836] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x7ff990, cchData=256 | out: lpLCData="July") returned 5 [0254.836] GetLastError () returned 0x0 [0254.836] SetLastError (dwErrCode=0x0) [0254.836] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Aug") returned 4 [0254.836] GetLastError () returned 0x0 [0254.836] SetLastError (dwErrCode=0x0) [0254.836] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x7ff990, cchData=256 | out: lpLCData="August") returned 7 [0254.836] GetLastError () returned 0x0 [0254.836] SetLastError (dwErrCode=0x0) [0254.836] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Sep") returned 4 [0254.836] GetLastError () returned 0x0 [0254.836] SetLastError (dwErrCode=0x0) [0254.836] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x7ff990, cchData=256 | out: lpLCData="September") returned 10 [0254.836] GetLastError () returned 0x0 [0254.837] SetLastError (dwErrCode=0x0) [0254.837] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Oct") returned 4 [0254.837] GetLastError () returned 0x0 [0254.837] SetLastError (dwErrCode=0x0) [0254.837] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x7ff990, cchData=256 | out: lpLCData="October") returned 8 [0254.837] GetLastError () returned 0x0 [0254.837] SetLastError (dwErrCode=0x0) [0254.837] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Nov") returned 4 [0254.837] GetLastError () returned 0x0 [0254.853] SetLastError (dwErrCode=0x0) [0254.854] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x7ff990, cchData=256 | out: lpLCData="November") returned 9 [0254.854] GetLastError () returned 0x0 [0254.854] SetLastError (dwErrCode=0x0) [0254.854] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Dec") returned 4 [0254.854] GetLastError () returned 0x0 [0254.855] SetLastError (dwErrCode=0x0) [0254.855] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x7ff990, cchData=256 | out: lpLCData="December") returned 9 [0254.855] GetLastError () returned 0x0 [0254.855] SetLastError (dwErrCode=0x0) [0254.855] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Sun") returned 4 [0254.855] GetLastError () returned 0x0 [0254.855] SetLastError (dwErrCode=0x0) [0254.855] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Sunday") returned 7 [0254.855] GetLastError () returned 0x0 [0254.855] SetLastError (dwErrCode=0x0) [0254.855] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Mon") returned 4 [0254.855] GetLastError () returned 0x0 [0254.855] SetLastError (dwErrCode=0x0) [0254.856] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Monday") returned 7 [0254.856] GetLastError () returned 0x0 [0254.856] SetLastError (dwErrCode=0x0) [0254.856] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Tue") returned 4 [0254.856] GetLastError () returned 0x0 [0254.856] SetLastError (dwErrCode=0x0) [0254.856] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Tuesday") returned 8 [0254.856] GetLastError () returned 0x0 [0254.856] SetLastError (dwErrCode=0x0) [0254.856] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Wed") returned 4 [0254.856] GetLastError () returned 0x0 [0254.856] SetLastError (dwErrCode=0x0) [0254.856] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Wednesday") returned 10 [0254.857] GetLastError () returned 0x0 [0254.857] SetLastError (dwErrCode=0x0) [0254.857] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Thu") returned 4 [0254.857] GetLastError () returned 0x0 [0254.857] SetLastError (dwErrCode=0x0) [0254.857] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Thursday") returned 9 [0254.857] GetLastError () returned 0x0 [0254.857] SetLastError (dwErrCode=0x0) [0254.857] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Fri") returned 4 [0254.857] GetLastError () returned 0x0 [0254.857] SetLastError (dwErrCode=0x0) [0254.857] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Friday") returned 7 [0254.857] GetLastError () returned 0x0 [0254.857] SetLastError (dwErrCode=0x0) [0254.858] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Sat") returned 4 [0254.858] GetLastError () returned 0x0 [0254.858] SetLastError (dwErrCode=0x0) [0254.858] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x7ff990, cchData=256 | out: lpLCData="Saturday") returned 9 [0254.858] GetLastError () returned 0x0 [0254.858] SetLastError (dwErrCode=0x0) [0254.858] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ffa90, cchData=4 | out: lpLCData="/") returned 2 [0254.858] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x7ff990, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0254.858] GetLastError () returned 0x0 [0254.858] SetLastError (dwErrCode=0x0) [0254.858] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x7ff990, cchData=256 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0254.858] GetLastError () returned 0x0 [0254.858] SetLastError (dwErrCode=0x0) [0254.858] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ffa90, cchData=4 | out: lpLCData=":") returned 2 [0254.858] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x7ff990, cchData=256 | out: lpLCData="AM") returned 3 [0254.858] GetLastError () returned 0x0 [0254.859] SetLastError (dwErrCode=0x0) [0254.859] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x7ff990, cchData=256 | out: lpLCData="PM") returned 3 [0254.859] GetLastError () returned 0x0 [0254.859] SetLastError (dwErrCode=0x0) [0254.859] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x7ff990, cchData=256 | out: lpLCData="0") returned 2 [0254.859] GetLastError () returned 0x0 [0254.859] SetLastError (dwErrCode=0x0) [0254.859] GetLastError () returned 0x0 [0254.859] SetLastError (dwErrCode=0x0) [0254.859] GetLastError () returned 0x0 [0254.859] SetLastError (dwErrCode=0x0) [0254.859] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x7ff990, cchData=256 | out: lpLCData="$") returned 2 [0254.859] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x7ff990, cchData=256 | out: lpLCData="0") returned 2 [0254.859] GetLastError () returned 0x0 [0254.860] SetLastError (dwErrCode=0x0) [0254.860] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x7ff990, cchData=256 | out: lpLCData="0") returned 2 [0254.860] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x7ffa90, cchData=4 | out: lpLCData=",") returned 2 [0254.860] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x7ffa90, cchData=4 | out: lpLCData=".") returned 2 [0254.860] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x7ff990, cchData=256 | out: lpLCData="2") returned 2 [0254.860] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x7ffa90, cchData=4 | out: lpLCData=",") returned 2 [0254.860] GetLastError () returned 0x0 [0254.860] SetLastError (dwErrCode=0x0) [0254.861] GetVersionExA (in: lpVersionInformation=0x7ffcd0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6d0065, dwMinorVersion=0x490065, dwBuildNumber=0x69006e, dwPlatformId=0x410074, szCSDVersion="p") | out: lpVersionInformation=0x7ffcd0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0254.861] GetModuleHandleA (lpModuleName="kernel32") returned 0x7ffd4e1c0000 [0254.873] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetDiskFreeSpaceExA") returned 0x7ffd4e1ed9f0 [0254.873] GetLastError () returned 0x0 [0254.873] SetLastError (dwErrCode=0x0) [0254.873] GetProcessHeap () returned 0x8f0000 [0254.873] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x91ae80 [0254.875] GetWindowsDirectoryA (in: lpBuffer=0x91aed8, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0254.876] HeapCreate (flOptions=0x0, dwInitialSize=0x88000, dwMaximumSize=0x88000) returned 0x2750000 [0254.881] RtlAllocateHeap (HeapHandle=0x2750000, Flags=0x0, Size=0x10000) returned 0x2750720 [0254.881] RtlAllocateHeap (HeapHandle=0x2750000, Flags=0x0, Size=0x10000) returned 0x2760730 [0254.881] RtlAllocateHeap (HeapHandle=0x2750000, Flags=0x0, Size=0x10000) returned 0x2770740 [0254.882] RtlAllocateHeap (HeapHandle=0x2750000, Flags=0x0, Size=0x10000) returned 0x2780750 [0254.882] RtlAllocateHeap (HeapHandle=0x2750000, Flags=0x0, Size=0x10000) returned 0x2790760 [0254.882] RtlAllocateHeap (HeapHandle=0x2750000, Flags=0x0, Size=0x10000) returned 0x27a0770 [0254.882] RtlAllocateHeap (HeapHandle=0x2750000, Flags=0x0, Size=0x10000) returned 0x27b0780 [0254.883] RtlAllocateHeap (HeapHandle=0x2750000, Flags=0x0, Size=0x10000) returned 0x27c0790 [0254.883] GetLastError () returned 0x0 [0254.884] SetLastError (dwErrCode=0x0) [0254.884] GetLastError () returned 0x0 [0254.885] SetLastError (dwErrCode=0x0) [0254.885] GetProcessHeap () returned 0x8f0000 [0254.885] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40000) returned 0x922e90 [0254.896] GetLastError () returned 0x0 [0254.896] SetLastError (dwErrCode=0x0) [0254.896] GetLastError () returned 0x0 [0254.896] SetLastError (dwErrCode=0x0) [0254.896] GetLastError () returned 0x0 [0254.896] SetLastError (dwErrCode=0x0) [0254.896] GetLastError () returned 0x0 [0254.896] SetLastError (dwErrCode=0x0) [0254.896] GetProcessHeap () returned 0x8f0000 [0254.896] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x962ea0 [0254.897] GetLastError () returned 0x0 [0254.897] SetLastError (dwErrCode=0x0) [0254.897] GetLastError () returned 0x0 [0254.897] SetLastError (dwErrCode=0x0) [0254.897] GetLastError () returned 0x0 [0254.897] SetLastError (dwErrCode=0x0) [0254.897] GetLastError () returned 0x0 [0254.897] SetLastError (dwErrCode=0x0) [0254.897] GetLastError () returned 0x0 [0254.898] SetLastError (dwErrCode=0x0) [0254.898] GetLastError () returned 0x0 [0254.898] SetLastError (dwErrCode=0x0) [0254.898] GetProcessHeap () returned 0x8f0000 [0254.898] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40000) returned 0x96aeb0 [0254.903] GetLastError () returned 0x0 [0254.903] SetLastError (dwErrCode=0x0) [0254.903] GetLastError () returned 0x0 [0254.903] SetLastError (dwErrCode=0x0) [0254.903] GetLastError () returned 0x0 [0254.903] SetLastError (dwErrCode=0x0) [0254.904] GetLastError () returned 0x0 [0254.904] SetLastError (dwErrCode=0x0) [0254.904] GetLastError () returned 0x0 [0254.905] SetLastError (dwErrCode=0x0) [0254.905] GetLastError () returned 0x0 [0254.905] SetLastError (dwErrCode=0x0) [0254.905] GetLastError () returned 0x0 [0254.905] SetLastError (dwErrCode=0x0) [0254.905] GetLastError () returned 0x0 [0254.905] SetLastError (dwErrCode=0x0) [0254.906] GetLastError () returned 0x0 [0254.906] SetLastError (dwErrCode=0x0) [0254.906] GetLastError () returned 0x0 [0254.906] SetLastError (dwErrCode=0x0) [0254.906] GetLastError () returned 0x0 [0254.906] SetLastError (dwErrCode=0x0) [0254.906] GetLastError () returned 0x0 [0254.906] SetLastError (dwErrCode=0x0) [0254.906] GetLastError () returned 0x0 [0254.906] SetLastError (dwErrCode=0x0) [0254.907] GetLastError () returned 0x0 [0254.907] SetLastError (dwErrCode=0x0) [0254.907] GetLastError () returned 0x0 [0254.907] SetLastError (dwErrCode=0x0) [0254.907] GetLastError () returned 0x0 [0254.907] SetLastError (dwErrCode=0x0) [0254.907] GetLastError () returned 0x0 [0254.907] SetLastError (dwErrCode=0x0) [0254.907] GetLastError () returned 0x0 [0254.907] SetLastError (dwErrCode=0x0) [0254.907] GetProcessHeap () returned 0x8f0000 [0254.908] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x9aaec0 [0254.908] GetLastError () returned 0x0 [0254.909] SetLastError (dwErrCode=0x0) [0254.909] GetProcessHeap () returned 0x8f0000 [0254.909] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40000) returned 0x9b2ed0 [0254.910] GetLastError () returned 0x0 [0254.910] SetLastError (dwErrCode=0x0) [0254.910] GetLastError () returned 0x0 [0254.910] SetLastError (dwErrCode=0x0) [0254.910] GetLastError () returned 0x0 [0254.910] SetLastError (dwErrCode=0x0) [0254.911] GetLastError () returned 0x0 [0254.911] SetLastError (dwErrCode=0x0) [0254.911] GetLastError () returned 0x0 [0254.911] SetLastError (dwErrCode=0x0) [0254.911] GetLastError () returned 0x0 [0254.911] SetLastError (dwErrCode=0x0) [0254.911] GetLastError () returned 0x0 [0254.911] SetLastError (dwErrCode=0x0) [0254.911] GetLastError () returned 0x0 [0254.911] SetLastError (dwErrCode=0x0) [0254.911] GetLastError () returned 0x0 [0254.911] SetLastError (dwErrCode=0x0) [0254.912] GetLastError () returned 0x0 [0254.912] SetLastError (dwErrCode=0x0) [0254.912] GetLastError () returned 0x0 [0254.912] SetLastError (dwErrCode=0x0) [0254.912] GetLastError () returned 0x0 [0254.912] SetLastError (dwErrCode=0x0) [0254.912] GetLastError () returned 0x0 [0254.912] SetLastError (dwErrCode=0x0) [0254.912] GetLastError () returned 0x0 [0254.912] SetLastError (dwErrCode=0x0) [0254.913] GetLastError () returned 0x0 [0254.913] SetLastError (dwErrCode=0x0) [0254.913] GetLastError () returned 0x0 [0254.913] SetLastError (dwErrCode=0x0) [0254.913] GetLastError () returned 0x0 [0254.913] SetLastError (dwErrCode=0x0) [0254.913] GetLastError () returned 0x0 [0254.913] SetLastError (dwErrCode=0x0) [0254.913] GetLastError () returned 0x0 [0254.913] SetLastError (dwErrCode=0x0) [0254.914] GetLastError () returned 0x0 [0254.914] SetLastError (dwErrCode=0x0) [0254.914] GetLastError () returned 0x0 [0254.914] SetLastError (dwErrCode=0x0) [0254.914] GetLastError () returned 0x0 [0254.914] SetLastError (dwErrCode=0x0) [0254.914] GetLastError () returned 0x0 [0254.914] SetLastError (dwErrCode=0x0) [0254.914] GetLastError () returned 0x0 [0254.915] SetLastError (dwErrCode=0x0) [0254.915] GetLastError () returned 0x0 [0254.915] SetLastError (dwErrCode=0x0) [0254.915] GetLastError () returned 0x0 [0254.915] SetLastError (dwErrCode=0x0) [0254.915] GetLastError () returned 0x0 [0254.915] SetLastError (dwErrCode=0x0) [0254.916] GetLastError () returned 0x0 [0254.916] SetLastError (dwErrCode=0x0) [0254.916] GetLastError () returned 0x0 [0254.916] SetLastError (dwErrCode=0x0) [0254.916] GetLastError () returned 0x0 [0254.916] SetLastError (dwErrCode=0x0) [0254.916] GetLastError () returned 0x0 [0254.916] SetLastError (dwErrCode=0x0) [0254.917] GetLastError () returned 0x0 [0254.917] SetLastError (dwErrCode=0x0) [0254.917] GetLastError () returned 0x0 [0254.917] SetLastError (dwErrCode=0x0) [0254.917] GetLastError () returned 0x0 [0254.917] SetLastError (dwErrCode=0x0) [0254.917] GetLastError () returned 0x0 [0254.917] SetLastError (dwErrCode=0x0) [0254.917] GetLastError () returned 0x0 [0254.918] SetLastError (dwErrCode=0x0) [0254.918] GetLastError () returned 0x0 [0254.918] SetLastError (dwErrCode=0x0) [0254.918] GetLastError () returned 0x0 [0254.918] SetLastError (dwErrCode=0x0) [0254.918] GetLastError () returned 0x0 [0254.918] SetLastError (dwErrCode=0x0) [0254.918] GetLastError () returned 0x0 [0254.918] SetLastError (dwErrCode=0x0) [0254.918] GetLastError () returned 0x0 [0254.919] SetLastError (dwErrCode=0x0) [0254.919] GetLastError () returned 0x0 [0254.919] SetLastError (dwErrCode=0x0) [0254.919] GetLastError () returned 0x0 [0254.919] SetLastError (dwErrCode=0x0) [0254.919] GetLastError () returned 0x0 [0254.919] SetLastError (dwErrCode=0x0) [0254.919] GetLastError () returned 0x0 [0254.919] SetLastError (dwErrCode=0x0) [0254.919] GetLastError () returned 0x0 [0254.920] SetLastError (dwErrCode=0x0) [0254.920] GetLastError () returned 0x0 [0254.920] SetLastError (dwErrCode=0x0) [0254.920] GetLastError () returned 0x0 [0254.920] SetLastError (dwErrCode=0x0) [0254.920] GetLastError () returned 0x0 [0254.920] SetLastError (dwErrCode=0x0) [0254.920] GetLastError () returned 0x0 [0254.920] SetLastError (dwErrCode=0x0) [0254.921] GetLastError () returned 0x0 [0254.921] SetLastError (dwErrCode=0x0) [0254.921] GetLastError () returned 0x0 [0254.921] SetLastError (dwErrCode=0x0) [0254.921] GetLastError () returned 0x0 [0254.921] SetLastError (dwErrCode=0x0) [0254.921] GetLastError () returned 0x0 [0254.921] SetLastError (dwErrCode=0x0) [0254.921] GetLastError () returned 0x0 [0254.921] SetLastError (dwErrCode=0x0) [0254.922] GetLastError () returned 0x0 [0254.922] SetLastError (dwErrCode=0x0) [0254.922] GetLastError () returned 0x0 [0254.922] SetLastError (dwErrCode=0x0) [0254.922] GetLastError () returned 0x0 [0254.922] SetLastError (dwErrCode=0x0) [0254.922] GetLastError () returned 0x0 [0254.922] SetLastError (dwErrCode=0x0) [0254.922] GetLastError () returned 0x0 [0254.922] SetLastError (dwErrCode=0x0) [0254.923] GetLastError () returned 0x0 [0254.923] SetLastError (dwErrCode=0x0) [0254.923] GetLastError () returned 0x0 [0254.923] SetLastError (dwErrCode=0x0) [0254.923] GetLastError () returned 0x0 [0254.923] SetLastError (dwErrCode=0x0) [0254.923] GetLastError () returned 0x0 [0254.923] SetLastError (dwErrCode=0x0) [0254.923] GetLastError () returned 0x0 [0254.924] SetLastError (dwErrCode=0x0) [0254.924] GetLastError () returned 0x0 [0254.924] SetLastError (dwErrCode=0x0) [0254.924] GetLastError () returned 0x0 [0254.924] SetLastError (dwErrCode=0x0) [0254.924] GetLastError () returned 0x0 [0254.924] SetLastError (dwErrCode=0x0) [0254.924] GetLastError () returned 0x0 [0254.924] SetLastError (dwErrCode=0x0) [0254.924] GetLastError () returned 0x0 [0254.924] SetLastError (dwErrCode=0x0) [0254.925] GetLastError () returned 0x0 [0254.925] SetLastError (dwErrCode=0x0) [0254.925] GetLastError () returned 0x0 [0254.925] SetLastError (dwErrCode=0x0) [0254.925] GetLastError () returned 0x0 [0254.925] SetLastError (dwErrCode=0x0) [0254.925] GetLastError () returned 0x0 [0254.925] SetLastError (dwErrCode=0x0) [0254.925] GetProcessHeap () returned 0x8f0000 [0254.926] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40000) returned 0x9f2ee0 [0254.927] GetLastError () returned 0x0 [0254.927] SetLastError (dwErrCode=0x0) [0254.927] GetLastError () returned 0x0 [0254.927] SetLastError (dwErrCode=0x0) [0254.928] GetLastError () returned 0x0 [0254.928] SetLastError (dwErrCode=0x0) [0254.928] GetLastError () returned 0x0 [0254.928] SetLastError (dwErrCode=0x0) [0254.928] GetLastError () returned 0x0 [0254.928] SetLastError (dwErrCode=0x0) [0254.928] GetLastError () returned 0x0 [0254.928] SetLastError (dwErrCode=0x0) [0254.928] GetLastError () returned 0x0 [0254.928] SetLastError (dwErrCode=0x0) [0254.928] GetLastError () returned 0x0 [0254.929] SetLastError (dwErrCode=0x0) [0254.929] GetLastError () returned 0x0 [0254.929] SetLastError (dwErrCode=0x0) [0254.929] GetLastError () returned 0x0 [0254.929] SetLastError (dwErrCode=0x0) [0254.929] GetLastError () returned 0x0 [0254.929] SetLastError (dwErrCode=0x0) [0254.929] GetLastError () returned 0x0 [0254.929] SetLastError (dwErrCode=0x0) [0254.929] GetLastError () returned 0x0 [0254.930] SetLastError (dwErrCode=0x0) [0254.930] GetLastError () returned 0x0 [0254.930] SetLastError (dwErrCode=0x0) [0254.930] GetLastError () returned 0x0 [0254.930] SetLastError (dwErrCode=0x0) [0254.930] GetLastError () returned 0x0 [0254.930] SetLastError (dwErrCode=0x0) [0254.930] GetLastError () returned 0x0 [0254.930] SetLastError (dwErrCode=0x0) [0254.931] GetLastError () returned 0x0 [0254.931] SetLastError (dwErrCode=0x0) [0254.931] GetLastError () returned 0x0 [0254.931] SetLastError (dwErrCode=0x0) [0254.931] GetLastError () returned 0x0 [0254.931] SetLastError (dwErrCode=0x0) [0254.931] GetLastError () returned 0x0 [0254.931] SetLastError (dwErrCode=0x0) [0254.931] GetLastError () returned 0x0 [0254.931] SetLastError (dwErrCode=0x0) [0254.932] GetLastError () returned 0x0 [0254.932] SetLastError (dwErrCode=0x0) [0254.932] GetLastError () returned 0x0 [0254.932] SetLastError (dwErrCode=0x0) [0254.932] GetLastError () returned 0x0 [0254.932] SetLastError (dwErrCode=0x0) [0254.932] GetLastError () returned 0x0 [0254.932] SetLastError (dwErrCode=0x0) [0254.932] GetLastError () returned 0x0 [0254.932] SetLastError (dwErrCode=0x0) [0254.933] GetLastError () returned 0x0 [0254.933] SetLastError (dwErrCode=0x0) [0254.933] GetLastError () returned 0x0 [0254.933] SetLastError (dwErrCode=0x0) [0254.933] GetLastError () returned 0x0 [0254.933] SetLastError (dwErrCode=0x0) [0254.933] GetLastError () returned 0x0 [0254.933] SetLastError (dwErrCode=0x0) [0254.933] GetLastError () returned 0x0 [0254.933] SetLastError (dwErrCode=0x0) [0254.934] GetLastError () returned 0x0 [0254.934] SetLastError (dwErrCode=0x0) [0254.934] GetLastError () returned 0x0 [0254.934] SetLastError (dwErrCode=0x0) [0254.934] GetLastError () returned 0x0 [0254.934] SetLastError (dwErrCode=0x0) [0254.934] GetLastError () returned 0x0 [0254.934] SetLastError (dwErrCode=0x0) [0254.934] GetLastError () returned 0x0 [0254.935] SetLastError (dwErrCode=0x0) [0254.968] GetProcessHeap () returned 0x8f0000 [0254.968] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xa32ef0 [0254.974] GetLastError () returned 0x0 [0254.974] SetLastError (dwErrCode=0x0) [0254.975] GetLastError () returned 0x0 [0254.978] SetLastError (dwErrCode=0x0) [0254.979] GetLastError () returned 0x0 [0254.981] SetLastError (dwErrCode=0x0) [0254.981] GetLastError () returned 0x0 [0254.983] SetLastError (dwErrCode=0x0) [0254.985] GetLastError () returned 0x0 [0254.986] SetLastError (dwErrCode=0x0) [0254.986] GetProcessHeap () returned 0x8f0000 [0254.986] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xa3af00 [0254.988] GetLastError () returned 0x0 [0254.988] SetLastError (dwErrCode=0x0) [0254.988] GetLastError () returned 0x0 [0254.988] SetLastError (dwErrCode=0x0) [0254.988] GetLastError () returned 0x0 [0254.988] SetLastError (dwErrCode=0x0) [0254.988] GetProcessHeap () returned 0x8f0000 [0254.988] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xa42f10 [0254.989] GetLastError () returned 0x0 [0254.990] SetLastError (dwErrCode=0x0) [0254.990] GetLastError () returned 0x0 [0254.990] SetLastError (dwErrCode=0x0) [0254.990] GetLastError () returned 0x0 [0254.990] SetLastError (dwErrCode=0x0) [0254.990] GetLastError () returned 0x0 [0254.990] SetLastError (dwErrCode=0x0) [0254.990] GetLastError () returned 0x0 [0254.990] SetLastError (dwErrCode=0x0) [0254.991] GetLastError () returned 0x0 [0254.991] SetLastError (dwErrCode=0x0) [0254.991] GetLastError () returned 0x0 [0254.991] SetLastError (dwErrCode=0x0) [0254.991] GetLastError () returned 0x0 [0254.991] SetLastError (dwErrCode=0x0) [0254.991] GetLastError () returned 0x0 [0254.991] SetLastError (dwErrCode=0x0) [0254.991] GetLastError () returned 0x0 [0254.991] SetLastError (dwErrCode=0x0) [0254.991] GetLastError () returned 0x0 [0254.991] SetLastError (dwErrCode=0x0) [0254.992] GetLastError () returned 0x0 [0254.992] SetLastError (dwErrCode=0x0) [0254.992] GetLastError () returned 0x0 [0254.992] SetLastError (dwErrCode=0x0) [0254.992] GetLastError () returned 0x0 [0254.992] SetLastError (dwErrCode=0x0) [0254.992] GetProcessHeap () returned 0x8f0000 [0254.992] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xa4af20 [0254.993] GetLastError () returned 0x0 [0254.993] SetLastError (dwErrCode=0x0) [0254.994] GetLastError () returned 0x0 [0254.994] SetLastError (dwErrCode=0x0) [0254.994] GetLastError () returned 0x0 [0254.994] SetLastError (dwErrCode=0x0) [0254.995] GetLastError () returned 0x0 [0254.995] SetLastError (dwErrCode=0x0) [0254.995] GetLastError () returned 0x0 [0254.995] SetLastError (dwErrCode=0x0) [0254.995] GetProcessHeap () returned 0x8f0000 [0254.995] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xa52f30 [0254.996] GetLastError () returned 0x0 [0254.996] SetLastError (dwErrCode=0x0) [0254.996] GetProcessHeap () returned 0x8f0000 [0254.996] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xa5af40 [0254.997] GetLastError () returned 0x0 [0254.997] SetLastError (dwErrCode=0x0) [0254.998] GetLastError () returned 0x0 [0254.998] SetLastError (dwErrCode=0x0) [0254.998] GetLastError () returned 0x0 [0254.998] SetLastError (dwErrCode=0x0) [0254.998] GetLastError () returned 0x0 [0254.998] SetLastError (dwErrCode=0x0) [0254.998] GetLastError () returned 0x0 [0254.999] SetLastError (dwErrCode=0x0) [0254.999] GetLastError () returned 0x0 [0254.999] SetLastError (dwErrCode=0x0) [0254.999] GetLastError () returned 0x0 [0254.999] SetLastError (dwErrCode=0x0) [0254.999] GetLastError () returned 0x0 [0254.999] SetLastError (dwErrCode=0x0) [0254.999] GetLastError () returned 0x0 [0254.999] SetLastError (dwErrCode=0x0) [0254.999] GetLastError () returned 0x0 [0255.000] SetLastError (dwErrCode=0x0) [0255.000] GetLastError () returned 0x0 [0255.000] SetLastError (dwErrCode=0x0) [0255.000] GetLastError () returned 0x0 [0255.000] SetLastError (dwErrCode=0x0) [0255.000] GetLastError () returned 0x0 [0255.000] SetLastError (dwErrCode=0x0) [0255.001] GetLastError () returned 0x0 [0255.001] SetLastError (dwErrCode=0x0) [0255.001] GetLastError () returned 0x0 [0255.001] SetLastError (dwErrCode=0x0) [0255.001] GetLastError () returned 0x0 [0255.001] SetLastError (dwErrCode=0x0) [0255.001] GetLastError () returned 0x0 [0255.001] SetLastError (dwErrCode=0x0) [0255.002] GetLastError () returned 0x0 [0255.002] SetLastError (dwErrCode=0x0) [0255.002] GetLastError () returned 0x0 [0255.002] SetLastError (dwErrCode=0x0) [0255.002] GetLastError () returned 0x0 [0255.002] SetLastError (dwErrCode=0x0) [0255.002] GetLastError () returned 0x0 [0255.002] SetLastError (dwErrCode=0x0) [0255.002] GetLastError () returned 0x0 [0255.002] SetLastError (dwErrCode=0x0) [0255.002] GetLastError () returned 0x0 [0255.003] SetLastError (dwErrCode=0x0) [0255.003] GetLastError () returned 0x0 [0255.003] SetLastError (dwErrCode=0x0) [0255.003] GetLastError () returned 0x0 [0255.003] SetLastError (dwErrCode=0x0) [0255.003] GetLastError () returned 0x0 [0255.003] SetLastError (dwErrCode=0x0) [0255.003] GetProcessHeap () returned 0x8f0000 [0255.003] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40000) returned 0xa62f50 [0255.005] GetLastError () returned 0x0 [0255.005] SetLastError (dwErrCode=0x0) [0255.005] GetLastError () returned 0x0 [0255.005] SetLastError (dwErrCode=0x0) [0255.005] GetLastError () returned 0x0 [0255.005] SetLastError (dwErrCode=0x0) [0255.005] GetLastError () returned 0x0 [0255.005] SetLastError (dwErrCode=0x0) [0255.005] GetLastError () returned 0x0 [0255.006] SetLastError (dwErrCode=0x0) [0255.006] GetLastError () returned 0x0 [0255.006] SetLastError (dwErrCode=0x0) [0255.006] GetLastError () returned 0x0 [0255.006] SetLastError (dwErrCode=0x0) [0255.006] GetLastError () returned 0x0 [0255.007] SetLastError (dwErrCode=0x0) [0255.007] GetLastError () returned 0x0 [0255.007] SetLastError (dwErrCode=0x0) [0255.007] GetLastError () returned 0x0 [0255.007] SetLastError (dwErrCode=0x0) [0255.007] GetLastError () returned 0x0 [0255.007] SetLastError (dwErrCode=0x0) [0255.007] GetLastError () returned 0x0 [0255.007] SetLastError (dwErrCode=0x0) [0255.007] GetLastError () returned 0x0 [0255.007] SetLastError (dwErrCode=0x0) [0255.008] GetLastError () returned 0x0 [0255.008] SetLastError (dwErrCode=0x0) [0255.008] GetLastError () returned 0x0 [0255.008] SetLastError (dwErrCode=0x0) [0255.008] GetLastError () returned 0x0 [0255.008] SetLastError (dwErrCode=0x0) [0255.008] GetLastError () returned 0x0 [0255.008] SetLastError (dwErrCode=0x0) [0255.008] GetLastError () returned 0x0 [0255.008] SetLastError (dwErrCode=0x0) [0255.009] GetLastError () returned 0x0 [0255.009] SetLastError (dwErrCode=0x0) [0255.009] GetLastError () returned 0x0 [0255.009] SetLastError (dwErrCode=0x0) [0255.009] GetLastError () returned 0x0 [0255.009] SetLastError (dwErrCode=0x0) [0255.009] GetLastError () returned 0x0 [0255.009] SetLastError (dwErrCode=0x0) [0255.011] GetLastError () returned 0x0 [0255.011] SetLastError (dwErrCode=0x0) [0255.011] GetLastError () returned 0x0 [0255.011] SetLastError (dwErrCode=0x0) [0255.011] GetLastError () returned 0x0 [0255.011] SetLastError (dwErrCode=0x0) [0255.011] GetProcessHeap () returned 0x8f0000 [0255.011] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xaa2f60 [0255.012] GetLastError () returned 0x0 [0255.013] SetLastError (dwErrCode=0x0) [0255.013] GetLastError () returned 0x0 [0255.013] SetLastError (dwErrCode=0x0) [0255.013] GetLastError () returned 0x0 [0255.013] SetLastError (dwErrCode=0x0) [0255.013] GetProcessHeap () returned 0x8f0000 [0255.013] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xaaaf70 [0255.014] GetLastError () returned 0x0 [0255.014] SetLastError (dwErrCode=0x0) [0255.014] GetLastError () returned 0x0 [0255.014] SetLastError (dwErrCode=0x0) [0255.014] GetLastError () returned 0x0 [0255.014] SetLastError (dwErrCode=0x0) [0255.015] GetLastError () returned 0x0 [0255.015] SetLastError (dwErrCode=0x0) [0255.015] GetLastError () returned 0x0 [0255.015] SetLastError (dwErrCode=0x0) [0255.015] GetLastError () returned 0x0 [0255.015] SetLastError (dwErrCode=0x0) [0255.015] GetLastError () returned 0x0 [0255.015] SetLastError (dwErrCode=0x0) [0255.015] GetLastError () returned 0x0 [0255.015] SetLastError (dwErrCode=0x0) [0255.016] GetLastError () returned 0x0 [0255.016] SetLastError (dwErrCode=0x0) [0255.016] GetLastError () returned 0x0 [0255.016] SetLastError (dwErrCode=0x0) [0255.016] GetLastError () returned 0x0 [0255.016] SetLastError (dwErrCode=0x0) [0255.016] GetLastError () returned 0x0 [0255.016] SetLastError (dwErrCode=0x0) [0255.017] GetLastError () returned 0x0 [0255.017] SetLastError (dwErrCode=0x0) [0255.017] GetLastError () returned 0x0 [0255.017] SetLastError (dwErrCode=0x0) [0255.017] GetLastError () returned 0x0 [0255.017] SetLastError (dwErrCode=0x0) [0255.017] GetLastError () returned 0x0 [0255.017] SetLastError (dwErrCode=0x0) [0255.017] GetLastError () returned 0x0 [0255.017] SetLastError (dwErrCode=0x0) [0255.017] GetLastError () returned 0x0 [0255.018] SetLastError (dwErrCode=0x0) [0255.018] GetLastError () returned 0x0 [0255.018] SetLastError (dwErrCode=0x0) [0255.018] GetLastError () returned 0x0 [0255.018] SetLastError (dwErrCode=0x0) [0255.018] GetLastError () returned 0x0 [0255.018] SetLastError (dwErrCode=0x0) [0255.018] GetProcessHeap () returned 0x8f0000 [0255.018] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xab2f80 [0255.020] GetLastError () returned 0x0 [0255.020] SetLastError (dwErrCode=0x0) [0255.020] GetLastError () returned 0x0 [0255.020] SetLastError (dwErrCode=0x0) [0255.020] GetLastError () returned 0x0 [0255.020] SetLastError (dwErrCode=0x0) [0255.020] GetLastError () returned 0x0 [0255.020] SetLastError (dwErrCode=0x0) [0255.020] GetLastError () returned 0x0 [0255.021] SetLastError (dwErrCode=0x0) [0255.021] GetLastError () returned 0x0 [0255.021] SetLastError (dwErrCode=0x0) [0255.021] GetLastError () returned 0x0 [0255.021] SetLastError (dwErrCode=0x0) [0255.021] GetLastError () returned 0x0 [0255.021] SetLastError (dwErrCode=0x0) [0255.022] GetLastError () returned 0x0 [0255.022] SetLastError (dwErrCode=0x0) [0255.022] GetLastError () returned 0x0 [0255.022] SetLastError (dwErrCode=0x0) [0255.022] GetLastError () returned 0x0 [0255.022] SetLastError (dwErrCode=0x0) [0255.022] GetLastError () returned 0x0 [0255.022] SetLastError (dwErrCode=0x0) [0255.022] GetLastError () returned 0x0 [0255.022] SetLastError (dwErrCode=0x0) [0255.023] GetLastError () returned 0x0 [0255.023] SetLastError (dwErrCode=0x0) [0255.023] GetLastError () returned 0x0 [0255.023] SetLastError (dwErrCode=0x0) [0255.023] GetLastError () returned 0x0 [0255.023] SetLastError (dwErrCode=0x0) [0255.023] GetLastError () returned 0x0 [0255.024] SetLastError (dwErrCode=0x0) [0255.024] GetLastError () returned 0x0 [0255.024] SetLastError (dwErrCode=0x0) [0255.024] GetLastError () returned 0x0 [0255.024] SetLastError (dwErrCode=0x0) [0255.025] GetLastError () returned 0x0 [0255.025] SetLastError (dwErrCode=0x0) [0255.025] GetLastError () returned 0x0 [0255.025] SetLastError (dwErrCode=0x0) [0255.025] GetLastError () returned 0x0 [0255.025] SetLastError (dwErrCode=0x0) [0255.025] GetLastError () returned 0x0 [0255.025] SetLastError (dwErrCode=0x0) [0255.026] GetLastError () returned 0x0 [0255.026] SetLastError (dwErrCode=0x0) [0255.026] GetLastError () returned 0x0 [0255.026] SetLastError (dwErrCode=0x0) [0255.026] GetLastError () returned 0x0 [0255.026] SetLastError (dwErrCode=0x0) [0255.026] GetLastError () returned 0x0 [0255.026] SetLastError (dwErrCode=0x0) [0255.026] GetLastError () returned 0x0 [0255.027] SetLastError (dwErrCode=0x0) [0255.027] GetLastError () returned 0x0 [0255.027] SetLastError (dwErrCode=0x0) [0255.027] GetLastError () returned 0x0 [0255.027] SetLastError (dwErrCode=0x0) [0255.027] GetLastError () returned 0x0 [0255.027] SetLastError (dwErrCode=0x0) [0255.027] GetLastError () returned 0x0 [0255.027] SetLastError (dwErrCode=0x0) [0255.027] GetLastError () returned 0x0 [0255.028] SetLastError (dwErrCode=0x0) [0255.028] GetLastError () returned 0x0 [0255.028] SetLastError (dwErrCode=0x0) [0255.028] GetLastError () returned 0x0 [0255.028] SetLastError (dwErrCode=0x0) [0255.030] GetLastError () returned 0x0 [0255.030] SetLastError (dwErrCode=0x0) [0255.030] GetLastError () returned 0x0 [0255.030] SetLastError (dwErrCode=0x0) [0255.030] GetLastError () returned 0x0 [0255.030] SetLastError (dwErrCode=0x0) [0255.030] GetLastError () returned 0x0 [0255.031] SetLastError (dwErrCode=0x0) [0255.031] GetLastError () returned 0x0 [0255.031] SetLastError (dwErrCode=0x0) [0255.031] GetLastError () returned 0x0 [0255.031] SetLastError (dwErrCode=0x0) [0255.031] GetLastError () returned 0x0 [0255.031] SetLastError (dwErrCode=0x0) [0255.031] GetProcessHeap () returned 0x8f0000 [0255.031] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40000) returned 0x2410080 [0255.033] GetLastError () returned 0x0 [0255.033] SetLastError (dwErrCode=0x0) [0255.033] GetLastError () returned 0x0 [0255.033] SetLastError (dwErrCode=0x0) [0255.033] GetLastError () returned 0x0 [0255.033] SetLastError (dwErrCode=0x0) [0255.035] GetLastError () returned 0x0 [0255.035] SetLastError (dwErrCode=0x0) [0255.035] GetLastError () returned 0x0 [0255.035] SetLastError (dwErrCode=0x0) [0255.036] GetLastError () returned 0x0 [0255.036] SetLastError (dwErrCode=0x0) [0255.036] GetLastError () returned 0x0 [0255.036] SetLastError (dwErrCode=0x0) [0255.036] GetLastError () returned 0x0 [0255.036] SetLastError (dwErrCode=0x0) [0255.036] GetLastError () returned 0x0 [0255.038] SetLastError (dwErrCode=0x0) [0255.038] GetLastError () returned 0x0 [0255.038] SetLastError (dwErrCode=0x0) [0255.038] GetLastError () returned 0x0 [0255.038] SetLastError (dwErrCode=0x0) [0255.038] GetLastError () returned 0x0 [0255.038] SetLastError (dwErrCode=0x0) [0255.039] GetLastError () returned 0x0 [0255.039] SetLastError (dwErrCode=0x0) [0255.039] GetLastError () returned 0x0 [0255.039] SetLastError (dwErrCode=0x0) [0255.039] GetLastError () returned 0x0 [0255.039] SetLastError (dwErrCode=0x0) [0255.039] GetLastError () returned 0x0 [0255.039] SetLastError (dwErrCode=0x0) [0255.039] GetLastError () returned 0x0 [0255.039] SetLastError (dwErrCode=0x0) [0255.040] GetLastError () returned 0x0 [0255.040] SetLastError (dwErrCode=0x0) [0255.040] GetLastError () returned 0x0 [0255.040] SetLastError (dwErrCode=0x0) [0255.040] GetLastError () returned 0x0 [0255.040] SetLastError (dwErrCode=0x0) [0255.040] GetLastError () returned 0x0 [0255.040] SetLastError (dwErrCode=0x0) [0255.040] GetLastError () returned 0x0 [0255.040] SetLastError (dwErrCode=0x0) [0255.040] GetLastError () returned 0x0 [0255.041] SetLastError (dwErrCode=0x0) [0255.041] GetLastError () returned 0x0 [0255.041] SetLastError (dwErrCode=0x0) [0255.041] GetLastError () returned 0x0 [0255.041] SetLastError (dwErrCode=0x0) [0255.041] GetLastError () returned 0x0 [0255.041] SetLastError (dwErrCode=0x0) [0255.041] GetLastError () returned 0x0 [0255.042] SetLastError (dwErrCode=0x0) [0255.042] GetLastError () returned 0x0 [0255.042] SetLastError (dwErrCode=0x0) [0255.042] GetLastError () returned 0x0 [0255.042] SetLastError (dwErrCode=0x0) [0255.042] GetLastError () returned 0x0 [0255.042] SetLastError (dwErrCode=0x0) [0255.042] GetLastError () returned 0x0 [0255.042] SetLastError (dwErrCode=0x0) [0255.042] GetLastError () returned 0x0 [0255.042] SetLastError (dwErrCode=0x0) [0255.042] GetLastError () returned 0x0 [0255.042] SetLastError (dwErrCode=0x0) [0255.042] GetLastError () returned 0x0 [0255.043] SetLastError (dwErrCode=0x0) [0255.043] GetLastError () returned 0x0 [0255.043] SetLastError (dwErrCode=0x0) [0255.043] GetLastError () returned 0x0 [0255.043] SetLastError (dwErrCode=0x0) [0255.043] GetLastError () returned 0x0 [0255.043] SetLastError (dwErrCode=0x0) [0255.043] GetLastError () returned 0x0 [0255.043] SetLastError (dwErrCode=0x0) [0255.043] GetLastError () returned 0x0 [0255.043] SetLastError (dwErrCode=0x0) [0255.043] GetLastError () returned 0x0 [0255.044] SetLastError (dwErrCode=0x0) [0255.044] GetLastError () returned 0x0 [0255.044] SetLastError (dwErrCode=0x0) [0255.044] GetLastError () returned 0x0 [0255.044] SetLastError (dwErrCode=0x0) [0255.044] GetLastError () returned 0x0 [0255.044] SetLastError (dwErrCode=0x0) [0255.044] GetLastError () returned 0x0 [0255.044] SetLastError (dwErrCode=0x0) [0255.044] GetLastError () returned 0x0 [0255.044] SetLastError (dwErrCode=0x0) [0255.044] GetLastError () returned 0x0 [0255.044] SetLastError (dwErrCode=0x0) [0255.044] GetLastError () returned 0x0 [0255.045] SetLastError (dwErrCode=0x0) [0255.045] GetLastError () returned 0x0 [0255.045] SetLastError (dwErrCode=0x0) [0255.045] GetLastError () returned 0x0 [0255.045] SetLastError (dwErrCode=0x0) [0255.045] GetLastError () returned 0x0 [0255.046] SetLastError (dwErrCode=0x0) [0255.046] GetLastError () returned 0x0 [0255.046] SetLastError (dwErrCode=0x0) [0255.046] GetLastError () returned 0x0 [0255.046] SetLastError (dwErrCode=0x0) [0255.046] GetLastError () returned 0x0 [0255.046] SetLastError (dwErrCode=0x0) [0255.046] GetLastError () returned 0x0 [0255.046] SetLastError (dwErrCode=0x0) [0255.046] GetLastError () returned 0x0 [0255.046] SetLastError (dwErrCode=0x0) [0255.046] GetLastError () returned 0x0 [0255.047] SetLastError (dwErrCode=0x0) [0255.047] GetLastError () returned 0x0 [0255.047] SetLastError (dwErrCode=0x0) [0255.047] GetLastError () returned 0x0 [0255.047] SetLastError (dwErrCode=0x0) [0255.047] GetLastError () returned 0x0 [0255.047] SetLastError (dwErrCode=0x0) [0255.047] GetLastError () returned 0x0 [0255.047] SetLastError (dwErrCode=0x0) [0255.047] GetLastError () returned 0x0 [0255.047] SetLastError (dwErrCode=0x0) [0255.048] GetLastError () returned 0x0 [0255.048] SetLastError (dwErrCode=0x0) [0255.048] GetLastError () returned 0x0 [0255.048] SetLastError (dwErrCode=0x0) [0255.048] GetLastError () returned 0x0 [0255.048] SetLastError (dwErrCode=0x0) [0255.048] GetLastError () returned 0x0 [0255.048] SetLastError (dwErrCode=0x0) [0255.048] GetLastError () returned 0x0 [0255.048] SetLastError (dwErrCode=0x0) [0255.048] GetLastError () returned 0x0 [0255.048] SetLastError (dwErrCode=0x0) [0255.048] GetLastError () returned 0x0 [0255.048] SetLastError (dwErrCode=0x0) [0255.049] GetLastError () returned 0x0 [0255.049] SetLastError (dwErrCode=0x0) [0255.049] GetLastError () returned 0x0 [0255.049] SetLastError (dwErrCode=0x0) [0255.049] GetLastError () returned 0x0 [0255.049] SetLastError (dwErrCode=0x0) [0255.049] GetLastError () returned 0x0 [0255.049] SetLastError (dwErrCode=0x0) [0255.049] GetLastError () returned 0x0 [0255.049] SetLastError (dwErrCode=0x0) [0255.049] GetLastError () returned 0x0 [0255.050] SetLastError (dwErrCode=0x0) [0255.050] GetLastError () returned 0x0 [0255.050] SetLastError (dwErrCode=0x0) [0255.050] GetLastError () returned 0x0 [0255.050] SetLastError (dwErrCode=0x0) [0255.050] GetProcessHeap () returned 0x8f0000 [0255.050] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40000) returned 0x2450090 [0255.051] GetLastError () returned 0x0 [0255.051] SetLastError (dwErrCode=0x0) [0255.051] GetLastError () returned 0x0 [0255.051] SetLastError (dwErrCode=0x0) [0255.052] GetLastError () returned 0x0 [0255.052] SetLastError (dwErrCode=0x0) [0255.052] GetLastError () returned 0x0 [0255.052] SetLastError (dwErrCode=0x0) [0255.052] GetLastError () returned 0x0 [0255.052] SetLastError (dwErrCode=0x0) [0255.052] GetLastError () returned 0x0 [0255.052] SetLastError (dwErrCode=0x0) [0255.052] GetLastError () returned 0x0 [0255.052] SetLastError (dwErrCode=0x0) [0255.052] GetLastError () returned 0x0 [0255.052] SetLastError (dwErrCode=0x0) [0255.052] GetLastError () returned 0x0 [0255.052] SetLastError (dwErrCode=0x0) [0255.053] GetLastError () returned 0x0 [0255.053] SetLastError (dwErrCode=0x0) [0255.053] GetLastError () returned 0x0 [0255.053] SetLastError (dwErrCode=0x0) [0255.053] GetLastError () returned 0x0 [0255.053] SetLastError (dwErrCode=0x0) [0255.053] GetLastError () returned 0x0 [0255.053] SetLastError (dwErrCode=0x0) [0255.053] GetLastError () returned 0x0 [0255.053] SetLastError (dwErrCode=0x0) [0255.053] GetLastError () returned 0x0 [0255.053] SetLastError (dwErrCode=0x0) [0255.053] GetLastError () returned 0x0 [0255.054] SetLastError (dwErrCode=0x0) [0255.054] GetLastError () returned 0x0 [0255.054] SetLastError (dwErrCode=0x0) [0255.054] GetLastError () returned 0x0 [0255.054] SetLastError (dwErrCode=0x0) [0255.054] GetLastError () returned 0x0 [0255.054] SetLastError (dwErrCode=0x0) [0255.054] GetLastError () returned 0x0 [0255.054] SetLastError (dwErrCode=0x0) [0255.054] GetLastError () returned 0x0 [0255.054] SetLastError (dwErrCode=0x0) [0255.054] GetLastError () returned 0x0 [0255.055] SetLastError (dwErrCode=0x0) [0255.055] GetLastError () returned 0x0 [0255.055] SetLastError (dwErrCode=0x0) [0255.055] GetLastError () returned 0x0 [0255.055] SetLastError (dwErrCode=0x0) [0255.055] GetLastError () returned 0x0 [0255.055] SetLastError (dwErrCode=0x0) [0255.055] GetLastError () returned 0x0 [0255.055] SetLastError (dwErrCode=0x0) [0255.055] GetLastError () returned 0x0 [0255.055] SetLastError (dwErrCode=0x0) [0255.055] GetLastError () returned 0x0 [0255.055] SetLastError (dwErrCode=0x0) [0255.068] GetProcessHeap () returned 0x8f0000 [0255.068] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40000) returned 0x24900a0 [0255.072] SetLastError (dwErrCode=0x0) [0255.072] GetLastError () returned 0x0 [0255.072] SetLastError (dwErrCode=0x0) [0255.072] GetLastError () returned 0x0 [0255.072] SetLastError (dwErrCode=0x0) [0255.073] GetLastError () returned 0x0 [0255.073] SetLastError (dwErrCode=0x0) [0255.073] GetLastError () returned 0x0 [0255.073] SetLastError (dwErrCode=0x0) [0255.073] GetLastError () returned 0x0 [0255.073] SetLastError (dwErrCode=0x0) [0255.073] GetLastError () returned 0x0 [0255.073] SetLastError (dwErrCode=0x0) [0255.073] GetLastError () returned 0x0 [0255.073] SetLastError (dwErrCode=0x0) [0255.074] GetLastError () returned 0x0 [0255.074] SetLastError (dwErrCode=0x0) [0255.074] GetLastError () returned 0x0 [0255.074] SetLastError (dwErrCode=0x0) [0255.074] GetLastError () returned 0x0 [0255.074] SetLastError (dwErrCode=0x0) [0255.074] GetLastError () returned 0x0 [0255.074] SetLastError (dwErrCode=0x0) [0255.074] GetLastError () returned 0x0 [0255.075] SetLastError (dwErrCode=0x0) [0255.075] VirtualAlloc (lpAddress=0x0, dwSize=0x3d0900, flAllocationType=0x101000, flProtect=0x40) returned 0x7ff5ffaf0000 [0255.122] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0255.122] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="RtlAddFunctionTable") returned 0x7ffd5054df40 [0255.122] RtlAddFunctionTable (FunctionTable=0x7ff5ffaf0000, EntryCount=0x1, BaseAddress=0x7ff5ffaf0000, TargetGp=0x29b) returned 1 [0255.123] GetCurrentThreadId () returned 0x1160 [0255.196] GetLastError () returned 0x0 [0255.196] SetLastError (dwErrCode=0x0) [0255.196] GetLastError () returned 0x0 [0255.196] SetLastError (dwErrCode=0x0) [0255.196] GetLastError () returned 0x0 [0255.196] SetLastError (dwErrCode=0x0) [0255.196] GetLastError () returned 0x0 [0255.196] SetLastError (dwErrCode=0x0) [0255.196] GetLastError () returned 0x0 [0255.196] SetLastError (dwErrCode=0x0) [0255.196] GetLastError () returned 0x0 [0255.197] SetLastError (dwErrCode=0x0) [0255.197] GetLastError () returned 0x0 [0255.197] SetLastError (dwErrCode=0x0) [0255.197] GetLastError () returned 0x0 [0255.197] SetLastError (dwErrCode=0x0) [0255.197] GetLastError () returned 0x0 [0255.197] SetLastError (dwErrCode=0x0) [0255.197] GetLastError () returned 0x0 [0255.197] SetLastError (dwErrCode=0x0) [0255.197] GetLastError () returned 0x0 [0255.197] SetLastError (dwErrCode=0x0) [0255.198] GetLastError () returned 0x0 [0255.198] SetLastError (dwErrCode=0x0) [0255.198] GetLastError () returned 0x0 [0255.198] GetLastError () returned 0x0 [0255.198] SetLastError (dwErrCode=0x0) [0255.198] SetLastError (dwErrCode=0x0) [0255.198] GetLastError () returned 0x0 [0255.198] SetLastError (dwErrCode=0x0) [0255.198] GetLastError () returned 0x0 [0255.198] SetLastError (dwErrCode=0x0) [0255.198] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff67c4a0000 [0255.199] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff67c4a0000 [0255.199] GetStartupInfoA (in: lpStartupInfo=0x7ff67d0883b0 | out: lpStartupInfo=0x7ff67d0883b0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffffffffffff, hStdOutput=0xffffffffffffffff, hStdError=0xffffffffffffffff)) [0255.199] GetCurrentThreadId () returned 0x1160 [0255.199] GetLastError () returned 0x0 [0255.199] LocalAlloc (uFlags=0x40, uBytes=0x12c9) returned 0x24d00b0 [0255.199] SetLastError (dwErrCode=0x0) [0255.199] GetLastError () returned 0x0 [0255.199] SetLastError (dwErrCode=0x0) [0255.200] GetLastError () returned 0x0 [0255.200] SetLastError (dwErrCode=0x0) [0255.200] GetLastError () returned 0x0 [0255.200] SetLastError (dwErrCode=0x0) [0255.200] GetLastError () returned 0x0 [0255.200] SetLastError (dwErrCode=0x0) [0255.200] GetLastError () returned 0x0 [0255.200] SetLastError (dwErrCode=0x0) [0255.200] GetLastError () returned 0x0 [0255.200] SetLastError (dwErrCode=0x0) [0255.200] GetLastError () returned 0x0 [0255.200] SetLastError (dwErrCode=0x0) [0255.200] GetLastError () returned 0x0 [0255.200] SetLastError (dwErrCode=0x0) [0255.200] GetLastError () returned 0x0 [0255.200] SetLastError (dwErrCode=0x0) [0255.201] GetLastError () returned 0x0 [0255.201] SetLastError (dwErrCode=0x0) [0255.201] GetLastError () returned 0x0 [0255.201] SetLastError (dwErrCode=0x0) [0255.201] GetLastError () returned 0x0 [0255.201] SetLastError (dwErrCode=0x0) [0255.201] GetLastError () returned 0x0 [0255.201] SetLastError (dwErrCode=0x0) [0255.201] GetLastError () returned 0x0 [0255.201] SetLastError (dwErrCode=0x0) [0255.201] GetLastError () returned 0x0 [0255.201] SetLastError (dwErrCode=0x0) [0255.201] GetLastError () returned 0x0 [0255.202] SetLastError (dwErrCode=0x0) [0255.202] GetLastError () returned 0x0 [0255.202] SetLastError (dwErrCode=0x0) [0255.202] GetLastError () returned 0x0 [0255.202] SetLastError (dwErrCode=0x0) [0255.202] GetLastError () returned 0x0 [0255.202] SetLastError (dwErrCode=0x0) [0255.202] GetLastError () returned 0x0 [0255.202] SetLastError (dwErrCode=0x0) [0255.202] GetLastError () returned 0x0 [0255.202] SetLastError (dwErrCode=0x0) [0255.202] GetLastError () returned 0x0 [0255.203] SetLastError (dwErrCode=0x0) [0255.203] GetLastError () returned 0x0 [0255.203] SetLastError (dwErrCode=0x0) [0255.203] GetLastError () returned 0x0 [0255.203] SetLastError (dwErrCode=0x0) [0255.203] GetLastError () returned 0x0 [0255.204] SetLastError (dwErrCode=0x0) [0255.204] GetLastError () returned 0x0 [0255.207] SetLastError (dwErrCode=0x0) [0255.207] SysReAllocStringLen (in: pbstr=0x7ff67cf498f0*=0x0, psz="enigma_ide64.dll", len=0x10 | out: pbstr=0x7ff67cf498f0*="enigma_ide64.dll") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56df0*=0x0, psz="%DEFAULT FOLDER%", len=0x10 | out: pbstr=0x7ff67cf56df0*="%DEFAULT FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56df8*=0x0, psz="%SYSTEM FOLDER%", len=0xf | out: pbstr=0x7ff67cf56df8*="%SYSTEM FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56e00*=0x0, psz="%WINDOWS FOLDER%", len=0x10 | out: pbstr=0x7ff67cf56e00*="%WINDOWS FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56e08*=0x0, psz="%My Documents FOLDER%", len=0x15 | out: pbstr=0x7ff67cf56e08*="%My Documents FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56e10*=0x0, psz="%Program Files FOLDER%", len=0x16 | out: pbstr=0x7ff67cf56e10*="%Program Files FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56e18*=0x0, psz="%Program Files, Common FOLDER%", len=0x1e | out: pbstr=0x7ff67cf56e18*="%Program Files, Common FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56e20*=0x0, psz="%AllUsers, Documents FOLDER%", len=0x1c | out: pbstr=0x7ff67cf56e20*="%AllUsers, Documents FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56e28*=0x0, psz="%My Pictures FOLDER%", len=0x14 | out: pbstr=0x7ff67cf56e28*="%My Pictures FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56e30*=0x0, psz="%History FOLDER%", len=0x10 | out: pbstr=0x7ff67cf56e30*="%History FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56e38*=0x0, psz="%Cookies FOLDER%", len=0x10 | out: pbstr=0x7ff67cf56e38*="%Cookies FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56e40*=0x0, psz="%InternetCache FOLDER%", len=0x16 | out: pbstr=0x7ff67cf56e40*="%InternetCache FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56e48*=0x0, psz="%ApplicationData FOLDER%", len=0x18 | out: pbstr=0x7ff67cf56e48*="%ApplicationData FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56e50*=0x0, psz="%Temp FOLDER%", len=0xd | out: pbstr=0x7ff67cf56e50*="%Temp FOLDER%") returned 1 [0255.208] SysReAllocStringLen (in: pbstr=0x7ff67cf56e58*=0x0, psz="%AllUsers, ApplicationData FOLDER%", len=0x22 | out: pbstr=0x7ff67cf56e58*="%AllUsers, ApplicationData FOLDER%") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf56e60*=0x0, psz="%Local, ApplicationData FOLDER%", len=0x1f | out: pbstr=0x7ff67cf56e60*="%Local, ApplicationData FOLDER%") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf56e68*=0x0, psz="%SYSTEM DRIVE%", len=0xe | out: pbstr=0x7ff67cf56e68*="%SYSTEM DRIVE%") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf56e70*=0x0, psz="%UserProfile FOLDER%", len=0x14 | out: pbstr=0x7ff67cf56e70*="%UserProfile FOLDER%") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf62a30*=0x0, psz="MICROSOFTEDGE", len=0xd | out: pbstr=0x7ff67cf62a30*="MICROSOFTEDGE") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf7a600*=0x0, psz="LAZ_PIC_DIALOG_TEMPLATE", len=0x17 | out: pbstr=0x7ff67cf7a600*="LAZ_PIC_DIALOG_TEMPLATE") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf57000*=0x0, psz="hh.exe", len=0x6 | out: pbstr=0x7ff67cf57000*="hh.exe") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf57008*=0x0, psz="write.exe", len=0x9 | out: pbstr=0x7ff67cf57008*="write.exe") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf57010*=0x0, psz="attrib.exe", len=0xa | out: pbstr=0x7ff67cf57010*="attrib.exe") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf57018*=0x0, psz="chkdsk.exe", len=0xa | out: pbstr=0x7ff67cf57018*="chkdsk.exe") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf57020*=0x0, psz="compact.exe", len=0xb | out: pbstr=0x7ff67cf57020*="compact.exe") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf57028*=0x0, psz="find.exe", len=0x8 | out: pbstr=0x7ff67cf57028*="find.exe") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf57030*=0x0, psz="help.exe", len=0x8 | out: pbstr=0x7ff67cf57030*="help.exe") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf57038*=0x0, psz="winver.exe", len=0xa | out: pbstr=0x7ff67cf57038*="winver.exe") returned 1 [0255.209] SysReAllocStringLen (in: pbstr=0x7ff67cf57040*=0x0, psz="regsvr32.exe", len=0xc | out: pbstr=0x7ff67cf57040*="regsvr32.exe") returned 1 [0255.210] SysReAllocStringLen (in: pbstr=0x7ff67cf57048*=0x0, psz="replace.exe", len=0xb | out: pbstr=0x7ff67cf57048*="replace.exe") returned 1 [0255.210] SysReAllocStringLen (in: pbstr=0x7ff67cf57050*=0x0, psz="dllhost.exe", len=0xb | out: pbstr=0x7ff67cf57050*="dllhost.exe") returned 1 [0255.210] SysReAllocStringLen (in: pbstr=0x7ff67cf57058*=0x0, psz="ntvdm.exe", len=0x9 | out: pbstr=0x7ff67cf57058*="ntvdm.exe") returned 1 [0255.210] SysReAllocStringLen (in: pbstr=0x7ff67cf57060*=0x0, psz="tcpsvcs.exe", len=0xb | out: pbstr=0x7ff67cf57060*="tcpsvcs.exe") returned 1 [0255.210] GetACP () returned 0x4e4 [0255.210] GetStdHandle (nStdHandle=0xfffffff6) returned 0x20 [0255.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x24 [0255.210] GetStdHandle (nStdHandle=0xfffffff4) returned 0x28 [0255.210] GetLastError () returned 0x0 [0255.210] SetLastError (dwErrCode=0x0) [0255.210] GetConsoleCP () returned 0x1b5 [0255.211] GetLastError () returned 0x0 [0255.211] SetLastError (dwErrCode=0x0) [0255.211] GetConsoleOutputCP () returned 0x1b5 [0255.212] GetLastError () returned 0x0 [0255.212] SetLastError (dwErrCode=0x0) [0255.212] GetConsoleOutputCP () returned 0x1b5 [0255.213] GetLastError () returned 0x0 [0255.213] SetLastError (dwErrCode=0x0) [0255.213] GetConsoleOutputCP () returned 0x1b5 [0255.213] GetLastError () returned 0x0 [0255.213] SetLastError (dwErrCode=0x0) [0255.213] GetConsoleOutputCP () returned 0x1b5 [0255.214] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x7ffc38, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe")) returned 0x32 [0255.214] GetLastError () returned 0x0 [0255.214] SetLastError (dwErrCode=0x0) [0255.214] GetProcessHeap () returned 0x8f0000 [0255.214] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xabaf90 [0255.215] GetLastError () returned 0x0 [0255.215] SetLastError (dwErrCode=0x0) [0255.215] GetProcessHeap () returned 0x8f0000 [0255.215] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xac2fa0 [0255.217] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe\" " [0255.217] GetLastError () returned 0x0 [0255.217] SetLastError (dwErrCode=0x0) [0255.217] GetCurrentProcessId () returned 0x115c [0255.217] GetLastError () returned 0x0 [0255.217] SetLastError (dwErrCode=0x0) [0255.217] GetLastError () returned 0x0 [0255.217] SetLastError (dwErrCode=0x0) [0255.217] GetUserDefaultLCID () returned 0x409 [0255.217] SetThreadLocale (Locale=0x409) returned 1 [0255.217] GetSystemMetrics (nIndex=42) returned 0 [0255.218] GetSystemMetrics (nIndex=74) returned 0 [0255.218] GetThreadLocale () returned 0x409 [0255.218] GetThreadLocale () returned 0x409 [0255.218] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Jan") returned 4 [0255.218] GetLastError () returned 0x0 [0255.218] SetLastError (dwErrCode=0x0) [0255.218] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="January") returned 8 [0255.218] GetLastError () returned 0x0 [0255.218] SetLastError (dwErrCode=0x0) [0255.218] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Feb") returned 4 [0255.218] GetLastError () returned 0x0 [0255.218] SetLastError (dwErrCode=0x0) [0255.218] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="February") returned 9 [0255.218] GetLastError () returned 0x0 [0255.218] SetLastError (dwErrCode=0x0) [0255.219] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Mar") returned 4 [0255.219] GetLastError () returned 0x0 [0255.219] SetLastError (dwErrCode=0x0) [0255.219] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="March") returned 6 [0255.219] GetLastError () returned 0x0 [0255.219] SetLastError (dwErrCode=0x0) [0255.219] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Apr") returned 4 [0255.219] GetLastError () returned 0x0 [0255.219] SetLastError (dwErrCode=0x0) [0255.219] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="April") returned 6 [0255.220] GetLastError () returned 0x0 [0255.220] SetLastError (dwErrCode=0x0) [0255.220] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="May") returned 4 [0255.220] GetLastError () returned 0x0 [0255.220] SetLastError (dwErrCode=0x0) [0255.220] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="May") returned 4 [0255.220] GetLastError () returned 0x0 [0255.220] SetLastError (dwErrCode=0x0) [0255.220] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Jun") returned 4 [0255.220] GetLastError () returned 0x0 [0255.220] SetLastError (dwErrCode=0x0) [0255.220] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="June") returned 5 [0255.220] GetLastError () returned 0x0 [0255.220] SetLastError (dwErrCode=0x0) [0255.220] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Jul") returned 4 [0255.220] GetLastError () returned 0x0 [0255.221] SetLastError (dwErrCode=0x0) [0255.221] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="July") returned 5 [0255.221] GetLastError () returned 0x0 [0255.221] SetLastError (dwErrCode=0x0) [0255.221] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Aug") returned 4 [0255.221] GetLastError () returned 0x0 [0255.221] SetLastError (dwErrCode=0x0) [0255.221] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="August") returned 7 [0255.221] GetLastError () returned 0x0 [0255.221] SetLastError (dwErrCode=0x0) [0255.222] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Sep") returned 4 [0255.222] GetLastError () returned 0x0 [0255.222] SetLastError (dwErrCode=0x0) [0255.222] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="September") returned 10 [0255.222] GetLastError () returned 0x0 [0255.222] SetLastError (dwErrCode=0x0) [0255.222] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Oct") returned 4 [0255.222] GetLastError () returned 0x0 [0255.222] SetLastError (dwErrCode=0x0) [0255.222] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="October") returned 8 [0255.222] GetLastError () returned 0x0 [0255.222] SetLastError (dwErrCode=0x0) [0255.222] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Nov") returned 4 [0255.223] GetLastError () returned 0x0 [0255.223] SetLastError (dwErrCode=0x0) [0255.223] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="November") returned 9 [0255.223] GetLastError () returned 0x0 [0255.223] SetLastError (dwErrCode=0x0) [0255.223] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Dec") returned 4 [0255.223] GetLastError () returned 0x0 [0255.223] SetLastError (dwErrCode=0x0) [0255.223] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="December") returned 9 [0255.223] GetLastError () returned 0x0 [0255.224] SetLastError (dwErrCode=0x0) [0255.224] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Sun") returned 4 [0255.224] GetLastError () returned 0x0 [0255.224] SetLastError (dwErrCode=0x0) [0255.224] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Sunday") returned 7 [0255.224] GetLastError () returned 0x0 [0255.224] SetLastError (dwErrCode=0x0) [0255.224] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Mon") returned 4 [0255.224] GetLastError () returned 0x0 [0255.224] SetLastError (dwErrCode=0x0) [0255.224] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Monday") returned 7 [0255.225] GetLastError () returned 0x0 [0255.225] SetLastError (dwErrCode=0x0) [0255.225] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Tue") returned 4 [0255.225] GetLastError () returned 0x0 [0255.225] SetLastError (dwErrCode=0x0) [0255.225] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Tuesday") returned 8 [0255.225] GetLastError () returned 0x0 [0255.225] SetLastError (dwErrCode=0x0) [0255.225] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Wed") returned 4 [0255.225] GetLastError () returned 0x0 [0255.225] SetLastError (dwErrCode=0x0) [0255.225] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Wednesday") returned 10 [0255.225] GetLastError () returned 0x0 [0255.225] SetLastError (dwErrCode=0x0) [0255.225] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Thu") returned 4 [0255.225] GetLastError () returned 0x0 [0255.226] SetLastError (dwErrCode=0x0) [0255.226] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Thursday") returned 9 [0255.226] GetLastError () returned 0x0 [0255.226] SetLastError (dwErrCode=0x0) [0255.226] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Fri") returned 4 [0255.226] GetLastError () returned 0x0 [0255.226] SetLastError (dwErrCode=0x0) [0255.226] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Friday") returned 7 [0255.226] GetLastError () returned 0x0 [0255.226] SetLastError (dwErrCode=0x0) [0255.226] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Sat") returned 4 [0255.226] GetLastError () returned 0x0 [0255.226] SetLastError (dwErrCode=0x0) [0255.226] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="Saturday") returned 9 [0255.226] GetLastError () returned 0x0 [0255.227] SetLastError (dwErrCode=0x0) [0255.227] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ffaa0, cchData=4 | out: lpLCData="/") returned 2 [0255.227] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0255.227] GetLastError () returned 0x0 [0255.227] SetLastError (dwErrCode=0x0) [0255.227] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0255.227] GetLastError () returned 0x0 [0255.227] SetLastError (dwErrCode=0x0) [0255.227] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ffaa0, cchData=4 | out: lpLCData=":") returned 2 [0255.227] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="AM") returned 3 [0255.227] GetLastError () returned 0x0 [0255.227] SetLastError (dwErrCode=0x0) [0255.227] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="PM") returned 3 [0255.227] GetLastError () returned 0x0 [0255.227] SetLastError (dwErrCode=0x0) [0255.228] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="0") returned 2 [0255.228] GetLastError () returned 0x0 [0255.228] SetLastError (dwErrCode=0x0) [0255.228] GetLastError () returned 0x0 [0255.228] SetLastError (dwErrCode=0x0) [0255.228] GetLastError () returned 0x0 [0255.228] SetLastError (dwErrCode=0x0) [0255.228] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="$") returned 2 [0255.229] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="0") returned 2 [0255.229] GetLastError () returned 0x0 [0255.229] SetLastError (dwErrCode=0x0) [0255.229] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="0") returned 2 [0255.229] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x7ffaa0, cchData=4 | out: lpLCData=",") returned 2 [0255.229] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x7ffaa0, cchData=4 | out: lpLCData=".") returned 2 [0255.229] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x7ff9a0, cchData=256 | out: lpLCData="2") returned 2 [0255.229] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x7ffaa0, cchData=4 | out: lpLCData=",") returned 2 [0255.229] GetLastError () returned 0x0 [0255.229] SetLastError (dwErrCode=0x0) [0255.229] GetVersionExA (in: lpVersionInformation=0x7ffce0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x6e, dwBuildNumber=0x0, dwPlatformId=0x6, szCSDVersion="") | out: lpVersionInformation=0x7ffce0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.230] GetModuleHandleA (lpModuleName="kernel32") returned 0x7ffd4e1c0000 [0255.230] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetDiskFreeSpaceExA") returned 0x7ffd4e1ed9f0 [0255.230] GetLastError () returned 0x0 [0255.230] SetLastError (dwErrCode=0x0) [0255.230] GetProcessHeap () returned 0x8f0000 [0255.230] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xacafb0 [0255.231] GetWindowsDirectoryA (in: lpBuffer=0xacb008, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0255.231] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x170 [0255.231] GetCurrentThreadId () returned 0x1160 [0255.231] GetLastError () returned 0x0 [0255.231] SetLastError (dwErrCode=0x0) [0255.231] GetLastError () returned 0x0 [0255.232] SetLastError (dwErrCode=0x0) [0255.232] GetLastError () returned 0x0 [0255.232] SetLastError (dwErrCode=0x0) [0255.232] GetProcessHeap () returned 0x8f0000 [0255.232] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xad2fc0 [0255.233] GetSystemInfo (in: lpSystemInfo=0x7ffd10 | out: lpSystemInfo=0x7ffd10*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0255.233] GetLastError () returned 0x0 [0255.233] SetLastError (dwErrCode=0x0) [0255.233] GetLastError () returned 0x0 [0255.233] SetLastError (dwErrCode=0x0) [0255.233] GetLastError () returned 0x0 [0255.233] SetLastError (dwErrCode=0x0) [0255.235] GetLastError () returned 0x0 [0255.235] SetLastError (dwErrCode=0x0) [0255.235] GetLastError () returned 0x0 [0255.235] SetLastError (dwErrCode=0x0) [0255.235] GetLastError () returned 0x0 [0255.235] SetLastError (dwErrCode=0x0) [0255.235] GetLastError () returned 0x0 [0255.235] SetLastError (dwErrCode=0x0) [0255.235] GetProcessHeap () returned 0x8f0000 [0255.235] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0xadafd0 [0255.236] GetLastError () returned 0x0 [0255.236] SetLastError (dwErrCode=0x0) [0255.236] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x174 [0255.236] ResetEvent (hEvent=0x174) returned 1 [0255.236] GetLastError () returned 0x0 [0255.237] SetLastError (dwErrCode=0x0) [0255.237] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x178 [0255.237] GetLastError () returned 0x0 [0255.237] SetLastError (dwErrCode=0x0) [0255.237] GetLastError () returned 0x0 [0255.237] SetLastError (dwErrCode=0x0) [0255.237] GetLastError () returned 0x0 [0255.237] SetLastError (dwErrCode=0x0) [0255.237] GetLastError () returned 0x0 [0255.237] SetLastError (dwErrCode=0x0) [0255.237] GetLastError () returned 0x0 [0255.237] SetLastError (dwErrCode=0x0) [0255.238] GetLastError () returned 0x0 [0255.238] SetLastError (dwErrCode=0x0) [0255.238] GetLastError () returned 0x0 [0255.238] SetLastError (dwErrCode=0x0) [0255.238] GetLastError () returned 0x0 [0255.238] SetLastError (dwErrCode=0x0) [0255.238] GetProcessHeap () returned 0x8f0000 [0255.238] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x24d2bb0 [0255.239] GetLastError () returned 0x0 [0255.239] SetLastError (dwErrCode=0x0) [0255.240] GetLastError () returned 0x0 [0255.240] SetLastError (dwErrCode=0x0) [0255.240] GetProcessHeap () returned 0x8f0000 [0255.240] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40000) returned 0x27e0080 [0255.241] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x7ffd50380000 [0255.242] GetProcAddress (hModule=0x7ffd50380000, lpProcName="CoCreateInstanceEx") returned 0x7ffd4dca82a0 [0255.243] GetProcAddress (hModule=0x7ffd50380000, lpProcName="CoInitializeEx") returned 0x7ffd4dcd2c50 [0255.243] GetProcAddress (hModule=0x7ffd50380000, lpProcName="CoAddRefServerProcess") returned 0x7ffd4dc9e660 [0255.243] GetProcAddress (hModule=0x7ffd50380000, lpProcName="CoReleaseServerProcess") returned 0x7ffd4dd33130 [0255.243] GetProcAddress (hModule=0x7ffd50380000, lpProcName="CoResumeClassObjects") returned 0x7ffd4dd3f990 [0255.244] GetProcAddress (hModule=0x7ffd50380000, lpProcName="CoSuspendClassObjects") returned 0x7ffd4dd3fe90 [0255.244] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0255.244] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x160000 [0255.244] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.244] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetProcAddress") returned 0x7ffd4e1e0b80 [0255.244] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwClose") returned 0x7ffd50574f20 [0255.245] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetInformationFile") returned 0x7ffd50575220 [0255.245] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryInformationFile") returned 0x7ffd50574f60 [0255.245] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwReadFile") returned 0x7ffd50574e00 [0255.245] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateFile") returned 0x7ffd505757e0 [0255.245] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenFile") returned 0x7ffd505753a0 [0255.245] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryAttributesFile") returned 0x7ffd505754e0 [0255.245] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateSection") returned 0x7ffd50575680 [0255.245] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwMapViewOfSection") returned 0x7ffd50575240 [0255.246] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQuerySection") returned 0x7ffd50575760 [0255.246] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnmapViewOfSection") returned 0x7ffd50575280 [0255.246] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryFullAttributesFile") returned 0x7ffd50577350 [0255.246] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwWriteFile") returned 0x7ffd50574e40 [0255.246] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryObject") returned 0x7ffd50574f40 [0255.246] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryDirectoryFile") returned 0x7ffd505753e0 [0255.246] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenSection") returned 0x7ffd50575420 [0255.246] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDuplicateObject") returned 0x7ffd505754c0 [0255.246] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryVolumeInformationFile") returned 0x7ffd50575660 [0255.247] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeleteFile") returned 0x7ffd505765d0 [0255.247] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwLockFile") returned 0x7ffd50576cb0 [0255.247] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnlockFile") returned 0x7ffd50578330 [0255.247] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwTerminateProcess") returned 0x7ffd505752c0 [0255.247] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenKey") returned 0x7ffd50574f80 [0255.247] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwEnumerateValueKey") returned 0x7ffd50574fa0 [0255.247] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryKey") returned 0x7ffd50575000 [0255.248] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryValueKey") returned 0x7ffd50575020 [0255.248] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateKey") returned 0x7ffd505750e0 [0255.249] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwEnumerateKey") returned 0x7ffd50575380 [0255.249] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetValueKey") returned 0x7ffd50575930 [0255.249] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeleteKey") returned 0x7ffd505765f0 [0255.251] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeleteValueKey") returned 0x7ffd50576650 [0255.251] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFlushKey") returned 0x7ffd50576890 [0255.252] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwLoadKey") returned 0x7ffd50576c50 [0255.252] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwLoadKey2") returned 0x7ffd50576c70 [0255.252] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwNotifyChangeKey") returned 0x7ffd50576e30 [0255.252] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryMultipleValueKey") returned 0x7ffd505774f0 [0255.252] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwReplaceKey") returned 0x7ffd505778d0 [0255.252] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwRestoreKey") returned 0x7ffd50577990 [0255.252] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSaveKey") returned 0x7ffd50577a70 [0255.253] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetInformationKey") returned 0x7ffd50577d10 [0255.253] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnloadKey") returned 0x7ffd505782d0 [0255.253] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwAccessCheck") returned 0x7ffd50574d40 [0255.254] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwExtendSection") returned 0x7ffd505767b0 [0255.254] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFlushBuffersFile") returned 0x7ffd505756a0 [0255.254] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFsControlFile") returned 0x7ffd50575460 [0255.254] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwNotifyChangeDirectoryFile") returned 0x7ffd50576e10 [0255.254] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQuerySecurityObject") returned 0x7ffd505775d0 [0255.254] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetSecurityObject") returned 0x7ffd50577ef0 [0255.255] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetVolumeInformationFile") returned 0x7ffd50578050 [0255.255] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenKeyEx") returned 0x7ffd50576f10 [0255.255] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateProcess") returned 0x7ffd505762f0 [0255.255] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateProcessEx") returned 0x7ffd505756e0 [0255.255] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateUserProcess") returned 0x7ffd50576490 [0255.256] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwResumeThread") returned 0x7ffd50575780 [0255.256] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateThread") returned 0x7ffd50575700 [0255.256] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryInformationProcess") returned 0x7ffd50575060 [0255.256] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryVirtualMemory") returned 0x7ffd505751a0 [0255.256] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeviceIoControlFile") returned 0x7ffd50574e20 [0255.256] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnmapViewOfSectionEx") returned 0x7ffd50578370 [0255.256] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryDirectoryFileEx") returned 0x0 [0255.257] VirtualFree (lpAddress=0x160000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.259] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0255.259] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwProtectVirtualMemory") returned 0x7ffd50575740 [0255.259] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0255.259] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwClose") returned 0x7ffd50574f20 [0255.259] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0255.260] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryInformationFile") returned 0x7ffd50574f60 [0255.260] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0255.260] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetInformationFile") returned 0x7ffd50575220 [0255.260] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0255.260] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFlushBuffersFile") returned 0x7ffd505756a0 [0255.260] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0255.260] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateFile") returned 0x7ffd505757e0 [0255.261] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0255.261] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwWriteFile") returned 0x7ffd50574e40 [0255.261] LoadLibraryA (lpLibFileName="SHFolder.dll") returned 0x7ffd45f80000 [0255.385] GetProcAddress (hModule=0x7ffd45f80000, lpProcName="SHGetFolderPathA") returned 0x7ffd45f81010 [0255.385] GetProcAddress (hModule=0x7ffd45f80000, lpProcName="SHGetFolderPathW") returned 0x7ffd45f819a0 [0255.385] GetTickCount () returned 0xb83346 [0255.386] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x1000, flProtect=0x1) returned 0x170000 [0255.386] GetTickCount () returned 0xb83346 [0255.386] GetLastError () returned 0x7f [0255.386] SetLastError (dwErrCode=0x7f) [0255.386] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ffb08, nSize=0x208 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe")) returned 0x32 [0255.386] GetLastError () returned 0x0 [0255.386] SetLastError (dwErrCode=0x0) [0255.386] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe\" " [0255.387] GetLastError () returned 0x0 [0255.387] SetLastError (dwErrCode=0x0) [0255.387] GetLastError () returned 0x0 [0255.387] SetLastError (dwErrCode=0x0) [0255.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0255.387] GetLastError () returned 0x0 [0255.387] SetLastError (dwErrCode=0x0) [0255.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", cchWideChar=50, lpMultiByteStr=0xabb168, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", lpUsedDefaultChar=0x0) returned 50 [0255.387] GetThreadLocale () returned 0x409 [0255.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Jan") returned 4 [0255.387] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jan", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.387] GetLastError () returned 0x0 [0255.388] SetLastError (dwErrCode=0x0) [0255.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jan", cchWideChar=3, lpMultiByteStr=0xac3db8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jan", lpUsedDefaultChar=0x0) returned 3 [0255.388] GetLastError () returned 0x0 [0255.388] SetLastError (dwErrCode=0x0) [0255.388] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x7ff988, cchData=512 | out: lpLCData="January") returned 8 [0255.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="January", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.388] GetLastError () returned 0x0 [0255.388] SetLastError (dwErrCode=0x0) [0255.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="January", cchWideChar=7, lpMultiByteStr=0xac30b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="January", lpUsedDefaultChar=0x0) returned 7 [0255.388] GetLastError () returned 0x0 [0255.388] SetLastError (dwErrCode=0x0) [0255.388] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Feb") returned 4 [0255.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Feb", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.388] GetLastError () returned 0x0 [0255.388] SetLastError (dwErrCode=0x0) [0255.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Feb", cchWideChar=3, lpMultiByteStr=0xac30f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Feb", lpUsedDefaultChar=0x0) returned 3 [0255.388] GetLastError () returned 0x0 [0255.388] SetLastError (dwErrCode=0x0) [0255.388] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x7ff988, cchData=512 | out: lpLCData="February") returned 9 [0255.388] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="February", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.388] GetLastError () returned 0x0 [0255.388] SetLastError (dwErrCode=0x0) [0255.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="February", cchWideChar=8, lpMultiByteStr=0xac3138, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="February", lpUsedDefaultChar=0x0) returned 8 [0255.389] GetLastError () returned 0x0 [0255.389] SetLastError (dwErrCode=0x0) [0255.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Mar") returned 4 [0255.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mar", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.389] GetLastError () returned 0x0 [0255.389] SetLastError (dwErrCode=0x0) [0255.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mar", cchWideChar=3, lpMultiByteStr=0xac3178, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mar", lpUsedDefaultChar=0x0) returned 3 [0255.389] GetLastError () returned 0x0 [0255.389] SetLastError (dwErrCode=0x0) [0255.389] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x7ff988, cchData=512 | out: lpLCData="March") returned 6 [0255.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="March", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.389] GetLastError () returned 0x0 [0255.389] SetLastError (dwErrCode=0x0) [0255.389] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="March", cchWideChar=5, lpMultiByteStr=0xac31b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="March", lpUsedDefaultChar=0x0) returned 5 [0255.389] GetLastError () returned 0x0 [0255.390] SetLastError (dwErrCode=0x0) [0255.390] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Apr") returned 4 [0255.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Apr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.390] GetLastError () returned 0x0 [0255.390] SetLastError (dwErrCode=0x0) [0255.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Apr", cchWideChar=3, lpMultiByteStr=0xac31f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Apr", lpUsedDefaultChar=0x0) returned 3 [0255.390] GetLastError () returned 0x0 [0255.390] SetLastError (dwErrCode=0x0) [0255.390] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x7ff988, cchData=512 | out: lpLCData="April") returned 6 [0255.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="April", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0255.390] GetLastError () returned 0x0 [0255.390] SetLastError (dwErrCode=0x0) [0255.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="April", cchWideChar=5, lpMultiByteStr=0xac3238, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="April", lpUsedDefaultChar=0x0) returned 5 [0255.390] GetLastError () returned 0x0 [0255.390] SetLastError (dwErrCode=0x0) [0255.390] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x7ff988, cchData=512 | out: lpLCData="May") returned 4 [0255.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="May", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.390] GetLastError () returned 0x0 [0255.390] SetLastError (dwErrCode=0x0) [0255.390] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="May", cchWideChar=3, lpMultiByteStr=0xac3278, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 3 [0255.391] GetLastError () returned 0x0 [0255.391] SetLastError (dwErrCode=0x0) [0255.391] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x7ff988, cchData=512 | out: lpLCData="May") returned 4 [0255.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="May", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.391] GetLastError () returned 0x0 [0255.391] SetLastError (dwErrCode=0x0) [0255.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="May", cchWideChar=3, lpMultiByteStr=0xac32b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 3 [0255.391] GetLastError () returned 0x0 [0255.391] SetLastError (dwErrCode=0x0) [0255.391] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Jun") returned 4 [0255.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jun", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.391] GetLastError () returned 0x0 [0255.391] SetLastError (dwErrCode=0x0) [0255.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jun", cchWideChar=3, lpMultiByteStr=0xac32f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jun", lpUsedDefaultChar=0x0) returned 3 [0255.391] GetLastError () returned 0x0 [0255.391] SetLastError (dwErrCode=0x0) [0255.391] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x7ff988, cchData=512 | out: lpLCData="June") returned 5 [0255.391] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="June", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.391] GetLastError () returned 0x0 [0255.391] SetLastError (dwErrCode=0x0) [0255.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="June", cchWideChar=4, lpMultiByteStr=0xac3338, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="June", lpUsedDefaultChar=0x0) returned 4 [0255.392] GetLastError () returned 0x0 [0255.392] SetLastError (dwErrCode=0x0) [0255.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Jul") returned 4 [0255.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jul", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.392] GetLastError () returned 0x0 [0255.392] SetLastError (dwErrCode=0x0) [0255.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jul", cchWideChar=3, lpMultiByteStr=0xac3378, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jul", lpUsedDefaultChar=0x0) returned 3 [0255.392] GetLastError () returned 0x0 [0255.392] SetLastError (dwErrCode=0x0) [0255.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x7ff988, cchData=512 | out: lpLCData="July") returned 5 [0255.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="July", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0255.392] GetLastError () returned 0x0 [0255.392] SetLastError (dwErrCode=0x0) [0255.392] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="July", cchWideChar=4, lpMultiByteStr=0xac33b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="July", lpUsedDefaultChar=0x0) returned 4 [0255.392] GetLastError () returned 0x0 [0255.392] SetLastError (dwErrCode=0x0) [0255.393] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Aug") returned 4 [0255.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Aug", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.393] GetLastError () returned 0x0 [0255.393] SetLastError (dwErrCode=0x0) [0255.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Aug", cchWideChar=3, lpMultiByteStr=0xac33f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Aug", lpUsedDefaultChar=0x0) returned 3 [0255.393] GetLastError () returned 0x0 [0255.393] SetLastError (dwErrCode=0x0) [0255.393] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x7ff988, cchData=512 | out: lpLCData="August") returned 7 [0255.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="August", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.393] GetLastError () returned 0x0 [0255.393] SetLastError (dwErrCode=0x0) [0255.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="August", cchWideChar=6, lpMultiByteStr=0xac3438, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="August", lpUsedDefaultChar=0x0) returned 6 [0255.393] GetLastError () returned 0x0 [0255.393] SetLastError (dwErrCode=0x0) [0255.393] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Sep") returned 4 [0255.393] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sep", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.393] GetLastError () returned 0x0 [0255.394] SetLastError (dwErrCode=0x0) [0255.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sep", cchWideChar=3, lpMultiByteStr=0xac3478, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sep", lpUsedDefaultChar=0x0) returned 3 [0255.394] GetLastError () returned 0x0 [0255.394] SetLastError (dwErrCode=0x0) [0255.394] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x7ff988, cchData=512 | out: lpLCData="September") returned 10 [0255.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="September", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0255.394] GetLastError () returned 0x0 [0255.394] SetLastError (dwErrCode=0x0) [0255.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="September", cchWideChar=9, lpMultiByteStr=0xac34b8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="September", lpUsedDefaultChar=0x0) returned 9 [0255.394] GetLastError () returned 0x0 [0255.394] SetLastError (dwErrCode=0x0) [0255.394] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Oct") returned 4 [0255.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Oct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.394] GetLastError () returned 0x0 [0255.394] SetLastError (dwErrCode=0x0) [0255.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Oct", cchWideChar=3, lpMultiByteStr=0xac34f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Oct", lpUsedDefaultChar=0x0) returned 3 [0255.394] GetLastError () returned 0x0 [0255.394] SetLastError (dwErrCode=0x0) [0255.394] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x7ff988, cchData=512 | out: lpLCData="October") returned 8 [0255.394] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="October", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.394] GetLastError () returned 0x0 [0255.395] SetLastError (dwErrCode=0x0) [0255.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="October", cchWideChar=7, lpMultiByteStr=0xac3538, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="October", lpUsedDefaultChar=0x0) returned 7 [0255.395] GetLastError () returned 0x0 [0255.395] SetLastError (dwErrCode=0x0) [0255.395] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Nov") returned 4 [0255.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nov", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.395] GetLastError () returned 0x0 [0255.395] SetLastError (dwErrCode=0x0) [0255.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nov", cchWideChar=3, lpMultiByteStr=0xac3578, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nov", lpUsedDefaultChar=0x0) returned 3 [0255.395] GetLastError () returned 0x0 [0255.395] SetLastError (dwErrCode=0x0) [0255.395] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x7ff988, cchData=512 | out: lpLCData="November") returned 9 [0255.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="November", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.395] GetLastError () returned 0x0 [0255.395] SetLastError (dwErrCode=0x0) [0255.395] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="November", cchWideChar=8, lpMultiByteStr=0xac35b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="November", lpUsedDefaultChar=0x0) returned 8 [0255.395] GetLastError () returned 0x0 [0255.395] SetLastError (dwErrCode=0x0) [0255.396] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Dec") returned 4 [0255.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dec", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.396] GetLastError () returned 0x0 [0255.396] SetLastError (dwErrCode=0x0) [0255.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dec", cchWideChar=3, lpMultiByteStr=0xac35f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dec", lpUsedDefaultChar=0x0) returned 3 [0255.396] GetLastError () returned 0x0 [0255.396] SetLastError (dwErrCode=0x0) [0255.396] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x7ff988, cchData=512 | out: lpLCData="December") returned 9 [0255.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="December", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.396] GetLastError () returned 0x0 [0255.396] SetLastError (dwErrCode=0x0) [0255.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="December", cchWideChar=8, lpMultiByteStr=0xac3638, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="December", lpUsedDefaultChar=0x0) returned 8 [0255.396] GetLastError () returned 0x0 [0255.396] SetLastError (dwErrCode=0x0) [0255.396] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Sun") returned 4 [0255.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sun", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.396] GetLastError () returned 0x0 [0255.396] SetLastError (dwErrCode=0x0) [0255.396] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sun", cchWideChar=3, lpMultiByteStr=0xac3678, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sun", lpUsedDefaultChar=0x0) returned 3 [0255.396] GetLastError () returned 0x0 [0255.397] SetLastError (dwErrCode=0x0) [0255.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Sunday") returned 7 [0255.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sunday", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.397] GetLastError () returned 0x0 [0255.397] SetLastError (dwErrCode=0x0) [0255.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sunday", cchWideChar=6, lpMultiByteStr=0xac36b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sunday", lpUsedDefaultChar=0x0) returned 6 [0255.397] GetLastError () returned 0x0 [0255.397] SetLastError (dwErrCode=0x0) [0255.397] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Mon") returned 4 [0255.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mon", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.397] GetLastError () returned 0x0 [0255.397] SetLastError (dwErrCode=0x0) [0255.397] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mon", cchWideChar=3, lpMultiByteStr=0xac36f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mon", lpUsedDefaultChar=0x0) returned 3 [0255.397] GetLastError () returned 0x0 [0255.397] SetLastError (dwErrCode=0x0) [0255.398] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Monday") returned 7 [0255.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Monday", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.398] GetLastError () returned 0x0 [0255.398] SetLastError (dwErrCode=0x0) [0255.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Monday", cchWideChar=6, lpMultiByteStr=0xac3738, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Monday", lpUsedDefaultChar=0x0) returned 6 [0255.398] GetLastError () returned 0x0 [0255.398] SetLastError (dwErrCode=0x0) [0255.398] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Tue") returned 4 [0255.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tue", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.398] GetLastError () returned 0x0 [0255.398] SetLastError (dwErrCode=0x0) [0255.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tue", cchWideChar=3, lpMultiByteStr=0xac3778, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tue", lpUsedDefaultChar=0x0) returned 3 [0255.398] GetLastError () returned 0x0 [0255.398] SetLastError (dwErrCode=0x0) [0255.398] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Tuesday") returned 8 [0255.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tuesday", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0255.398] GetLastError () returned 0x0 [0255.398] SetLastError (dwErrCode=0x0) [0255.398] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tuesday", cchWideChar=7, lpMultiByteStr=0xac37b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tuesday", lpUsedDefaultChar=0x0) returned 7 [0255.398] GetLastError () returned 0x0 [0255.399] SetLastError (dwErrCode=0x0) [0255.399] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Wed") returned 4 [0255.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wed", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.399] GetLastError () returned 0x0 [0255.399] SetLastError (dwErrCode=0x0) [0255.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wed", cchWideChar=3, lpMultiByteStr=0xac37f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wed", lpUsedDefaultChar=0x0) returned 3 [0255.399] GetLastError () returned 0x0 [0255.399] SetLastError (dwErrCode=0x0) [0255.399] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Wednesday") returned 10 [0255.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wednesday", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0255.399] GetLastError () returned 0x0 [0255.399] SetLastError (dwErrCode=0x0) [0255.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wednesday", cchWideChar=9, lpMultiByteStr=0xac3838, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wednesday", lpUsedDefaultChar=0x0) returned 9 [0255.399] GetLastError () returned 0x0 [0255.399] SetLastError (dwErrCode=0x0) [0255.399] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Thu") returned 4 [0255.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thu", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.399] GetLastError () returned 0x0 [0255.399] SetLastError (dwErrCode=0x0) [0255.399] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thu", cchWideChar=3, lpMultiByteStr=0xac3878, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thu", lpUsedDefaultChar=0x0) returned 3 [0255.399] GetLastError () returned 0x0 [0255.399] SetLastError (dwErrCode=0x0) [0255.399] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Thursday") returned 9 [0255.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thursday", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.400] GetLastError () returned 0x0 [0255.400] SetLastError (dwErrCode=0x0) [0255.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thursday", cchWideChar=8, lpMultiByteStr=0xac38b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thursday", lpUsedDefaultChar=0x0) returned 8 [0255.400] GetLastError () returned 0x0 [0255.400] SetLastError (dwErrCode=0x0) [0255.400] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Fri") returned 4 [0255.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fri", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.400] GetLastError () returned 0x0 [0255.400] SetLastError (dwErrCode=0x0) [0255.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fri", cchWideChar=3, lpMultiByteStr=0xac38f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fri", lpUsedDefaultChar=0x0) returned 3 [0255.400] GetLastError () returned 0x0 [0255.400] SetLastError (dwErrCode=0x0) [0255.400] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Friday") returned 7 [0255.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Friday", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0255.400] GetLastError () returned 0x0 [0255.400] SetLastError (dwErrCode=0x0) [0255.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Friday", cchWideChar=6, lpMultiByteStr=0xac3938, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Friday", lpUsedDefaultChar=0x0) returned 6 [0255.400] GetLastError () returned 0x0 [0255.401] SetLastError (dwErrCode=0x0) [0255.401] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Sat") returned 4 [0255.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sat", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0255.401] GetLastError () returned 0x0 [0255.401] SetLastError (dwErrCode=0x0) [0255.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sat", cchWideChar=3, lpMultiByteStr=0xac3978, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sat", lpUsedDefaultChar=0x0) returned 3 [0255.401] GetLastError () returned 0x0 [0255.401] SetLastError (dwErrCode=0x0) [0255.401] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x7ff988, cchData=512 | out: lpLCData="Saturday") returned 9 [0255.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Saturday", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.401] GetLastError () returned 0x0 [0255.401] SetLastError (dwErrCode=0x0) [0255.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Saturday", cchWideChar=8, lpMultiByteStr=0xac39b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Saturday", lpUsedDefaultChar=0x0) returned 8 [0255.401] GetLastError () returned 0x0 [0255.401] SetLastError (dwErrCode=0x0) [0255.401] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ffb88, cchData=4 | out: lpLCData="/") returned 2 [0255.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/\x7f", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0255.401] GetLastError () returned 0x0 [0255.401] SetLastError (dwErrCode=0x0) [0255.401] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/\x7f", cchWideChar=1, lpMultiByteStr=0xac39f8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/", lpUsedDefaultChar=0x0) returned 1 [0255.402] GetLastError () returned 0x0 [0255.402] SetLastError (dwErrCode=0x0) [0255.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x7ff988, cchData=512 | out: lpLCData="M/d/yyyy") returned 9 [0255.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M/d/yyyy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0255.402] GetLastError () returned 0x0 [0255.402] SetLastError (dwErrCode=0x0) [0255.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M/d/yyyy", cchWideChar=8, lpMultiByteStr=0xac39f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M/d/yyyy", lpUsedDefaultChar=0x0) returned 8 [0255.402] GetLastError () returned 0x0 [0255.402] SetLastError (dwErrCode=0x0) [0255.402] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x7ff988, cchData=512 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0255.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dddd, MMMM d, yyyy", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0255.402] GetLastError () returned 0x0 [0255.402] SetLastError (dwErrCode=0x0) [0255.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dddd, MMMM d, yyyy", cchWideChar=18, lpMultiByteStr=0xac3a38, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dddd, MMMM d, yyyy", lpUsedDefaultChar=0x0) returned 18 [0255.403] GetLastError () returned 0x0 [0255.403] SetLastError (dwErrCode=0x0) [0255.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ffb88, cchData=4 | out: lpLCData=":") returned 2 [0255.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":\x7f", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0255.403] GetLastError () returned 0x0 [0255.403] SetLastError (dwErrCode=0x0) [0255.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":\x7f", cchWideChar=1, lpMultiByteStr=0xac3a78, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=":", lpUsedDefaultChar=0x0) returned 1 [0255.403] GetLastError () returned 0x0 [0255.403] SetLastError (dwErrCode=0x0) [0255.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x7ff988, cchData=512 | out: lpLCData="AM") returned 3 [0255.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AM", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0255.403] GetLastError () returned 0x0 [0255.403] SetLastError (dwErrCode=0x0) [0255.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AM", cchWideChar=2, lpMultiByteStr=0xac3a78, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AM", lpUsedDefaultChar=0x0) returned 2 [0255.403] GetLastError () returned 0x0 [0255.403] SetLastError (dwErrCode=0x0) [0255.403] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x7ff988, cchData=512 | out: lpLCData="PM") returned 3 [0255.403] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PM", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0255.403] GetLastError () returned 0x0 [0255.404] SetLastError (dwErrCode=0x0) [0255.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PM", cchWideChar=2, lpMultiByteStr=0xac3ab8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PM", lpUsedDefaultChar=0x0) returned 2 [0255.404] GetLastError () returned 0x0 [0255.404] SetLastError (dwErrCode=0x0) [0255.404] GetLocaleInfoW (in: Locale=0x409, LCType=0x25, lpLCData=0x7ff988, cchData=512 | out: lpLCData="0") returned 2 [0255.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0255.404] GetLastError () returned 0x0 [0255.404] SetLastError (dwErrCode=0x0) [0255.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0xac3af8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0", lpUsedDefaultChar=0x0) returned 1 [0255.404] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x7ff988, cchData=512 | out: lpLCData="$") returned 2 [0255.404] GetLastError () returned 0x0 [0255.404] SetLastError (dwErrCode=0x0) [0255.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0255.404] GetLastError () returned 0x0 [0255.404] SetLastError (dwErrCode=0x0) [0255.404] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0xac3af8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$", lpUsedDefaultChar=0x0) returned 1 [0255.405] GetLastError () returned 0x0 [0255.405] SetLastError (dwErrCode=0x0) [0255.405] GetLocaleInfoW (in: Locale=0x409, LCType=0x1b, lpLCData=0x7ff988, cchData=512 | out: lpLCData="0") returned 2 [0255.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0255.405] GetLastError () returned 0x0 [0255.405] SetLastError (dwErrCode=0x0) [0255.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0xac3b38, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0", lpUsedDefaultChar=0x0) returned 1 [0255.405] GetLocaleInfoW (in: Locale=0x409, LCType=0x1c, lpLCData=0x7ff988, cchData=512 | out: lpLCData="0") returned 2 [0255.405] GetLastError () returned 0x0 [0255.405] SetLastError (dwErrCode=0x0) [0255.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0255.405] GetLastError () returned 0x0 [0255.405] SetLastError (dwErrCode=0x0) [0255.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0xac3b38, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0", lpUsedDefaultChar=0x0) returned 1 [0255.405] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ffb88, cchData=4 | out: lpLCData=",") returned 2 [0255.405] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",\x7f", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0255.405] GetLastError () returned 0x0 [0255.406] SetLastError (dwErrCode=0x0) [0255.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",\x7f", cchWideChar=1, lpMultiByteStr=0xac3df8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 1 [0255.406] GetLastError () returned 0x0 [0255.406] SetLastError (dwErrCode=0x0) [0255.406] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ffb88, cchData=4 | out: lpLCData=".") returned 2 [0255.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=".\x7f", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0255.406] GetLastError () returned 0x0 [0255.406] SetLastError (dwErrCode=0x0) [0255.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=".\x7f", cchWideChar=1, lpMultiByteStr=0xac3df8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 1 [0255.406] GetLastError () returned 0x0 [0255.406] SetLastError (dwErrCode=0x0) [0255.406] GetLocaleInfoW (in: Locale=0x409, LCType=0x19, lpLCData=0x7ff988, cchData=512 | out: lpLCData="2") returned 2 [0255.406] GetLastError () returned 0x0 [0255.406] SetLastError (dwErrCode=0x0) [0255.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0255.406] GetLastError () returned 0x0 [0255.406] SetLastError (dwErrCode=0x0) [0255.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0xac3b38, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2", lpUsedDefaultChar=0x0) returned 1 [0255.406] GetLocaleInfoW (in: Locale=0x409, LCType=0xc, lpLCData=0x7ffb88, cchData=4 | out: lpLCData=",") returned 2 [0255.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",\x7f", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0255.406] GetLastError () returned 0x0 [0255.406] SetLastError (dwErrCode=0x0) [0255.406] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",\x7f", cchWideChar=1, lpMultiByteStr=0xac3df8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 1 [0255.407] GetLastError () returned 0x0 [0255.407] SetLastError (dwErrCode=0x0) [0255.407] GetLastError () returned 0x0 [0255.407] SetLastError (dwErrCode=0x0) [0255.407] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x7ffd40ab0000 [0255.407] GetProcAddress (hModule=0x7ffd40ab0000, lpProcName="TaskDialogIndirect") returned 0x0 [0255.407] GetProcAddress (hModule=0x7ffd40ab0000, lpProcName="TaskDialog") returned 0x0 [0255.407] GetLastError () returned 0x7f [0255.408] SetLastError (dwErrCode=0x7f) [0255.408] GetLastError () returned 0x7f [0255.408] SetLastError (dwErrCode=0x7f) [0255.408] GetLastError () returned 0x7f [0255.408] SetLastError (dwErrCode=0x7f) [0255.408] GetLastError () returned 0x7f [0255.408] SetLastError (dwErrCode=0x7f) [0255.408] GetLastError () returned 0x7f [0255.408] SetLastError (dwErrCode=0x7f) [0255.408] GetLastError () returned 0x7f [0255.408] SetLastError (dwErrCode=0x7f) [0255.408] GetLastError () returned 0x7f [0255.408] SetLastError (dwErrCode=0x7f) [0255.409] GetModuleHandleA (lpModuleName="kernel32") returned 0x7ffd4e1c0000 [0255.409] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetDiskFreeSpaceExA") returned 0x7ffd4e1ed9f0 [0255.409] GetLastError () returned 0x7f [0255.409] SetLastError (dwErrCode=0x7f) [0255.409] GetLastError () returned 0x7f [0255.409] SetLastError (dwErrCode=0x7f) [0255.409] GetLastError () returned 0x7f [0255.409] SetLastError (dwErrCode=0x7f) [0255.409] GetLastError () returned 0x7f [0255.409] SetLastError (dwErrCode=0x7f) [0255.409] GetLastError () returned 0x7f [0255.409] SetLastError (dwErrCode=0x7f) [0255.409] GetLastError () returned 0x7f [0255.409] SetLastError (dwErrCode=0x7f) [0255.409] GetLastError () returned 0x7f [0255.409] SetLastError (dwErrCode=0x7f) [0255.409] GetLastError () returned 0x7f [0255.409] SetLastError (dwErrCode=0x7f) [0255.410] GetLastError () returned 0x7f [0255.410] SetLastError (dwErrCode=0x7f) [0255.410] GetLastError () returned 0x7f [0255.410] SetLastError (dwErrCode=0x7f) [0255.410] GetLastError () returned 0x7f [0255.410] SetLastError (dwErrCode=0x7f) [0255.410] GetLastError () returned 0x7f [0255.410] SetLastError (dwErrCode=0x7f) [0255.410] GetLastError () returned 0x7f [0255.410] SetLastError (dwErrCode=0x7f) [0255.410] GetLastError () returned 0x7f [0255.410] SetLastError (dwErrCode=0x7f) [0255.410] GetLastError () returned 0x7f [0255.410] SetLastError (dwErrCode=0x7f) [0255.411] GetLastError () returned 0x7f [0255.411] SetLastError (dwErrCode=0x7f) [0255.411] GetLastError () returned 0x7f [0255.411] SetLastError (dwErrCode=0x7f) [0255.411] GetLastError () returned 0x7f [0255.411] SetLastError (dwErrCode=0x7f) [0255.411] GetLastError () returned 0x7f [0255.411] SetLastError (dwErrCode=0x7f) [0255.411] GetLastError () returned 0x7f [0255.411] SetLastError (dwErrCode=0x7f) [0255.411] GetLastError () returned 0x7f [0255.411] SetLastError (dwErrCode=0x7f) [0255.411] GetLastError () returned 0x7f [0255.411] SetLastError (dwErrCode=0x7f) [0255.411] GetLastError () returned 0x7f [0255.411] SetLastError (dwErrCode=0x7f) [0255.411] GetLastError () returned 0x7f [0255.411] SetLastError (dwErrCode=0x7f) [0255.411] GetLastError () returned 0x7f [0255.412] SetLastError (dwErrCode=0x7f) [0255.412] GetLastError () returned 0x7f [0255.412] SetLastError (dwErrCode=0x7f) [0255.412] GetLastError () returned 0x7f [0255.412] SetLastError (dwErrCode=0x7f) [0255.412] GetLastError () returned 0x7f [0255.412] SetLastError (dwErrCode=0x7f) [0255.412] GetLastError () returned 0x7f [0255.412] SetLastError (dwErrCode=0x7f) [0255.412] GetLastError () returned 0x7f [0255.412] SetLastError (dwErrCode=0x7f) [0255.412] GetLastError () returned 0x7f [0255.412] SetLastError (dwErrCode=0x7f) [0255.413] GetLastError () returned 0x7f [0255.413] SetLastError (dwErrCode=0x7f) [0255.413] GetLastError () returned 0x7f [0255.413] SetLastError (dwErrCode=0x7f) [0255.413] GetLastError () returned 0x7f [0255.413] SetLastError (dwErrCode=0x7f) [0255.413] GetLastError () returned 0x7f [0255.413] SetLastError (dwErrCode=0x7f) [0255.413] GetLastError () returned 0x7f [0255.413] SetLastError (dwErrCode=0x7f) [0255.413] GetLastError () returned 0x7f [0255.413] SetLastError (dwErrCode=0x7f) [0255.413] GetLastError () returned 0x7f [0255.413] SetLastError (dwErrCode=0x7f) [0255.413] GetLastError () returned 0x7f [0255.413] SetLastError (dwErrCode=0x7f) [0255.413] GetLastError () returned 0x7f [0255.413] SetLastError (dwErrCode=0x7f) [0255.413] GetLastError () returned 0x7f [0255.414] SetLastError (dwErrCode=0x7f) [0255.414] GetLastError () returned 0x7f [0255.414] SetLastError (dwErrCode=0x7f) [0255.414] GetLastError () returned 0x7f [0255.414] SetLastError (dwErrCode=0x7f) [0255.414] GetLastError () returned 0x7f [0255.414] SetLastError (dwErrCode=0x7f) [0255.414] GetLastError () returned 0x7f [0255.414] SetLastError (dwErrCode=0x7f) [0255.414] GetLastError () returned 0x7f [0255.414] SetLastError (dwErrCode=0x7f) [0255.414] GetLastError () returned 0x7f [0255.414] SetLastError (dwErrCode=0x7f) [0255.414] GetLastError () returned 0x7f [0255.414] SetLastError (dwErrCode=0x7f) [0255.414] GetLastError () returned 0x7f [0255.414] SetLastError (dwErrCode=0x7f) [0255.414] GetLastError () returned 0x7f [0255.414] SetLastError (dwErrCode=0x7f) [0255.414] GetProcessHeap () returned 0x8f0000 [0255.414] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x24dabc0 [0255.416] GetLastError () returned 0x7f [0255.416] SetLastError (dwErrCode=0x7f) [0255.416] GetLastError () returned 0x7f [0255.416] SetLastError (dwErrCode=0x7f) [0255.416] GetLastError () returned 0x7f [0255.416] SetLastError (dwErrCode=0x7f) [0255.416] GetLastError () returned 0x7f [0255.416] SetLastError (dwErrCode=0x7f) [0255.416] GetLastError () returned 0x7f [0255.417] SetLastError (dwErrCode=0x7f) [0255.417] GetLastError () returned 0x7f [0255.417] SetLastError (dwErrCode=0x7f) [0255.417] GetLastError () returned 0x7f [0255.417] SetLastError (dwErrCode=0x7f) [0255.417] GetLastError () returned 0x7f [0255.417] SetLastError (dwErrCode=0x7f) [0255.417] GetLastError () returned 0x7f [0255.417] SetLastError (dwErrCode=0x7f) [0255.417] GetLastError () returned 0x7f [0255.417] SetLastError (dwErrCode=0x7f) [0255.417] GetLastError () returned 0x7f [0255.417] SetLastError (dwErrCode=0x7f) [0255.417] GetLastError () returned 0x7f [0255.417] SetLastError (dwErrCode=0x7f) [0255.417] GetLastError () returned 0x7f [0255.418] SetLastError (dwErrCode=0x7f) [0255.418] GetLastError () returned 0x7f [0255.418] SetLastError (dwErrCode=0x7f) [0255.418] GetLastError () returned 0x7f [0255.418] SetLastError (dwErrCode=0x7f) [0255.418] GetLastError () returned 0x7f [0255.418] SetLastError (dwErrCode=0x7f) [0255.418] GetLastError () returned 0x7f [0255.418] SetLastError (dwErrCode=0x7f) [0255.418] GetLastError () returned 0x7f [0255.418] SetLastError (dwErrCode=0x7f) [0255.418] GetLastError () returned 0x7f [0255.418] SetLastError (dwErrCode=0x7f) [0255.418] GetLastError () returned 0x7f [0255.418] SetLastError (dwErrCode=0x7f) [0255.418] GetLastError () returned 0x7f [0255.418] SetLastError (dwErrCode=0x7f) [0255.418] GetLastError () returned 0x7f [0255.418] SetLastError (dwErrCode=0x7f) [0255.419] GetLastError () returned 0x7f [0255.419] SetLastError (dwErrCode=0x7f) [0255.419] GetLastError () returned 0x7f [0255.421] SetLastError (dwErrCode=0x7f) [0255.421] GetLastError () returned 0x7f [0255.421] SetLastError (dwErrCode=0x7f) [0255.421] GetLastError () returned 0x7f [0255.422] SetLastError (dwErrCode=0x7f) [0255.422] GetLastError () returned 0x7f [0255.422] SetLastError (dwErrCode=0x7f) [0255.422] GetLastError () returned 0x7f [0255.422] SetLastError (dwErrCode=0x7f) [0255.422] GetLastError () returned 0x7f [0255.422] SetLastError (dwErrCode=0x7f) [0255.422] GetLastError () returned 0x7f [0255.422] SetLastError (dwErrCode=0x7f) [0255.422] GetLastError () returned 0x7f [0255.422] SetLastError (dwErrCode=0x7f) [0255.422] GetLastError () returned 0x7f [0255.422] SetLastError (dwErrCode=0x7f) [0255.422] GetLastError () returned 0x7f [0255.423] SetLastError (dwErrCode=0x7f) [0255.423] GetLastError () returned 0x7f [0255.423] SetLastError (dwErrCode=0x7f) [0255.423] GetLastError () returned 0x7f [0255.423] SetLastError (dwErrCode=0x7f) [0255.423] GetLastError () returned 0x7f [0255.423] SetLastError (dwErrCode=0x7f) [0255.423] GetLastError () returned 0x7f [0255.423] SetLastError (dwErrCode=0x7f) [0255.423] GetLastError () returned 0x7f [0255.423] SetLastError (dwErrCode=0x7f) [0255.423] GetLastError () returned 0x7f [0255.423] SetLastError (dwErrCode=0x7f) [0255.423] GetLastError () returned 0x7f [0255.423] SetLastError (dwErrCode=0x7f) [0255.423] GetLastError () returned 0x7f [0255.423] SetLastError (dwErrCode=0x7f) [0255.424] GetLastError () returned 0x7f [0255.424] SetLastError (dwErrCode=0x7f) [0255.424] GetLastError () returned 0x7f [0255.424] SetLastError (dwErrCode=0x7f) [0255.424] GetLastError () returned 0x7f [0255.424] SetLastError (dwErrCode=0x7f) [0255.424] GetLastError () returned 0x7f [0255.424] SetLastError (dwErrCode=0x7f) [0255.424] GetLastError () returned 0x7f [0255.424] SetLastError (dwErrCode=0x7f) [0255.424] GetLastError () returned 0x7f [0255.424] SetLastError (dwErrCode=0x7f) [0255.424] GetLastError () returned 0x7f [0255.424] SetLastError (dwErrCode=0x7f) [0255.424] GetLastError () returned 0x7f [0255.424] SetLastError (dwErrCode=0x7f) [0255.425] GetLastError () returned 0x7f [0255.425] SetLastError (dwErrCode=0x7f) [0255.425] GetLastError () returned 0x7f [0255.425] SetLastError (dwErrCode=0x7f) [0255.425] GetLastError () returned 0x7f [0255.425] SetLastError (dwErrCode=0x7f) [0255.425] GetLastError () returned 0x7f [0255.425] SetLastError (dwErrCode=0x7f) [0255.425] GetLastError () returned 0x7f [0255.425] SetLastError (dwErrCode=0x7f) [0255.425] GetLastError () returned 0x7f [0255.425] SetLastError (dwErrCode=0x7f) [0255.425] GetLastError () returned 0x7f [0255.425] SetLastError (dwErrCode=0x7f) [0255.425] GetLastError () returned 0x7f [0255.425] SetLastError (dwErrCode=0x7f) [0255.425] GetLastError () returned 0x7f [0255.426] SetLastError (dwErrCode=0x7f) [0255.426] GetLastError () returned 0x7f [0255.426] SetLastError (dwErrCode=0x7f) [0255.426] GetLastError () returned 0x7f [0255.426] SetLastError (dwErrCode=0x7f) [0255.426] GetLastError () returned 0x7f [0255.426] SetLastError (dwErrCode=0x7f) [0255.426] GetProcessHeap () returned 0x8f0000 [0255.426] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x24e2bd0 [0255.427] GetLastError () returned 0x7f [0255.427] SetLastError (dwErrCode=0x7f) [0255.427] GetLastError () returned 0x7f [0255.428] SetLastError (dwErrCode=0x7f) [0255.428] GetLastError () returned 0x7f [0255.428] SetLastError (dwErrCode=0x7f) [0255.428] GetLastError () returned 0x7f [0255.428] SetLastError (dwErrCode=0x7f) [0255.428] GetLastError () returned 0x7f [0255.428] SetLastError (dwErrCode=0x7f) [0255.428] GetLastError () returned 0x7f [0255.428] SetLastError (dwErrCode=0x7f) [0255.428] GetLastError () returned 0x7f [0255.428] SetLastError (dwErrCode=0x7f) [0255.428] GetLastError () returned 0x7f [0255.428] SetLastError (dwErrCode=0x7f) [0255.428] GetLastError () returned 0x7f [0255.428] SetLastError (dwErrCode=0x7f) [0255.428] GetLastError () returned 0x7f [0255.429] SetLastError (dwErrCode=0x7f) [0255.429] GetLastError () returned 0x7f [0255.429] SetLastError (dwErrCode=0x7f) [0255.429] GetLastError () returned 0x7f [0255.429] SetLastError (dwErrCode=0x7f) [0255.429] GetLastError () returned 0x7f [0255.429] SetLastError (dwErrCode=0x7f) [0255.429] GetLastError () returned 0x7f [0255.429] SetLastError (dwErrCode=0x7f) [0255.429] GetLastError () returned 0x7f [0255.429] SetLastError (dwErrCode=0x7f) [0255.429] GetLastError () returned 0x7f [0255.429] SetLastError (dwErrCode=0x7f) [0255.429] GetLastError () returned 0x7f [0255.429] SetLastError (dwErrCode=0x7f) [0255.429] GetLastError () returned 0x7f [0255.429] SetLastError (dwErrCode=0x7f) [0255.430] GetLastError () returned 0x7f [0255.430] SetLastError (dwErrCode=0x7f) [0255.430] GetLastError () returned 0x7f [0255.430] SetLastError (dwErrCode=0x7f) [0255.430] GetVersionExA (in: lpVersionInformation=0x7ffcd8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0xac4d60, dwBuildNumber=0x0, dwPlatformId=0x10, szCSDVersion="") | out: lpVersionInformation=0x7ffcd8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.430] GetModuleHandleA (lpModuleName="comctl32.dll") returned 0x7ffd40ab0000 [0255.430] GetProcAddress (hModule=0x7ffd40ab0000, lpProcName="TaskDialogIndirect") returned 0x0 [0255.431] GetLastError () returned 0x7f [0255.431] SetLastError (dwErrCode=0x7f) [0255.431] GetLastError () returned 0x7f [0255.431] SetLastError (dwErrCode=0x7f) [0255.431] GetFileVersionInfoSizeA (in: lptstrFilename="comctl32.dll", lpdwHandle=0x7ff0b8 | out: lpdwHandle=0x7ff0b8) returned 0x71c [0255.800] GetFileVersionInfoA (in: lptstrFilename="comctl32.dll", dwHandle=0x0, dwLen=0x71c, lpData=0x7ff0e0 | out: lpData=0x7ff0e0) returned 1 [0255.800] VerQueryValueA (in: pBlock=0x7ff0e0, lpSubBlock="\\", lplpBuffer=0x7ff0b0, puLen=0x7ff0c8 | out: lplpBuffer=0x7ff0b0*=0x7ff108, puLen=0x7ff0c8) returned 1 [0255.801] LoadLibraryA (lpLibFileName="msimg32.dll") returned 0x7ffd31cc0000 [0255.868] GetProcAddress (hModule=0x7ffd31cc0000, lpProcName="AlphaBlend") returned 0x7ffd31cc1090 [0255.868] GetProcAddress (hModule=0x7ffd31cc0000, lpProcName="GradientFill") returned 0x7ffd31cc1010 [0255.868] LoadLibraryA (lpLibFileName="user32.dll") returned 0x7ffd4e9d0000 [0255.869] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetComboBoxInfo") returned 0x7ffd4ea08f20 [0255.869] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetMenuBarInfo") returned 0x7ffd4ea036a0 [0255.869] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetWindowInfo") returned 0x7ffd4e9e31e0 [0255.869] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetLayeredWindowAttributes") returned 0x7ffd4ea0a440 [0255.869] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="UpdateLayeredWindow") returned 0x7ffd4e9f9800 [0255.869] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="IsProcessDPIAware") returned 0x7ffd4e9f2120 [0255.869] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x7ffd4eb30000 [0255.870] GetProcAddress (hModule=0x7ffd4eb30000, lpProcName="SHGetStockIconInfo") returned 0x7ffd4ec41ad0 [0255.870] GetProcAddress (hModule=0x7ffd4eb30000, lpProcName="SHCreateItemFromParsingName") returned 0x7ffd4ec07880 [0255.870] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x7ffd4d8d0000 [0255.870] GetProcAddress (hModule=0x7ffd4d8d0000, lpProcName="SetLayout") returned 0x7ffd4d8f5c90 [0255.870] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x7ffd40ab0000 [0255.870] GetProcAddress (hModule=0x7ffd40ab0000, lpProcName="TaskDialogIndirect") returned 0x0 [0255.870] GetProcAddress (hModule=0x7ffd40ab0000, lpProcName="TaskDialog") returned 0x0 [0255.870] GlobalAddAtomA (lpString="WindowInfo") returned 0xc171 [0255.871] GetProcessHeap () returned 0x8f0000 [0255.871] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x24eabe0 [0255.872] GetLastError () returned 0x7f [0255.872] SetLastError (dwErrCode=0x7f) [0255.872] GetProcessHeap () returned 0x8f0000 [0255.872] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x24f2bf0 [0255.873] LoadLibraryA (lpLibFileName="uxtheme.dll") returned 0x7ffd4b470000 [0255.873] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="OpenThemeData") returned 0x7ffd4b481a90 [0255.873] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="CloseThemeData") returned 0x7ffd4b483ff0 [0255.874] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeBackground") returned 0x7ffd4b47f870 [0255.874] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeText") returned 0x7ffd4b4742d0 [0255.874] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeBackgroundContentRect") returned 0x7ffd4b47e280 [0255.874] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeBackgroundExtent") returned 0x7ffd4b47d840 [0255.874] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemePartSize") returned 0x7ffd4b47e590 [0255.874] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeTextExtent") returned 0x7ffd4b47a390 [0255.874] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeTextMetrics") returned 0x7ffd4b4745b0 [0255.874] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeBackgroundRegion") returned 0x7ffd4b475c30 [0255.874] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="HitTestThemeBackground") returned 0x7ffd4b490c60 [0255.875] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeEdge") returned 0x7ffd4b472e90 [0255.875] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeIcon") returned 0x7ffd4b4b9c10 [0255.875] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="IsThemePartDefined") returned 0x7ffd4b483ee0 [0255.875] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="IsThemeBackgroundPartiallyTransparent") returned 0x7ffd4b477860 [0255.875] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeColor") returned 0x7ffd4b47a960 [0255.875] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeMetric") returned 0x7ffd4b474230 [0255.875] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeString") returned 0x7ffd4b4baa70 [0255.875] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeBool") returned 0x7ffd4b47d300 [0255.876] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeInt") returned 0x7ffd4b47a960 [0255.876] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeEnumValue") returned 0x7ffd4b47a2f0 [0255.876] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemePosition") returned 0x7ffd4b475b90 [0255.877] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeFont") returned 0x7ffd4b47aa00 [0255.877] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeRect") returned 0x7ffd4b4936c0 [0255.877] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeMargins") returned 0x7ffd4b47da60 [0255.877] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeIntList") returned 0x7ffd4b4ba8c0 [0255.877] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemePropertyOrigin") returned 0x7ffd4b4ba9c0 [0255.877] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="SetWindowTheme") returned 0x7ffd4b473b50 [0255.877] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeFilename") returned 0x7ffd4b4ba7f0 [0255.878] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysColor") returned 0x7ffd4b4babf0 [0255.878] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysColorBrush") returned 0x7ffd4b4bacc0 [0255.878] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysBool") returned 0x7ffd4b4bab30 [0255.878] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysSize") returned 0x7ffd4b4bb120 [0255.878] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysFont") returned 0x7ffd4b4bad90 [0255.878] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysString") returned 0x7ffd4b4bb1e0 [0255.878] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysInt") returned 0x7ffd4b4bb080 [0255.878] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="IsThemeActive") returned 0x7ffd4b473730 [0255.878] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="IsAppThemed") returned 0x7ffd4b473700 [0255.879] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetWindowTheme") returned 0x7ffd4b475350 [0255.879] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="EnableThemeDialogTexture") returned 0x7ffd4b4744f0 [0255.879] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="IsThemeDialogTextureEnabled") returned 0x7ffd4b4bb3d0 [0255.879] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeAppProperties") returned 0x7ffd4b475680 [0255.879] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="SetThemeAppProperties") returned 0x7ffd4b4bb8b0 [0255.879] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetCurrentThemeName") returned 0x7ffd4b476f80 [0255.879] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeDocumentationProperty") returned 0x7ffd4b4ba730 [0255.879] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeParentBackground") returned 0x7ffd4b473270 [0255.880] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="EnableTheming") returned 0x7ffd4b4b9f80 [0255.880] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="OpenThemeDataEx") returned 0x7ffd4b4bb440 [0255.880] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeBackgroundEx") returned 0x7ffd4b473db0 [0255.880] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeParentBackgroundEx") returned 0x7ffd4b473290 [0255.886] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="SetWindowThemeAttribute") returned 0x7ffd4b476970 [0255.887] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeTextEx") returned 0x7ffd4b481910 [0255.888] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeBitmap") returned 0x7ffd4b477ab0 [0255.888] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeStream") returned 0x7ffd4b493600 [0255.888] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BufferedPaintInit") returned 0x7ffd4b476f40 [0255.888] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BufferedPaintUnInit") returned 0x7ffd4b476e20 [0255.888] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BeginBufferedPaint") returned 0x7ffd4b47d190 [0255.888] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="EndBufferedPaint") returned 0x7ffd4b47af10 [0255.888] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetBufferedPaintTargetRect") returned 0x7ffd4b4ba500 [0255.888] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetBufferedPaintTargetDC") returned 0x7ffd4b478090 [0255.889] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetBufferedPaintDC") returned 0x7ffd4b478110 [0255.889] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetBufferedPaintBits") returned 0x7ffd4b47ad70 [0255.889] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BufferedPaintClear") returned 0x7ffd4b47ae50 [0255.889] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BufferedPaintSetAlpha") returned 0x7ffd4b478190 [0255.889] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BufferedPaintStopAllAnimations") returned 0x7ffd4b475de0 [0255.889] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BeginBufferedAnimation") returned 0x7ffd4b48f430 [0255.889] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="EndBufferedAnimation") returned 0x7ffd4b478380 [0255.889] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BufferedPaintRenderAnimation") returned 0x7ffd4b48f3c0 [0255.890] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="IsCompositionActive") returned 0x7ffd4b47a1d0 [0255.890] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeTransitionDuration") returned 0x7ffd4b475700 [0255.890] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BeginPanningFeedback") returned 0x7ffd4b4b0c30 [0255.890] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="UpdatePanningFeedback") returned 0x7ffd4b4b0cb0 [0255.890] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="EndPanningFeedback") returned 0x7ffd4b4b0c40 [0255.890] IsAppThemed () returned 0x1 [0255.891] IsThemeActive () returned 0x1 [0255.892] GetLastError () returned 0x0 [0255.892] SetLastError (dwErrCode=0x0) [0255.892] GetFileVersionInfoSizeA (in: lptstrFilename="comctl32.dll", lpdwHandle=0x7fef68 | out: lpdwHandle=0x7fef68) returned 0x71c [0255.892] GetFileVersionInfoA (in: lptstrFilename="comctl32.dll", dwHandle=0x0, dwLen=0x71c, lpData=0x7fef90 | out: lpData=0x7fef90) returned 1 [0255.892] VerQueryValueA (in: pBlock=0x7fef90, lpSubBlock="\\", lplpBuffer=0x7fef60, puLen=0x7fef78 | out: lplpBuffer=0x7fef60*=0x7fefb8, puLen=0x7fef78) returned 1 [0255.892] GetLastError () returned 0x0 [0255.892] SetLastError (dwErrCode=0x0) [0255.892] GetLastError () returned 0x0 [0255.892] SetLastError (dwErrCode=0x0) [0255.892] SystemParametersInfoA (in: uiAction=0x29, uiParam=0x154, pvParam=0x24eac48, fWinIni=0x0 | out: pvParam=0x24eac48) returned 1 [0255.911] CreateFontIndirectA (lplf=0x24ead60) returned 0x250a06b3 [0255.911] GetModuleHandleA (lpModuleName="comctl32.dll") returned 0x7ffd40ab0000 [0255.911] GetProcAddress (hModule=0x7ffd40ab0000, lpProcName="InitCommonControlsEx") returned 0x7ffd40ab1700 [0255.911] GetLastError () returned 0x0 [0255.912] SetLastError (dwErrCode=0x0) [0255.912] GetFileVersionInfoSizeA (in: lptstrFilename="comctl32.dll", lpdwHandle=0x7ff0a8 | out: lpdwHandle=0x7ff0a8) returned 0x71c [0255.912] GetFileVersionInfoA (in: lptstrFilename="comctl32.dll", dwHandle=0x0, dwLen=0x71c, lpData=0x7ff0d0 | out: lpData=0x7ff0d0) returned 1 [0255.912] VerQueryValueA (in: pBlock=0x7ff0d0, lpSubBlock="\\", lplpBuffer=0x7ff0a0, puLen=0x7ff0b8 | out: lplpBuffer=0x7ff0a0*=0x7ff0f8, puLen=0x7ff0b8) returned 1 [0255.912] GetLastError () returned 0x0 [0255.912] SetLastError (dwErrCode=0x0) [0255.912] GetTickCount () returned 0xb83559 [0255.912] GetLastError () returned 0x0 [0255.912] SetLastError (dwErrCode=0x0) [0255.912] GetLastError () returned 0x0 [0255.912] SetLastError (dwErrCode=0x0) [0255.912] GetLastError () returned 0x0 [0255.912] SetLastError (dwErrCode=0x0) [0255.912] GetLastError () returned 0x0 [0255.913] SetLastError (dwErrCode=0x0) [0255.913] GetLastError () returned 0x0 [0255.913] SetLastError (dwErrCode=0x0) [0255.913] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x188 [0255.913] ResetEvent (hEvent=0x188) returned 1 [0255.913] GetLastError () returned 0x0 [0255.913] SetLastError (dwErrCode=0x0) [0255.913] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x194 [0255.913] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0255.913] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x1e0000 [0255.914] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.914] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetProcAddress") returned 0x7ffd4e1e0b80 [0255.914] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwClose") returned 0x7ffd50574f20 [0255.914] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateFile") returned 0x7ffd505757e0 [0255.914] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenFile") returned 0x7ffd505753a0 [0255.914] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateSection") returned 0x7ffd50575680 [0255.915] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwMapViewOfSection") returned 0x7ffd50575240 [0255.915] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnmapViewOfSection") returned 0x7ffd50575280 [0255.915] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnmapViewOfSectionEx") returned 0x7ffd50578370 [0255.915] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwReadFile") returned 0x7ffd50574e00 [0255.915] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryInformationFile") returned 0x7ffd50574f60 [0255.915] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetInformationFile") returned 0x7ffd50575220 [0255.915] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryAttributesFile") returned 0x7ffd505754e0 [0255.916] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQuerySection") returned 0x7ffd50575760 [0255.917] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryFullAttributesFile") returned 0x7ffd50577350 [0255.917] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwWriteFile") returned 0x7ffd50574e40 [0255.918] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeviceIoControlFile") returned 0x7ffd50574e20 [0255.918] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryObject") returned 0x7ffd50574f40 [0255.918] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryDirectoryFile") returned 0x7ffd505753e0 [0255.918] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryDirectoryFileEx") returned 0x0 [0255.918] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenSection") returned 0x7ffd50575420 [0255.918] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDuplicateObject") returned 0x7ffd505754c0 [0255.918] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeleteFile") returned 0x7ffd505765d0 [0255.919] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwLockFile") returned 0x7ffd50576cb0 [0255.919] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnlockFile") returned 0x7ffd50578330 [0255.919] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwTerminateProcess") returned 0x7ffd505752c0 [0255.919] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryVirtualMemory") returned 0x7ffd505751a0 [0255.919] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryVolumeInformationFile") returned 0x7ffd50575660 [0255.919] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetVolumeInformationFile") returned 0x7ffd50578050 [0255.920] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwAccessCheck") returned 0x7ffd50574d40 [0255.920] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwExtendSection") returned 0x7ffd505767b0 [0255.920] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFlushBuffersFile") returned 0x7ffd505756a0 [0255.920] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFsControlFile") returned 0x7ffd50575460 [0255.920] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwNotifyChangeDirectoryFile") returned 0x7ffd50576e10 [0255.921] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQuerySecurityObject") returned 0x7ffd505775d0 [0255.921] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetSecurityObject") returned 0x7ffd50577ef0 [0255.921] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateProcess") returned 0x7ffd505762f0 [0255.921] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateProcessEx") returned 0x7ffd505756e0 [0255.921] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateUserProcess") returned 0x7ffd50576490 [0255.922] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwResumeThread") returned 0x7ffd50575780 [0255.922] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateThread") returned 0x7ffd50575700 [0255.922] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryInformationProcess") returned 0x7ffd50575060 [0255.922] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenKey") returned 0x7ffd50574f80 [0255.922] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenKeyEx") returned 0x7ffd50576f10 [0255.922] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwEnumerateValueKey") returned 0x7ffd50574fa0 [0255.922] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryKey") returned 0x7ffd50575000 [0255.923] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryValueKey") returned 0x7ffd50575020 [0255.923] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateKey") returned 0x7ffd505750e0 [0255.923] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwEnumerateKey") returned 0x7ffd50575380 [0255.923] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetValueKey") returned 0x7ffd50575930 [0255.923] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeleteKey") returned 0x7ffd505765f0 [0255.923] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeleteValueKey") returned 0x7ffd50576650 [0255.923] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFlushKey") returned 0x7ffd50576890 [0255.924] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwLoadKey") returned 0x7ffd50576c50 [0255.924] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwLoadKey2") returned 0x7ffd50576c70 [0255.924] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwNotifyChangeKey") returned 0x7ffd50576e30 [0255.924] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryMultipleValueKey") returned 0x7ffd505774f0 [0255.924] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwReplaceKey") returned 0x7ffd505778d0 [0255.924] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwRestoreKey") returned 0x7ffd50577990 [0255.925] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSaveKey") returned 0x7ffd50577a70 [0255.925] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetInformationKey") returned 0x7ffd50577d10 [0255.925] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnloadKey") returned 0x7ffd505782d0 [0255.925] VirtualFree (lpAddress=0x1e0000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0255.926] GetTickCount () returned 0xb83568 [0255.926] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.926] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetModuleHandleA") returned 0x7ffd4e1e4c90 [0255.927] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.927] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetModuleHandleW") returned 0x7ffd4e1e3d40 [0255.927] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.927] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileA") returned 0x7ffd4e1ed8a0 [0255.927] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.927] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileW") returned 0x7ffd4e1ed8b0 [0255.928] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.928] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileMappingA") returned 0x7ffd4e1e1810 [0255.928] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.928] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileMappingW") returned 0x7ffd4e1e3af0 [0255.928] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.928] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ReadFile") returned 0x7ffd4e1edbd0 [0255.928] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.929] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CloseHandle") returned 0x7ffd4e1ed650 [0255.929] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.929] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetFileSize") returned 0x7ffd4e1eda90 [0255.929] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.929] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetFilePointer") returned 0x7ffd4e1edc60 [0255.929] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.929] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="MapViewOfFile") returned 0x7ffd4e1e4860 [0255.930] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.930] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="MapViewOfFileEx") returned 0x7ffd4e1e1f30 [0255.930] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.930] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="UnmapViewOfFile") returned 0x7ffd4e1e4ce0 [0255.930] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.930] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryA") returned 0x7ffd4e1e74d0 [0255.930] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.931] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryExA") returned 0x7ffd4e1e6b80 [0255.931] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.931] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryW") returned 0x7ffd4e1e50f0 [0255.931] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.931] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryExW") returned 0x7ffd4e1e0dd0 [0255.931] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.931] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FreeLibrary") returned 0x7ffd4e1e4810 [0255.932] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.932] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FreeResource") returned 0x7ffd4e1e8ee0 [0255.932] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.932] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetVersion") returned 0x7ffd4e1e7550 [0255.932] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.932] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentProcessId") returned 0x7ffd4e1db4a0 [0255.932] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.933] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentProcess") returned 0x7ffd4e1db7c0 [0255.933] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.933] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCommandLineA") returned 0x7ffd4e1e6d00 [0255.933] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.933] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCommandLineW") returned 0x7ffd4e1e6a00 [0255.933] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.933] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LockResource") returned 0x7ffd4e1e4450 [0255.934] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.934] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetProcAddress") returned 0x7ffd4e1e0b80 [0255.934] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.934] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="UnhandledExceptionFilter") returned 0x7ffd4e206a20 [0255.934] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.934] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="DebugBreak") returned 0x7ffd4e205b90 [0255.935] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.935] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FatalAppExitA") returned 0x7ffd4e205d50 [0255.935] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.935] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RtlRaiseException") returned 0x7ffd4e206830 [0255.935] GetModuleHandleA (lpModuleName="user32.dll") returned 0x7ffd4e9d0000 [0255.935] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetWindowsHookExA") returned 0x7ffd4e9d28e0 [0255.935] GetModuleHandleA (lpModuleName="user32.dll") returned 0x7ffd4e9d0000 [0255.936] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetWindowsHookExW") returned 0x7ffd4e9f5dd0 [0255.937] GetModuleHandleA (lpModuleName="user32.dll") returned 0x7ffd4e9d0000 [0255.937] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="UnhookWindowsHookEx") returned 0x7ffd4ea02c80 [0255.937] GetModuleHandleA (lpModuleName="user32.dll") returned 0x7ffd4e9d0000 [0255.937] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="PeekMessageA") returned 0x7ffd4e9ec540 [0255.937] GetModuleHandleA (lpModuleName="user32.dll") returned 0x7ffd4e9d0000 [0255.938] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CallNextHookEx") returned 0x7ffd4e9e6150 [0255.938] GetLastError () returned 0x7f [0255.938] SetLastError (dwErrCode=0x7f) [0255.938] GetLastError () returned 0x7f [0255.938] SetLastError (dwErrCode=0x7f) [0255.938] GetLastError () returned 0x7f [0255.938] SetLastError (dwErrCode=0x7f) [0255.938] GetSystemInfo (in: lpSystemInfo=0x7ff67d089e10 | out: lpSystemInfo=0x7ff67d089e10*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0255.938] LoadIconA (hInstance=0x7ff67cd13000, lpIconName="MAINICON") returned 0x0 [0255.939] LoadIconA (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0255.939] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0255.940] RegisterClassW (lpWndClass=0x7ffbc8) returned 0xc1d8 [0255.940] RegisterClassW (lpWndClass=0x7ffbc8) returned 0xc1e1 [0255.940] OleInitialize (pvReserved=0x0) returned 0x0 [0255.955] InitCommonControls () [0255.955] InitCommonControlsEx (picce=0x7ffc78) returned 1 [0255.958] InitCommonControlsEx (picce=0x7ffc78) returned 1 [0255.958] InitCommonControlsEx (picce=0x7ffc78) returned 1 [0255.958] InitCommonControlsEx (picce=0x7ffc78) returned 1 [0255.959] InitCommonControlsEx (picce=0x7ffc78) returned 1 [0255.959] InitCommonControlsEx (picce=0x7ffc78) returned 1 [0255.960] GetDesktopWindow () returned 0x10010 [0255.960] GetDC (hWnd=0x10010) returned 0xa0100d0 [0255.961] GetDeviceCaps (hdc=0xa0100d0, index=88) returned 96 [0255.961] GetDeviceCaps (hdc=0xa0100d0, index=90) returned 96 [0255.961] GetDeviceCaps (hdc=0xa0100d0, index=12) returned 32 [0255.961] ReleaseDC (hWnd=0x10010, hDC=0xa0100d0) returned 1 [0255.961] FindResourceA (hModule=0x7ff67cd13000, lpName="MAINICON", lpType=0xe) returned 0x0 [0255.961] HeapCreate (flOptions=0x0, dwInitialSize=0x88000, dwMaximumSize=0x88000) returned 0x2bc0000 [0255.964] RtlAllocateHeap (HeapHandle=0x2bc0000, Flags=0x0, Size=0x10000) returned 0x2bc0720 [0255.964] RtlAllocateHeap (HeapHandle=0x2bc0000, Flags=0x0, Size=0x10000) returned 0x2bd0730 [0255.964] RtlAllocateHeap (HeapHandle=0x2bc0000, Flags=0x0, Size=0x10000) returned 0x2be0740 [0255.964] RtlAllocateHeap (HeapHandle=0x2bc0000, Flags=0x0, Size=0x10000) returned 0x2bf0750 [0255.964] RtlAllocateHeap (HeapHandle=0x2bc0000, Flags=0x0, Size=0x10000) returned 0x2c00760 [0255.964] RtlAllocateHeap (HeapHandle=0x2bc0000, Flags=0x0, Size=0x10000) returned 0x2c10770 [0255.964] RtlAllocateHeap (HeapHandle=0x2bc0000, Flags=0x0, Size=0x10000) returned 0x2c20780 [0255.964] RtlAllocateHeap (HeapHandle=0x2bc0000, Flags=0x0, Size=0x10000) returned 0x2c30790 [0255.965] GetLastError () returned 0x715 [0255.965] SetLastError (dwErrCode=0x715) [0255.965] GetLastError () returned 0x715 [0255.965] SetLastError (dwErrCode=0x715) [0255.965] GetLastError () returned 0x715 [0255.965] SetLastError (dwErrCode=0x715) [0255.965] GetLastError () returned 0x715 [0255.965] SetLastError (dwErrCode=0x715) [0255.965] GetLastError () returned 0x715 [0255.965] SetLastError (dwErrCode=0x715) [0255.965] GetLastError () returned 0x715 [0255.966] SetLastError (dwErrCode=0x715) [0255.966] GetLastError () returned 0x715 [0255.966] SetLastError (dwErrCode=0x715) [0255.966] GetLastError () returned 0x715 [0255.966] SetLastError (dwErrCode=0x715) [0255.966] GetLastError () returned 0x715 [0255.966] SetLastError (dwErrCode=0x715) [0255.966] GetLastError () returned 0x715 [0255.966] SetLastError (dwErrCode=0x715) [0255.966] GetLastError () returned 0x715 [0255.966] SetLastError (dwErrCode=0x715) [0255.966] GetLastError () returned 0x715 [0255.967] SetLastError (dwErrCode=0x715) [0255.967] GetLastError () returned 0x715 [0255.967] SetLastError (dwErrCode=0x715) [0255.967] GetLastError () returned 0x715 [0255.967] SetLastError (dwErrCode=0x715) [0255.968] GetLastError () returned 0x715 [0255.968] SetLastError (dwErrCode=0x715) [0255.968] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0255.969] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetVersionExA") returned 0x7ffd4e1e7450 [0255.969] GetVersionExA (in: lpVersionInformation=0x7ff908*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x7ff6, dwMinorVersion=0x16acb04, dwBuildNumber=0x0, dwPlatformId=0x7c4a0000, szCSDVersion="ö\x7f") | out: lpVersionInformation=0x7ff908*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0255.969] GetModuleFileNameW (in: hModule=0x7ff67c4a0000, lpFilename=0x2500898, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe")) returned 0x32 [0255.969] SysReAllocStringLen (in: pbstr=0x7ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", len=0x32 | out: pbstr=0x7ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe") returned 1 [0255.969] GetLastError () returned 0x0 [0255.969] SetLastError (dwErrCode=0x0) [0255.969] GetLastError () returned 0x0 [0255.969] SetLastError (dwErrCode=0x0) [0255.969] GetLastError () returned 0x0 [0255.969] SetLastError (dwErrCode=0x0) [0255.969] GetLastError () returned 0x0 [0255.969] SetLastError (dwErrCode=0x0) [0255.969] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff7f0 | out: lpBuffer=0x0, lpFilePart=0x7ff7f0*=0x0) returned 0x2a [0255.970] GetLastError () returned 0x0 [0255.970] SetLastError (dwErrCode=0x0) [0255.970] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb428, lpFilePart=0x7ff7f0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff7f0*="Temp") returned 0x28 [0255.970] GetLastError () returned 0x0 [0255.970] SetLastError (dwErrCode=0x0) [0255.970] GetLastError () returned 0x0 [0255.970] SetLastError (dwErrCode=0x0) [0255.970] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0255.970] GetLastError () returned 0x0 [0255.970] SetLastError (dwErrCode=0x0) [0255.970] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0255.970] GetLastError () returned 0x0 [0255.970] SetLastError (dwErrCode=0x0) [0255.970] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0255.970] GetLastError () returned 0x0 [0255.970] SetLastError (dwErrCode=0x0) [0255.970] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0255.971] GetLastError () returned 0x0 [0255.971] SetLastError (dwErrCode=0x0) [0255.971] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0255.971] GetLastError () returned 0x0 [0255.971] SetLastError (dwErrCode=0x0) [0255.971] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0255.971] GetLastError () returned 0x0 [0255.971] SetLastError (dwErrCode=0x0) [0255.971] GetLastError () returned 0x0 [0255.971] SetLastError (dwErrCode=0x0) [0255.971] GetLastError () returned 0x0 [0255.971] SetLastError (dwErrCode=0x0) [0255.971] GetLastError () returned 0x0 [0255.971] SetLastError (dwErrCode=0x0) [0255.971] GetLastError () returned 0x0 [0255.971] SetLastError (dwErrCode=0x0) [0255.971] GetLastError () returned 0x0 [0255.971] SetLastError (dwErrCode=0x0) [0255.971] GetLastError () returned 0x0 [0255.971] SetLastError (dwErrCode=0x0) [0255.971] GetLastError () returned 0x0 [0255.972] SetLastError (dwErrCode=0x0) [0255.972] GetLastError () returned 0x0 [0255.972] SetLastError (dwErrCode=0x0) [0255.972] SysReAllocStringLen (in: pbstr=0x27e0f18*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", len=0x32 | out: pbstr=0x27e0f18*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe") returned 1 [0255.972] SysReAllocStringLen (in: pbstr=0x7ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", len=0x32 | out: pbstr=0x7ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe") returned 1 [0255.972] GetThreadLocale () returned 0x409 [0255.972] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0255.977] GetThreadLocale () returned 0x409 [0255.978] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0255.978] GetLastError () returned 0x0 [0255.978] SetLastError (dwErrCode=0x0) [0255.978] GetLastError () returned 0x0 [0255.978] SetLastError (dwErrCode=0x0) [0255.978] GetLastError () returned 0x0 [0255.978] SetLastError (dwErrCode=0x0) [0255.978] GetLastError () returned 0x0 [0255.978] SetLastError (dwErrCode=0x0) [0255.978] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0255.978] GetLastError () returned 0x0 [0255.978] SetLastError (dwErrCode=0x0) [0255.978] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb4a8, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0255.978] GetLastError () returned 0x0 [0255.979] SetLastError (dwErrCode=0x0) [0255.979] GetLastError () returned 0x0 [0255.979] SetLastError (dwErrCode=0x0) [0255.979] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0255.979] GetLastError () returned 0x0 [0255.979] SetLastError (dwErrCode=0x0) [0255.979] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0255.979] GetLastError () returned 0x0 [0255.979] SetLastError (dwErrCode=0x0) [0255.979] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0255.979] GetLastError () returned 0x0 [0255.979] SetLastError (dwErrCode=0x0) [0255.979] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0255.979] GetLastError () returned 0x0 [0255.979] SetLastError (dwErrCode=0x0) [0255.979] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0255.980] GetLastError () returned 0x0 [0255.980] SetLastError (dwErrCode=0x0) [0255.980] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0255.980] GetLastError () returned 0x0 [0255.980] SetLastError (dwErrCode=0x0) [0255.980] GetLastError () returned 0x0 [0255.980] SetLastError (dwErrCode=0x0) [0255.980] GetLastError () returned 0x0 [0255.980] SetLastError (dwErrCode=0x0) [0255.980] GetLastError () returned 0x0 [0255.980] SetLastError (dwErrCode=0x0) [0255.980] GetLastError () returned 0x0 [0255.980] SetLastError (dwErrCode=0x0) [0255.980] GetLastError () returned 0x0 [0255.980] SetLastError (dwErrCode=0x0) [0255.980] GetLastError () returned 0x0 [0255.980] SetLastError (dwErrCode=0x0) [0255.980] GetLastError () returned 0x0 [0255.981] SetLastError (dwErrCode=0x0) [0255.981] GetLastError () returned 0x0 [0255.981] SetLastError (dwErrCode=0x0) [0255.981] SysReAllocStringLen (in: pbstr=0x7ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", len=0x32 | out: pbstr=0x7ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe") returned 1 [0255.981] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", len=0x32 | out: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe") returned 1 [0255.981] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", cchLength=0x32 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe") returned 0x32 [0255.981] SysReAllocStringLen (in: pbstr=0x7ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe", len=0x32 | out: pbstr=0x7ffa10*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe") returned 1 [0255.981] SysReAllocStringLen (in: pbstr=0x27e0f18*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe", len=0x32 | out: pbstr=0x27e0f18*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe") returned 1 [0255.981] GetLastError () returned 0x0 [0255.981] SetLastError (dwErrCode=0x0) [0255.981] GetLastError () returned 0x0 [0255.981] SetLastError (dwErrCode=0x0) [0255.981] GetLastError () returned 0x0 [0255.982] SetLastError (dwErrCode=0x0) [0255.982] GetLastError () returned 0x0 [0255.982] SetLastError (dwErrCode=0x0) [0255.982] SysReAllocStringLen (in: pbstr=0x27e0f38*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0x27e0f38*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0255.982] GetLastError () returned 0x0 [0255.982] SetLastError (dwErrCode=0x0) [0255.982] GetLastError () returned 0x0 [0255.982] SetLastError (dwErrCode=0x0) [0255.982] SysReAllocStringLen (in: pbstr=0x7ffa10*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0x7ffa10*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0255.982] GetThreadLocale () returned 0x409 [0255.982] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0255.982] GetThreadLocale () returned 0x409 [0255.982] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0255.983] GetLastError () returned 0x0 [0255.983] SetLastError (dwErrCode=0x0) [0255.983] GetLastError () returned 0x0 [0255.983] SetLastError (dwErrCode=0x0) [0255.983] GetLastError () returned 0x0 [0255.983] SetLastError (dwErrCode=0x0) [0255.983] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff7e8, cbMultiByte=1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0255.983] GetLastError () returned 0x0 [0255.983] SetLastError (dwErrCode=0x0) [0255.983] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff7e8, cbMultiByte=1, lpWideCharStr=0xac5138, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0255.983] GetLastError () returned 0x0 [0255.983] SetLastError (dwErrCode=0x0) [0255.983] GetLastError () returned 0x0 [0255.983] SetLastError (dwErrCode=0x0) [0255.983] GetLastError () returned 0x0 [0255.983] SetLastError (dwErrCode=0x0) [0255.983] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0255.983] GetLastError () returned 0x0 [0255.983] SetLastError (dwErrCode=0x0) [0255.984] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb5a8, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0255.984] GetLastError () returned 0x0 [0255.984] SetLastError (dwErrCode=0x0) [0255.984] GetLastError () returned 0x0 [0255.984] SetLastError (dwErrCode=0x0) [0255.984] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0255.984] GetLastError () returned 0x0 [0255.984] SetLastError (dwErrCode=0x0) [0255.984] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0255.984] GetLastError () returned 0x0 [0255.984] SetLastError (dwErrCode=0x0) [0255.984] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0255.984] GetLastError () returned 0x0 [0255.984] SetLastError (dwErrCode=0x0) [0255.984] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0255.984] GetLastError () returned 0x0 [0255.984] SetLastError (dwErrCode=0x0) [0255.984] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0255.984] GetLastError () returned 0x0 [0255.984] SetLastError (dwErrCode=0x0) [0255.984] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0255.984] GetLastError () returned 0x0 [0255.985] SetLastError (dwErrCode=0x0) [0255.986] GetLastError () returned 0x0 [0255.986] SetLastError (dwErrCode=0x0) [0255.986] GetLastError () returned 0x0 [0255.986] SetLastError (dwErrCode=0x0) [0255.986] GetLastError () returned 0x0 [0255.986] SetLastError (dwErrCode=0x0) [0255.986] GetLastError () returned 0x0 [0255.986] SetLastError (dwErrCode=0x0) [0255.986] GetLastError () returned 0x0 [0255.986] SetLastError (dwErrCode=0x0) [0255.986] GetLastError () returned 0x0 [0255.987] SetLastError (dwErrCode=0x0) [0255.987] GetLastError () returned 0x0 [0255.987] SetLastError (dwErrCode=0x0) [0255.987] GetLastError () returned 0x0 [0255.987] SetLastError (dwErrCode=0x0) [0255.987] GetLastError () returned 0x0 [0255.987] SetLastError (dwErrCode=0x0) [0255.987] SysReAllocStringLen (in: pbstr=0x7ffa10*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", psz="C:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0x7ffa10*="C:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0255.987] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", psz="C:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0x7ff968*="C:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0255.987] CharLowerBuffW (in: lpsz="C:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", cchLength=0x29 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 0x29 [0255.987] SysReAllocStringLen (in: pbstr=0x7ffa10*="C:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0x7ffa10*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0255.987] SysReAllocStringLen (in: pbstr=0x27e0f38*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0x27e0f38*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0255.987] GetLastError () returned 0x0 [0255.987] SetLastError (dwErrCode=0x0) [0255.989] GetSystemDirectoryW (in: lpBuffer=0x27f0650, uSize=0xfffe | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0255.989] GetLastError () returned 0x0 [0255.989] SetLastError (dwErrCode=0x0) [0255.989] GetLastError () returned 0x0 [0255.989] SetLastError (dwErrCode=0x0) [0255.989] GetLastError () returned 0x0 [0255.989] SetLastError (dwErrCode=0x0) [0255.989] GetLastError () returned 0x0 [0255.989] SetLastError (dwErrCode=0x0) [0255.989] SysReAllocStringLen (in: pbstr=0x7ffa10*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", psz="C:\\Windows\\system32\\", len=0x14 | out: pbstr=0x7ffa10*="C:\\Windows\\system32\\") returned 1 [0255.989] GetThreadLocale () returned 0x409 [0255.990] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Windows\\system32\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0255.990] GetThreadLocale () returned 0x409 [0255.990] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Windows\\system32\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0255.990] GetLastError () returned 0x0 [0255.990] SetLastError (dwErrCode=0x0) [0255.990] GetLastError () returned 0x0 [0255.990] SetLastError (dwErrCode=0x0) [0255.990] GetLastError () returned 0x0 [0255.990] SetLastError (dwErrCode=0x0) [0255.990] GetLastError () returned 0x0 [0255.990] SetLastError (dwErrCode=0x0) [0255.990] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0255.990] GetLastError () returned 0x0 [0255.990] SetLastError (dwErrCode=0x0) [0255.990] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb528, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0255.990] GetLastError () returned 0x0 [0255.990] SetLastError (dwErrCode=0x0) [0255.990] GetLastError () returned 0x0 [0255.990] SetLastError (dwErrCode=0x0) [0255.990] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0255.990] GetLastError () returned 0x0 [0255.990] SetLastError (dwErrCode=0x0) [0255.990] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0255.991] GetLastError () returned 0x0 [0255.991] SetLastError (dwErrCode=0x0) [0255.991] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0255.991] GetLastError () returned 0x0 [0255.991] SetLastError (dwErrCode=0x0) [0255.991] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0255.991] GetLastError () returned 0x0 [0255.991] SetLastError (dwErrCode=0x0) [0255.991] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0255.991] GetLastError () returned 0x0 [0255.991] SetLastError (dwErrCode=0x0) [0255.991] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0255.991] GetLastError () returned 0x0 [0255.991] SetLastError (dwErrCode=0x0) [0255.991] GetLastError () returned 0x0 [0255.991] SetLastError (dwErrCode=0x0) [0255.991] GetLastError () returned 0x0 [0255.991] SetLastError (dwErrCode=0x0) [0255.991] GetLastError () returned 0x0 [0255.991] SetLastError (dwErrCode=0x0) [0255.991] GetLastError () returned 0x0 [0255.991] SetLastError (dwErrCode=0x0) [0255.992] GetLastError () returned 0x0 [0255.992] SetLastError (dwErrCode=0x0) [0255.992] GetLastError () returned 0x0 [0255.992] SetLastError (dwErrCode=0x0) [0255.992] GetLastError () returned 0x0 [0255.992] SetLastError (dwErrCode=0x0) [0255.992] GetLastError () returned 0x0 [0255.992] SetLastError (dwErrCode=0x0) [0255.992] SysReAllocStringLen (in: pbstr=0x7ffa10*="C:\\Windows\\system32\\", psz="C:\\Windows\\system32\\", len=0x14 | out: pbstr=0x7ffa10*="C:\\Windows\\system32\\") returned 1 [0255.992] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Windows\\system32\\", psz="C:\\Windows\\system32\\", len=0x14 | out: pbstr=0x7ff968*="C:\\Windows\\system32\\") returned 1 [0255.992] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\", cchLength=0x14 | out: lpsz="c:\\windows\\system32\\") returned 0x14 [0255.992] SysReAllocStringLen (in: pbstr=0x7ffa10*="C:\\Windows\\system32\\", psz="c:\\windows\\system32\\", len=0x14 | out: pbstr=0x7ffa10*="c:\\windows\\system32\\") returned 1 [0255.992] SysReAllocStringLen (in: pbstr=0x27e0f30*=0x0, psz="c:\\windows\\system32\\", len=0x14 | out: pbstr=0x27e0f30*="c:\\windows\\system32\\") returned 1 [0255.992] GetTempPathW (in: nBufferLength=0xfffe, lpBuffer=0x27f0650 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0255.993] GetLastError () returned 0x0 [0255.993] SetLastError (dwErrCode=0x0) [0255.993] GetLastError () returned 0x0 [0255.993] SetLastError (dwErrCode=0x0) [0255.993] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Windows\\system32", psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", len=0x25 | out: pbstr=0x7ffa08*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 1 [0255.993] GetThreadLocale () returned 0x409 [0255.993] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0255.993] GetThreadLocale () returned 0x409 [0255.993] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0255.993] GetLastError () returned 0x0 [0255.993] SetLastError (dwErrCode=0x0) [0255.993] GetLastError () returned 0x0 [0255.993] SetLastError (dwErrCode=0x0) [0255.993] GetLastError () returned 0x0 [0255.994] SetLastError (dwErrCode=0x0) [0255.994] GetLastError () returned 0x0 [0255.994] SetLastError (dwErrCode=0x0) [0255.994] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0255.994] GetLastError () returned 0x0 [0255.994] SetLastError (dwErrCode=0x0) [0255.994] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb4a8, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0255.994] GetLastError () returned 0x0 [0255.994] SetLastError (dwErrCode=0x0) [0255.994] GetLastError () returned 0x0 [0255.994] SetLastError (dwErrCode=0x0) [0255.994] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0255.994] GetLastError () returned 0x0 [0255.994] SetLastError (dwErrCode=0x0) [0255.994] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0255.994] GetLastError () returned 0x0 [0255.994] SetLastError (dwErrCode=0x0) [0255.994] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0255.994] GetLastError () returned 0x0 [0255.994] SetLastError (dwErrCode=0x0) [0255.994] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0255.994] GetLastError () returned 0x0 [0255.995] SetLastError (dwErrCode=0x0) [0255.995] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0255.995] GetLastError () returned 0x0 [0255.995] SetLastError (dwErrCode=0x0) [0255.995] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0255.995] GetLastError () returned 0x0 [0255.995] SetLastError (dwErrCode=0x0) [0255.995] GetLastError () returned 0x0 [0255.995] SetLastError (dwErrCode=0x0) [0255.995] GetLastError () returned 0x0 [0255.995] SetLastError (dwErrCode=0x0) [0255.995] GetLastError () returned 0x0 [0255.995] SetLastError (dwErrCode=0x0) [0255.995] GetLastError () returned 0x0 [0255.995] SetLastError (dwErrCode=0x0) [0255.995] GetLastError () returned 0x0 [0255.995] SetLastError (dwErrCode=0x0) [0255.995] GetLastError () returned 0x0 [0255.995] SetLastError (dwErrCode=0x0) [0255.995] GetLastError () returned 0x0 [0255.995] SetLastError (dwErrCode=0x0) [0255.995] GetLastError () returned 0x0 [0255.996] SetLastError (dwErrCode=0x0) [0255.996] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", len=0x25 | out: pbstr=0x7ffa08*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 1 [0255.996] GetLastError () returned 0x0 [0255.996] SetLastError (dwErrCode=0x0) [0255.996] GetLastError () returned 0x0 [0255.996] SetLastError (dwErrCode=0x0) [0255.996] GetLastError () returned 0x0 [0255.996] SetLastError (dwErrCode=0x0) [0255.996] GetLastError () returned 0x0 [0255.996] SetLastError (dwErrCode=0x0) [0255.996] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff470 | out: lpBuffer=0x0, lpFilePart=0x7ff470*=0x0) returned 0x2a [0255.996] GetLastError () returned 0x0 [0255.996] SetLastError (dwErrCode=0x0) [0255.996] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb428, lpFilePart=0x7ff470 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff470*="Temp") returned 0x28 [0255.996] GetLastError () returned 0x0 [0255.996] SetLastError (dwErrCode=0x0) [0255.997] GetLastError () returned 0x0 [0255.997] SetLastError (dwErrCode=0x0) [0255.997] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0255.997] GetLastError () returned 0x0 [0255.997] SetLastError (dwErrCode=0x0) [0255.997] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0255.997] GetLastError () returned 0x0 [0255.997] SetLastError (dwErrCode=0x0) [0255.997] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0255.997] GetLastError () returned 0x0 [0255.997] SetLastError (dwErrCode=0x0) [0255.997] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0255.997] GetLastError () returned 0x0 [0255.997] SetLastError (dwErrCode=0x0) [0255.997] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0255.997] GetLastError () returned 0x0 [0255.997] SetLastError (dwErrCode=0x0) [0255.997] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0255.997] GetLastError () returned 0x0 [0255.997] SetLastError (dwErrCode=0x0) [0255.997] GetLastError () returned 0x0 [0255.997] SetLastError (dwErrCode=0x0) [0255.997] GetLastError () returned 0x0 [0255.998] SetLastError (dwErrCode=0x0) [0255.998] GetLastError () returned 0x0 [0255.998] SetLastError (dwErrCode=0x0) [0255.998] GetLastError () returned 0x0 [0255.998] SetLastError (dwErrCode=0x0) [0255.998] GetLastError () returned 0x0 [0255.998] SetLastError (dwErrCode=0x0) [0255.998] GetLastError () returned 0x0 [0255.998] SetLastError (dwErrCode=0x0) [0255.998] GetLastError () returned 0x0 [0256.027] SetLastError (dwErrCode=0x0) [0256.027] GetLastError () returned 0x0 [0256.027] SetLastError (dwErrCode=0x0) [0256.027] GetLastError () returned 0x0 [0256.027] SetLastError (dwErrCode=0x0) [0256.027] GetLastError () returned 0x0 [0256.027] SetLastError (dwErrCode=0x0) [0256.027] GetLastError () returned 0x0 [0256.027] SetLastError (dwErrCode=0x0) [0256.027] GetLastError () returned 0x0 [0256.027] SetLastError (dwErrCode=0x0) [0256.028] GetLastError () returned 0x0 [0256.028] SetLastError (dwErrCode=0x0) [0256.028] GetLastError () returned 0x0 [0256.028] SetLastError (dwErrCode=0x0) [0256.028] GetLastError () returned 0x0 [0256.028] SetLastError (dwErrCode=0x0) [0256.028] GetLastError () returned 0x0 [0256.028] SetLastError (dwErrCode=0x0) [0256.028] GetLastError () returned 0x0 [0256.028] SetLastError (dwErrCode=0x0) [0256.028] GetLastError () returned 0x0 [0256.028] SetLastError (dwErrCode=0x0) [0256.028] GetLastError () returned 0x0 [0256.028] SetLastError (dwErrCode=0x0) [0256.028] GetLastError () returned 0x0 [0256.029] SetLastError (dwErrCode=0x0) [0256.029] GetLastError () returned 0x0 [0256.029] SetLastError (dwErrCode=0x0) [0256.029] GetLastError () returned 0x0 [0256.029] SetLastError (dwErrCode=0x0) [0256.029] SysReAllocStringLen (in: pbstr=0x7ff5b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7ff5b0*="C:\\") returned 1 [0256.029] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.029] SysReAllocStringLen (in: pbstr=0x7ff5b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ff5b8*="c:\\") returned 1 [0256.029] SysReAllocStringLen (in: pbstr=0x7ff5a8*=0x0, psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", len=0x25 | out: pbstr=0x7ff5a8*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 1 [0256.029] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", cchLength=0x25 | out: lpsz="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\") returned 0x25 [0256.029] SysReAllocStringLen (in: pbstr=0x7ff5b0*=0x0, psz="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\", len=0x25 | out: pbstr=0x7ff5b0*="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\") returned 1 [0256.029] SetLastError (dwErrCode=0x0) [0256.030] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\", cchCount1=37, lpString2="c:\\", cchCount2=3) returned 3 [0256.030] GetLastError () returned 0x0 [0256.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0256.030] GetLastError () returned 0x0 [0256.030] SetLastError (dwErrCode=0x0) [0256.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", cchWideChar=37, lpMultiByteStr=0xabb768, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", lpUsedDefaultChar=0x0) returned 37 [0256.030] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=37, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0256.031] GetLastError () returned 0x0 [0256.031] SetLastError (dwErrCode=0x0) [0256.031] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=37, lpWideCharStr=0xadb5a8, cchWideChar=37 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 37 [0256.031] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", lpFindFileData=0x7ff6c8 | out: lpFindFileData=0x7ff6c8*(dwFileAttributes=0x8f0000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x8f8b00, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0x40, nFileSizeHigh=0x0, nFileSizeLow=0x8fe0a0, dwReserved0=0x0, dwReserved1=0x4, cFileName="", cAlternateFileName="翶")) returned 0xffffffffffffffff [0256.031] GetLastError () returned 0x2 [0256.031] GetLastError () returned 0x2 [0256.031] SetLastError (dwErrCode=0x2) [0256.031] GetLastError () returned 0x2 [0256.031] SetLastError (dwErrCode=0x2) [0256.031] GetLastError () returned 0x0 [0256.031] SetLastError (dwErrCode=0x0) [0256.032] GetLastError () returned 0x0 [0256.032] SetLastError (dwErrCode=0x0) [0256.032] GetLastError () returned 0x0 [0256.032] SetLastError (dwErrCode=0x0) [0256.032] GetLastError () returned 0x0 [0256.032] SetLastError (dwErrCode=0x0) [0256.032] SysReAllocStringLen (in: pbstr=0x7ff690*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp", len=0x24 | out: pbstr=0x7ff690*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp") returned 1 [0256.032] GetLastError () returned 0x0 [0256.032] SetLastError (dwErrCode=0x0) [0256.032] GetLastError () returned 0x0 [0256.032] SetLastError (dwErrCode=0x0) [0256.032] GetLastError () returned 0x0 [0256.032] SetLastError (dwErrCode=0x0) [0256.032] GetLastError () returned 0x0 [0256.032] SetLastError (dwErrCode=0x0) [0256.032] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff170 | out: lpBuffer=0x0, lpFilePart=0x7ff170*=0x0) returned 0x2a [0256.032] GetLastError () returned 0x0 [0256.033] SetLastError (dwErrCode=0x0) [0256.033] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb528, lpFilePart=0x7ff170 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff170*="Temp") returned 0x28 [0256.033] GetLastError () returned 0x0 [0256.033] SetLastError (dwErrCode=0x0) [0256.033] GetLastError () returned 0x0 [0256.033] SetLastError (dwErrCode=0x0) [0256.033] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.033] GetLastError () returned 0x0 [0256.033] SetLastError (dwErrCode=0x0) [0256.033] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5178, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.033] GetLastError () returned 0x0 [0256.033] SetLastError (dwErrCode=0x0) [0256.033] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.033] GetLastError () returned 0x0 [0256.033] SetLastError (dwErrCode=0x0) [0256.033] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5178, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.033] GetLastError () returned 0x0 [0256.033] SetLastError (dwErrCode=0x0) [0256.033] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.033] GetLastError () returned 0x0 [0256.033] SetLastError (dwErrCode=0x0) [0256.033] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5178, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.033] GetLastError () returned 0x0 [0256.034] SetLastError (dwErrCode=0x0) [0256.034] GetLastError () returned 0x0 [0256.034] SetLastError (dwErrCode=0x0) [0256.034] GetLastError () returned 0x0 [0256.034] SetLastError (dwErrCode=0x0) [0256.034] GetLastError () returned 0x0 [0256.034] SetLastError (dwErrCode=0x0) [0256.034] GetLastError () returned 0x0 [0256.034] SetLastError (dwErrCode=0x0) [0256.034] GetLastError () returned 0x0 [0256.034] SetLastError (dwErrCode=0x0) [0256.034] GetLastError () returned 0x0 [0256.034] SetLastError (dwErrCode=0x0) [0256.034] GetLastError () returned 0x0 [0256.034] SetLastError (dwErrCode=0x0) [0256.034] GetLastError () returned 0x0 [0256.034] SetLastError (dwErrCode=0x0) [0256.034] GetLastError () returned 0x0 [0256.035] SetLastError (dwErrCode=0x0) [0256.035] GetLastError () returned 0x0 [0256.035] SetLastError (dwErrCode=0x0) [0256.035] GetLastError () returned 0x0 [0256.035] SetLastError (dwErrCode=0x0) [0256.035] GetLastError () returned 0x0 [0256.035] SetLastError (dwErrCode=0x0) [0256.035] GetLastError () returned 0x0 [0256.035] SetLastError (dwErrCode=0x0) [0256.035] GetLastError () returned 0x0 [0256.035] SetLastError (dwErrCode=0x0) [0256.035] GetLastError () returned 0x0 [0256.035] SetLastError (dwErrCode=0x0) [0256.035] GetLastError () returned 0x0 [0256.035] SetLastError (dwErrCode=0x0) [0256.035] GetLastError () returned 0x0 [0256.035] SetLastError (dwErrCode=0x0) [0256.035] GetLastError () returned 0x0 [0256.035] SetLastError (dwErrCode=0x0) [0256.036] GetLastError () returned 0x0 [0256.036] SetLastError (dwErrCode=0x0) [0256.036] GetLastError () returned 0x0 [0256.036] SetLastError (dwErrCode=0x0) [0256.036] GetLastError () returned 0x0 [0256.036] SetLastError (dwErrCode=0x0) [0256.036] GetLastError () returned 0x0 [0256.036] SetLastError (dwErrCode=0x0) [0256.036] GetLastError () returned 0x0 [0256.036] SetLastError (dwErrCode=0x0) [0256.036] GetLastError () returned 0x0 [0256.036] SetLastError (dwErrCode=0x0) [0256.036] SysReAllocStringLen (in: pbstr=0x7ff2b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7ff2b0*="C:\\") returned 1 [0256.036] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.036] SysReAllocStringLen (in: pbstr=0x7ff2b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ff2b8*="c:\\") returned 1 [0256.036] SysReAllocStringLen (in: pbstr=0x7ff2a8*=0x0, psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", len=0x20 | out: pbstr=0x7ff2a8*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\") returned 1 [0256.036] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", cchLength=0x20 | out: lpsz="c:\\users\\rdhj0c~1\\appdata\\local\\") returned 0x20 [0256.036] SysReAllocStringLen (in: pbstr=0x7ff2b0*=0x0, psz="c:\\users\\rdhj0c~1\\appdata\\local\\", len=0x20 | out: pbstr=0x7ff2b0*="c:\\users\\rdhj0c~1\\appdata\\local\\") returned 1 [0256.037] SetLastError (dwErrCode=0x0) [0256.037] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\appdata\\local\\", cchCount1=32, lpString2="c:\\", cchCount2=3) returned 3 [0256.037] GetLastError () returned 0x0 [0256.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0256.037] GetLastError () returned 0x0 [0256.037] SetLastError (dwErrCode=0x0) [0256.037] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", cchWideChar=32, lpMultiByteStr=0xabb768, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", lpUsedDefaultChar=0x0) returned 32 [0256.037] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=32, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0256.037] GetLastError () returned 0x0 [0256.037] SetLastError (dwErrCode=0x0) [0256.037] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=32, lpWideCharStr=0xadb4a8, cchWideChar=32 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\") returned 32 [0256.037] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", lpFindFileData=0x7ff3c8 | out: lpFindFileData=0x7ff3c8*(dwFileAttributes=0x8f0000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x9009c0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0xadb5a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x25, cFileName="", cAlternateFileName="翶")) returned 0xffffffffffffffff [0256.038] GetLastError () returned 0x2 [0256.038] GetLastError () returned 0x2 [0256.038] SetLastError (dwErrCode=0x2) [0256.038] GetLastError () returned 0x2 [0256.038] SetLastError (dwErrCode=0x2) [0256.038] GetLastError () returned 0x0 [0256.038] SetLastError (dwErrCode=0x0) [0256.038] GetLastError () returned 0x0 [0256.038] SetLastError (dwErrCode=0x0) [0256.038] GetLastError () returned 0x0 [0256.038] SetLastError (dwErrCode=0x0) [0256.038] GetLastError () returned 0x0 [0256.038] SetLastError (dwErrCode=0x0) [0256.039] SysReAllocStringLen (in: pbstr=0x7ff390*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", psz="C:\\Users\\RDHJ0C~1\\AppData\\Local", len=0x1f | out: pbstr=0x7ff390*="C:\\Users\\RDHJ0C~1\\AppData\\Local") returned 1 [0256.039] GetLastError () returned 0x0 [0256.039] SetLastError (dwErrCode=0x0) [0256.039] GetLastError () returned 0x0 [0256.039] SetLastError (dwErrCode=0x0) [0256.039] GetLastError () returned 0x0 [0256.039] SetLastError (dwErrCode=0x0) [0256.039] GetLastError () returned 0x0 [0256.039] SetLastError (dwErrCode=0x0) [0256.039] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7fee70 | out: lpBuffer=0x0, lpFilePart=0x7fee70*=0x0) returned 0x2a [0256.039] GetLastError () returned 0x0 [0256.039] SetLastError (dwErrCode=0x0) [0256.039] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb4a8, lpFilePart=0x7fee70 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7fee70*="Temp") returned 0x28 [0256.039] GetLastError () returned 0x0 [0256.039] SetLastError (dwErrCode=0x0) [0256.039] GetLastError () returned 0x0 [0256.039] SetLastError (dwErrCode=0x0) [0256.039] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.039] GetLastError () returned 0x0 [0256.040] SetLastError (dwErrCode=0x0) [0256.040] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.040] GetLastError () returned 0x0 [0256.040] SetLastError (dwErrCode=0x0) [0256.040] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.040] GetLastError () returned 0x0 [0256.040] SetLastError (dwErrCode=0x0) [0256.040] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.040] GetLastError () returned 0x0 [0256.040] SetLastError (dwErrCode=0x0) [0256.040] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.040] GetLastError () returned 0x0 [0256.040] SetLastError (dwErrCode=0x0) [0256.040] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.040] GetLastError () returned 0x0 [0256.040] SetLastError (dwErrCode=0x0) [0256.040] GetLastError () returned 0x0 [0256.040] SetLastError (dwErrCode=0x0) [0256.040] GetLastError () returned 0x0 [0256.040] SetLastError (dwErrCode=0x0) [0256.041] GetLastError () returned 0x0 [0256.041] SetLastError (dwErrCode=0x0) [0256.041] GetLastError () returned 0x0 [0256.041] SetLastError (dwErrCode=0x0) [0256.041] GetLastError () returned 0x0 [0256.041] SetLastError (dwErrCode=0x0) [0256.041] GetLastError () returned 0x0 [0256.041] SetLastError (dwErrCode=0x0) [0256.041] GetLastError () returned 0x0 [0256.041] SetLastError (dwErrCode=0x0) [0256.041] GetLastError () returned 0x0 [0256.041] SetLastError (dwErrCode=0x0) [0256.041] GetLastError () returned 0x0 [0256.041] SetLastError (dwErrCode=0x0) [0256.041] GetLastError () returned 0x0 [0256.041] SetLastError (dwErrCode=0x0) [0256.041] GetLastError () returned 0x0 [0256.041] SetLastError (dwErrCode=0x0) [0256.041] GetLastError () returned 0x0 [0256.042] SetLastError (dwErrCode=0x0) [0256.042] GetLastError () returned 0x0 [0256.042] SetLastError (dwErrCode=0x0) [0256.042] GetLastError () returned 0x0 [0256.042] SetLastError (dwErrCode=0x0) [0256.042] GetLastError () returned 0x0 [0256.042] SetLastError (dwErrCode=0x0) [0256.042] GetLastError () returned 0x0 [0256.042] SetLastError (dwErrCode=0x0) [0256.042] GetLastError () returned 0x0 [0256.042] SetLastError (dwErrCode=0x0) [0256.042] GetLastError () returned 0x0 [0256.042] SetLastError (dwErrCode=0x0) [0256.042] GetLastError () returned 0x0 [0256.042] SetLastError (dwErrCode=0x0) [0256.042] GetLastError () returned 0x0 [0256.042] SetLastError (dwErrCode=0x0) [0256.043] GetLastError () returned 0x0 [0256.043] SetLastError (dwErrCode=0x0) [0256.043] GetLastError () returned 0x0 [0256.043] SetLastError (dwErrCode=0x0) [0256.043] GetLastError () returned 0x0 [0256.043] SetLastError (dwErrCode=0x0) [0256.043] GetLastError () returned 0x0 [0256.043] SetLastError (dwErrCode=0x0) [0256.043] SysReAllocStringLen (in: pbstr=0x7fefb0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7fefb0*="C:\\") returned 1 [0256.043] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.043] SysReAllocStringLen (in: pbstr=0x7fefb8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7fefb8*="c:\\") returned 1 [0256.043] SysReAllocStringLen (in: pbstr=0x7fefa8*=0x0, psz="C:\\Users\\RDHJ0C~1\\AppData\\", len=0x1a | out: pbstr=0x7fefa8*="C:\\Users\\RDHJ0C~1\\AppData\\") returned 1 [0256.043] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\AppData\\", cchLength=0x1a | out: lpsz="c:\\users\\rdhj0c~1\\appdata\\") returned 0x1a [0256.043] SysReAllocStringLen (in: pbstr=0x7fefb0*=0x0, psz="c:\\users\\rdhj0c~1\\appdata\\", len=0x1a | out: pbstr=0x7fefb0*="c:\\users\\rdhj0c~1\\appdata\\") returned 1 [0256.043] SetLastError (dwErrCode=0x0) [0256.043] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\appdata\\", cchCount1=26, lpString2="c:\\", cchCount2=3) returned 3 [0256.043] GetLastError () returned 0x0 [0256.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0256.044] GetLastError () returned 0x0 [0256.044] SetLastError (dwErrCode=0x0) [0256.044] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\", cchWideChar=26, lpMultiByteStr=0xac5178, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\", lpUsedDefaultChar=0x0) returned 26 [0256.044] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5178, cbMultiByte=26, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0256.044] GetLastError () returned 0x0 [0256.044] SetLastError (dwErrCode=0x0) [0256.044] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5178, cbMultiByte=26, lpWideCharStr=0xabb768, cchWideChar=26 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\") returned 26 [0256.044] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\", lpFindFileData=0x7ff0c8 | out: lpFindFileData=0x7ff0c8*(dwFileAttributes=0x8f0000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x8fe090, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0xadb4a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x20, cFileName="", cAlternateFileName="翶")) returned 0xffffffffffffffff [0256.044] GetLastError () returned 0x2 [0256.044] GetLastError () returned 0x2 [0256.044] SetLastError (dwErrCode=0x2) [0256.044] GetLastError () returned 0x2 [0256.044] SetLastError (dwErrCode=0x2) [0256.045] GetLastError () returned 0x0 [0256.045] SetLastError (dwErrCode=0x0) [0256.045] GetLastError () returned 0x0 [0256.045] SetLastError (dwErrCode=0x0) [0256.045] GetLastError () returned 0x0 [0256.045] SetLastError (dwErrCode=0x0) [0256.045] GetLastError () returned 0x0 [0256.045] SetLastError (dwErrCode=0x0) [0256.045] SysReAllocStringLen (in: pbstr=0x7ff090*="C:\\Users\\RDHJ0C~1\\AppData\\", psz="C:\\Users\\RDHJ0C~1\\AppData", len=0x19 | out: pbstr=0x7ff090*="C:\\Users\\RDHJ0C~1\\AppData") returned 1 [0256.045] GetLastError () returned 0x0 [0256.045] SetLastError (dwErrCode=0x0) [0256.045] GetLastError () returned 0x0 [0256.045] SetLastError (dwErrCode=0x0) [0256.045] GetLastError () returned 0x0 [0256.045] SetLastError (dwErrCode=0x0) [0256.046] GetLastError () returned 0x0 [0256.046] SetLastError (dwErrCode=0x0) [0256.046] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7feb70 | out: lpBuffer=0x0, lpFilePart=0x7feb70*=0x0) returned 0x2a [0256.046] GetLastError () returned 0x0 [0256.046] SetLastError (dwErrCode=0x0) [0256.046] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb4a8, lpFilePart=0x7feb70 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7feb70*="Temp") returned 0x28 [0256.046] GetLastError () returned 0x0 [0256.046] SetLastError (dwErrCode=0x0) [0256.046] GetLastError () returned 0x0 [0256.046] SetLastError (dwErrCode=0x0) [0256.046] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.046] GetLastError () returned 0x0 [0256.046] SetLastError (dwErrCode=0x0) [0256.046] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5178, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.046] GetLastError () returned 0x0 [0256.046] SetLastError (dwErrCode=0x0) [0256.046] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.046] GetLastError () returned 0x0 [0256.046] SetLastError (dwErrCode=0x0) [0256.046] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5178, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.046] GetLastError () returned 0x0 [0256.046] SetLastError (dwErrCode=0x0) [0256.047] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.047] GetLastError () returned 0x0 [0256.047] SetLastError (dwErrCode=0x0) [0256.047] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5178, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.047] GetLastError () returned 0x0 [0256.047] SetLastError (dwErrCode=0x0) [0256.047] GetLastError () returned 0x0 [0256.047] SetLastError (dwErrCode=0x0) [0256.047] GetLastError () returned 0x0 [0256.047] SetLastError (dwErrCode=0x0) [0256.047] GetLastError () returned 0x0 [0256.047] SetLastError (dwErrCode=0x0) [0256.047] GetLastError () returned 0x0 [0256.047] SetLastError (dwErrCode=0x0) [0256.047] GetLastError () returned 0x0 [0256.047] SetLastError (dwErrCode=0x0) [0256.047] GetLastError () returned 0x0 [0256.047] SetLastError (dwErrCode=0x0) [0256.047] GetLastError () returned 0x0 [0256.048] SetLastError (dwErrCode=0x0) [0256.048] GetLastError () returned 0x0 [0256.048] SetLastError (dwErrCode=0x0) [0256.048] GetLastError () returned 0x0 [0256.048] SetLastError (dwErrCode=0x0) [0256.048] GetLastError () returned 0x0 [0256.048] SetLastError (dwErrCode=0x0) [0256.048] GetLastError () returned 0x0 [0256.048] SetLastError (dwErrCode=0x0) [0256.048] GetLastError () returned 0x0 [0256.048] SetLastError (dwErrCode=0x0) [0256.048] GetLastError () returned 0x0 [0256.048] SetLastError (dwErrCode=0x0) [0256.048] GetLastError () returned 0x0 [0256.048] SetLastError (dwErrCode=0x0) [0256.048] GetLastError () returned 0x0 [0256.048] SetLastError (dwErrCode=0x0) [0256.048] GetLastError () returned 0x0 [0256.049] SetLastError (dwErrCode=0x0) [0256.049] GetLastError () returned 0x0 [0256.049] SetLastError (dwErrCode=0x0) [0256.049] GetLastError () returned 0x0 [0256.049] SetLastError (dwErrCode=0x0) [0256.049] GetLastError () returned 0x0 [0256.049] SetLastError (dwErrCode=0x0) [0256.049] GetLastError () returned 0x0 [0256.049] SetLastError (dwErrCode=0x0) [0256.049] GetLastError () returned 0x0 [0256.049] SetLastError (dwErrCode=0x0) [0256.049] GetLastError () returned 0x0 [0256.049] SetLastError (dwErrCode=0x0) [0256.049] GetLastError () returned 0x0 [0256.049] SetLastError (dwErrCode=0x0) [0256.050] GetLastError () returned 0x0 [0256.050] SetLastError (dwErrCode=0x0) [0256.050] SysReAllocStringLen (in: pbstr=0x7fecb0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7fecb0*="C:\\") returned 1 [0256.050] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.050] SysReAllocStringLen (in: pbstr=0x7fecb8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7fecb8*="c:\\") returned 1 [0256.050] SysReAllocStringLen (in: pbstr=0x7feca8*=0x0, psz="C:\\Users\\RDHJ0C~1\\", len=0x12 | out: pbstr=0x7feca8*="C:\\Users\\RDHJ0C~1\\") returned 1 [0256.050] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\", cchLength=0x12 | out: lpsz="c:\\users\\rdhj0c~1\\") returned 0x12 [0256.050] SysReAllocStringLen (in: pbstr=0x7fecb0*=0x0, psz="c:\\users\\rdhj0c~1\\", len=0x12 | out: pbstr=0x7fecb0*="c:\\users\\rdhj0c~1\\") returned 1 [0256.050] SetLastError (dwErrCode=0x0) [0256.050] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\", cchCount1=18, lpString2="c:\\", cchCount2=3) returned 3 [0256.050] GetLastError () returned 0x0 [0256.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0256.050] GetLastError () returned 0x0 [0256.050] SetLastError (dwErrCode=0x0) [0256.050] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\", cchWideChar=18, lpMultiByteStr=0xac5138, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\", lpUsedDefaultChar=0x0) returned 18 [0256.050] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=18, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0256.050] GetLastError () returned 0x0 [0256.050] SetLastError (dwErrCode=0x0) [0256.050] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=18, lpWideCharStr=0xabb708, cchWideChar=18 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\") returned 18 [0256.051] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\", lpFindFileData=0x7fedc8 | out: lpFindFileData=0x7fedc8*(dwFileAttributes=0x8f0000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x905590, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0xabb768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1a, cFileName="", cAlternateFileName="翶")) returned 0xffffffffffffffff [0256.051] GetLastError () returned 0x2 [0256.051] GetLastError () returned 0x2 [0256.051] SetLastError (dwErrCode=0x2) [0256.051] GetLastError () returned 0x2 [0256.051] SetLastError (dwErrCode=0x2) [0256.051] GetLastError () returned 0x0 [0256.051] SetLastError (dwErrCode=0x0) [0256.051] GetLastError () returned 0x0 [0256.051] SetLastError (dwErrCode=0x0) [0256.051] GetLastError () returned 0x0 [0256.051] SetLastError (dwErrCode=0x0) [0256.051] GetLastError () returned 0x0 [0256.051] SetLastError (dwErrCode=0x0) [0256.052] SysReAllocStringLen (in: pbstr=0x7fed90*="C:\\Users\\RDHJ0C~1\\", psz="C:\\Users\\RDHJ0C~1", len=0x11 | out: pbstr=0x7fed90*="C:\\Users\\RDHJ0C~1") returned 1 [0256.052] GetLastError () returned 0x0 [0256.052] SetLastError (dwErrCode=0x0) [0256.052] GetLastError () returned 0x0 [0256.052] SetLastError (dwErrCode=0x0) [0256.059] GetLastError () returned 0x0 [0256.059] SetLastError (dwErrCode=0x0) [0256.059] GetLastError () returned 0x0 [0256.059] SetLastError (dwErrCode=0x0) [0256.059] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7fe870 | out: lpBuffer=0x0, lpFilePart=0x7fe870*=0x0) returned 0x2a [0256.059] GetLastError () returned 0x0 [0256.059] SetLastError (dwErrCode=0x0) [0256.059] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb4a8, lpFilePart=0x7fe870 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7fe870*="Temp") returned 0x28 [0256.059] GetLastError () returned 0x0 [0256.059] SetLastError (dwErrCode=0x0) [0256.059] GetLastError () returned 0x0 [0256.059] SetLastError (dwErrCode=0x0) [0256.059] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.059] GetLastError () returned 0x0 [0256.059] SetLastError (dwErrCode=0x0) [0256.059] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5178, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.059] GetLastError () returned 0x0 [0256.060] SetLastError (dwErrCode=0x0) [0256.060] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.060] GetLastError () returned 0x0 [0256.060] SetLastError (dwErrCode=0x0) [0256.060] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5178, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.060] GetLastError () returned 0x0 [0256.060] SetLastError (dwErrCode=0x0) [0256.060] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.060] GetLastError () returned 0x0 [0256.060] SetLastError (dwErrCode=0x0) [0256.060] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5178, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.060] GetLastError () returned 0x0 [0256.060] SetLastError (dwErrCode=0x0) [0256.060] GetLastError () returned 0x0 [0256.060] SetLastError (dwErrCode=0x0) [0256.060] GetLastError () returned 0x0 [0256.060] SetLastError (dwErrCode=0x0) [0256.060] GetLastError () returned 0x0 [0256.060] SetLastError (dwErrCode=0x0) [0256.060] GetLastError () returned 0x0 [0256.060] SetLastError (dwErrCode=0x0) [0256.060] GetLastError () returned 0x0 [0256.060] SetLastError (dwErrCode=0x0) [0256.061] GetLastError () returned 0x0 [0256.061] SetLastError (dwErrCode=0x0) [0256.061] GetLastError () returned 0x0 [0256.061] SetLastError (dwErrCode=0x0) [0256.061] GetLastError () returned 0x0 [0256.061] SetLastError (dwErrCode=0x0) [0256.061] GetLastError () returned 0x0 [0256.061] SetLastError (dwErrCode=0x0) [0256.061] GetLastError () returned 0x0 [0256.061] SetLastError (dwErrCode=0x0) [0256.061] GetLastError () returned 0x0 [0256.061] SetLastError (dwErrCode=0x0) [0256.061] GetLastError () returned 0x0 [0256.061] SetLastError (dwErrCode=0x0) [0256.061] GetLastError () returned 0x0 [0256.061] SetLastError (dwErrCode=0x0) [0256.061] GetLastError () returned 0x0 [0256.062] SetLastError (dwErrCode=0x0) [0256.062] GetLastError () returned 0x0 [0256.062] SetLastError (dwErrCode=0x0) [0256.062] GetLastError () returned 0x0 [0256.062] SetLastError (dwErrCode=0x0) [0256.062] GetLastError () returned 0x0 [0256.062] SetLastError (dwErrCode=0x0) [0256.062] GetLastError () returned 0x0 [0256.062] SetLastError (dwErrCode=0x0) [0256.062] GetLastError () returned 0x0 [0256.062] SetLastError (dwErrCode=0x0) [0256.062] GetLastError () returned 0x0 [0256.062] SetLastError (dwErrCode=0x0) [0256.062] GetLastError () returned 0x0 [0256.062] SetLastError (dwErrCode=0x0) [0256.062] GetLastError () returned 0x0 [0256.062] SetLastError (dwErrCode=0x0) [0256.063] GetLastError () returned 0x0 [0256.063] SetLastError (dwErrCode=0x0) [0256.063] GetLastError () returned 0x0 [0256.063] SetLastError (dwErrCode=0x0) [0256.063] SysReAllocStringLen (in: pbstr=0x7fe9b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7fe9b0*="C:\\") returned 1 [0256.063] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.063] SysReAllocStringLen (in: pbstr=0x7fe9b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7fe9b8*="c:\\") returned 1 [0256.063] SysReAllocStringLen (in: pbstr=0x7fe9a8*=0x0, psz="C:\\Users\\", len=0x9 | out: pbstr=0x7fe9a8*="C:\\Users\\") returned 1 [0256.063] CharLowerBuffW (in: lpsz="C:\\Users\\", cchLength=0x9 | out: lpsz="c:\\users\\") returned 0x9 [0256.063] SysReAllocStringLen (in: pbstr=0x7fe9b0*=0x0, psz="c:\\users\\", len=0x9 | out: pbstr=0x7fe9b0*="c:\\users\\") returned 1 [0256.063] SetLastError (dwErrCode=0x0) [0256.063] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\", cchCount1=9, lpString2="c:\\", cchCount2=3) returned 3 [0256.063] GetLastError () returned 0x0 [0256.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0256.063] GetLastError () returned 0x0 [0256.063] SetLastError (dwErrCode=0x0) [0256.063] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\", cchWideChar=9, lpMultiByteStr=0xac5138, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\", lpUsedDefaultChar=0x0) returned 9 [0256.063] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0256.063] GetLastError () returned 0x0 [0256.064] SetLastError (dwErrCode=0x0) [0256.064] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=9, lpWideCharStr=0xac5178, cchWideChar=9 | out: lpWideCharStr="C:\\Users\\") returned 9 [0256.064] FindFirstFileW (in: lpFileName="C:\\Users\\", lpFindFileData=0x7feac8 | out: lpFindFileData=0x7feac8*(dwFileAttributes=0x8f0000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x9002c0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0xabb708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="", cAlternateFileName="翶")) returned 0xffffffffffffffff [0256.064] SysReAllocStringLen (in: pbstr=0x7fea90*="C:\\Users\\", psz="C:\\Users", len=0x8 | out: pbstr=0x7fea90*="C:\\Users") returned 1 [0256.064] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7fe570 | out: lpBuffer=0x0, lpFilePart=0x7fe570*=0x0) returned 0x2a [0256.064] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb4a8, lpFilePart=0x7fe570 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7fe570*="Temp") returned 0x28 [0256.064] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.064] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac51f8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.064] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.065] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac51f8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.065] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.065] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac51f8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.065] SysReAllocStringLen (in: pbstr=0x7fe6b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7fe6b0*="C:\\") returned 1 [0256.065] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.065] SysReAllocStringLen (in: pbstr=0x7fe6b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7fe6b8*="c:\\") returned 1 [0256.065] SysReAllocStringLen (in: pbstr=0x7fe6a8*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7fe6a8*="C:\\") returned 1 [0256.065] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.065] SysReAllocStringLen (in: pbstr=0x7fe6b0*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7fe6b0*="c:\\") returned 1 [0256.066] SetLastError (dwErrCode=0x0) [0256.066] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\", cchCount1=3, lpString2="c:\\", cchCount2=3) returned 2 [0256.066] GetLastError () returned 0x0 [0256.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.066] GetLastError () returned 0x0 [0256.066] SetLastError (dwErrCode=0x0) [0256.066] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users", cchWideChar=8, lpMultiByteStr=0xac5238, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users", lpUsedDefaultChar=0x0) returned 8 [0256.066] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5238, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0256.066] GetLastError () returned 0x0 [0256.066] SetLastError (dwErrCode=0x0) [0256.066] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5238, cbMultiByte=8, lpWideCharStr=0xac5178, cchWideChar=8 | out: lpWideCharStr="C:\\Users") returned 8 [0256.066] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x7fe7c8 | out: lpFindFileData=0x7fe7c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9, cFileName="Users", cAlternateFileName="")) returned 0x24d1d40 [0256.066] FileTimeToLocalFileTime (in: lpFileTime=0x7fe7dc, lpLocalFileTime=0x7fe5b0 | out: lpLocalFileTime=0x7fe5b0) returned 1 [0256.066] FileTimeToDosDateTime (in: lpFileTime=0x7fe5b0, lpFatDate=0x7fe79a, lpFatTime=0x7fe798 | out: lpFatDate=0x7fe79a, lpFatTime=0x7fe798) returned 1 [0256.067] GetLastError () returned 0x0 [0256.067] SetLastError (dwErrCode=0x0) [0256.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.067] GetLastError () returned 0x0 [0256.067] SetLastError (dwErrCode=0x0) [0256.067] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=5, lpMultiByteStr=0xac51b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Users", lpUsedDefaultChar=0x0) returned 5 [0256.067] GetLastError () returned 0x0 [0256.067] SetLastError (dwErrCode=0x0) [0256.067] GetLastError () returned 0x0 [0256.067] SetLastError (dwErrCode=0x0) [0256.067] GetLastError () returned 0x0 [0256.067] SetLastError (dwErrCode=0x0) [0256.067] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac51b8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0256.067] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac51b8, cbMultiByte=5, lpWideCharStr=0x24d24e8, cchWideChar=5 | out: lpWideCharStr="Users") returned 5 [0256.067] FindClose (in: hFindFile=0x24d1d40 | out: hFindFile=0x24d1d40) returned 1 [0256.068] GetLastError () returned 0x0 [0256.068] SetLastError (dwErrCode=0x0) [0256.068] SysReAllocStringLen (in: pbstr=0x7fea90*="C:\\Users", psz="C:\\Users", len=0x8 | out: pbstr=0x7fea90*="C:\\Users") returned 1 [0256.068] GetLastError () returned 0x0 [0256.068] SetLastError (dwErrCode=0x0) [0256.068] GetLastError () returned 0x0 [0256.068] SetLastError (dwErrCode=0x0) [0256.068] GetLastError () returned 0x0 [0256.068] SetLastError (dwErrCode=0x0) [0256.068] GetLastError () returned 0x0 [0256.068] SetLastError (dwErrCode=0x0) [0256.068] SysReAllocStringLen (in: pbstr=0x7fea90*="C:\\Users", psz="C:\\Users\\", len=0x9 | out: pbstr=0x7fea90*="C:\\Users\\") returned 1 [0256.068] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.068] GetLastError () returned 0x0 [0256.069] SetLastError (dwErrCode=0x0) [0256.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1", cchWideChar=17, lpMultiByteStr=0xac5238, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1", lpUsedDefaultChar=0x0) returned 17 [0256.069] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5238, cbMultiByte=17, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0256.069] GetLastError () returned 0x0 [0256.069] SetLastError (dwErrCode=0x0) [0256.069] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5238, cbMultiByte=17, lpWideCharStr=0xabb768, cchWideChar=17 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1") returned 17 [0256.069] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1", lpFindFileData=0x7feac8 | out: lpFindFileData=0x7feac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x24d17a0 [0256.069] FileTimeToLocalFileTime (in: lpFileTime=0x7feadc, lpLocalFileTime=0x7fe8b0 | out: lpLocalFileTime=0x7fe8b0) returned 1 [0256.069] FileTimeToDosDateTime (in: lpFileTime=0x7fe8b0, lpFatDate=0x7fea9a, lpFatTime=0x7fea98 | out: lpFatDate=0x7fea9a, lpFatTime=0x7fea98) returned 1 [0256.069] GetLastError () returned 0x0 [0256.069] SetLastError (dwErrCode=0x0) [0256.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RDhJ0CNFevzX", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0256.069] GetLastError () returned 0x0 [0256.069] SetLastError (dwErrCode=0x0) [0256.069] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RDhJ0CNFevzX", cchWideChar=12, lpMultiByteStr=0xac5138, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RDhJ0CNFevzX", lpUsedDefaultChar=0x0) returned 12 [0256.069] GetLastError () returned 0x0 [0256.069] SetLastError (dwErrCode=0x0) [0256.070] GetLastError () returned 0x0 [0256.070] SetLastError (dwErrCode=0x0) [0256.070] GetLastError () returned 0x0 [0256.070] SetLastError (dwErrCode=0x0) [0256.070] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0256.070] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=12, lpWideCharStr=0x905648, cchWideChar=12 | out: lpWideCharStr="RDhJ0CNFevzX") returned 12 [0256.070] FindClose (in: hFindFile=0x24d17a0 | out: hFindFile=0x24d17a0) returned 1 [0256.070] GetLastError () returned 0x0 [0256.070] SetLastError (dwErrCode=0x0) [0256.070] SysReAllocStringLen (in: pbstr=0x7fed90*="C:\\Users\\RDHJ0C~1", psz="C:\\Users\\RDhJ0CNFevzX", len=0x15 | out: pbstr=0x7fed90*="C:\\Users\\RDhJ0CNFevzX") returned 1 [0256.070] GetLastError () returned 0x0 [0256.070] SetLastError (dwErrCode=0x0) [0256.070] GetLastError () returned 0x0 [0256.070] SetLastError (dwErrCode=0x0) [0256.071] GetLastError () returned 0x0 [0256.071] SetLastError (dwErrCode=0x0) [0256.071] GetLastError () returned 0x0 [0256.071] SetLastError (dwErrCode=0x0) [0256.071] SysReAllocStringLen (in: pbstr=0x7fed90*="C:\\Users\\RDhJ0CNFevzX", psz="C:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x7fed90*="C:\\Users\\RDhJ0CNFevzX\\") returned 1 [0256.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0256.071] GetLastError () returned 0x0 [0256.071] SetLastError (dwErrCode=0x0) [0256.071] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData", cchWideChar=29, lpMultiByteStr=0xac5138, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData", lpUsedDefaultChar=0x0) returned 29 [0256.071] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0256.071] GetLastError () returned 0x0 [0256.071] SetLastError (dwErrCode=0x0) [0256.071] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=29, lpWideCharStr=0xabb648, cchWideChar=29 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData") returned 29 [0256.071] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData", lpFindFileData=0x7fedc8 | out: lpFindFileData=0x7fedc8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1a, cFileName="AppData", cAlternateFileName="")) returned 0x24d1500 [0256.071] FileTimeToLocalFileTime (in: lpFileTime=0x7feddc, lpLocalFileTime=0x7febb0 | out: lpLocalFileTime=0x7febb0) returned 1 [0256.071] FileTimeToDosDateTime (in: lpFileTime=0x7febb0, lpFatDate=0x7fed9a, lpFatTime=0x7fed98 | out: lpFatDate=0x7fed9a, lpFatTime=0x7fed98) returned 1 [0256.072] GetLastError () returned 0x0 [0256.072] SetLastError (dwErrCode=0x0) [0256.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.072] GetLastError () returned 0x0 [0256.072] SetLastError (dwErrCode=0x0) [0256.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=7, lpMultiByteStr=0xac51b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppData", lpUsedDefaultChar=0x0) returned 7 [0256.072] GetLastError () returned 0x0 [0256.072] SetLastError (dwErrCode=0x0) [0256.072] GetLastError () returned 0x0 [0256.072] SetLastError (dwErrCode=0x0) [0256.072] GetLastError () returned 0x0 [0256.072] SetLastError (dwErrCode=0x0) [0256.072] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac51b8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0256.072] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac51b8, cbMultiByte=7, lpWideCharStr=0x24d2968, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0256.072] FindClose (in: hFindFile=0x24d1500 | out: hFindFile=0x24d1500) returned 1 [0256.072] GetLastError () returned 0x0 [0256.072] SetLastError (dwErrCode=0x0) [0256.073] SysReAllocStringLen (in: pbstr=0x7ff090*="C:\\Users\\RDHJ0C~1\\AppData", psz="C:\\Users\\RDhJ0CNFevzX\\AppData", len=0x1d | out: pbstr=0x7ff090*="C:\\Users\\RDhJ0CNFevzX\\AppData") returned 1 [0256.073] GetLastError () returned 0x0 [0256.073] SetLastError (dwErrCode=0x0) [0256.073] GetLastError () returned 0x0 [0256.073] SetLastError (dwErrCode=0x0) [0256.073] GetLastError () returned 0x0 [0256.073] SetLastError (dwErrCode=0x0) [0256.073] GetLastError () returned 0x0 [0256.073] SetLastError (dwErrCode=0x0) [0256.073] SysReAllocStringLen (in: pbstr=0x7ff090*="C:\\Users\\RDhJ0CNFevzX\\AppData", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x7ff090*="C:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0256.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0256.073] GetLastError () returned 0x0 [0256.073] SetLastError (dwErrCode=0x0) [0256.073] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", cchWideChar=35, lpMultiByteStr=0xabb768, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpUsedDefaultChar=0x0) returned 35 [0256.073] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0256.073] GetLastError () returned 0x0 [0256.074] SetLastError (dwErrCode=0x0) [0256.074] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=35, lpWideCharStr=0xadb4a8, cchWideChar=35 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 35 [0256.074] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFindFileData=0x7ff0c8 | out: lpFindFileData=0x7ff0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x20, cFileName="Local", cAlternateFileName="")) returned 0x24d1d40 [0256.074] FileTimeToLocalFileTime (in: lpFileTime=0x7ff0dc, lpLocalFileTime=0x7feeb0 | out: lpLocalFileTime=0x7feeb0) returned 1 [0256.074] FileTimeToDosDateTime (in: lpFileTime=0x7feeb0, lpFatDate=0x7ff09a, lpFatTime=0x7ff098 | out: lpFatDate=0x7ff09a, lpFatTime=0x7ff098) returned 1 [0256.074] GetLastError () returned 0x0 [0256.074] SetLastError (dwErrCode=0x0) [0256.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Local", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.074] GetLastError () returned 0x0 [0256.074] SetLastError (dwErrCode=0x0) [0256.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Local", cchWideChar=5, lpMultiByteStr=0xac5138, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Local", lpUsedDefaultChar=0x0) returned 5 [0256.074] GetLastError () returned 0x0 [0256.074] SetLastError (dwErrCode=0x0) [0256.074] GetLastError () returned 0x0 [0256.074] SetLastError (dwErrCode=0x0) [0256.074] GetLastError () returned 0x0 [0256.074] SetLastError (dwErrCode=0x0) [0256.074] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0256.074] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=5, lpWideCharStr=0x24d2968, cchWideChar=5 | out: lpWideCharStr="Local") returned 5 [0256.075] FindClose (in: hFindFile=0x24d1d40 | out: hFindFile=0x24d1d40) returned 1 [0256.075] GetLastError () returned 0x0 [0256.075] SetLastError (dwErrCode=0x0) [0256.075] SysReAllocStringLen (in: pbstr=0x7ff390*="C:\\Users\\RDHJ0C~1\\AppData\\Local", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", len=0x23 | out: pbstr=0x7ff390*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 1 [0256.075] GetLastError () returned 0x0 [0256.075] SetLastError (dwErrCode=0x0) [0256.075] GetLastError () returned 0x0 [0256.075] SetLastError (dwErrCode=0x0) [0256.075] GetLastError () returned 0x0 [0256.075] SetLastError (dwErrCode=0x0) [0256.075] GetLastError () returned 0x0 [0256.075] SetLastError (dwErrCode=0x0) [0256.075] SysReAllocStringLen (in: pbstr=0x7ff390*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x7ff390*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0256.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.076] GetLastError () returned 0x0 [0256.076] SetLastError (dwErrCode=0x0) [0256.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", cchWideChar=40, lpMultiByteStr=0xabb768, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 40 [0256.076] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=40, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0256.076] GetLastError () returned 0x0 [0256.076] SetLastError (dwErrCode=0x0) [0256.076] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=40, lpWideCharStr=0xadb428, cchWideChar=40 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp") returned 40 [0256.076] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFindFileData=0x7ff3c8 | out: lpFindFileData=0x7ff3c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xb12b8d, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x25, cFileName="Temp", cAlternateFileName="")) returned 0x24d1c80 [0256.076] FileTimeToLocalFileTime (in: lpFileTime=0x7ff3dc, lpLocalFileTime=0x7ff1b0 | out: lpLocalFileTime=0x7ff1b0) returned 1 [0256.076] FileTimeToDosDateTime (in: lpFileTime=0x7ff1b0, lpFatDate=0x7ff39a, lpFatTime=0x7ff398 | out: lpFatDate=0x7ff39a, lpFatTime=0x7ff398) returned 1 [0256.076] GetLastError () returned 0x0 [0256.076] SetLastError (dwErrCode=0x0) [0256.076] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Temp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.076] GetLastError () returned 0x0 [0256.076] SetLastError (dwErrCode=0x0) [0256.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Temp", cchWideChar=4, lpMultiByteStr=0xac51b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Temp", lpUsedDefaultChar=0x0) returned 4 [0256.077] GetLastError () returned 0x0 [0256.077] SetLastError (dwErrCode=0x0) [0256.077] GetLastError () returned 0x0 [0256.077] SetLastError (dwErrCode=0x0) [0256.077] GetLastError () returned 0x0 [0256.077] SetLastError (dwErrCode=0x0) [0256.077] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac51b8, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.077] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac51b8, cbMultiByte=4, lpWideCharStr=0x24d2968, cchWideChar=4 | out: lpWideCharStr="Temp") returned 4 [0256.077] FindClose (in: hFindFile=0x24d1c80 | out: hFindFile=0x24d1c80) returned 1 [0256.077] GetLastError () returned 0x0 [0256.077] SetLastError (dwErrCode=0x0) [0256.077] SysReAllocStringLen (in: pbstr=0x7ff690*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", len=0x28 | out: pbstr=0x7ff690*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp") returned 1 [0256.078] GetLastError () returned 0x0 [0256.078] SetLastError (dwErrCode=0x0) [0256.078] GetLastError () returned 0x0 [0256.078] SetLastError (dwErrCode=0x0) [0256.078] GetLastError () returned 0x0 [0256.078] SetLastError (dwErrCode=0x0) [0256.078] GetLastError () returned 0x0 [0256.078] SetLastError (dwErrCode=0x0) [0256.078] SysReAllocStringLen (in: pbstr=0x7ff690*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x7ff690*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0256.078] SysReAllocStringLen (in: pbstr=0x7ff668*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x7ff668*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0256.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0256.078] GetLastError () returned 0x0 [0256.078] SetLastError (dwErrCode=0x0) [0256.078] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", cchWideChar=41, lpMultiByteStr=0xabb768, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpUsedDefaultChar=0x0) returned 41 [0256.078] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0256.078] GetLastError () returned 0x0 [0256.078] SetLastError (dwErrCode=0x0) [0256.078] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=41, lpWideCharStr=0xadb4a8, cchWideChar=41 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 41 [0256.078] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpFindFileData=0x7ff6c8 | out: lpFindFileData=0x7ff6c8*(dwFileAttributes=0x8f0000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x8f8b00, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0x40, nFileSizeHigh=0x0, nFileSizeLow=0x8fe0a0, dwReserved0=0x0, dwReserved1=0x4, cFileName="", cAlternateFileName="翶")) returned 0xffffffffffffffff [0256.079] GetLastError () returned 0x2 [0256.079] GetLastError () returned 0x2 [0256.079] SetLastError (dwErrCode=0x2) [0256.079] GetLastError () returned 0x2 [0256.079] SetLastError (dwErrCode=0x2) [0256.079] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", len=0x25 | out: pbstr=0x7ffa08*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 1 [0256.079] GetLastError () returned 0x0 [0256.079] SetLastError (dwErrCode=0x0) [0256.079] GetFileAttributesW (lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp")) returned 0x10 [0256.079] GetLastError () returned 0x0 [0256.079] SetLastError (dwErrCode=0x0) [0256.080] GetLastError () returned 0x0 [0256.080] SetLastError (dwErrCode=0x0) [0256.080] GetLastError () returned 0x0 [0256.080] SetLastError (dwErrCode=0x0) [0256.080] GetLastError () returned 0x0 [0256.080] SetLastError (dwErrCode=0x0) [0256.080] GetLastError () returned 0x0 [0256.080] SetLastError (dwErrCode=0x0) [0256.080] GetLastError () returned 0x0 [0256.080] SetLastError (dwErrCode=0x0) [0256.080] GetLastError () returned 0x0 [0256.080] SetLastError (dwErrCode=0x0) [0256.080] GetLastError () returned 0x0 [0256.080] SetLastError (dwErrCode=0x0) [0256.080] GetLastError () returned 0x0 [0256.080] SetLastError (dwErrCode=0x0) [0256.080] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff470 | out: lpBuffer=0x0, lpFilePart=0x7ff470*=0x0) returned 0x2a [0256.080] GetLastError () returned 0x0 [0256.081] SetLastError (dwErrCode=0x0) [0256.081] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb5a8, lpFilePart=0x7ff470 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff470*="Temp") returned 0x28 [0256.081] GetLastError () returned 0x0 [0256.081] SetLastError (dwErrCode=0x0) [0256.081] GetLastError () returned 0x0 [0256.081] SetLastError (dwErrCode=0x0) [0256.081] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.081] GetLastError () returned 0x0 [0256.081] SetLastError (dwErrCode=0x0) [0256.081] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.081] GetLastError () returned 0x0 [0256.081] SetLastError (dwErrCode=0x0) [0256.081] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.081] GetLastError () returned 0x0 [0256.081] SetLastError (dwErrCode=0x0) [0256.081] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac51b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.081] GetLastError () returned 0x0 [0256.081] SetLastError (dwErrCode=0x0) [0256.081] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.081] GetLastError () returned 0x0 [0256.081] SetLastError (dwErrCode=0x0) [0256.081] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.081] GetLastError () returned 0x0 [0256.082] SetLastError (dwErrCode=0x0) [0256.082] GetLastError () returned 0x0 [0256.082] SetLastError (dwErrCode=0x0) [0256.082] GetLastError () returned 0x0 [0256.082] SetLastError (dwErrCode=0x0) [0256.082] GetLastError () returned 0x0 [0256.082] SetLastError (dwErrCode=0x0) [0256.082] GetLastError () returned 0x0 [0256.082] SetLastError (dwErrCode=0x0) [0256.082] GetLastError () returned 0x0 [0256.082] SetLastError (dwErrCode=0x0) [0256.082] GetLastError () returned 0x0 [0256.082] SetLastError (dwErrCode=0x0) [0256.082] GetLastError () returned 0x0 [0256.082] SetLastError (dwErrCode=0x0) [0256.082] GetLastError () returned 0x0 [0256.082] SetLastError (dwErrCode=0x0) [0256.082] GetLastError () returned 0x0 [0256.083] SetLastError (dwErrCode=0x0) [0256.083] GetLastError () returned 0x0 [0256.083] SetLastError (dwErrCode=0x0) [0256.083] GetLastError () returned 0x0 [0256.083] SetLastError (dwErrCode=0x0) [0256.083] GetLastError () returned 0x0 [0256.083] SetLastError (dwErrCode=0x0) [0256.083] GetLastError () returned 0x0 [0256.083] SetLastError (dwErrCode=0x0) [0256.083] GetLastError () returned 0x0 [0256.083] SetLastError (dwErrCode=0x0) [0256.083] GetLastError () returned 0x0 [0256.083] SetLastError (dwErrCode=0x0) [0256.083] GetLastError () returned 0x0 [0256.083] SetLastError (dwErrCode=0x0) [0256.083] GetLastError () returned 0x0 [0256.083] SetLastError (dwErrCode=0x0) [0256.083] GetLastError () returned 0x0 [0256.083] SetLastError (dwErrCode=0x0) [0256.083] GetLastError () returned 0x0 [0256.084] SetLastError (dwErrCode=0x0) [0256.084] GetLastError () returned 0x0 [0256.084] SetLastError (dwErrCode=0x0) [0256.084] GetLastError () returned 0x0 [0256.084] SetLastError (dwErrCode=0x0) [0256.084] GetLastError () returned 0x0 [0256.084] SetLastError (dwErrCode=0x0) [0256.084] GetLastError () returned 0x0 [0256.084] SetLastError (dwErrCode=0x0) [0256.084] GetLastError () returned 0x0 [0256.084] SetLastError (dwErrCode=0x0) [0256.084] SysReAllocStringLen (in: pbstr=0x7ff5b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7ff5b0*="C:\\") returned 1 [0256.084] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.084] SysReAllocStringLen (in: pbstr=0x7ff5b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ff5b8*="c:\\") returned 1 [0256.085] SysReAllocStringLen (in: pbstr=0x7ff5a8*=0x0, psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", len=0x20 | out: pbstr=0x7ff5a8*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\") returned 1 [0256.085] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", cchLength=0x20 | out: lpsz="c:\\users\\rdhj0c~1\\appdata\\local\\") returned 0x20 [0256.085] SysReAllocStringLen (in: pbstr=0x7ff5b0*=0x0, psz="c:\\users\\rdhj0c~1\\appdata\\local\\", len=0x20 | out: pbstr=0x7ff5b0*="c:\\users\\rdhj0c~1\\appdata\\local\\") returned 1 [0256.085] SetLastError (dwErrCode=0x0) [0256.085] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\appdata\\local\\", cchCount1=32, lpString2="c:\\", cchCount2=3) returned 3 [0256.085] GetLastError () returned 0x0 [0256.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0256.085] GetLastError () returned 0x0 [0256.085] SetLastError (dwErrCode=0x0) [0256.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", cchWideChar=32, lpMultiByteStr=0xabb768, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", lpUsedDefaultChar=0x0) returned 32 [0256.085] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=32, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0256.085] GetLastError () returned 0x0 [0256.085] SetLastError (dwErrCode=0x0) [0256.085] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=32, lpWideCharStr=0xadb4a8, cchWideChar=32 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\") returned 32 [0256.085] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", lpFindFileData=0x7ff6c8 | out: lpFindFileData=0x7ff6c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x7cd27dbd, dwReserved0=0x7ff6, dwReserved1=0x0, cFileName="", cAlternateFileName="翶")) returned 0xffffffffffffffff [0256.086] GetLastError () returned 0x2 [0256.086] GetLastError () returned 0x2 [0256.086] SetLastError (dwErrCode=0x2) [0256.086] GetLastError () returned 0x2 [0256.088] SetLastError (dwErrCode=0x2) [0256.088] GetLastError () returned 0x0 [0256.088] SetLastError (dwErrCode=0x0) [0256.088] GetLastError () returned 0x0 [0256.088] SetLastError (dwErrCode=0x0) [0256.088] GetLastError () returned 0x0 [0256.088] SetLastError (dwErrCode=0x0) [0256.088] GetLastError () returned 0x0 [0256.088] SetLastError (dwErrCode=0x0) [0256.089] SysReAllocStringLen (in: pbstr=0x7ff690*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", psz="C:\\Users\\RDHJ0C~1\\AppData\\Local", len=0x1f | out: pbstr=0x7ff690*="C:\\Users\\RDHJ0C~1\\AppData\\Local") returned 1 [0256.089] GetLastError () returned 0x0 [0256.089] SetLastError (dwErrCode=0x0) [0256.089] GetLastError () returned 0x0 [0256.089] SetLastError (dwErrCode=0x0) [0256.089] GetLastError () returned 0x0 [0256.089] SetLastError (dwErrCode=0x0) [0256.089] GetLastError () returned 0x0 [0256.089] SetLastError (dwErrCode=0x0) [0256.089] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff170 | out: lpBuffer=0x0, lpFilePart=0x7ff170*=0x0) returned 0x2a [0256.089] GetLastError () returned 0x0 [0256.089] SetLastError (dwErrCode=0x0) [0256.089] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb4a8, lpFilePart=0x7ff170 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff170*="Temp") returned 0x28 [0256.089] GetLastError () returned 0x0 [0256.089] SetLastError (dwErrCode=0x0) [0256.089] GetLastError () returned 0x0 [0256.089] SetLastError (dwErrCode=0x0) [0256.089] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.089] GetLastError () returned 0x0 [0256.089] SetLastError (dwErrCode=0x0) [0256.089] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.089] GetLastError () returned 0x0 [0256.090] SetLastError (dwErrCode=0x0) [0256.090] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.090] GetLastError () returned 0x0 [0256.090] SetLastError (dwErrCode=0x0) [0256.090] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.090] GetLastError () returned 0x0 [0256.090] SetLastError (dwErrCode=0x0) [0256.090] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.090] GetLastError () returned 0x0 [0256.090] SetLastError (dwErrCode=0x0) [0256.090] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.090] GetLastError () returned 0x0 [0256.090] SetLastError (dwErrCode=0x0) [0256.090] GetLastError () returned 0x0 [0256.090] SetLastError (dwErrCode=0x0) [0256.090] GetLastError () returned 0x0 [0256.090] SetLastError (dwErrCode=0x0) [0256.090] GetLastError () returned 0x0 [0256.090] SetLastError (dwErrCode=0x0) [0256.090] GetLastError () returned 0x0 [0256.091] SetLastError (dwErrCode=0x0) [0256.091] GetLastError () returned 0x0 [0256.091] SetLastError (dwErrCode=0x0) [0256.091] GetLastError () returned 0x0 [0256.091] SetLastError (dwErrCode=0x0) [0256.091] GetLastError () returned 0x0 [0256.091] SetLastError (dwErrCode=0x0) [0256.091] GetLastError () returned 0x0 [0256.091] SetLastError (dwErrCode=0x0) [0256.091] GetLastError () returned 0x0 [0256.091] SetLastError (dwErrCode=0x0) [0256.091] GetLastError () returned 0x0 [0256.091] SetLastError (dwErrCode=0x0) [0256.091] GetLastError () returned 0x0 [0256.091] SetLastError (dwErrCode=0x0) [0256.091] GetLastError () returned 0x0 [0256.091] SetLastError (dwErrCode=0x0) [0256.092] GetLastError () returned 0x0 [0256.092] SetLastError (dwErrCode=0x0) [0256.092] GetLastError () returned 0x0 [0256.092] SetLastError (dwErrCode=0x0) [0256.092] GetLastError () returned 0x0 [0256.092] SetLastError (dwErrCode=0x0) [0256.092] GetLastError () returned 0x0 [0256.092] SetLastError (dwErrCode=0x0) [0256.092] GetLastError () returned 0x0 [0256.092] SetLastError (dwErrCode=0x0) [0256.092] GetLastError () returned 0x0 [0256.092] SetLastError (dwErrCode=0x0) [0256.092] GetLastError () returned 0x0 [0256.092] SetLastError (dwErrCode=0x0) [0256.092] GetLastError () returned 0x0 [0256.092] SetLastError (dwErrCode=0x0) [0256.092] GetLastError () returned 0x0 [0256.093] SetLastError (dwErrCode=0x0) [0256.093] GetLastError () returned 0x0 [0256.093] SetLastError (dwErrCode=0x0) [0256.093] GetLastError () returned 0x0 [0256.093] SetLastError (dwErrCode=0x0) [0256.093] GetLastError () returned 0x0 [0256.093] SetLastError (dwErrCode=0x0) [0256.093] SysReAllocStringLen (in: pbstr=0x7ff2b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7ff2b0*="C:\\") returned 1 [0256.093] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.093] SysReAllocStringLen (in: pbstr=0x7ff2b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ff2b8*="c:\\") returned 1 [0256.093] SysReAllocStringLen (in: pbstr=0x7ff2a8*=0x0, psz="C:\\Users\\RDHJ0C~1\\AppData\\", len=0x1a | out: pbstr=0x7ff2a8*="C:\\Users\\RDHJ0C~1\\AppData\\") returned 1 [0256.093] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\AppData\\", cchLength=0x1a | out: lpsz="c:\\users\\rdhj0c~1\\appdata\\") returned 0x1a [0256.093] SysReAllocStringLen (in: pbstr=0x7ff2b0*=0x0, psz="c:\\users\\rdhj0c~1\\appdata\\", len=0x1a | out: pbstr=0x7ff2b0*="c:\\users\\rdhj0c~1\\appdata\\") returned 1 [0256.093] SetLastError (dwErrCode=0x0) [0256.093] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\appdata\\", cchCount1=26, lpString2="c:\\", cchCount2=3) returned 3 [0256.093] GetLastError () returned 0x0 [0256.093] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0256.093] GetLastError () returned 0x0 [0256.094] SetLastError (dwErrCode=0x0) [0256.094] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\", cchWideChar=26, lpMultiByteStr=0xac51b8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\", lpUsedDefaultChar=0x0) returned 26 [0256.094] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac51b8, cbMultiByte=26, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0256.094] GetLastError () returned 0x0 [0256.094] SetLastError (dwErrCode=0x0) [0256.094] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac51b8, cbMultiByte=26, lpWideCharStr=0xabb768, cchWideChar=26 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\") returned 26 [0256.094] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\", lpFindFileData=0x7ff3c8 | out: lpFindFileData=0x7ff3c8*(dwFileAttributes=0x8f0000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x24d1fd0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0xadb4a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x20, cFileName="", cAlternateFileName="翶")) returned 0xffffffffffffffff [0256.094] GetLastError () returned 0x2 [0256.094] GetLastError () returned 0x2 [0256.094] SetLastError (dwErrCode=0x2) [0256.094] GetLastError () returned 0x2 [0256.094] SetLastError (dwErrCode=0x2) [0256.094] GetLastError () returned 0x0 [0256.094] SetLastError (dwErrCode=0x0) [0256.094] GetLastError () returned 0x0 [0256.094] SetLastError (dwErrCode=0x0) [0256.095] GetLastError () returned 0x0 [0256.095] SetLastError (dwErrCode=0x0) [0256.095] GetLastError () returned 0x0 [0256.095] SetLastError (dwErrCode=0x0) [0256.095] SysReAllocStringLen (in: pbstr=0x7ff390*="C:\\Users\\RDHJ0C~1\\AppData\\", psz="C:\\Users\\RDHJ0C~1\\AppData", len=0x19 | out: pbstr=0x7ff390*="C:\\Users\\RDHJ0C~1\\AppData") returned 1 [0256.095] GetLastError () returned 0x0 [0256.095] SetLastError (dwErrCode=0x0) [0256.095] GetLastError () returned 0x0 [0256.095] SetLastError (dwErrCode=0x0) [0256.095] GetLastError () returned 0x0 [0256.095] SetLastError (dwErrCode=0x0) [0256.095] GetLastError () returned 0x0 [0256.095] SetLastError (dwErrCode=0x0) [0256.095] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7fee70 | out: lpBuffer=0x0, lpFilePart=0x7fee70*=0x0) returned 0x2a [0256.095] GetLastError () returned 0x0 [0256.095] SetLastError (dwErrCode=0x0) [0256.095] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb4a8, lpFilePart=0x7fee70 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7fee70*="Temp") returned 0x28 [0256.095] GetLastError () returned 0x0 [0256.095] SetLastError (dwErrCode=0x0) [0256.095] GetLastError () returned 0x0 [0256.096] SetLastError (dwErrCode=0x0) [0256.096] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.096] GetLastError () returned 0x0 [0256.096] SetLastError (dwErrCode=0x0) [0256.096] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.096] GetLastError () returned 0x0 [0256.096] SetLastError (dwErrCode=0x0) [0256.096] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.096] GetLastError () returned 0x0 [0256.096] SetLastError (dwErrCode=0x0) [0256.096] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac51b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.096] GetLastError () returned 0x0 [0256.096] SetLastError (dwErrCode=0x0) [0256.096] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.096] GetLastError () returned 0x0 [0256.096] SetLastError (dwErrCode=0x0) [0256.096] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.096] GetLastError () returned 0x0 [0256.096] SetLastError (dwErrCode=0x0) [0256.096] GetLastError () returned 0x0 [0256.096] SetLastError (dwErrCode=0x0) [0256.096] GetLastError () returned 0x0 [0256.096] SetLastError (dwErrCode=0x0) [0256.097] GetLastError () returned 0x0 [0256.097] SetLastError (dwErrCode=0x0) [0256.097] GetLastError () returned 0x0 [0256.097] SetLastError (dwErrCode=0x0) [0256.097] GetLastError () returned 0x0 [0256.097] SetLastError (dwErrCode=0x0) [0256.097] GetLastError () returned 0x0 [0256.097] SetLastError (dwErrCode=0x0) [0256.097] GetLastError () returned 0x0 [0256.097] SetLastError (dwErrCode=0x0) [0256.097] GetLastError () returned 0x0 [0256.097] SetLastError (dwErrCode=0x0) [0256.097] GetLastError () returned 0x0 [0256.097] SetLastError (dwErrCode=0x0) [0256.097] GetLastError () returned 0x0 [0256.097] SetLastError (dwErrCode=0x0) [0256.097] GetLastError () returned 0x0 [0256.097] SetLastError (dwErrCode=0x0) [0256.097] GetLastError () returned 0x0 [0256.098] SetLastError (dwErrCode=0x0) [0256.098] GetLastError () returned 0x0 [0256.098] SetLastError (dwErrCode=0x0) [0256.098] GetLastError () returned 0x0 [0256.098] SetLastError (dwErrCode=0x0) [0256.098] GetLastError () returned 0x0 [0256.098] SetLastError (dwErrCode=0x0) [0256.098] GetLastError () returned 0x0 [0256.098] SetLastError (dwErrCode=0x0) [0256.098] GetLastError () returned 0x0 [0256.098] SetLastError (dwErrCode=0x0) [0256.098] GetLastError () returned 0x0 [0256.098] SetLastError (dwErrCode=0x0) [0256.098] GetLastError () returned 0x0 [0256.098] SetLastError (dwErrCode=0x0) [0256.099] GetLastError () returned 0x0 [0256.099] SetLastError (dwErrCode=0x0) [0256.099] GetLastError () returned 0x0 [0256.099] SetLastError (dwErrCode=0x0) [0256.099] GetLastError () returned 0x0 [0256.099] SetLastError (dwErrCode=0x0) [0256.099] GetLastError () returned 0x0 [0256.099] SetLastError (dwErrCode=0x0) [0256.099] GetLastError () returned 0x0 [0256.099] SetLastError (dwErrCode=0x0) [0256.099] SysReAllocStringLen (in: pbstr=0x7fefb0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7fefb0*="C:\\") returned 1 [0256.099] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.099] SysReAllocStringLen (in: pbstr=0x7fefb8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7fefb8*="c:\\") returned 1 [0256.099] SysReAllocStringLen (in: pbstr=0x7fefa8*=0x0, psz="C:\\Users\\RDHJ0C~1\\", len=0x12 | out: pbstr=0x7fefa8*="C:\\Users\\RDHJ0C~1\\") returned 1 [0256.099] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\", cchLength=0x12 | out: lpsz="c:\\users\\rdhj0c~1\\") returned 0x12 [0256.099] SysReAllocStringLen (in: pbstr=0x7fefb0*=0x0, psz="c:\\users\\rdhj0c~1\\", len=0x12 | out: pbstr=0x7fefb0*="c:\\users\\rdhj0c~1\\") returned 1 [0256.099] SetLastError (dwErrCode=0x0) [0256.099] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\", cchCount1=18, lpString2="c:\\", cchCount2=3) returned 3 [0256.099] GetLastError () returned 0x0 [0256.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0256.100] GetLastError () returned 0x0 [0256.100] SetLastError (dwErrCode=0x0) [0256.100] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\", cchWideChar=18, lpMultiByteStr=0xac5138, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\", lpUsedDefaultChar=0x0) returned 18 [0256.100] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=18, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0256.100] GetLastError () returned 0x0 [0256.100] SetLastError (dwErrCode=0x0) [0256.100] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=18, lpWideCharStr=0xabb6a8, cchWideChar=18 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\") returned 18 [0256.100] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\", lpFindFileData=0x7ff0c8 | out: lpFindFileData=0x7ff0c8*(dwFileAttributes=0x8f0000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x905900, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0xabb768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1a, cFileName="", cAlternateFileName="翶")) returned 0xffffffffffffffff [0256.100] GetLastError () returned 0x2 [0256.100] GetLastError () returned 0x2 [0256.101] SetLastError (dwErrCode=0x2) [0256.101] GetLastError () returned 0x2 [0256.101] SetLastError (dwErrCode=0x2) [0256.101] GetLastError () returned 0x0 [0256.101] SetLastError (dwErrCode=0x0) [0256.101] GetLastError () returned 0x0 [0256.101] SetLastError (dwErrCode=0x0) [0256.101] GetLastError () returned 0x0 [0256.101] SetLastError (dwErrCode=0x0) [0256.101] GetLastError () returned 0x0 [0256.101] SetLastError (dwErrCode=0x0) [0256.101] SysReAllocStringLen (in: pbstr=0x7ff090*="C:\\Users\\RDHJ0C~1\\", psz="C:\\Users\\RDHJ0C~1", len=0x11 | out: pbstr=0x7ff090*="C:\\Users\\RDHJ0C~1") returned 1 [0256.101] GetLastError () returned 0x0 [0256.101] SetLastError (dwErrCode=0x0) [0256.101] GetLastError () returned 0x0 [0256.101] SetLastError (dwErrCode=0x0) [0256.101] GetLastError () returned 0x0 [0256.101] SetLastError (dwErrCode=0x0) [0256.101] GetLastError () returned 0x0 [0256.102] SetLastError (dwErrCode=0x0) [0256.102] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7feb70 | out: lpBuffer=0x0, lpFilePart=0x7feb70*=0x0) returned 0x2a [0256.102] GetLastError () returned 0x0 [0256.102] SetLastError (dwErrCode=0x0) [0256.102] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb4a8, lpFilePart=0x7feb70 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7feb70*="Temp") returned 0x28 [0256.102] GetLastError () returned 0x0 [0256.102] SetLastError (dwErrCode=0x0) [0256.102] GetLastError () returned 0x0 [0256.102] SetLastError (dwErrCode=0x0) [0256.102] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.102] GetLastError () returned 0x0 [0256.102] SetLastError (dwErrCode=0x0) [0256.102] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.102] GetLastError () returned 0x0 [0256.102] SetLastError (dwErrCode=0x0) [0256.102] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.102] GetLastError () returned 0x0 [0256.102] SetLastError (dwErrCode=0x0) [0256.102] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac51b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.102] GetLastError () returned 0x0 [0256.102] SetLastError (dwErrCode=0x0) [0256.102] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.102] GetLastError () returned 0x0 [0256.103] SetLastError (dwErrCode=0x0) [0256.103] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.103] GetLastError () returned 0x0 [0256.103] SetLastError (dwErrCode=0x0) [0256.103] GetLastError () returned 0x0 [0256.103] SetLastError (dwErrCode=0x0) [0256.103] GetLastError () returned 0x0 [0256.103] SetLastError (dwErrCode=0x0) [0256.103] GetLastError () returned 0x0 [0256.103] SetLastError (dwErrCode=0x0) [0256.103] GetLastError () returned 0x0 [0256.103] SetLastError (dwErrCode=0x0) [0256.103] GetLastError () returned 0x0 [0256.103] SetLastError (dwErrCode=0x0) [0256.103] GetLastError () returned 0x0 [0256.103] SetLastError (dwErrCode=0x0) [0256.103] GetLastError () returned 0x0 [0256.103] SetLastError (dwErrCode=0x0) [0256.103] GetLastError () returned 0x0 [0256.103] SetLastError (dwErrCode=0x0) [0256.104] GetLastError () returned 0x0 [0256.104] SetLastError (dwErrCode=0x0) [0256.104] GetLastError () returned 0x0 [0256.104] SetLastError (dwErrCode=0x0) [0256.104] GetLastError () returned 0x0 [0256.104] SetLastError (dwErrCode=0x0) [0256.104] GetLastError () returned 0x0 [0256.104] SetLastError (dwErrCode=0x0) [0256.104] GetLastError () returned 0x0 [0256.104] SetLastError (dwErrCode=0x0) [0256.104] GetLastError () returned 0x0 [0256.104] SetLastError (dwErrCode=0x0) [0256.104] GetLastError () returned 0x0 [0256.104] SetLastError (dwErrCode=0x0) [0256.104] GetLastError () returned 0x0 [0256.104] SetLastError (dwErrCode=0x0) [0256.104] GetLastError () returned 0x0 [0256.104] SetLastError (dwErrCode=0x0) [0256.104] GetLastError () returned 0x0 [0256.105] SetLastError (dwErrCode=0x0) [0256.105] GetLastError () returned 0x0 [0256.105] SetLastError (dwErrCode=0x0) [0256.105] GetLastError () returned 0x0 [0256.105] SetLastError (dwErrCode=0x0) [0256.105] GetLastError () returned 0x0 [0256.105] SetLastError (dwErrCode=0x0) [0256.105] GetLastError () returned 0x0 [0256.105] SetLastError (dwErrCode=0x0) [0256.105] GetLastError () returned 0x0 [0256.105] SetLastError (dwErrCode=0x0) [0256.105] SysReAllocStringLen (in: pbstr=0x7fecb0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7fecb0*="C:\\") returned 1 [0256.105] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.105] SysReAllocStringLen (in: pbstr=0x7fecb8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7fecb8*="c:\\") returned 1 [0256.105] SysReAllocStringLen (in: pbstr=0x7feca8*=0x0, psz="C:\\Users\\", len=0x9 | out: pbstr=0x7feca8*="C:\\Users\\") returned 1 [0256.105] CharLowerBuffW (in: lpsz="C:\\Users\\", cchLength=0x9 | out: lpsz="c:\\users\\") returned 0x9 [0256.105] SysReAllocStringLen (in: pbstr=0x7fecb0*=0x0, psz="c:\\users\\", len=0x9 | out: pbstr=0x7fecb0*="c:\\users\\") returned 1 [0256.105] SetLastError (dwErrCode=0x0) [0256.105] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\", cchCount1=9, lpString2="c:\\", cchCount2=3) returned 3 [0256.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0256.106] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0256.106] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=9, lpWideCharStr=0xac51b8, cchWideChar=9 | out: lpWideCharStr="C:\\Users\\") returned 9 [0256.106] FindFirstFileW (in: lpFileName="C:\\Users\\", lpFindFileData=0x7fedc8 | out: lpFindFileData=0x7fedc8*(dwFileAttributes=0x8f0000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x900540, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0xabb6a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="", cAlternateFileName="翶")) returned 0xffffffffffffffff [0256.106] GetLastError () returned 0x2 [0256.106] GetLastError () returned 0x2 [0256.106] SetLastError (dwErrCode=0x2) [0256.106] GetLastError () returned 0x2 [0256.106] SetLastError (dwErrCode=0x2) [0256.106] GetLastError () returned 0x0 [0256.106] SetLastError (dwErrCode=0x0) [0256.106] GetLastError () returned 0x0 [0256.107] GetLastError () returned 0x0 [0256.107] SysReAllocStringLen (in: pbstr=0x7fed90*="C:\\Users\\", psz="C:\\Users", len=0x8 | out: pbstr=0x7fed90*="C:\\Users") returned 1 [0256.107] GetLastError () returned 0x0 [0256.107] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7fe870 | out: lpBuffer=0x0, lpFilePart=0x7fe870*=0x0) returned 0x2a [0256.107] GetLastError () returned 0x0 [0256.107] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb4a8, lpFilePart=0x7fe870 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7fe870*="Temp") returned 0x28 [0256.107] GetLastError () returned 0x0 [0256.107] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.107] GetLastError () returned 0x0 [0256.107] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5178, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.107] GetLastError () returned 0x0 [0256.107] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.107] GetLastError () returned 0x0 [0256.108] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5178, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.108] GetLastError () returned 0x0 [0256.108] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.108] GetLastError () returned 0x0 [0256.108] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5178, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.108] GetLastError () returned 0x0 [0256.108] GetLastError () returned 0x0 [0256.108] GetLastError () returned 0x0 [0256.108] GetLastError () returned 0x0 [0256.109] GetLastError () returned 0x0 [0256.109] GetLastError () returned 0x0 [0256.109] GetLastError () returned 0x0 [0256.109] SetLastError (dwErrCode=0x0) [0256.109] GetLastError () returned 0x0 [0256.109] SetLastError (dwErrCode=0x0) [0256.109] GetLastError () returned 0x0 [0256.109] SetLastError (dwErrCode=0x0) [0256.109] GetLastError () returned 0x0 [0256.109] SetLastError (dwErrCode=0x0) [0256.109] GetLastError () returned 0x0 [0256.109] SetLastError (dwErrCode=0x0) [0256.109] GetLastError () returned 0x0 [0256.109] SetLastError (dwErrCode=0x0) [0256.109] GetLastError () returned 0x0 [0256.110] SetLastError (dwErrCode=0x0) [0256.110] GetLastError () returned 0x0 [0256.110] SetLastError (dwErrCode=0x0) [0256.110] SysReAllocStringLen (in: pbstr=0x7fe9b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7fe9b0*="C:\\") returned 1 [0256.110] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.110] SysReAllocStringLen (in: pbstr=0x7fe9b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7fe9b8*="c:\\") returned 1 [0256.110] SysReAllocStringLen (in: pbstr=0x7fe9a8*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x7fe9a8*="C:\\") returned 1 [0256.110] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0256.110] SysReAllocStringLen (in: pbstr=0x7fe9b0*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7fe9b0*="c:\\") returned 1 [0256.110] SetLastError (dwErrCode=0x0) [0256.110] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\", cchCount1=3, lpString2="c:\\", cchCount2=3) returned 2 [0256.110] GetLastError () returned 0x0 [0256.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.110] GetLastError () returned 0x0 [0256.110] SetLastError (dwErrCode=0x0) [0256.110] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users", cchWideChar=8, lpMultiByteStr=0xac51f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users", lpUsedDefaultChar=0x0) returned 8 [0256.110] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac51f8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0256.111] GetLastError () returned 0x0 [0256.111] SetLastError (dwErrCode=0x0) [0256.111] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac51f8, cbMultiByte=8, lpWideCharStr=0xac51b8, cchWideChar=8 | out: lpWideCharStr="C:\\Users") returned 8 [0256.111] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x7feac8 | out: lpFindFileData=0x7feac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9, cFileName="Users", cAlternateFileName="")) returned 0x24d13e0 [0256.111] FileTimeToLocalFileTime (in: lpFileTime=0x7feadc, lpLocalFileTime=0x7fe8b0 | out: lpLocalFileTime=0x7fe8b0) returned 1 [0256.111] FileTimeToDosDateTime (in: lpFileTime=0x7fe8b0, lpFatDate=0x7fea9a, lpFatTime=0x7fea98 | out: lpFatDate=0x7fea9a, lpFatTime=0x7fea98) returned 1 [0256.111] GetLastError () returned 0x0 [0256.111] SetLastError (dwErrCode=0x0) [0256.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.111] GetLastError () returned 0x0 [0256.111] SetLastError (dwErrCode=0x0) [0256.111] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=5, lpMultiByteStr=0xac5238, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Users", lpUsedDefaultChar=0x0) returned 5 [0256.111] GetLastError () returned 0x0 [0256.111] SetLastError (dwErrCode=0x0) [0256.111] GetLastError () returned 0x0 [0256.111] SetLastError (dwErrCode=0x0) [0256.111] GetLastError () returned 0x0 [0256.111] SetLastError (dwErrCode=0x0) [0256.111] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5238, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0256.112] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5238, cbMultiByte=5, lpWideCharStr=0x24d2728, cchWideChar=5 | out: lpWideCharStr="Users") returned 5 [0256.112] FindClose (in: hFindFile=0x24d13e0 | out: hFindFile=0x24d13e0) returned 1 [0256.112] GetLastError () returned 0x0 [0256.112] SetLastError (dwErrCode=0x0) [0256.112] SysReAllocStringLen (in: pbstr=0x7fed90*="C:\\Users", psz="C:\\Users", len=0x8 | out: pbstr=0x7fed90*="C:\\Users") returned 1 [0256.112] GetLastError () returned 0x0 [0256.112] SetLastError (dwErrCode=0x0) [0256.112] GetLastError () returned 0x0 [0256.112] SetLastError (dwErrCode=0x0) [0256.112] GetLastError () returned 0x0 [0256.112] SetLastError (dwErrCode=0x0) [0256.112] GetLastError () returned 0x0 [0256.112] SetLastError (dwErrCode=0x0) [0256.112] SysReAllocStringLen (in: pbstr=0x7fed90*="C:\\Users", psz="C:\\Users\\", len=0x9 | out: pbstr=0x7fed90*="C:\\Users\\") returned 1 [0256.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.113] GetLastError () returned 0x0 [0256.113] SetLastError (dwErrCode=0x0) [0256.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1", cchWideChar=17, lpMultiByteStr=0xac51f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1", lpUsedDefaultChar=0x0) returned 17 [0256.113] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac51f8, cbMultiByte=17, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0256.113] GetLastError () returned 0x0 [0256.113] SetLastError (dwErrCode=0x0) [0256.113] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac51f8, cbMultiByte=17, lpWideCharStr=0xabb768, cchWideChar=17 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1") returned 17 [0256.113] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1", lpFindFileData=0x7fedc8 | out: lpFindFileData=0x7fedc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x24d1c80 [0256.113] FileTimeToLocalFileTime (in: lpFileTime=0x7feddc, lpLocalFileTime=0x7febb0 | out: lpLocalFileTime=0x7febb0) returned 1 [0256.113] FileTimeToDosDateTime (in: lpFileTime=0x7febb0, lpFatDate=0x7fed9a, lpFatTime=0x7fed98 | out: lpFatDate=0x7fed9a, lpFatTime=0x7fed98) returned 1 [0256.113] GetLastError () returned 0x0 [0256.113] SetLastError (dwErrCode=0x0) [0256.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RDhJ0CNFevzX", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0256.113] GetLastError () returned 0x0 [0256.113] SetLastError (dwErrCode=0x0) [0256.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RDhJ0CNFevzX", cchWideChar=12, lpMultiByteStr=0xac5138, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RDhJ0CNFevzX", lpUsedDefaultChar=0x0) returned 12 [0256.113] GetLastError () returned 0x0 [0256.113] SetLastError (dwErrCode=0x0) [0256.114] GetLastError () returned 0x0 [0256.114] SetLastError (dwErrCode=0x0) [0256.114] GetLastError () returned 0x0 [0256.114] SetLastError (dwErrCode=0x0) [0256.114] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0256.114] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=12, lpWideCharStr=0x905648, cchWideChar=12 | out: lpWideCharStr="RDhJ0CNFevzX") returned 12 [0256.114] FindClose (in: hFindFile=0x24d1c80 | out: hFindFile=0x24d1c80) returned 1 [0256.114] GetLastError () returned 0x0 [0256.114] SetLastError (dwErrCode=0x0) [0256.114] SysReAllocStringLen (in: pbstr=0x7ff090*="C:\\Users\\RDHJ0C~1", psz="C:\\Users\\RDhJ0CNFevzX", len=0x15 | out: pbstr=0x7ff090*="C:\\Users\\RDhJ0CNFevzX") returned 1 [0256.114] GetLastError () returned 0x0 [0256.114] SetLastError (dwErrCode=0x0) [0256.114] GetLastError () returned 0x0 [0256.114] SetLastError (dwErrCode=0x0) [0256.115] GetLastError () returned 0x0 [0256.115] SetLastError (dwErrCode=0x0) [0256.115] GetLastError () returned 0x0 [0256.115] SetLastError (dwErrCode=0x0) [0256.115] SysReAllocStringLen (in: pbstr=0x7ff090*="C:\\Users\\RDhJ0CNFevzX", psz="C:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x7ff090*="C:\\Users\\RDhJ0CNFevzX\\") returned 1 [0256.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0256.115] GetLastError () returned 0x0 [0256.115] SetLastError (dwErrCode=0x0) [0256.115] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData", cchWideChar=29, lpMultiByteStr=0xac5138, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData", lpUsedDefaultChar=0x0) returned 29 [0256.115] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0256.115] GetLastError () returned 0x0 [0256.115] SetLastError (dwErrCode=0x0) [0256.115] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=29, lpWideCharStr=0xabb708, cchWideChar=29 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData") returned 29 [0256.115] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData", lpFindFileData=0x7ff0c8 | out: lpFindFileData=0x7ff0c8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1a, cFileName="AppData", cAlternateFileName="")) returned 0x24d1680 [0256.115] FileTimeToLocalFileTime (in: lpFileTime=0x7ff0dc, lpLocalFileTime=0x7feeb0 | out: lpLocalFileTime=0x7feeb0) returned 1 [0256.115] FileTimeToDosDateTime (in: lpFileTime=0x7feeb0, lpFatDate=0x7ff09a, lpFatTime=0x7ff098 | out: lpFatDate=0x7ff09a, lpFatTime=0x7ff098) returned 1 [0256.116] GetLastError () returned 0x0 [0256.116] SetLastError (dwErrCode=0x0) [0256.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0256.116] GetLastError () returned 0x0 [0256.116] SetLastError (dwErrCode=0x0) [0256.116] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=7, lpMultiByteStr=0xac5238, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppData", lpUsedDefaultChar=0x0) returned 7 [0256.116] GetLastError () returned 0x0 [0256.116] SetLastError (dwErrCode=0x0) [0256.116] GetLastError () returned 0x0 [0256.116] SetLastError (dwErrCode=0x0) [0256.116] GetLastError () returned 0x0 [0256.116] SetLastError (dwErrCode=0x0) [0256.116] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5238, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0256.116] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5238, cbMultiByte=7, lpWideCharStr=0x24d26f8, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0256.116] FindClose (in: hFindFile=0x24d1680 | out: hFindFile=0x24d1680) returned 1 [0256.116] GetLastError () returned 0x0 [0256.116] SetLastError (dwErrCode=0x0) [0256.117] SysReAllocStringLen (in: pbstr=0x7ff390*="C:\\Users\\RDHJ0C~1\\AppData", psz="C:\\Users\\RDhJ0CNFevzX\\AppData", len=0x1d | out: pbstr=0x7ff390*="C:\\Users\\RDhJ0CNFevzX\\AppData") returned 1 [0256.117] GetLastError () returned 0x0 [0256.117] SetLastError (dwErrCode=0x0) [0256.117] GetLastError () returned 0x0 [0256.117] SetLastError (dwErrCode=0x0) [0256.117] GetLastError () returned 0x0 [0256.117] SetLastError (dwErrCode=0x0) [0256.117] GetLastError () returned 0x0 [0256.117] SetLastError (dwErrCode=0x0) [0256.117] SysReAllocStringLen (in: pbstr=0x7ff390*="C:\\Users\\RDhJ0CNFevzX\\AppData", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x7ff390*="C:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0256.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0256.117] GetLastError () returned 0x0 [0256.117] SetLastError (dwErrCode=0x0) [0256.117] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", cchWideChar=35, lpMultiByteStr=0xabb768, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpUsedDefaultChar=0x0) returned 35 [0256.117] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0256.117] GetLastError () returned 0x0 [0256.117] SetLastError (dwErrCode=0x0) [0256.117] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=35, lpWideCharStr=0xadb4a8, cchWideChar=35 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 35 [0256.118] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFindFileData=0x7ff3c8 | out: lpFindFileData=0x7ff3c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x20, cFileName="Local", cAlternateFileName="")) returned 0x24d1aa0 [0256.118] FileTimeToLocalFileTime (in: lpFileTime=0x7ff3dc, lpLocalFileTime=0x7ff1b0 | out: lpLocalFileTime=0x7ff1b0) returned 1 [0256.118] FileTimeToDosDateTime (in: lpFileTime=0x7ff1b0, lpFatDate=0x7ff39a, lpFatTime=0x7ff398 | out: lpFatDate=0x7ff39a, lpFatTime=0x7ff398) returned 1 [0256.118] GetLastError () returned 0x0 [0256.118] SetLastError (dwErrCode=0x0) [0256.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Local", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0256.118] GetLastError () returned 0x0 [0256.118] SetLastError (dwErrCode=0x0) [0256.118] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Local", cchWideChar=5, lpMultiByteStr=0xac5138, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Local", lpUsedDefaultChar=0x0) returned 5 [0256.118] GetLastError () returned 0x0 [0256.118] SetLastError (dwErrCode=0x0) [0256.118] GetLastError () returned 0x0 [0256.118] SetLastError (dwErrCode=0x0) [0256.118] GetLastError () returned 0x0 [0256.118] SetLastError (dwErrCode=0x0) [0256.119] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0256.119] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5138, cbMultiByte=5, lpWideCharStr=0x24d26f8, cchWideChar=5 | out: lpWideCharStr="Local") returned 5 [0256.119] FindClose (in: hFindFile=0x24d1aa0 | out: hFindFile=0x24d1aa0) returned 1 [0256.119] GetLastError () returned 0x0 [0256.119] SetLastError (dwErrCode=0x0) [0256.119] SysReAllocStringLen (in: pbstr=0x7ff690*="C:\\Users\\RDHJ0C~1\\AppData\\Local", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", len=0x23 | out: pbstr=0x7ff690*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 1 [0256.119] GetLastError () returned 0x0 [0256.119] SetLastError (dwErrCode=0x0) [0256.119] GetLastError () returned 0x0 [0256.119] SetLastError (dwErrCode=0x0) [0256.120] GetLastError () returned 0x0 [0256.120] SetLastError (dwErrCode=0x0) [0256.120] GetLastError () returned 0x0 [0256.120] SetLastError (dwErrCode=0x0) [0256.120] SysReAllocStringLen (in: pbstr=0x7ff690*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x7ff690*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0256.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.120] GetLastError () returned 0x0 [0256.120] SetLastError (dwErrCode=0x0) [0256.120] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", cchWideChar=40, lpMultiByteStr=0xabb768, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 40 [0256.120] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=40, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0256.120] GetLastError () returned 0x0 [0256.120] SetLastError (dwErrCode=0x0) [0256.120] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb768, cbMultiByte=40, lpWideCharStr=0xadb528, cchWideChar=40 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp") returned 40 [0256.121] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFindFileData=0x7ff6c8 | out: lpFindFileData=0x7ff6c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xb12b8d, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff6, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0x24d1aa0 [0256.121] FileTimeToLocalFileTime (in: lpFileTime=0x7ff6dc, lpLocalFileTime=0x7ff4b0 | out: lpLocalFileTime=0x7ff4b0) returned 1 [0256.121] FileTimeToDosDateTime (in: lpFileTime=0x7ff4b0, lpFatDate=0x7ff69a, lpFatTime=0x7ff698 | out: lpFatDate=0x7ff69a, lpFatTime=0x7ff698) returned 1 [0256.121] GetLastError () returned 0x0 [0256.121] SetLastError (dwErrCode=0x0) [0256.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Temp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0256.121] GetLastError () returned 0x0 [0256.121] SetLastError (dwErrCode=0x0) [0256.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Temp", cchWideChar=4, lpMultiByteStr=0xac5238, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Temp", lpUsedDefaultChar=0x0) returned 4 [0256.121] GetLastError () returned 0x0 [0256.121] SetLastError (dwErrCode=0x0) [0256.121] GetLastError () returned 0x0 [0256.121] SetLastError (dwErrCode=0x0) [0256.122] GetLastError () returned 0x0 [0256.122] SetLastError (dwErrCode=0x0) [0256.122] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5238, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.122] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5238, cbMultiByte=4, lpWideCharStr=0x24d26f8, cchWideChar=4 | out: lpWideCharStr="Temp") returned 4 [0256.122] FindClose (in: hFindFile=0x24d1aa0 | out: hFindFile=0x24d1aa0) returned 1 [0256.122] GetLastError () returned 0x0 [0256.122] SetLastError (dwErrCode=0x0) [0256.122] GetLastError () returned 0x0 [0256.122] SetLastError (dwErrCode=0x0) [0256.122] GetLastError () returned 0x0 [0256.123] SetLastError (dwErrCode=0x0) [0256.123] GetLastError () returned 0x0 [0256.123] SetLastError (dwErrCode=0x0) [0256.123] GetLastError () returned 0x0 [0256.123] SetLastError (dwErrCode=0x0) [0256.123] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0256.123] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0256.123] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", cchLength=0x29 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 0x29 [0256.123] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0256.124] SysReAllocStringLen (in: pbstr=0x27e0f40*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0x27e0f40*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0256.124] GetWindowsDirectoryW (in: lpBuffer=0x27f0650, uSize=0xfffe | out: lpBuffer="C:\\Windows") returned 0xa [0256.124] GetLastError () returned 0x0 [0256.124] SetLastError (dwErrCode=0x0) [0256.124] GetLastError () returned 0x0 [0256.124] SetLastError (dwErrCode=0x0) [0256.124] GetLastError () returned 0x0 [0256.124] SetLastError (dwErrCode=0x0) [0256.124] GetLastError () returned 0x0 [0256.124] SetLastError (dwErrCode=0x0) [0256.125] SysReAllocStringLen (in: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", psz="C:\\Windows\\", len=0xb | out: pbstr=0x7ffa08*="C:\\Windows\\") returned 1 [0256.125] GetThreadLocale () returned 0x409 [0256.125] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Windows\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0256.125] GetThreadLocale () returned 0x409 [0256.125] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Windows\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0256.125] GetLastError () returned 0x0 [0256.125] SetLastError (dwErrCode=0x0) [0256.125] GetLastError () returned 0x0 [0256.125] SetLastError (dwErrCode=0x0) [0256.125] GetLastError () returned 0x0 [0256.125] SetLastError (dwErrCode=0x0) [0256.125] GetLastError () returned 0x0 [0256.125] SetLastError (dwErrCode=0x0) [0256.125] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0256.125] GetLastError () returned 0x0 [0256.125] SetLastError (dwErrCode=0x0) [0256.125] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb4a8, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0256.125] GetLastError () returned 0x0 [0256.125] SetLastError (dwErrCode=0x0) [0256.125] GetLastError () returned 0x0 [0256.125] SetLastError (dwErrCode=0x0) [0256.126] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.126] GetLastError () returned 0x0 [0256.126] SetLastError (dwErrCode=0x0) [0256.126] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.126] GetLastError () returned 0x0 [0256.126] SetLastError (dwErrCode=0x0) [0256.126] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.126] GetLastError () returned 0x0 [0256.126] SetLastError (dwErrCode=0x0) [0256.126] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac51b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.126] GetLastError () returned 0x0 [0256.126] SetLastError (dwErrCode=0x0) [0256.126] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.126] GetLastError () returned 0x0 [0256.126] SetLastError (dwErrCode=0x0) [0256.126] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.126] GetLastError () returned 0x0 [0256.126] SetLastError (dwErrCode=0x0) [0256.126] GetLastError () returned 0x0 [0256.126] SetLastError (dwErrCode=0x0) [0256.126] GetLastError () returned 0x0 [0256.126] SetLastError (dwErrCode=0x0) [0256.126] GetLastError () returned 0x0 [0256.127] SetLastError (dwErrCode=0x0) [0256.127] GetLastError () returned 0x0 [0256.127] SetLastError (dwErrCode=0x0) [0256.127] GetLastError () returned 0x0 [0256.127] SetLastError (dwErrCode=0x0) [0256.127] GetLastError () returned 0x0 [0256.127] SetLastError (dwErrCode=0x0) [0256.127] GetLastError () returned 0x0 [0256.127] SetLastError (dwErrCode=0x0) [0256.127] GetLastError () returned 0x0 [0256.127] SetLastError (dwErrCode=0x0) [0256.127] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Windows\\", psz="C:\\Windows\\", len=0xb | out: pbstr=0x7ffa08*="C:\\Windows\\") returned 1 [0256.127] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Windows\\", psz="C:\\Windows\\", len=0xb | out: pbstr=0x7ff968*="C:\\Windows\\") returned 1 [0256.127] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xb | out: lpsz="c:\\windows\\") returned 0xb [0256.127] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Windows\\", psz="c:\\windows\\", len=0xb | out: pbstr=0x7ffa08*="c:\\windows\\") returned 1 [0256.127] SysReAllocStringLen (in: pbstr=0x27e0f28*=0x0, psz="c:\\windows\\", len=0xb | out: pbstr=0x27e0f28*="c:\\windows\\") returned 1 [0256.127] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x27f0650 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Documents") returned 0x0 [0256.135] GetLastError () returned 0x0 [0256.135] SetLastError (dwErrCode=0x0) [0256.135] GetLastError () returned 0x0 [0256.135] SetLastError (dwErrCode=0x0) [0256.135] GetLastError () returned 0x0 [0256.135] SetLastError (dwErrCode=0x0) [0256.135] GetLastError () returned 0x0 [0256.135] SetLastError (dwErrCode=0x0) [0256.135] SysReAllocStringLen (in: pbstr=0x7ffa08*="c:\\windows\\", psz="C:\\Users\\RDhJ0CNFevzX\\Documents\\", len=0x20 | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\Documents\\") returned 1 [0256.135] GetThreadLocale () returned 0x409 [0256.135] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\Documents\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0256.135] GetThreadLocale () returned 0x409 [0256.135] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\Documents\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0256.136] GetLastError () returned 0x0 [0256.136] SetLastError (dwErrCode=0x0) [0256.136] GetLastError () returned 0x0 [0256.136] SetLastError (dwErrCode=0x0) [0256.136] GetLastError () returned 0x0 [0256.136] SetLastError (dwErrCode=0x0) [0256.136] GetLastError () returned 0x0 [0256.136] SetLastError (dwErrCode=0x0) [0256.136] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0256.136] GetLastError () returned 0x0 [0256.136] SetLastError (dwErrCode=0x0) [0256.136] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb428, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0256.136] GetLastError () returned 0x0 [0256.136] SetLastError (dwErrCode=0x0) [0256.136] GetLastError () returned 0x0 [0256.136] SetLastError (dwErrCode=0x0) [0256.136] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.136] GetLastError () returned 0x0 [0256.136] SetLastError (dwErrCode=0x0) [0256.136] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5178, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.136] GetLastError () returned 0x0 [0256.136] SetLastError (dwErrCode=0x0) [0256.137] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.137] GetLastError () returned 0x0 [0256.137] SetLastError (dwErrCode=0x0) [0256.137] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5178, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.137] GetLastError () returned 0x0 [0256.137] SetLastError (dwErrCode=0x0) [0256.137] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.137] GetLastError () returned 0x0 [0256.137] SetLastError (dwErrCode=0x0) [0256.137] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5178, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.137] GetLastError () returned 0x0 [0256.137] SetLastError (dwErrCode=0x0) [0256.137] GetLastError () returned 0x0 [0256.137] SetLastError (dwErrCode=0x0) [0256.137] GetLastError () returned 0x0 [0256.137] SetLastError (dwErrCode=0x0) [0256.137] GetLastError () returned 0x0 [0256.137] SetLastError (dwErrCode=0x0) [0256.137] GetLastError () returned 0x0 [0256.137] SetLastError (dwErrCode=0x0) [0256.137] GetLastError () returned 0x0 [0256.137] SetLastError (dwErrCode=0x0) [0256.138] GetLastError () returned 0x0 [0256.138] SetLastError (dwErrCode=0x0) [0256.138] GetLastError () returned 0x0 [0256.138] SetLastError (dwErrCode=0x0) [0256.138] GetLastError () returned 0x0 [0256.138] SetLastError (dwErrCode=0x0) [0256.138] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\Documents\\", psz="C:\\Users\\RDhJ0CNFevzX\\Documents\\", len=0x20 | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\Documents\\") returned 1 [0256.138] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\Documents\\", psz="C:\\Users\\RDhJ0CNFevzX\\Documents\\", len=0x20 | out: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\Documents\\") returned 1 [0256.138] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\Documents\\", cchLength=0x20 | out: lpsz="c:\\users\\rdhj0cnfevzx\\documents\\") returned 0x20 [0256.138] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\Documents\\", psz="c:\\users\\rdhj0cnfevzx\\documents\\", len=0x20 | out: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\documents\\") returned 1 [0256.138] SysReAllocStringLen (in: pbstr=0x27e0f20*=0x0, psz="c:\\users\\rdhj0cnfevzx\\documents\\", len=0x20 | out: pbstr=0x27e0f20*="c:\\users\\rdhj0cnfevzx\\documents\\") returned 1 [0256.138] SHGetFolderPathW (in: hwnd=0x0, csidl=46, hToken=0x0, dwFlags=0x0, pszPath=0x27f0650 | out: pszPath="C:\\Users\\Public\\Documents") returned 0x0 [0256.141] GetLastError () returned 0x0 [0256.141] SetLastError (dwErrCode=0x0) [0256.141] GetLastError () returned 0x0 [0256.141] SetLastError (dwErrCode=0x0) [0256.141] GetLastError () returned 0x0 [0256.141] SetLastError (dwErrCode=0x0) [0256.141] GetLastError () returned 0x0 [0256.141] SetLastError (dwErrCode=0x0) [0256.141] SysReAllocStringLen (in: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\documents\\", psz="C:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x7ffa08*="C:\\Users\\Public\\Documents\\") returned 1 [0256.141] GetThreadLocale () returned 0x409 [0256.141] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\Public\\Documents\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0256.141] GetThreadLocale () returned 0x409 [0256.141] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\Public\\Documents\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0256.141] GetLastError () returned 0x0 [0256.142] SetLastError (dwErrCode=0x0) [0256.142] GetLastError () returned 0x0 [0256.142] SetLastError (dwErrCode=0x0) [0256.142] GetLastError () returned 0x0 [0256.142] SetLastError (dwErrCode=0x0) [0256.142] GetLastError () returned 0x0 [0256.142] SetLastError (dwErrCode=0x0) [0256.142] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0256.142] GetLastError () returned 0x0 [0256.142] SetLastError (dwErrCode=0x0) [0256.142] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb628, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0256.142] GetLastError () returned 0x0 [0256.142] SetLastError (dwErrCode=0x0) [0256.142] GetLastError () returned 0x0 [0256.142] SetLastError (dwErrCode=0x0) [0256.142] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.142] GetLastError () returned 0x0 [0256.142] SetLastError (dwErrCode=0x0) [0256.142] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5178, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.142] GetLastError () returned 0x0 [0256.142] SetLastError (dwErrCode=0x0) [0256.142] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.143] GetLastError () returned 0x0 [0256.143] SetLastError (dwErrCode=0x0) [0256.143] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5178, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.143] GetLastError () returned 0x0 [0256.143] SetLastError (dwErrCode=0x0) [0256.143] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.143] GetLastError () returned 0x0 [0256.143] SetLastError (dwErrCode=0x0) [0256.143] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5178, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.143] GetLastError () returned 0x0 [0256.143] SetLastError (dwErrCode=0x0) [0256.143] GetLastError () returned 0x0 [0256.143] SetLastError (dwErrCode=0x0) [0256.143] GetLastError () returned 0x0 [0256.143] SetLastError (dwErrCode=0x0) [0256.143] GetLastError () returned 0x0 [0256.143] SetLastError (dwErrCode=0x0) [0256.143] GetLastError () returned 0x0 [0256.143] SetLastError (dwErrCode=0x0) [0256.143] GetLastError () returned 0x0 [0256.143] SetLastError (dwErrCode=0x0) [0256.143] GetLastError () returned 0x0 [0256.143] SetLastError (dwErrCode=0x0) [0256.143] GetLastError () returned 0x0 [0256.144] SetLastError (dwErrCode=0x0) [0256.144] GetLastError () returned 0x0 [0256.144] SetLastError (dwErrCode=0x0) [0256.144] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\Public\\Documents\\", psz="C:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x7ffa08*="C:\\Users\\Public\\Documents\\") returned 1 [0256.144] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Users\\Public\\Documents\\", psz="C:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x7ff968*="C:\\Users\\Public\\Documents\\") returned 1 [0256.144] CharLowerBuffW (in: lpsz="C:\\Users\\Public\\Documents\\", cchLength=0x1a | out: lpsz="c:\\users\\public\\documents\\") returned 0x1a [0256.144] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\Public\\Documents\\", psz="c:\\users\\public\\documents\\", len=0x1a | out: pbstr=0x7ffa08*="c:\\users\\public\\documents\\") returned 1 [0256.144] SysReAllocStringLen (in: pbstr=0x27e0f48*=0x0, psz="c:\\users\\public\\documents\\", len=0x1a | out: pbstr=0x27e0f48*="c:\\users\\public\\documents\\") returned 1 [0256.144] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x27f0650 | out: pszPath="C:\\Program Files") returned 0x0 [0256.145] GetLastError () returned 0x0 [0256.145] SetLastError (dwErrCode=0x0) [0256.145] GetLastError () returned 0x0 [0256.146] SetLastError (dwErrCode=0x0) [0256.146] GetLastError () returned 0x0 [0256.146] SetLastError (dwErrCode=0x0) [0256.146] GetLastError () returned 0x0 [0256.146] SetLastError (dwErrCode=0x0) [0256.146] SysReAllocStringLen (in: pbstr=0x7ffa08*="c:\\users\\public\\documents\\", psz="C:\\Program Files\\", len=0x11 | out: pbstr=0x7ffa08*="C:\\Program Files\\") returned 1 [0256.146] GetThreadLocale () returned 0x409 [0256.146] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Program Files\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0256.146] GetThreadLocale () returned 0x409 [0256.146] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Program Files\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0256.146] GetLastError () returned 0x0 [0256.146] SetLastError (dwErrCode=0x0) [0256.146] GetLastError () returned 0x0 [0256.146] SetLastError (dwErrCode=0x0) [0256.146] GetLastError () returned 0x0 [0256.146] SetLastError (dwErrCode=0x0) [0256.146] GetLastError () returned 0x0 [0256.146] SetLastError (dwErrCode=0x0) [0256.146] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0256.146] GetLastError () returned 0x0 [0256.147] SetLastError (dwErrCode=0x0) [0256.147] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb628, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0256.147] GetLastError () returned 0x0 [0256.147] SetLastError (dwErrCode=0x0) [0256.147] GetLastError () returned 0x0 [0256.147] SetLastError (dwErrCode=0x0) [0256.147] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.147] GetLastError () returned 0x0 [0256.147] SetLastError (dwErrCode=0x0) [0256.147] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.147] GetLastError () returned 0x0 [0256.147] SetLastError (dwErrCode=0x0) [0256.147] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.147] GetLastError () returned 0x0 [0256.147] SetLastError (dwErrCode=0x0) [0256.147] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.147] GetLastError () returned 0x0 [0256.147] SetLastError (dwErrCode=0x0) [0256.147] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.147] GetLastError () returned 0x0 [0256.147] SetLastError (dwErrCode=0x0) [0256.147] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.147] GetLastError () returned 0x0 [0256.147] SetLastError (dwErrCode=0x0) [0256.148] GetLastError () returned 0x0 [0256.148] SetLastError (dwErrCode=0x0) [0256.148] GetLastError () returned 0x0 [0256.148] SetLastError (dwErrCode=0x0) [0256.148] GetLastError () returned 0x0 [0256.148] SetLastError (dwErrCode=0x0) [0256.148] GetLastError () returned 0x0 [0256.148] SetLastError (dwErrCode=0x0) [0256.148] GetLastError () returned 0x0 [0256.148] SetLastError (dwErrCode=0x0) [0256.148] GetLastError () returned 0x0 [0256.148] SetLastError (dwErrCode=0x0) [0256.148] GetLastError () returned 0x0 [0256.148] SetLastError (dwErrCode=0x0) [0256.148] GetLastError () returned 0x0 [0256.149] SetLastError (dwErrCode=0x0) [0256.149] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Program Files\\", psz="C:\\Program Files\\", len=0x11 | out: pbstr=0x7ffa08*="C:\\Program Files\\") returned 1 [0256.149] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Program Files\\", psz="C:\\Program Files\\", len=0x11 | out: pbstr=0x7ff968*="C:\\Program Files\\") returned 1 [0256.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0256.149] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Program Files\\", psz="c:\\program files\\", len=0x11 | out: pbstr=0x7ffa08*="c:\\program files\\") returned 1 [0256.149] SysReAllocStringLen (in: pbstr=0x27e0f50*=0x0, psz="c:\\program files\\", len=0x11 | out: pbstr=0x27e0f50*="c:\\program files\\") returned 1 [0256.149] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x27f0650 | out: pszPath="C:\\ProgramData") returned 0x0 [0256.150] GetLastError () returned 0x0 [0256.150] SetLastError (dwErrCode=0x0) [0256.150] GetLastError () returned 0x0 [0256.150] SetLastError (dwErrCode=0x0) [0256.150] GetLastError () returned 0x0 [0256.150] SetLastError (dwErrCode=0x0) [0256.150] GetLastError () returned 0x0 [0256.150] SetLastError (dwErrCode=0x0) [0256.150] SysReAllocStringLen (in: pbstr=0x7ffa08*="c:\\program files\\", psz="C:\\ProgramData\\", len=0xf | out: pbstr=0x7ffa08*="C:\\ProgramData\\") returned 1 [0256.150] GetThreadLocale () returned 0x409 [0256.150] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\ProgramData\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0256.150] GetThreadLocale () returned 0x409 [0256.150] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\ProgramData\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0256.151] GetLastError () returned 0x0 [0256.151] SetLastError (dwErrCode=0x0) [0256.151] GetLastError () returned 0x0 [0256.151] SetLastError (dwErrCode=0x0) [0256.151] GetLastError () returned 0x0 [0256.151] SetLastError (dwErrCode=0x0) [0256.151] GetLastError () returned 0x0 [0256.151] SetLastError (dwErrCode=0x0) [0256.151] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0256.151] GetLastError () returned 0x0 [0256.151] SetLastError (dwErrCode=0x0) [0256.151] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb628, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0256.151] GetLastError () returned 0x0 [0256.151] SetLastError (dwErrCode=0x0) [0256.151] GetLastError () returned 0x0 [0256.151] SetLastError (dwErrCode=0x0) [0256.151] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.151] GetLastError () returned 0x0 [0256.151] SetLastError (dwErrCode=0x0) [0256.151] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac51f8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.151] GetLastError () returned 0x0 [0256.151] SetLastError (dwErrCode=0x0) [0256.152] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.152] GetLastError () returned 0x0 [0256.152] SetLastError (dwErrCode=0x0) [0256.152] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac51f8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.152] GetLastError () returned 0x0 [0256.152] SetLastError (dwErrCode=0x0) [0256.152] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.152] GetLastError () returned 0x0 [0256.152] SetLastError (dwErrCode=0x0) [0256.152] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac51f8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.152] GetLastError () returned 0x0 [0256.152] SetLastError (dwErrCode=0x0) [0256.152] GetLastError () returned 0x0 [0256.152] SetLastError (dwErrCode=0x0) [0256.152] GetLastError () returned 0x0 [0256.152] SetLastError (dwErrCode=0x0) [0256.152] GetLastError () returned 0x0 [0256.152] SetLastError (dwErrCode=0x0) [0256.152] GetLastError () returned 0x0 [0256.153] SetLastError (dwErrCode=0x0) [0256.153] GetLastError () returned 0x0 [0256.153] SetLastError (dwErrCode=0x0) [0256.153] GetLastError () returned 0x0 [0256.153] SetLastError (dwErrCode=0x0) [0256.153] GetLastError () returned 0x0 [0256.153] SetLastError (dwErrCode=0x0) [0256.153] GetLastError () returned 0x0 [0256.153] SetLastError (dwErrCode=0x0) [0256.153] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\ProgramData\\", psz="C:\\ProgramData\\", len=0xf | out: pbstr=0x7ffa08*="C:\\ProgramData\\") returned 1 [0256.153] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\ProgramData\\", psz="C:\\ProgramData\\", len=0xf | out: pbstr=0x7ff968*="C:\\ProgramData\\") returned 1 [0256.153] CharLowerBuffW (in: lpsz="C:\\ProgramData\\", cchLength=0xf | out: lpsz="c:\\programdata\\") returned 0xf [0256.153] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\ProgramData\\", psz="c:\\programdata\\", len=0xf | out: pbstr=0x7ffa08*="c:\\programdata\\") returned 1 [0256.153] SysReAllocStringLen (in: pbstr=0x27e0f58*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x27e0f58*="c:\\programdata\\") returned 1 [0256.153] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0x27f0650 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0256.154] GetLastError () returned 0x0 [0256.154] SetLastError (dwErrCode=0x0) [0256.154] GetLastError () returned 0x0 [0256.154] SetLastError (dwErrCode=0x0) [0256.154] GetLastError () returned 0x0 [0256.154] SetLastError (dwErrCode=0x0) [0256.154] GetLastError () returned 0x0 [0256.154] SetLastError (dwErrCode=0x0) [0256.154] SysReAllocStringLen (in: pbstr=0x7ffa08*="c:\\programdata\\", psz="C:\\Program Files\\Common Files\\", len=0x1e | out: pbstr=0x7ffa08*="C:\\Program Files\\Common Files\\") returned 1 [0256.155] GetThreadLocale () returned 0x409 [0256.155] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Program Files\\Common Files\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0256.155] GetThreadLocale () returned 0x409 [0256.155] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Program Files\\Common Files\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0256.155] GetLastError () returned 0x0 [0256.155] SetLastError (dwErrCode=0x0) [0256.155] GetLastError () returned 0x0 [0256.155] SetLastError (dwErrCode=0x0) [0256.155] GetLastError () returned 0x0 [0256.155] SetLastError (dwErrCode=0x0) [0256.155] GetLastError () returned 0x0 [0256.155] SetLastError (dwErrCode=0x0) [0256.155] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0256.155] GetLastError () returned 0x0 [0256.155] SetLastError (dwErrCode=0x0) [0256.155] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb628, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0256.155] GetLastError () returned 0x0 [0256.155] SetLastError (dwErrCode=0x0) [0256.155] GetLastError () returned 0x0 [0256.155] SetLastError (dwErrCode=0x0) [0256.155] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.155] GetLastError () returned 0x0 [0256.155] SetLastError (dwErrCode=0x0) [0256.155] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.155] GetLastError () returned 0x0 [0256.156] SetLastError (dwErrCode=0x0) [0256.156] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.156] GetLastError () returned 0x0 [0256.156] SetLastError (dwErrCode=0x0) [0256.156] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac51b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.156] GetLastError () returned 0x0 [0256.156] SetLastError (dwErrCode=0x0) [0256.156] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.156] GetLastError () returned 0x0 [0256.156] SetLastError (dwErrCode=0x0) [0256.156] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.156] GetLastError () returned 0x0 [0256.156] SetLastError (dwErrCode=0x0) [0256.156] GetLastError () returned 0x0 [0256.156] SetLastError (dwErrCode=0x0) [0256.156] GetLastError () returned 0x0 [0256.156] SetLastError (dwErrCode=0x0) [0256.156] GetLastError () returned 0x0 [0256.156] SetLastError (dwErrCode=0x0) [0256.156] GetLastError () returned 0x0 [0256.156] SetLastError (dwErrCode=0x0) [0256.156] GetLastError () returned 0x0 [0256.157] SetLastError (dwErrCode=0x0) [0256.157] GetLastError () returned 0x0 [0256.157] SetLastError (dwErrCode=0x0) [0256.157] GetLastError () returned 0x0 [0256.157] SetLastError (dwErrCode=0x0) [0256.157] GetLastError () returned 0x0 [0256.157] SetLastError (dwErrCode=0x0) [0256.157] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Program Files\\Common Files\\", psz="C:\\Program Files\\Common Files\\", len=0x1e | out: pbstr=0x7ffa08*="C:\\Program Files\\Common Files\\") returned 1 [0256.157] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Program Files\\Common Files\\", psz="C:\\Program Files\\Common Files\\", len=0x1e | out: pbstr=0x7ff968*="C:\\Program Files\\Common Files\\") returned 1 [0256.157] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0256.157] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Program Files\\Common Files\\", psz="c:\\program files\\common files\\", len=0x1e | out: pbstr=0x7ffa08*="c:\\program files\\common files\\") returned 1 [0256.157] SysReAllocStringLen (in: pbstr=0x27e0f60*=0x0, psz="c:\\program files\\common files\\", len=0x1e | out: pbstr=0x27e0f60*="c:\\program files\\common files\\") returned 1 [0256.157] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x27f0650 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Pictures") returned 0x0 [0256.159] GetLastError () returned 0x0 [0256.159] SetLastError (dwErrCode=0x0) [0256.159] GetLastError () returned 0x0 [0256.159] SetLastError (dwErrCode=0x0) [0256.159] GetLastError () returned 0x0 [0256.159] SetLastError (dwErrCode=0x0) [0256.159] GetLastError () returned 0x0 [0256.159] SetLastError (dwErrCode=0x0) [0256.159] SysReAllocStringLen (in: pbstr=0x7ffa08*="c:\\program files\\common files\\", psz="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", len=0x1f | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\Pictures\\") returned 1 [0256.159] GetThreadLocale () returned 0x409 [0256.160] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0256.160] GetThreadLocale () returned 0x409 [0256.160] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0256.160] GetLastError () returned 0x0 [0256.160] SetLastError (dwErrCode=0x0) [0256.160] GetLastError () returned 0x0 [0256.160] SetLastError (dwErrCode=0x0) [0256.160] GetLastError () returned 0x0 [0256.164] SetLastError (dwErrCode=0x0) [0256.164] GetLastError () returned 0x0 [0256.164] SetLastError (dwErrCode=0x0) [0256.164] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0256.164] GetLastError () returned 0x0 [0256.164] SetLastError (dwErrCode=0x0) [0256.164] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb628, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0256.164] GetLastError () returned 0x0 [0256.164] SetLastError (dwErrCode=0x0) [0256.164] GetLastError () returned 0x0 [0256.164] SetLastError (dwErrCode=0x0) [0256.164] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.164] GetLastError () returned 0x0 [0256.164] SetLastError (dwErrCode=0x0) [0256.164] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.164] GetLastError () returned 0x0 [0256.164] SetLastError (dwErrCode=0x0) [0256.164] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.164] GetLastError () returned 0x0 [0256.164] SetLastError (dwErrCode=0x0) [0256.164] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac51b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.164] GetLastError () returned 0x0 [0256.164] SetLastError (dwErrCode=0x0) [0256.165] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.165] GetLastError () returned 0x0 [0256.165] SetLastError (dwErrCode=0x0) [0256.165] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.165] GetLastError () returned 0x0 [0256.165] SetLastError (dwErrCode=0x0) [0256.165] GetLastError () returned 0x0 [0256.165] SetLastError (dwErrCode=0x0) [0256.165] GetLastError () returned 0x0 [0256.165] SetLastError (dwErrCode=0x0) [0256.165] GetLastError () returned 0x0 [0256.165] SetLastError (dwErrCode=0x0) [0256.165] GetLastError () returned 0x0 [0256.165] SetLastError (dwErrCode=0x0) [0256.165] GetLastError () returned 0x0 [0256.165] SetLastError (dwErrCode=0x0) [0256.165] GetLastError () returned 0x0 [0256.165] SetLastError (dwErrCode=0x0) [0256.165] GetLastError () returned 0x0 [0256.165] SetLastError (dwErrCode=0x0) [0256.165] GetLastError () returned 0x0 [0256.166] SetLastError (dwErrCode=0x0) [0256.166] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", psz="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", len=0x1f | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\Pictures\\") returned 1 [0256.166] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", psz="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", len=0x1f | out: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\Pictures\\") returned 1 [0256.166] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", cchLength=0x1f | out: lpsz="c:\\users\\rdhj0cnfevzx\\pictures\\") returned 0x1f [0256.166] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", psz="c:\\users\\rdhj0cnfevzx\\pictures\\", len=0x1f | out: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\pictures\\") returned 1 [0256.166] SysReAllocStringLen (in: pbstr=0x27e0f68*=0x0, psz="c:\\users\\rdhj0cnfevzx\\pictures\\", len=0x1f | out: pbstr=0x27e0f68*="c:\\users\\rdhj0cnfevzx\\pictures\\") returned 1 [0256.166] SHGetFolderPathW (in: hwnd=0x0, csidl=34, hToken=0x0, dwFlags=0x0, pszPath=0x27f0650 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x0 [0256.167] GetLastError () returned 0x0 [0256.167] SetLastError (dwErrCode=0x0) [0256.167] GetLastError () returned 0x0 [0256.167] SetLastError (dwErrCode=0x0) [0256.167] GetLastError () returned 0x0 [0256.167] SetLastError (dwErrCode=0x0) [0256.167] GetLastError () returned 0x0 [0256.167] SetLastError (dwErrCode=0x0) [0256.168] SysReAllocStringLen (in: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\pictures\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x3e | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0256.168] GetThreadLocale () returned 0x409 [0256.168] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0256.168] GetThreadLocale () returned 0x409 [0256.168] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0256.168] GetLastError () returned 0x0 [0256.168] SetLastError (dwErrCode=0x0) [0256.168] GetLastError () returned 0x0 [0256.168] SetLastError (dwErrCode=0x0) [0256.168] GetLastError () returned 0x0 [0256.168] SetLastError (dwErrCode=0x0) [0256.168] GetLastError () returned 0x0 [0256.168] SetLastError (dwErrCode=0x0) [0256.168] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0256.168] GetLastError () returned 0x0 [0256.168] SetLastError (dwErrCode=0x0) [0256.169] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb628, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0256.169] GetLastError () returned 0x0 [0256.169] SetLastError (dwErrCode=0x0) [0256.169] GetLastError () returned 0x0 [0256.169] SetLastError (dwErrCode=0x0) [0256.169] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.169] GetLastError () returned 0x0 [0256.169] SetLastError (dwErrCode=0x0) [0256.169] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.169] GetLastError () returned 0x0 [0256.169] SetLastError (dwErrCode=0x0) [0256.169] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.169] GetLastError () returned 0x0 [0256.169] SetLastError (dwErrCode=0x0) [0256.169] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac51b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.169] GetLastError () returned 0x0 [0256.169] SetLastError (dwErrCode=0x0) [0256.169] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.169] GetLastError () returned 0x0 [0256.169] SetLastError (dwErrCode=0x0) [0256.169] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.169] GetLastError () returned 0x0 [0256.169] SetLastError (dwErrCode=0x0) [0256.170] GetLastError () returned 0x0 [0256.170] SetLastError (dwErrCode=0x0) [0256.170] GetLastError () returned 0x0 [0256.170] SetLastError (dwErrCode=0x0) [0256.170] GetLastError () returned 0x0 [0256.170] SetLastError (dwErrCode=0x0) [0256.170] GetLastError () returned 0x0 [0256.170] SetLastError (dwErrCode=0x0) [0256.170] GetLastError () returned 0x0 [0256.170] SetLastError (dwErrCode=0x0) [0256.170] GetLastError () returned 0x0 [0256.170] SetLastError (dwErrCode=0x0) [0256.170] GetLastError () returned 0x0 [0256.170] SetLastError (dwErrCode=0x0) [0256.170] GetLastError () returned 0x0 [0256.170] SetLastError (dwErrCode=0x0) [0256.170] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x3e | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0256.171] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x3e | out: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0256.171] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", cchLength=0x3e | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\") returned 0x3e [0256.171] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\", len=0x3e | out: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\") returned 1 [0256.171] SysReAllocStringLen (in: pbstr=0x27e0f70*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\", len=0x3e | out: pbstr=0x27e0f70*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\") returned 1 [0256.171] SHGetFolderPathW (in: hwnd=0x0, csidl=33, hToken=0x0, dwFlags=0x0, pszPath=0x27f0650 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies") returned 0x0 [0256.172] GetLastError () returned 0x0 [0256.172] SetLastError (dwErrCode=0x0) [0256.172] GetProcessHeap () returned 0x8f0000 [0256.172] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x2500fd0 [0256.173] GetLastError () returned 0x0 [0256.174] SetLastError (dwErrCode=0x0) [0256.174] GetLastError () returned 0x0 [0256.174] SetLastError (dwErrCode=0x0) [0256.174] GetLastError () returned 0x0 [0256.174] SetLastError (dwErrCode=0x0) [0256.174] SysReAllocStringLen (in: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", len=0x42 | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\") returned 1 [0256.174] GetThreadLocale () returned 0x409 [0256.174] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0256.174] GetThreadLocale () returned 0x409 [0256.174] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0256.174] GetLastError () returned 0x0 [0256.174] SetLastError (dwErrCode=0x0) [0256.174] GetLastError () returned 0x0 [0256.174] SetLastError (dwErrCode=0x0) [0256.174] GetLastError () returned 0x0 [0256.174] SetLastError (dwErrCode=0x0) [0256.174] GetLastError () returned 0x0 [0256.175] SetLastError (dwErrCode=0x0) [0256.175] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0256.175] GetLastError () returned 0x0 [0256.175] SetLastError (dwErrCode=0x0) [0256.175] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb628, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0256.175] GetLastError () returned 0x0 [0256.175] SetLastError (dwErrCode=0x0) [0256.175] GetLastError () returned 0x0 [0256.175] SetLastError (dwErrCode=0x0) [0256.175] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.175] GetLastError () returned 0x0 [0256.175] SetLastError (dwErrCode=0x0) [0256.175] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.175] GetLastError () returned 0x0 [0256.175] SetLastError (dwErrCode=0x0) [0256.175] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.175] GetLastError () returned 0x0 [0256.175] SetLastError (dwErrCode=0x0) [0256.175] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac51b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.175] GetLastError () returned 0x0 [0256.175] SetLastError (dwErrCode=0x0) [0256.175] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.175] GetLastError () returned 0x0 [0256.176] SetLastError (dwErrCode=0x0) [0256.176] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.176] GetLastError () returned 0x0 [0256.176] SetLastError (dwErrCode=0x0) [0256.176] GetLastError () returned 0x0 [0256.176] SetLastError (dwErrCode=0x0) [0256.176] GetLastError () returned 0x0 [0256.176] SetLastError (dwErrCode=0x0) [0256.176] GetLastError () returned 0x0 [0256.176] SetLastError (dwErrCode=0x0) [0256.176] GetLastError () returned 0x0 [0256.176] SetLastError (dwErrCode=0x0) [0256.176] GetLastError () returned 0x0 [0256.176] SetLastError (dwErrCode=0x0) [0256.176] GetLastError () returned 0x0 [0256.176] SetLastError (dwErrCode=0x0) [0256.176] GetLastError () returned 0x0 [0256.176] SetLastError (dwErrCode=0x0) [0256.176] GetLastError () returned 0x0 [0256.176] SetLastError (dwErrCode=0x0) [0256.177] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", len=0x42 | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\") returned 1 [0256.177] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", len=0x42 | out: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\") returned 1 [0256.177] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", cchLength=0x42 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\") returned 0x42 [0256.177] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\", len=0x42 | out: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\") returned 1 [0256.177] SysReAllocStringLen (in: pbstr=0x27e0f78*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\", len=0x42 | out: pbstr=0x27e0f78*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\") returned 1 [0256.177] SHGetFolderPathW (in: hwnd=0x0, csidl=32, hToken=0x0, dwFlags=0x0, pszPath=0x27f0650 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache") returned 0x0 [0256.178] GetLastError () returned 0x0 [0256.178] SetLastError (dwErrCode=0x0) [0256.178] GetLastError () returned 0x0 [0256.178] SetLastError (dwErrCode=0x0) [0256.178] GetLastError () returned 0x0 [0256.178] SetLastError (dwErrCode=0x0) [0256.178] GetLastError () returned 0x0 [0256.178] SetLastError (dwErrCode=0x0) [0256.179] SysReAllocStringLen (in: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", len=0x40 | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 1 [0256.179] GetThreadLocale () returned 0x409 [0256.179] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0256.179] GetThreadLocale () returned 0x409 [0256.179] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0256.179] GetLastError () returned 0x0 [0256.179] SetLastError (dwErrCode=0x0) [0256.179] GetLastError () returned 0x0 [0256.179] SetLastError (dwErrCode=0x0) [0256.179] GetLastError () returned 0x0 [0256.179] SetLastError (dwErrCode=0x0) [0256.179] GetLastError () returned 0x0 [0256.179] SetLastError (dwErrCode=0x0) [0256.179] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0256.179] GetLastError () returned 0x0 [0256.179] SetLastError (dwErrCode=0x0) [0256.179] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb628, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0256.179] GetLastError () returned 0x0 [0256.179] SetLastError (dwErrCode=0x0) [0256.179] GetLastError () returned 0x0 [0256.179] SetLastError (dwErrCode=0x0) [0256.179] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.180] GetLastError () returned 0x0 [0256.180] SetLastError (dwErrCode=0x0) [0256.180] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.180] GetLastError () returned 0x0 [0256.180] SetLastError (dwErrCode=0x0) [0256.180] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.180] GetLastError () returned 0x0 [0256.180] SetLastError (dwErrCode=0x0) [0256.180] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac51b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.180] GetLastError () returned 0x0 [0256.180] SetLastError (dwErrCode=0x0) [0256.180] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.180] GetLastError () returned 0x0 [0256.180] SetLastError (dwErrCode=0x0) [0256.180] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.180] GetLastError () returned 0x0 [0256.180] SetLastError (dwErrCode=0x0) [0256.180] GetLastError () returned 0x0 [0256.180] SetLastError (dwErrCode=0x0) [0256.180] GetLastError () returned 0x0 [0256.180] SetLastError (dwErrCode=0x0) [0256.181] GetLastError () returned 0x0 [0256.181] SetLastError (dwErrCode=0x0) [0256.181] GetLastError () returned 0x0 [0256.181] SetLastError (dwErrCode=0x0) [0256.181] GetLastError () returned 0x0 [0256.181] SetLastError (dwErrCode=0x0) [0256.181] GetLastError () returned 0x0 [0256.181] SetLastError (dwErrCode=0x0) [0256.181] GetLastError () returned 0x0 [0256.181] SetLastError (dwErrCode=0x0) [0256.181] GetLastError () returned 0x0 [0256.181] SetLastError (dwErrCode=0x0) [0256.181] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", len=0x40 | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 1 [0256.181] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", len=0x40 | out: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 1 [0256.181] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", cchLength=0x40 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\") returned 0x40 [0256.181] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\", len=0x40 | out: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\") returned 1 [0256.181] SysReAllocStringLen (in: pbstr=0x27e0f80*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\", len=0x40 | out: pbstr=0x27e0f80*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\") returned 1 [0256.181] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x27f0650 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0256.183] GetLastError () returned 0x0 [0256.183] SetLastError (dwErrCode=0x0) [0256.183] GetLastError () returned 0x0 [0256.183] SetLastError (dwErrCode=0x0) [0256.183] GetLastError () returned 0x0 [0256.183] SetLastError (dwErrCode=0x0) [0256.183] GetLastError () returned 0x0 [0256.183] SetLastError (dwErrCode=0x0) [0256.183] SysReAllocStringLen (in: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", len=0x26 | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\") returned 1 [0256.183] GetThreadLocale () returned 0x409 [0256.183] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0256.183] GetThreadLocale () returned 0x409 [0256.183] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0256.183] GetLastError () returned 0x0 [0256.183] SetLastError (dwErrCode=0x0) [0256.183] GetLastError () returned 0x0 [0256.183] SetLastError (dwErrCode=0x0) [0256.183] GetLastError () returned 0x0 [0256.183] SetLastError (dwErrCode=0x0) [0256.183] GetLastError () returned 0x0 [0256.184] SetLastError (dwErrCode=0x0) [0256.184] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff770 | out: lpBuffer=0x0, lpFilePart=0x7ff770*=0x0) returned 0x2a [0256.184] GetLastError () returned 0x0 [0256.184] SetLastError (dwErrCode=0x0) [0256.184] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb528, lpFilePart=0x7ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff770*="Temp") returned 0x28 [0256.184] GetLastError () returned 0x0 [0256.184] SetLastError (dwErrCode=0x0) [0256.184] GetLastError () returned 0x0 [0256.184] SetLastError (dwErrCode=0x0) [0256.184] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.184] GetLastError () returned 0x0 [0256.184] SetLastError (dwErrCode=0x0) [0256.184] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.184] GetLastError () returned 0x0 [0256.184] SetLastError (dwErrCode=0x0) [0256.184] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.184] GetLastError () returned 0x0 [0256.184] SetLastError (dwErrCode=0x0) [0256.184] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac51b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.184] GetLastError () returned 0x0 [0256.184] SetLastError (dwErrCode=0x0) [0256.185] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.185] GetLastError () returned 0x0 [0256.185] SetLastError (dwErrCode=0x0) [0256.185] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac51b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.185] GetLastError () returned 0x0 [0256.185] SetLastError (dwErrCode=0x0) [0256.185] GetLastError () returned 0x0 [0256.185] SetLastError (dwErrCode=0x0) [0256.186] GetLastError () returned 0x0 [0256.186] SetLastError (dwErrCode=0x0) [0256.186] GetLastError () returned 0x0 [0256.186] SetLastError (dwErrCode=0x0) [0256.186] GetLastError () returned 0x0 [0256.186] SetLastError (dwErrCode=0x0) [0256.186] GetLastError () returned 0x0 [0256.186] SetLastError (dwErrCode=0x0) [0256.186] GetLastError () returned 0x0 [0256.186] SetLastError (dwErrCode=0x0) [0256.186] GetLastError () returned 0x0 [0256.186] SetLastError (dwErrCode=0x0) [0256.186] GetLastError () returned 0x0 [0256.186] SetLastError (dwErrCode=0x0) [0256.186] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", len=0x26 | out: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\") returned 1 [0256.186] SysReAllocStringLen (in: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", len=0x26 | out: pbstr=0x7ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\") returned 1 [0256.186] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", cchLength=0x26 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\") returned 0x26 [0256.186] SysReAllocStringLen (in: pbstr=0x7ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\", len=0x26 | out: pbstr=0x7ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\") returned 1 [0256.186] SysReAllocStringLen (in: pbstr=0x27e0f88*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\", len=0x26 | out: pbstr=0x27e0f88*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\") returned 1 [0256.186] GetLastError () returned 0x0 [0256.187] SetLastError (dwErrCode=0x0) [0256.187] GetLastError () returned 0x0 [0256.187] SetLastError (dwErrCode=0x0) [0256.187] GetLastError () returned 0x0 [0256.187] SetLastError (dwErrCode=0x0) [0256.187] GetVersion () returned 0x23f00206 [0256.187] GetCurrentProcessId () returned 0x115c [0256.187] GetCurrentProcess () returned 0xffffffffffffffff [0256.187] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe\" " [0256.187] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe\" " [0256.187] GetLastError () returned 0x0 [0256.187] SetLastError (dwErrCode=0x0) [0256.187] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe\" " [0256.187] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe\" " [0256.187] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0256.188] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe", NtPathName=0x7ff978, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0256.188] NtCreateFile (in: FileHandle=0x7ff998, DesiredAccess=0x80100080, ObjectAttributes=0x7ff948*(Length=0x30, RootDirectory=0x0, ObjectName="\\??\\c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x7ff988, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x7ff998*=0x1c8, IoStatusBlock=0x7ff988*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0256.188] RtlFreeAnsiString (AnsiString="\\") [0256.188] NtSetInformationFile (FileHandle=0x1c8, IoStatusBlock=0x7ff978, FileInformation=0x7ff988, Length=0x8, FileInformationClass=0xe) returned 0x0 [0256.188] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x7ff978, Buffer=0x7ffb58, BufferLength=0x40, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x7ff978, Buffer=0x7ffb58*) returned 0x0 [0256.189] NtSetInformationFile (FileHandle=0x1c8, IoStatusBlock=0x7ff978, FileInformation=0x7ff988, Length=0x8, FileInformationClass=0xe) returned 0x0 [0256.189] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x7ff978, Buffer=0x7ffb38, BufferLength=0x14, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x7ff978, Buffer=0x7ffb38*) returned 0x0 [0256.190] NtSetInformationFile (FileHandle=0x1c8, IoStatusBlock=0x7ff978, FileInformation=0x7ff988, Length=0x8, FileInformationClass=0xe) returned 0x0 [0256.190] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x7ff978, Buffer=0x7ffa48, BufferLength=0xf0, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x7ff978, Buffer=0x7ffa48*) returned 0x0 [0256.190] NtSetInformationFile (FileHandle=0x1c8, IoStatusBlock=0x7ff978, FileInformation=0x7ff988, Length=0x8, FileInformationClass=0xe) returned 0x0 [0256.190] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x7ff978, Buffer=0x7ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x7ff978, Buffer=0x7ffa20*) returned 0x0 [0256.190] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x7ff978, Buffer=0x7ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x7ff978, Buffer=0x7ffa20*) returned 0x0 [0256.190] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x7ff978, Buffer=0x7ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x7ff978, Buffer=0x7ffa20*) returned 0x0 [0256.191] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x7ff978, Buffer=0x7ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x7ff978, Buffer=0x7ffa20*) returned 0x0 [0256.191] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x7ff978, Buffer=0x7ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x7ff978, Buffer=0x7ffa20*) returned 0x0 [0256.191] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x7ff978, Buffer=0x7ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x7ff978, Buffer=0x7ffa20*) returned 0x0 [0256.191] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x7ff978, Buffer=0x7ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x7ff978, Buffer=0x7ffa20*) returned 0x0 [0256.191] NtClose (Handle=0x1c8) returned 0x0 [0256.193] GetLastError () returned 0x0 [0256.193] SetLastError (dwErrCode=0x0) [0256.193] GetLastError () returned 0x0 [0256.193] SetLastError (dwErrCode=0x0) [0256.193] GetLastError () returned 0x0 [0256.193] SetLastError (dwErrCode=0x0) [0256.193] GetLastError () returned 0x0 [0256.193] GetLastError () returned 0x0 [0256.193] SetLastError (dwErrCode=0x0) [0256.193] GetProcessHeap () returned 0x8f0000 [0256.194] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x2821f60 [0256.195] GetLastError () returned 0x0 [0256.195] SetLastError (dwErrCode=0x0) [0256.195] SetLastError (dwErrCode=0x0) [0256.195] GetLastError () returned 0x0 [0256.195] SetLastError (dwErrCode=0x0) [0256.195] GetLastError () returned 0x0 [0256.195] SetLastError (dwErrCode=0x0) [0256.195] GetLastError () returned 0x0 [0256.195] SetLastError (dwErrCode=0x0) [0256.195] GetLastError () returned 0x0 [0256.196] SetLastError (dwErrCode=0x0) [0256.196] GetLastError () returned 0x0 [0256.196] SetLastError (dwErrCode=0x0) [0256.196] GetLastError () returned 0x0 [0256.196] SetLastError (dwErrCode=0x0) [0256.196] GetProcessHeap () returned 0x8f0000 [0256.196] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x2829f70 [0256.197] GetLastError () returned 0x0 [0256.197] SetLastError (dwErrCode=0x0) [0256.197] GetLastError () returned 0x0 [0256.197] SetLastError (dwErrCode=0x0) [0256.197] GetLastError () returned 0x0 [0256.197] SetLastError (dwErrCode=0x0) [0256.197] GetLastError () returned 0x0 [0256.198] SetLastError (dwErrCode=0x0) [0256.198] GetLastError () returned 0x0 [0256.198] SetLastError (dwErrCode=0x0) [0256.198] GetLastError () returned 0x0 [0256.198] SetLastError (dwErrCode=0x0) [0256.198] GetLastError () returned 0x0 [0256.198] SetLastError (dwErrCode=0x0) [0256.198] GetLastError () returned 0x0 [0256.198] SetLastError (dwErrCode=0x0) [0256.198] GetLastError () returned 0x0 [0256.198] SetLastError (dwErrCode=0x0) [0256.198] GetLastError () returned 0x0 [0256.198] SetLastError (dwErrCode=0x0) [0256.230] GetLastError () returned 0x0 [0256.230] SetLastError (dwErrCode=0x0) [0256.230] GetCurrentThreadId () returned 0x1160 [0256.230] GetLastError () returned 0x0 [0256.230] SetLastError (dwErrCode=0x0) [0256.230] GetLastError () returned 0x0 [0256.230] SetLastError (dwErrCode=0x0) [0256.232] GetLastError () returned 0x0 [0256.232] SetLastError (dwErrCode=0x0) [0256.232] GetLastError () returned 0x0 [0256.232] SetLastError (dwErrCode=0x0) [0256.232] GetLastError () returned 0x0 [0256.232] SetLastError (dwErrCode=0x0) [0256.232] GetLastError () returned 0x0 [0256.233] SetLastError (dwErrCode=0x0) [0256.233] GetLastError () returned 0x0 [0256.233] SetLastError (dwErrCode=0x0) [0256.233] GetLastError () returned 0x0 [0256.233] SetLastError (dwErrCode=0x0) [0256.233] GetLastError () returned 0x0 [0256.233] SetLastError (dwErrCode=0x0) [0256.233] GetTickCount () returned 0xb836a1 [0256.233] GetLastError () returned 0x0 [0256.233] SetLastError (dwErrCode=0x0) [0256.233] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644325169) returned 1 [0256.233] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644335245) returned 1 [0256.234] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644343978) returned 1 [0256.234] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644352293) returned 1 [0256.234] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644360961) returned 1 [0256.234] Sleep (dwMilliseconds=0x0) [0256.235] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644503310) returned 1 [0256.235] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644510865) returned 1 [0256.235] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644520485) returned 1 [0256.235] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644527733) returned 1 [0256.235] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644535091) returned 1 [0256.236] Sleep (dwMilliseconds=0x0) [0256.236] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644559045) returned 1 [0256.236] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644568740) returned 1 [0256.236] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644576055) returned 1 [0256.236] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644583170) returned 1 [0256.236] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217644590245) returned 1 [0256.236] Sleep (dwMilliseconds=0x0) [0256.243] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217645291519) returned 1 [0256.243] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217645301351) returned 1 [0256.243] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217645310161) returned 1 [0256.243] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217645325072) returned 1 [0256.243] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217645333961) returned 1 [0256.244] Sleep (dwMilliseconds=0x0) [0256.245] GetTickCount () returned 0xb836a1 [0256.245] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217645444547) returned 1 [0256.245] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217645453684) returned 1 [0256.245] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217645465174) returned 1 [0256.245] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217645487755) returned 1 [0256.245] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffc60 | out: lpPerformanceCount=0x7ffc60*=1217645496530) returned 1 [0256.245] Sleep (dwMilliseconds=0x0) [0256.253] GetTickCount () returned 0xb836b1 [0256.253] GetLastError () returned 0x0 [0256.253] SetLastError (dwErrCode=0x0) [0256.253] GetLastError () returned 0x0 [0256.253] SetLastError (dwErrCode=0x0) [0256.253] GetLastError () returned 0x0 [0256.253] SetLastError (dwErrCode=0x0) [0256.253] GetLastError () returned 0x0 [0256.254] SetLastError (dwErrCode=0x0) [0256.254] GetLastError () returned 0x0 [0256.254] SetLastError (dwErrCode=0x0) [0256.254] GetLastError () returned 0x0 [0256.254] SetLastError (dwErrCode=0x0) [0256.254] GetLastError () returned 0x0 [0256.254] SetLastError (dwErrCode=0x0) [0256.254] GetLastError () returned 0x0 [0256.254] SetLastError (dwErrCode=0x0) [0256.254] GetLastError () returned 0x0 [0256.254] SetLastError (dwErrCode=0x0) [0256.254] GetLastError () returned 0x0 [0256.254] SetLastError (dwErrCode=0x0) [0256.254] GetLastError () returned 0x0 [0256.254] SetLastError (dwErrCode=0x0) [0256.260] GetLastError () returned 0x0 [0256.260] SetLastError (dwErrCode=0x0) [0256.261] GetLastError () returned 0x0 [0256.261] SetLastError (dwErrCode=0x0) [0256.269] GetLastError () returned 0x0 [0256.269] SetLastError (dwErrCode=0x0) [0256.269] GetLastError () returned 0x0 [0256.269] SetLastError (dwErrCode=0x0) [0256.635] GetLastError () returned 0x0 [0256.635] SetLastError (dwErrCode=0x0) [0256.635] GetLastError () returned 0x0 [0256.635] SetLastError (dwErrCode=0x0) [0256.635] GetLastError () returned 0x0 [0256.635] SetLastError (dwErrCode=0x0) [0256.635] GetLastError () returned 0x0 [0256.635] SetLastError (dwErrCode=0x0) [0256.635] GetLastError () returned 0x0 [0256.636] SetLastError (dwErrCode=0x0) [0256.636] GetLastError () returned 0x0 [0256.636] SetLastError (dwErrCode=0x0) [0256.636] GetLastError () returned 0x0 [0256.636] SetLastError (dwErrCode=0x0) [0256.636] GetLastError () returned 0x0 [0256.636] SetLastError (dwErrCode=0x0) [0256.636] GetLastError () returned 0x0 [0256.636] SetLastError (dwErrCode=0x0) [0256.636] GetLastError () returned 0x0 [0256.636] SetLastError (dwErrCode=0x0) [0256.636] GetProcessHeap () returned 0x8f0000 [0256.637] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40000) returned 0x2831f80 [0256.638] GetLastError () returned 0x0 [0256.638] SetLastError (dwErrCode=0x0) [0256.640] GetLastError () returned 0x0 [0256.640] SetLastError (dwErrCode=0x0) [0256.640] GetLastError () returned 0x0 [0256.640] SetLastError (dwErrCode=0x0) [0256.641] GetLastError () returned 0x0 [0256.641] SetLastError (dwErrCode=0x0) [0256.641] GetLastError () returned 0x0 [0256.641] SetLastError (dwErrCode=0x0) [0256.641] GetLastError () returned 0x0 [0256.641] SetLastError (dwErrCode=0x0) [0256.641] GetLastError () returned 0x0 [0256.641] SetLastError (dwErrCode=0x0) [0256.642] GetLastError () returned 0x0 [0256.642] SetLastError (dwErrCode=0x0) [0256.644] GetLastError () returned 0x0 [0256.644] SetLastError (dwErrCode=0x0) [0256.695] GetLastError () returned 0x0 [0256.695] SetLastError (dwErrCode=0x0) [0256.695] GetLastError () returned 0x0 [0256.695] SetLastError (dwErrCode=0x0) [0256.695] GetLastError () returned 0x0 [0256.696] SetLastError (dwErrCode=0x0) [0256.696] GetLastError () returned 0x0 [0256.696] SetLastError (dwErrCode=0x0) [0256.696] GetLastError () returned 0x0 [0256.696] SetLastError (dwErrCode=0x0) [0256.696] GetLastError () returned 0x0 [0256.696] SetLastError (dwErrCode=0x0) [0256.696] GetLastError () returned 0x0 [0256.698] SetLastError (dwErrCode=0x0) [0256.698] GetLastError () returned 0x0 [0256.698] SetLastError (dwErrCode=0x0) [0256.698] GetLastError () returned 0x0 [0256.698] SetLastError (dwErrCode=0x0) [0256.698] GetLastError () returned 0x0 [0256.699] SetLastError (dwErrCode=0x0) [0256.699] GetLastError () returned 0x0 [0256.699] SetLastError (dwErrCode=0x0) [0256.699] GetLastError () returned 0x0 [0256.699] SetLastError (dwErrCode=0x0) [0256.699] GetLastError () returned 0x0 [0256.699] SetLastError (dwErrCode=0x0) [0256.699] GetLastError () returned 0x0 [0256.699] SetLastError (dwErrCode=0x0) [0256.699] GetLastError () returned 0x0 [0256.699] SetLastError (dwErrCode=0x0) [0256.699] GetLastError () returned 0x0 [0256.699] SetLastError (dwErrCode=0x0) [0256.699] GetLastError () returned 0x0 [0256.700] SetLastError (dwErrCode=0x0) [0256.700] GetLastError () returned 0x0 [0256.700] SetLastError (dwErrCode=0x0) [0256.700] GetLastError () returned 0x0 [0256.700] SetLastError (dwErrCode=0x0) [0256.700] GetLastError () returned 0x0 [0256.700] SetLastError (dwErrCode=0x0) [0256.700] GetLastError () returned 0x0 [0256.700] SetLastError (dwErrCode=0x0) [0256.700] GetLastError () returned 0x0 [0256.700] SetLastError (dwErrCode=0x0) [0256.700] GetLastError () returned 0x0 [0256.700] SetLastError (dwErrCode=0x0) [0256.700] GetLastError () returned 0x0 [0256.701] SetLastError (dwErrCode=0x0) [0256.701] GetLastError () returned 0x0 [0256.701] SetLastError (dwErrCode=0x0) [0256.701] GetLastError () returned 0x0 [0256.701] SetLastError (dwErrCode=0x0) [0256.701] GetLastError () returned 0x0 [0256.701] SetLastError (dwErrCode=0x0) [0256.701] GetLastError () returned 0x0 [0256.701] SetLastError (dwErrCode=0x0) [0256.701] GetLastError () returned 0x0 [0256.701] SetLastError (dwErrCode=0x0) [0256.701] GetLastError () returned 0x0 [0256.702] SetLastError (dwErrCode=0x0) [0256.702] GetLastError () returned 0x0 [0256.702] SetLastError (dwErrCode=0x0) [0256.702] GetLastError () returned 0x0 [0256.702] SetLastError (dwErrCode=0x0) [0256.830] GetLastError () returned 0x0 [0256.830] SetLastError (dwErrCode=0x0) [0256.830] GetLastError () returned 0x0 [0256.831] SetLastError (dwErrCode=0x0) [0256.831] GetLastError () returned 0x0 [0256.831] SetLastError (dwErrCode=0x0) [0256.831] GetLastError () returned 0x0 [0256.831] SetLastError (dwErrCode=0x0) [0256.831] GetLastError () returned 0x0 [0256.831] SetLastError (dwErrCode=0x0) [0256.831] GetLastError () returned 0x0 [0256.831] SetLastError (dwErrCode=0x0) [0256.831] GetLastError () returned 0x0 [0256.831] SetLastError (dwErrCode=0x0) [0256.831] GetLastError () returned 0x0 [0256.832] GetLastError () returned 0x0 [0256.832] SetLastError (dwErrCode=0x0) [0256.832] GetLastError () returned 0x0 [0256.832] SetLastError (dwErrCode=0x0) [0256.832] SetLastError (dwErrCode=0x0) [0256.832] GetLastError () returned 0x0 [0256.832] SetLastError (dwErrCode=0x0) [0256.832] GetLastError () returned 0x0 [0256.832] SetLastError (dwErrCode=0x0) [0256.832] GetLastError () returned 0x0 [0256.832] SetLastError (dwErrCode=0x0) [0256.832] GetLastError () returned 0x0 [0256.832] SetLastError (dwErrCode=0x0) [0256.833] GetLastError () returned 0x0 [0256.833] SetLastError (dwErrCode=0x0) [0256.833] GetLastError () returned 0x0 [0256.833] SetLastError (dwErrCode=0x0) [0256.833] GetLastError () returned 0x0 [0256.833] SetLastError (dwErrCode=0x0) [0256.833] GetLastError () returned 0x0 [0256.833] SetLastError (dwErrCode=0x0) [0256.833] GetLastError () returned 0x0 [0256.833] SetLastError (dwErrCode=0x0) [0256.833] GetLastError () returned 0x0 [0256.833] SetLastError (dwErrCode=0x0) [0256.833] GetLastError () returned 0x0 [0256.834] SetLastError (dwErrCode=0x0) [0256.834] GetLastError () returned 0x0 [0256.834] SetLastError (dwErrCode=0x0) [0256.834] GetLastError () returned 0x0 [0256.834] SetLastError (dwErrCode=0x0) [0256.834] GetLastError () returned 0x0 [0256.834] SetLastError (dwErrCode=0x0) [0256.834] GetLastError () returned 0x0 [0256.834] SetLastError (dwErrCode=0x0) [0256.834] GetLastError () returned 0x0 [0256.834] SetLastError (dwErrCode=0x0) [0256.834] GetLastError () returned 0x0 [0256.834] SetLastError (dwErrCode=0x0) [0256.835] GetLastError () returned 0x0 [0256.835] SetLastError (dwErrCode=0x0) [0256.835] GetLastError () returned 0x0 [0256.835] SetLastError (dwErrCode=0x0) [0256.835] GetLastError () returned 0x0 [0256.835] SetLastError (dwErrCode=0x0) [0256.835] GetLastError () returned 0x0 [0256.835] SetLastError (dwErrCode=0x0) [0256.835] GetLastError () returned 0x0 [0256.836] SetLastError (dwErrCode=0x0) [0256.836] GetLastError () returned 0x0 [0256.836] SetLastError (dwErrCode=0x0) [0256.836] GetLastError () returned 0x0 [0256.836] SetLastError (dwErrCode=0x0) [0256.836] GetLastError () returned 0x0 [0256.836] SetLastError (dwErrCode=0x0) [0256.836] GetLastError () returned 0x0 [0256.836] SetLastError (dwErrCode=0x0) [0256.836] GetLastError () returned 0x0 [0256.836] SetLastError (dwErrCode=0x0) [0256.836] GetLastError () returned 0x0 [0256.836] SetLastError (dwErrCode=0x0) [0256.837] GetLastError () returned 0x0 [0256.837] SetLastError (dwErrCode=0x0) [0256.837] GetLastError () returned 0x0 [0256.837] SetLastError (dwErrCode=0x0) [0256.837] GetLastError () returned 0x0 [0256.837] SetLastError (dwErrCode=0x0) [0256.837] GetLastError () returned 0x0 [0256.837] SetLastError (dwErrCode=0x0) [0256.837] GetLastError () returned 0x0 [0256.837] SetLastError (dwErrCode=0x0) [0256.837] GetLastError () returned 0x0 [0256.838] SetLastError (dwErrCode=0x0) [0256.838] GetLastError () returned 0x0 [0256.838] SetLastError (dwErrCode=0x0) [0256.838] GetLastError () returned 0x0 [0256.838] SetLastError (dwErrCode=0x0) [0256.838] GetLastError () returned 0x0 [0256.838] SetLastError (dwErrCode=0x0) [0256.838] GetLastError () returned 0x0 [0256.838] SetLastError (dwErrCode=0x0) [0256.838] GetLastError () returned 0x0 [0256.838] SetLastError (dwErrCode=0x0) [0256.838] GetLastError () returned 0x0 [0256.839] SetLastError (dwErrCode=0x0) [0256.839] GetLastError () returned 0x0 [0256.839] SetLastError (dwErrCode=0x0) [0256.839] GetLastError () returned 0x0 [0256.839] SetLastError (dwErrCode=0x0) [0256.839] GetLastError () returned 0x0 [0256.839] SetLastError (dwErrCode=0x0) [0256.839] GetLastError () returned 0x0 [0256.839] SetLastError (dwErrCode=0x0) [0256.839] GetLastError () returned 0x0 [0256.839] SetLastError (dwErrCode=0x0) [0256.839] GetLastError () returned 0x0 [0256.839] SetLastError (dwErrCode=0x0) [0256.840] GetLastError () returned 0x0 [0256.840] SetLastError (dwErrCode=0x0) [0256.840] GetLastError () returned 0x0 [0256.840] SetLastError (dwErrCode=0x0) [0256.840] GetLastError () returned 0x0 [0256.840] SetLastError (dwErrCode=0x0) [0256.840] GetLastError () returned 0x0 [0256.840] SetLastError (dwErrCode=0x0) [0256.840] GetLastError () returned 0x0 [0256.840] SetLastError (dwErrCode=0x0) [0256.840] GetLastError () returned 0x0 [0256.840] SetLastError (dwErrCode=0x0) [0256.840] GetLastError () returned 0x0 [0256.841] SetLastError (dwErrCode=0x0) [0256.841] GetLastError () returned 0x0 [0256.841] SetLastError (dwErrCode=0x0) [0256.841] GetLastError () returned 0x0 [0256.841] SetLastError (dwErrCode=0x0) [0256.841] GetLastError () returned 0x0 [0256.841] SetLastError (dwErrCode=0x0) [0256.841] GetLastError () returned 0x0 [0256.841] SetLastError (dwErrCode=0x0) [0256.841] GetLastError () returned 0x0 [0256.841] SetLastError (dwErrCode=0x0) [0256.841] GetLastError () returned 0x0 [0256.841] SetLastError (dwErrCode=0x0) [0256.842] GetLastError () returned 0x0 [0256.842] SetLastError (dwErrCode=0x0) [0256.842] GetLastError () returned 0x0 [0256.842] SetLastError (dwErrCode=0x0) [0256.842] GetLastError () returned 0x0 [0256.842] SetLastError (dwErrCode=0x0) [0256.842] GetLastError () returned 0x0 [0256.842] SetLastError (dwErrCode=0x0) [0256.842] GetLastError () returned 0x0 [0256.842] SetLastError (dwErrCode=0x0) [0256.842] GetLastError () returned 0x0 [0256.842] SetLastError (dwErrCode=0x0) [0256.842] GetLastError () returned 0x0 [0256.842] SetLastError (dwErrCode=0x0) [0256.843] GetLastError () returned 0x0 [0256.843] SetLastError (dwErrCode=0x0) [0256.843] GetLastError () returned 0x0 [0256.843] SetLastError (dwErrCode=0x0) [0256.843] GetLastError () returned 0x0 [0256.843] SetLastError (dwErrCode=0x0) [0256.843] GetLastError () returned 0x0 [0256.843] SetLastError (dwErrCode=0x0) [0256.843] GetLastError () returned 0x0 [0256.843] SetLastError (dwErrCode=0x0) [0256.843] GetLastError () returned 0x0 [0256.843] SetLastError (dwErrCode=0x0) [0256.843] GetLastError () returned 0x0 [0256.843] SetLastError (dwErrCode=0x0) [0256.843] GetLastError () returned 0x0 [0256.844] SetLastError (dwErrCode=0x0) [0256.844] GetLastError () returned 0x0 [0256.844] SetLastError (dwErrCode=0x0) [0256.844] GetLastError () returned 0x0 [0256.844] SetLastError (dwErrCode=0x0) [0256.844] GetLastError () returned 0x0 [0256.844] SetLastError (dwErrCode=0x0) [0256.844] GetLastError () returned 0x0 [0256.844] SetLastError (dwErrCode=0x0) [0256.844] GetLastError () returned 0x0 [0256.844] SetLastError (dwErrCode=0x0) [0256.844] GetLastError () returned 0x0 [0256.844] SetLastError (dwErrCode=0x0) [0256.844] GetLastError () returned 0x0 [0256.845] SetLastError (dwErrCode=0x0) [0256.845] GetLastError () returned 0x0 [0256.845] SetLastError (dwErrCode=0x0) [0256.845] GetLastError () returned 0x0 [0256.845] SetLastError (dwErrCode=0x0) [0256.845] GetCurrentThreadId () returned 0x1160 [0256.845] GetLastError () returned 0x0 [0256.846] SetLastError (dwErrCode=0x0) [0256.846] GetLastError () returned 0x0 [0256.846] SetLastError (dwErrCode=0x0) [0256.846] GetLastError () returned 0x0 [0256.846] SetLastError (dwErrCode=0x0) [0256.846] GetCurrentThreadId () returned 0x1160 [0256.846] GetLastError () returned 0x0 [0256.846] SetLastError (dwErrCode=0x0) [0256.846] GetLastError () returned 0x0 [0256.846] SetLastError (dwErrCode=0x0) [0256.846] GetLastError () returned 0x0 [0256.847] SetLastError (dwErrCode=0x0) [0256.847] GetCurrentThreadId () returned 0x1160 [0256.847] GetLastError () returned 0x0 [0256.847] SetLastError (dwErrCode=0x0) [0256.847] GetLastError () returned 0x0 [0256.847] SetLastError (dwErrCode=0x0) [0256.847] GetLastError () returned 0x0 [0256.847] SetLastError (dwErrCode=0x0) [0256.847] GetLastError () returned 0x0 [0256.848] SetLastError (dwErrCode=0x0) [0256.848] GetLastError () returned 0x0 [0256.848] SetLastError (dwErrCode=0x0) [0256.848] GetLastError () returned 0x0 [0256.848] SetLastError (dwErrCode=0x0) [0256.848] GetLastError () returned 0x0 [0256.848] SetLastError (dwErrCode=0x0) [0256.848] GetLastError () returned 0x0 [0256.848] SetLastError (dwErrCode=0x0) [0256.848] GetLastError () returned 0x0 [0256.848] SetLastError (dwErrCode=0x0) [0256.848] GetLastError () returned 0x0 [0256.849] SetLastError (dwErrCode=0x0) [0256.849] GetLastError () returned 0x0 [0256.849] SetLastError (dwErrCode=0x0) [0256.849] GetLastError () returned 0x0 [0256.849] SetLastError (dwErrCode=0x0) [0256.849] GetLastError () returned 0x0 [0256.849] SetLastError (dwErrCode=0x0) [0256.849] GetCurrentThreadId () returned 0x1160 [0256.849] GetLastError () returned 0x0 [0256.849] SetLastError (dwErrCode=0x0) [0256.849] GetLastError () returned 0x0 [0256.850] GetLastError () returned 0x0 [0256.850] SetLastError (dwErrCode=0x0) [0256.850] GetLastError () returned 0x0 [0256.850] SetLastError (dwErrCode=0x0) [0256.850] SetLastError (dwErrCode=0x0) [0256.850] GetLastError () returned 0x0 [0256.850] SetLastError (dwErrCode=0x0) [0256.850] GetCurrentThreadId () returned 0x1160 [0256.850] GetLastError () returned 0x0 [0256.850] SetLastError (dwErrCode=0x0) [0256.850] GetLastError () returned 0x0 [0256.851] SetLastError (dwErrCode=0x0) [0256.851] GetLastError () returned 0x0 [0256.851] GetLastError () returned 0x0 [0256.851] SetLastError (dwErrCode=0x0) [0256.851] SetLastError (dwErrCode=0x0) [0256.851] GetLastError () returned 0x0 [0256.851] SetLastError (dwErrCode=0x0) [0256.851] GetCurrentThreadId () returned 0x1160 [0256.851] GetLastError () returned 0x0 [0256.851] SetLastError (dwErrCode=0x0) [0256.851] GetLastError () returned 0x0 [0256.851] SetLastError (dwErrCode=0x0) [0256.852] GetLastError () returned 0x0 [0256.852] SetLastError (dwErrCode=0x0) [0256.852] GetCurrentThreadId () returned 0x1160 [0256.852] GetLastError () returned 0x0 [0256.852] SetLastError (dwErrCode=0x0) [0256.852] GetLastError () returned 0x0 [0256.852] GetLastError () returned 0x0 [0256.852] SetLastError (dwErrCode=0x0) [0256.852] SetLastError (dwErrCode=0x0) [0256.852] GetLastError () returned 0x0 [0256.852] SetLastError (dwErrCode=0x0) [0256.852] GetCurrentThreadId () returned 0x1160 [0256.853] GetLastError () returned 0x0 [0256.853] SetLastError (dwErrCode=0x0) [0256.853] GetLastError () returned 0x0 [0256.853] SetLastError (dwErrCode=0x0) [0256.853] GetLastError () returned 0x0 [0256.853] SetLastError (dwErrCode=0x0) [0256.853] GetLastError () returned 0x0 [0256.853] SetLastError (dwErrCode=0x0) [0256.853] GetCurrentThreadId () returned 0x1160 [0256.853] GetLastError () returned 0x0 [0256.854] SetLastError (dwErrCode=0x0) [0256.854] GetLastError () returned 0x0 [0256.854] GetLastError () returned 0x0 [0256.854] SetLastError (dwErrCode=0x0) [0256.854] SetLastError (dwErrCode=0x0) [0256.854] GetLastError () returned 0x0 [0256.854] SetLastError (dwErrCode=0x0) [0256.854] GetLastError () returned 0x0 [0256.854] SetLastError (dwErrCode=0x0) [0256.854] GetLastError () returned 0x0 [0256.854] SetLastError (dwErrCode=0x0) [0256.854] GetLastError () returned 0x0 [0256.855] SetLastError (dwErrCode=0x0) [0256.855] GetLastError () returned 0x0 [0256.855] SetLastError (dwErrCode=0x0) [0256.855] GetLastError () returned 0x0 [0256.855] SetLastError (dwErrCode=0x0) [0256.856] GetLastError () returned 0x0 [0256.856] SetLastError (dwErrCode=0x0) [0256.856] GetLastError () returned 0x0 [0256.856] SetLastError (dwErrCode=0x0) [0256.856] GetLastError () returned 0x0 [0256.856] SetLastError (dwErrCode=0x0) [0256.857] GetLastError () returned 0x0 [0256.857] SetLastError (dwErrCode=0x0) [0256.857] GetLastError () returned 0x0 [0256.857] SetLastError (dwErrCode=0x0) [0256.857] GetLastError () returned 0x0 [0256.857] SetLastError (dwErrCode=0x0) [0256.857] GetLastError () returned 0x0 [0256.857] GetLastError () returned 0x0 [0256.858] SetLastError (dwErrCode=0x0) [0256.858] SetLastError (dwErrCode=0x0) [0256.858] GetLastError () returned 0x0 [0256.858] SetLastError (dwErrCode=0x0) [0256.858] GetLastError () returned 0x0 [0256.858] SetLastError (dwErrCode=0x0) [0256.858] GetLastError () returned 0x0 [0256.858] SetLastError (dwErrCode=0x0) [0256.858] GetLastError () returned 0x0 [0256.858] SetLastError (dwErrCode=0x0) [0256.858] GetLastError () returned 0x0 [0256.859] SetLastError (dwErrCode=0x0) [0256.859] GetLastError () returned 0x0 [0256.859] SetLastError (dwErrCode=0x0) [0256.859] GetLastError () returned 0x0 [0256.859] SetLastError (dwErrCode=0x0) [0256.859] GetLastError () returned 0x0 [0256.859] GetLastError () returned 0x0 [0256.859] SetLastError (dwErrCode=0x0) [0256.859] SetLastError (dwErrCode=0x0) [0256.859] GetLastError () returned 0x0 [0256.859] SetLastError (dwErrCode=0x0) [0256.859] GetLastError () returned 0x0 [0256.860] SetLastError (dwErrCode=0x0) [0256.860] GetLastError () returned 0x0 [0256.860] SetLastError (dwErrCode=0x0) [0256.860] GetLastError () returned 0x0 [0256.860] SetLastError (dwErrCode=0x0) [0256.860] GetLastError () returned 0x0 [0256.860] SetLastError (dwErrCode=0x0) [0256.860] GetLastError () returned 0x0 [0256.860] SetLastError (dwErrCode=0x0) [0256.860] GetLastError () returned 0x0 [0256.860] SetLastError (dwErrCode=0x0) [0256.861] GetLastError () returned 0x0 [0256.861] GetLastError () returned 0x0 [0256.861] SetLastError (dwErrCode=0x0) [0256.861] SetLastError (dwErrCode=0x0) [0256.861] GetLastError () returned 0x0 [0256.861] SetLastError (dwErrCode=0x0) [0256.861] GetLastError () returned 0x0 [0256.861] SetLastError (dwErrCode=0x0) [0256.864] GetLastError () returned 0x0 [0256.864] SetLastError (dwErrCode=0x0) [0256.864] GetLastError () returned 0x0 [0256.864] SetLastError (dwErrCode=0x0) [0256.864] GetLastError () returned 0x0 [0256.864] SetLastError (dwErrCode=0x0) [0256.865] GetLastError () returned 0x0 [0256.865] GetLastError () returned 0x0 [0256.865] SetLastError (dwErrCode=0x0) [0256.865] SetLastError (dwErrCode=0x0) [0256.865] GetLastError () returned 0x0 [0256.865] SetLastError (dwErrCode=0x0) [0256.865] GetLastError () returned 0x0 [0256.865] SetLastError (dwErrCode=0x0) [0256.865] GetLastError () returned 0x0 [0256.866] SetLastError (dwErrCode=0x0) [0256.866] GetLastError () returned 0x0 [0256.866] SetLastError (dwErrCode=0x0) [0256.866] GetLastError () returned 0x0 [0256.866] SetLastError (dwErrCode=0x0) [0256.866] GetLastError () returned 0x0 [0256.866] SetLastError (dwErrCode=0x0) [0256.866] GetLastError () returned 0x0 [0256.866] GetLastError () returned 0x0 [0256.866] SetLastError (dwErrCode=0x0) [0256.866] SetLastError (dwErrCode=0x0) [0256.866] GetLastError () returned 0x0 [0256.867] SetLastError (dwErrCode=0x0) [0256.867] GetLastError () returned 0x0 [0256.867] SetLastError (dwErrCode=0x0) [0256.867] GetLastError () returned 0x0 [0256.867] SetLastError (dwErrCode=0x0) [0256.867] GetLastError () returned 0x0 [0256.867] SetLastError (dwErrCode=0x0) [0256.867] GetLastError () returned 0x0 [0256.867] SetLastError (dwErrCode=0x0) [0256.867] GetLastError () returned 0x0 [0256.868] SetLastError (dwErrCode=0x0) [0256.868] GetLastError () returned 0x0 [0256.868] SetLastError (dwErrCode=0x0) [0256.868] GetLastError () returned 0x0 [0256.868] SetLastError (dwErrCode=0x0) [0256.868] GetLastError () returned 0x0 [0256.868] SetLastError (dwErrCode=0x0) [0256.868] GetLastError () returned 0x0 [0256.868] SetLastError (dwErrCode=0x0) [0256.868] GetLastError () returned 0x0 [0256.868] SetLastError (dwErrCode=0x0) [0256.868] GetLastError () returned 0x0 [0256.869] SetLastError (dwErrCode=0x0) [0256.869] GetLastError () returned 0x0 [0256.869] SetLastError (dwErrCode=0x0) [0256.869] GetLastError () returned 0x0 [0256.869] SetLastError (dwErrCode=0x0) [0256.869] GetLastError () returned 0x0 [0256.869] GetLastError () returned 0x0 [0256.869] SetLastError (dwErrCode=0x0) [0256.869] SetLastError (dwErrCode=0x0) [0256.869] GetLastError () returned 0x0 [0256.870] SetLastError (dwErrCode=0x0) [0256.870] GetLastError () returned 0x0 [0256.870] SetLastError (dwErrCode=0x0) [0256.870] GetLastError () returned 0x0 [0256.870] SetLastError (dwErrCode=0x0) [0256.870] GetLastError () returned 0x0 [0256.870] SetLastError (dwErrCode=0x0) [0256.870] GetLastError () returned 0x0 [0256.870] SetLastError (dwErrCode=0x0) [0256.870] GetLastError () returned 0x0 [0256.870] SetLastError (dwErrCode=0x0) [0256.870] GetLastError () returned 0x0 [0256.870] SetLastError (dwErrCode=0x0) [0256.870] GetLastError () returned 0x0 [0256.871] SetLastError (dwErrCode=0x0) [0256.871] GetLastError () returned 0x0 [0256.871] GetLastError () returned 0x0 [0256.871] SetLastError (dwErrCode=0x0) [0256.871] SetLastError (dwErrCode=0x0) [0256.871] GetLastError () returned 0x0 [0256.871] SetLastError (dwErrCode=0x0) [0256.871] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0256.871] GetLastError () returned 0x0 [0256.872] SetLastError (dwErrCode=0x0) [0256.872] GetLastError () returned 0x0 [0256.872] SetLastError (dwErrCode=0x0) [0256.872] GetLastError () returned 0x0 [0256.872] SetLastError (dwErrCode=0x0) [0256.872] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CheckRemoteDebuggerPresent") returned 0x7ffd4e1eaa60 [0256.872] GetLastError () returned 0x0 [0256.873] SetLastError (dwErrCode=0x0) [0256.873] GetLastError () returned 0x0 [0256.873] GetLastError () returned 0x0 [0256.873] SetLastError (dwErrCode=0x0) [0256.873] SetLastError (dwErrCode=0x0) [0256.873] GetLastError () returned 0x0 [0256.873] SetLastError (dwErrCode=0x0) [0256.873] GetModuleFileNameW (in: hModule=0x7ff67c4a0000, lpFilename=0x25092a8, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe")) returned 0x32 [0256.873] SysReAllocStringLen (in: pbstr=0x7ffab0*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", len=0x32 | out: pbstr=0x7ffab0*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe") returned 1 [0256.873] GetLastError () returned 0x0 [0256.873] SetLastError (dwErrCode=0x0) [0256.874] GetLastError () returned 0x0 [0256.874] SetLastError (dwErrCode=0x0) [0256.874] GetLastError () returned 0x0 [0256.874] SetLastError (dwErrCode=0x0) [0256.874] GetLastError () returned 0x0 [0256.874] SetLastError (dwErrCode=0x0) [0256.874] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x7ff8a0 | out: lpBuffer=0x0, lpFilePart=0x7ff8a0*=0x0) returned 0x2a [0256.874] GetLastError () returned 0x0 [0256.874] SetLastError (dwErrCode=0x0) [0256.874] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0xadb4a8, lpFilePart=0x7ff8a0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x7ff8a0*="Temp") returned 0x28 [0256.874] GetLastError () returned 0x0 [0256.874] SetLastError (dwErrCode=0x0) [0256.874] GetLastError () returned 0x0 [0256.874] SetLastError (dwErrCode=0x0) [0256.874] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.874] GetLastError () returned 0x0 [0256.874] SetLastError (dwErrCode=0x0) [0256.874] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a08, cbMultiByte=3, lpWideCharStr=0xac57f8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0256.874] GetLastError () returned 0x0 [0256.874] SetLastError (dwErrCode=0x0) [0256.875] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0256.875] GetLastError () returned 0x0 [0256.875] SetLastError (dwErrCode=0x0) [0256.875] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a28, cbMultiByte=4, lpWideCharStr=0xac57f8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0256.875] GetLastError () returned 0x0 [0256.875] SetLastError (dwErrCode=0x0) [0256.875] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0256.875] GetLastError () returned 0x0 [0256.875] SetLastError (dwErrCode=0x0) [0256.875] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff67cf83a48, cbMultiByte=3, lpWideCharStr=0xac57f8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0256.875] GetLastError () returned 0x0 [0256.875] SetLastError (dwErrCode=0x0) [0256.875] GetLastError () returned 0x0 [0256.875] SetLastError (dwErrCode=0x0) [0256.875] GetLastError () returned 0x0 [0256.875] SetLastError (dwErrCode=0x0) [0256.875] GetLastError () returned 0x0 [0256.875] SetLastError (dwErrCode=0x0) [0256.876] GetLastError () returned 0x0 [0256.876] SetLastError (dwErrCode=0x0) [0256.876] GetLastError () returned 0x0 [0256.876] SetLastError (dwErrCode=0x0) [0256.876] GetLastError () returned 0x0 [0256.876] SetLastError (dwErrCode=0x0) [0256.876] GetLastError () returned 0x0 [0256.876] SetLastError (dwErrCode=0x0) [0256.876] GetLastError () returned 0x0 [0256.876] SetLastError (dwErrCode=0x0) [0256.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0256.876] GetLastError () returned 0x0 [0256.876] SetLastError (dwErrCode=0x0) [0256.876] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", cchWideChar=50, lpMultiByteStr=0xabb8e8, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", lpUsedDefaultChar=0x0) returned 50 [0256.876] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=50, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 50 [0256.876] GetLastError () returned 0x0 [0256.876] SetLastError (dwErrCode=0x0) [0256.876] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=50, lpWideCharStr=0x24d3068, cchWideChar=50 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe") returned 50 [0256.876] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", lpFindFileData=0x7ffae8 | out: lpFindFileData=0x7ffae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb12b8d, ftCreationTime.dwHighDateTime=0x1d7fc90, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0x46500cf, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x817400, dwReserved0=0x7ffd, dwReserved1=0x0, cFileName="build.exe", cAlternateFileName="")) returned 0x24d14a0 [0256.877] FileTimeToLocalFileTime (in: lpFileTime=0x7ffafc, lpLocalFileTime=0x7ff8e0 | out: lpLocalFileTime=0x7ff8e0) returned 1 [0256.877] FileTimeToDosDateTime (in: lpFileTime=0x7ff8e0, lpFatDate=0x7ffaba, lpFatTime=0x7ffab8 | out: lpFatDate=0x7ffaba, lpFatTime=0x7ffab8) returned 1 [0256.877] GetLastError () returned 0x0 [0256.877] SetLastError (dwErrCode=0x0) [0256.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="build.exe", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0256.877] GetLastError () returned 0x0 [0256.877] SetLastError (dwErrCode=0x0) [0256.877] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="build.exe", cchWideChar=9, lpMultiByteStr=0xac5838, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="build.exe", lpUsedDefaultChar=0x0) returned 9 [0256.877] GetLastError () returned 0x0 [0256.877] SetLastError (dwErrCode=0x0) [0256.877] GetLastError () returned 0x0 [0256.878] SetLastError (dwErrCode=0x0) [0256.878] GetLastError () returned 0x0 [0256.878] SetLastError (dwErrCode=0x0) [0256.878] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5838, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0256.878] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5838, cbMultiByte=9, lpWideCharStr=0x24d26f8, cchWideChar=9 | out: lpWideCharStr="build.exe") returned 9 [0256.878] GetLastError () returned 0x0 [0256.878] SetLastError (dwErrCode=0x0) [0256.878] GetLastError () returned 0x0 [0256.878] SetLastError (dwErrCode=0x0) [0256.878] GetLastError () returned 0x0 [0256.878] SetLastError (dwErrCode=0x0) [0256.878] GetLastError () returned 0x0 [0256.878] SetLastError (dwErrCode=0x0) [0256.878] GetLastError () returned 0x0 [0256.878] SetLastError (dwErrCode=0x0) [0256.878] GetLastError () returned 0x0 [0256.879] SetLastError (dwErrCode=0x0) [0256.879] SysReAllocStringLen (in: pbstr=0x7ffaa0*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", len=0x32 | out: pbstr=0x7ffaa0*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe") returned 1 [0256.879] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", cchLength=0x32 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe") returned 0x32 [0256.879] SysReAllocStringLen (in: pbstr=0x7ffe10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe", len=0x32 | out: pbstr=0x7ffe10*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe") returned 1 [0256.879] GetLastError () returned 0x0 [0256.879] SetLastError (dwErrCode=0x0) [0256.879] GetLastError () returned 0x0 [0256.879] SetLastError (dwErrCode=0x0) [0256.879] GetLastError () returned 0x0 [0256.879] SetLastError (dwErrCode=0x0) [0256.879] GetLastError () returned 0x0 [0256.880] SetLastError (dwErrCode=0x0) [0256.880] SysReAllocStringLen (in: pbstr=0x7ff67d08a130*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe", len=0x32 | out: pbstr=0x7ff67d08a130*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe") returned 1 [0256.880] GetLastError () returned 0x0 [0256.880] SetLastError (dwErrCode=0x0) [0256.880] GetLastError () returned 0x0 [0256.880] GetLastError () returned 0x0 [0256.880] SetLastError (dwErrCode=0x0) [0256.880] SetLastError (dwErrCode=0x0) [0256.880] GetLastError () returned 0x0 [0256.880] SetLastError (dwErrCode=0x0) [0256.880] GetLastError () returned 0x0 [0256.880] SetLastError (dwErrCode=0x0) [0256.880] SysReAllocStringLen (in: pbstr=0x24d3058*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe", len=0x32 | out: pbstr=0x24d3058*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe") returned 1 [0256.881] GetLastError () returned 0x0 [0256.881] SetLastError (dwErrCode=0x0) [0256.881] GetLastError () returned 0x0 [0256.881] SetLastError (dwErrCode=0x0) [0256.881] GetLastError () returned 0x0 [0256.881] SetLastError (dwErrCode=0x0) [0256.881] GetLastError () returned 0x0 [0256.881] SetLastError (dwErrCode=0x0) [0256.881] SysReAllocStringLen (in: pbstr=0x24d3080*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0x24d3080*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0256.881] GetLastError () returned 0x0 [0256.881] SetLastError (dwErrCode=0x0) [0256.881] GetLastError () returned 0x0 [0256.881] SetLastError (dwErrCode=0x0) [0256.881] GetLastError () returned 0x0 [0256.881] SetLastError (dwErrCode=0x0) [0256.881] GetLastError () returned 0x0 [0256.881] SetLastError (dwErrCode=0x0) [0256.881] GetLastError () returned 0x0 [0256.882] SetLastError (dwErrCode=0x0) [0256.882] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0x7ff970*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0256.882] CharLowerBuffW (in: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", cchLength=0x29 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 0x29 [0256.882] SysReAllocStringLen (in: pbstr=0xac5828*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0xac5828*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0256.882] GetLastError () returned 0x0 [0256.882] SetLastError (dwErrCode=0x0) [0256.882] GetLastError () returned 0x0 [0256.882] SetLastError (dwErrCode=0x0) [0256.882] GetLastError () returned 0x0 [0256.882] SetLastError (dwErrCode=0x0) [0256.882] GetLastError () returned 0x0 [0256.882] SetLastError (dwErrCode=0x0) [0256.882] SysReAllocStringLen (in: pbstr=0xac5830*=0x0, psz="c:", len=0x2 | out: pbstr=0xac5830*="c:") returned 1 [0256.882] GetLastError () returned 0x0 [0256.882] SetLastError (dwErrCode=0x0) [0256.882] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="users", len=0x5 | out: pbstr=0xad3780*="users") returned 1 [0256.882] GetLastError () returned 0x0 [0256.883] SetLastError (dwErrCode=0x0) [0256.883] GetLastError () returned 0x0 [0256.883] SetLastError (dwErrCode=0x0) [0256.883] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0xad37a0*="rdhj0cnfevzx") returned 1 [0256.883] GetLastError () returned 0x0 [0256.883] SetLastError (dwErrCode=0x0) [0256.883] SysReAllocStringLen (in: pbstr=0xad37c0*=0x0, psz="appdata", len=0x7 | out: pbstr=0xad37c0*="appdata") returned 1 [0256.883] GetLastError () returned 0x0 [0256.883] SetLastError (dwErrCode=0x0) [0256.883] SysReAllocStringLen (in: pbstr=0xad37e0*=0x0, psz="local", len=0x5 | out: pbstr=0xad37e0*="local") returned 1 [0256.883] GetLastError () returned 0x0 [0256.883] SetLastError (dwErrCode=0x0) [0256.883] SysReAllocStringLen (in: pbstr=0xad3800*=0x0, psz="temp", len=0x4 | out: pbstr=0xad3800*="temp") returned 1 [0256.883] GetLastError () returned 0x0 [0256.883] SetLastError (dwErrCode=0x0) [0256.883] GetLastError () returned 0x0 [0256.883] SetLastError (dwErrCode=0x0) [0256.884] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0256.884] GetLastError () returned 0x0 [0256.884] SetLastError (dwErrCode=0x0) [0256.884] GetLastError () returned 0x0 [0256.884] SetLastError (dwErrCode=0x0) [0256.884] GetLastError () returned 0x0 [0256.884] SetLastError (dwErrCode=0x0) [0256.884] GetLastError () returned 0x0 [0256.884] SetLastError (dwErrCode=0x0) [0256.884] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0256.884] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x7ffa00*="users") returned 1 [0256.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.884] GetLastError () returned 0x0 [0256.884] SetLastError (dwErrCode=0x0) [0256.884] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0256.885] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0256.885] GetLastError () returned 0x0 [0256.885] SetLastError (dwErrCode=0x0) [0256.885] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpWideCharStr=0xac5878, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0256.885] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x24d1da0 [0256.885] FindNextFileW (in: hFindFile=0x24d1da0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0256.885] GetLastError () returned 0x12 [0256.885] FindClose (in: hFindFile=0x24d1da0 | out: hFindFile=0x24d1da0) returned 1 [0256.885] GetLastError () returned 0x12 [0256.885] SetLastError (dwErrCode=0x12) [0256.885] GetLastError () returned 0x12 [0256.885] SetLastError (dwErrCode=0x12) [0256.886] GetLastError () returned 0x0 [0256.886] SetLastError (dwErrCode=0x0) [0256.886] GetLastError () returned 0x0 [0256.886] SetLastError (dwErrCode=0x0) [0256.886] GetLastError () returned 0x0 [0256.886] SetLastError (dwErrCode=0x0) [0256.886] GetLastError () returned 0x0 [0256.886] SetLastError (dwErrCode=0x0) [0256.886] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x7ffd08*="c:\\Users\\") returned 1 [0256.886] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x7ffa00*="rdhj0cnfevzx") returned 1 [0256.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0256.886] GetLastError () returned 0x0 [0256.886] SetLastError (dwErrCode=0x0) [0256.886] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0xac5878, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0256.886] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0256.887] GetLastError () returned 0x0 [0256.887] SetLastError (dwErrCode=0x0) [0256.887] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=21, lpWideCharStr=0xabb8e8, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0256.887] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x24d1620 [0256.887] FindNextFileW (in: hFindFile=0x24d1620, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0256.887] GetLastError () returned 0x12 [0256.887] FindClose (in: hFindFile=0x24d1620 | out: hFindFile=0x24d1620) returned 1 [0256.887] GetLastError () returned 0x12 [0256.887] SetLastError (dwErrCode=0x12) [0256.887] GetLastError () returned 0x12 [0256.887] SetLastError (dwErrCode=0x12) [0256.889] GetLastError () returned 0x0 [0256.889] SetLastError (dwErrCode=0x0) [0256.889] GetLastError () returned 0x0 [0256.889] SetLastError (dwErrCode=0x0) [0256.889] GetLastError () returned 0x0 [0256.889] SetLastError (dwErrCode=0x0) [0256.890] GetLastError () returned 0x0 [0256.890] SetLastError (dwErrCode=0x0) [0256.890] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0256.890] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x7ffa00*="appdata") returned 1 [0256.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0256.890] GetLastError () returned 0x0 [0256.890] SetLastError (dwErrCode=0x0) [0256.890] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0xac5878, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0256.890] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0256.890] GetLastError () returned 0x0 [0256.890] SetLastError (dwErrCode=0x0) [0256.890] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=29, lpWideCharStr=0xabb948, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0256.890] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x24d1ce0 [0256.890] FindNextFileW (in: hFindFile=0x24d1ce0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0256.890] GetLastError () returned 0x12 [0256.891] FindClose (in: hFindFile=0x24d1ce0 | out: hFindFile=0x24d1ce0) returned 1 [0256.891] GetLastError () returned 0x12 [0256.891] SetLastError (dwErrCode=0x12) [0256.891] GetLastError () returned 0x12 [0256.891] SetLastError (dwErrCode=0x12) [0256.891] GetLastError () returned 0x0 [0256.891] SetLastError (dwErrCode=0x0) [0256.891] GetLastError () returned 0x0 [0256.891] SetLastError (dwErrCode=0x0) [0256.891] GetLastError () returned 0x0 [0256.891] SetLastError (dwErrCode=0x0) [0256.891] GetLastError () returned 0x0 [0256.891] SetLastError (dwErrCode=0x0) [0256.891] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0256.891] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="local", len=0x5 | out: pbstr=0x7ffa00*="local") returned 1 [0256.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0256.892] GetLastError () returned 0x0 [0256.892] SetLastError (dwErrCode=0x0) [0256.892] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpUsedDefaultChar=0x0) returned 35 [0256.892] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0256.892] GetLastError () returned 0x0 [0256.892] SetLastError (dwErrCode=0x0) [0256.892] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpWideCharStr=0xadb628, cchWideChar=35 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local") returned 35 [0256.892] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x24d1d40 [0256.892] FindNextFileW (in: hFindFile=0x24d1d40, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0256.892] GetLastError () returned 0x12 [0256.892] FindClose (in: hFindFile=0x24d1d40 | out: hFindFile=0x24d1d40) returned 1 [0256.892] GetLastError () returned 0x12 [0256.892] SetLastError (dwErrCode=0x12) [0256.892] GetLastError () returned 0x12 [0256.893] SetLastError (dwErrCode=0x12) [0256.893] GetLastError () returned 0x0 [0256.893] SetLastError (dwErrCode=0x0) [0256.893] GetLastError () returned 0x0 [0256.893] SetLastError (dwErrCode=0x0) [0256.893] GetLastError () returned 0x0 [0256.893] SetLastError (dwErrCode=0x0) [0256.893] GetLastError () returned 0x0 [0256.893] SetLastError (dwErrCode=0x0) [0256.893] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0256.893] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", psz="temp", len=0x4 | out: pbstr=0x7ffa00*="temp") returned 1 [0256.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.893] GetLastError () returned 0x0 [0256.893] SetLastError (dwErrCode=0x0) [0256.893] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp", cchWideChar=40, lpMultiByteStr=0xabb8e8, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp", lpUsedDefaultChar=0x0) returned 40 [0256.893] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=40, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0256.894] GetLastError () returned 0x0 [0256.894] SetLastError (dwErrCode=0x0) [0256.894] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=40, lpWideCharStr=0xadb4a8, cchWideChar=40 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp") returned 40 [0256.894] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xb12b8d, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0x24d1920 [0256.894] FindNextFileW (in: hFindFile=0x24d1920, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xb12b8d, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0256.894] GetLastError () returned 0x12 [0256.894] FindClose (in: hFindFile=0x24d1920 | out: hFindFile=0x24d1920) returned 1 [0256.894] GetLastError () returned 0x12 [0256.894] SetLastError (dwErrCode=0x12) [0256.894] GetLastError () returned 0x12 [0256.894] SetLastError (dwErrCode=0x12) [0256.894] GetLastError () returned 0x0 [0256.894] SetLastError (dwErrCode=0x0) [0256.894] GetLastError () returned 0x0 [0256.894] SetLastError (dwErrCode=0x0) [0256.895] GetLastError () returned 0x0 [0256.895] SetLastError (dwErrCode=0x0) [0256.895] GetLastError () returned 0x0 [0256.895] SetLastError (dwErrCode=0x0) [0256.895] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0256.895] GetLastError () returned 0x0 [0256.895] SetLastError (dwErrCode=0x0) [0256.895] GetLastError () returned 0x0 [0256.895] SetLastError (dwErrCode=0x0) [0256.895] GetLastError () returned 0x0 [0256.895] SetLastError (dwErrCode=0x0) [0256.895] GetLastError () returned 0x0 [0256.895] SetLastError (dwErrCode=0x0) [0256.895] GetLastError () returned 0x0 [0256.895] SetLastError (dwErrCode=0x0) [0256.895] GetLastError () returned 0x0 [0256.896] SetLastError (dwErrCode=0x0) [0256.896] GetLastError () returned 0x0 [0256.896] SetLastError (dwErrCode=0x0) [0256.896] GetLastError () returned 0x0 [0256.896] SetLastError (dwErrCode=0x0) [0256.896] GetLastError () returned 0x0 [0256.896] SetLastError (dwErrCode=0x0) [0256.896] GetLastError () returned 0x0 [0256.896] SetLastError (dwErrCode=0x0) [0256.896] GetLastError () returned 0x0 [0256.896] SetLastError (dwErrCode=0x0) [0256.896] GetLastError () returned 0x0 [0256.896] SetLastError (dwErrCode=0x0) [0256.896] GetLastError () returned 0x0 [0256.896] SetLastError (dwErrCode=0x0) [0256.896] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", len=0x28 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp") returned 1 [0256.896] GetLastError () returned 0x0 [0256.897] SetLastError (dwErrCode=0x0) [0256.897] GetLastError () returned 0x0 [0256.897] SetLastError (dwErrCode=0x0) [0256.897] GetLastError () returned 0x0 [0256.897] SetLastError (dwErrCode=0x0) [0256.897] GetLastError () returned 0x0 [0256.897] SetLastError (dwErrCode=0x0) [0256.897] SysReAllocStringLen (in: pbstr=0x24d3080*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x24d3080*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0256.897] GetLastError () returned 0x0 [0256.897] SetLastError (dwErrCode=0x0) [0256.897] GetProcessHeap () returned 0x8f0000 [0256.897] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40000) returned 0x2871f90 [0256.900] GetSystemDirectoryW (in: lpBuffer=0x2871fe0, uSize=0xfffe | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0256.900] GetLastError () returned 0x0 [0256.900] SetLastError (dwErrCode=0x0) [0256.900] GetLastError () returned 0x0 [0256.900] SetLastError (dwErrCode=0x0) [0256.900] GetLastError () returned 0x0 [0256.900] SetLastError (dwErrCode=0x0) [0256.900] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Windows\\system32", len=0x13 | out: pbstr=0x7ff970*="C:\\Windows\\system32") returned 1 [0256.900] CharLowerBuffW (in: lpsz="C:\\Windows\\system32", cchLength=0x13 | out: lpsz="c:\\windows\\system32") returned 0x13 [0256.900] SysReAllocStringLen (in: pbstr=0xac5828*=0x0, psz="c:\\windows\\system32", len=0x13 | out: pbstr=0xac5828*="c:\\windows\\system32") returned 1 [0256.900] GetLastError () returned 0x0 [0256.900] SetLastError (dwErrCode=0x0) [0256.901] GetLastError () returned 0x0 [0256.901] SetLastError (dwErrCode=0x0) [0256.901] GetLastError () returned 0x0 [0256.901] SetLastError (dwErrCode=0x0) [0256.901] GetLastError () returned 0x0 [0256.901] SetLastError (dwErrCode=0x0) [0256.901] SysReAllocStringLen (in: pbstr=0xac5830*=0x0, psz="c:", len=0x2 | out: pbstr=0xac5830*="c:") returned 1 [0256.901] GetLastError () returned 0x0 [0256.901] SetLastError (dwErrCode=0x0) [0256.901] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="windows", len=0x7 | out: pbstr=0xad3780*="windows") returned 1 [0256.901] GetLastError () returned 0x0 [0256.901] SetLastError (dwErrCode=0x0) [0256.901] GetLastError () returned 0x0 [0256.901] SetLastError (dwErrCode=0x0) [0256.901] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="system32", len=0x8 | out: pbstr=0xad37a0*="system32") returned 1 [0256.902] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0256.902] GetLastError () returned 0x0 [0256.902] SetLastError (dwErrCode=0x0) [0256.902] GetLastError () returned 0x0 [0256.902] SetLastError (dwErrCode=0x0) [0256.902] GetLastError () returned 0x0 [0256.902] SetLastError (dwErrCode=0x0) [0256.902] GetLastError () returned 0x0 [0256.902] SetLastError (dwErrCode=0x0) [0256.902] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0256.902] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="windows", len=0x7 | out: pbstr=0x7ffa00*="windows") returned 1 [0256.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\windows", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0256.902] GetLastError () returned 0x0 [0256.902] SetLastError (dwErrCode=0x0) [0256.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\windows", cchWideChar=10, lpMultiByteStr=0xac58f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\windows", lpUsedDefaultChar=0x0) returned 10 [0256.902] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0256.902] GetLastError () returned 0x0 [0256.902] SetLastError (dwErrCode=0x0) [0256.902] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=10, lpWideCharStr=0xac58b8, cchWideChar=10 | out: lpWideCharStr="c:\\windows") returned 10 [0256.902] FindFirstFileW (in: lpFileName="c:\\windows", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x24d16e0 [0256.903] FindNextFileW (in: hFindFile=0x24d16e0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0256.903] GetLastError () returned 0x12 [0256.903] FindClose (in: hFindFile=0x24d16e0 | out: hFindFile=0x24d16e0) returned 1 [0256.903] GetLastError () returned 0x12 [0256.903] SetLastError (dwErrCode=0x12) [0256.903] GetLastError () returned 0x12 [0256.903] SetLastError (dwErrCode=0x12) [0256.903] GetLastError () returned 0x0 [0256.903] SetLastError (dwErrCode=0x0) [0256.903] GetLastError () returned 0x0 [0256.903] SetLastError (dwErrCode=0x0) [0256.903] GetLastError () returned 0x0 [0256.903] SetLastError (dwErrCode=0x0) [0256.903] GetLastError () returned 0x0 [0256.903] SetLastError (dwErrCode=0x0) [0256.903] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Windows", psz="c:\\Windows\\", len=0xb | out: pbstr=0x7ffd08*="c:\\Windows\\") returned 1 [0256.903] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Windows\\", psz="system32", len=0x8 | out: pbstr=0x7ffa00*="system32") returned 1 [0256.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Windows\\system32", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0256.904] GetLastError () returned 0x0 [0256.904] SetLastError (dwErrCode=0x0) [0256.904] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Windows\\system32", cchWideChar=19, lpMultiByteStr=0xac58b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Windows\\system32", lpUsedDefaultChar=0x0) returned 19 [0256.904] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=19, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0256.904] GetLastError () returned 0x0 [0256.904] SetLastError (dwErrCode=0x0) [0256.904] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=19, lpWideCharStr=0xabb8e8, cchWideChar=19 | out: lpWideCharStr="c:\\Windows\\system32") returned 19 [0256.904] FindFirstFileW (in: lpFileName="c:\\Windows\\system32", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xbae59694, ftLastAccessTime.dwHighDateTime=0x1d7e768, ftLastWriteTime.dwLowDateTime=0xbae59694, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x24d2280 [0256.904] FindNextFileW (in: hFindFile=0x24d2280, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xbae59694, ftLastAccessTime.dwHighDateTime=0x1d7e768, ftLastWriteTime.dwLowDateTime=0xbae59694, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0 [0256.904] GetLastError () returned 0x12 [0256.905] FindClose (in: hFindFile=0x24d2280 | out: hFindFile=0x24d2280) returned 1 [0256.905] GetLastError () returned 0x12 [0256.905] SetLastError (dwErrCode=0x12) [0256.905] GetLastError () returned 0x12 [0256.905] SetLastError (dwErrCode=0x12) [0256.905] GetLastError () returned 0x0 [0256.905] SetLastError (dwErrCode=0x0) [0256.905] GetLastError () returned 0x0 [0256.905] SetLastError (dwErrCode=0x0) [0256.905] GetLastError () returned 0x0 [0256.905] SetLastError (dwErrCode=0x0) [0256.905] GetLastError () returned 0x0 [0256.905] SetLastError (dwErrCode=0x0) [0256.905] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Windows\\System32", psz="c:\\Windows\\System32\\", len=0x14 | out: pbstr=0x7ffd08*="c:\\Windows\\System32\\") returned 1 [0256.905] GetLastError () returned 0x0 [0256.906] SetLastError (dwErrCode=0x0) [0256.906] GetLastError () returned 0x0 [0256.906] SetLastError (dwErrCode=0x0) [0256.906] GetLastError () returned 0x0 [0256.906] SetLastError (dwErrCode=0x0) [0256.906] GetLastError () returned 0x0 [0256.906] SetLastError (dwErrCode=0x0) [0256.906] GetLastError () returned 0x0 [0256.906] SetLastError (dwErrCode=0x0) [0256.906] GetLastError () returned 0x0 [0256.906] SetLastError (dwErrCode=0x0) [0256.906] GetLastError () returned 0x0 [0256.906] SetLastError (dwErrCode=0x0) [0256.906] GetLastError () returned 0x0 [0256.906] SetLastError (dwErrCode=0x0) [0256.906] GetLastError () returned 0x0 [0256.906] SetLastError (dwErrCode=0x0) [0256.906] GetLastError () returned 0x0 [0256.906] SetLastError (dwErrCode=0x0) [0256.906] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Windows\\System32\\", psz="c:\\Windows\\System32", len=0x13 | out: pbstr=0x7ffd08*="c:\\Windows\\System32") returned 1 [0256.907] GetLastError () returned 0x0 [0256.907] SetLastError (dwErrCode=0x0) [0256.907] GetLastError () returned 0x0 [0256.907] SetLastError (dwErrCode=0x0) [0256.907] GetLastError () returned 0x0 [0256.907] SetLastError (dwErrCode=0x0) [0256.907] GetLastError () returned 0x0 [0256.907] SetLastError (dwErrCode=0x0) [0256.907] SysReAllocStringLen (in: pbstr=0x24d3070*=0x0, psz="c:\\Windows\\System32\\", len=0x14 | out: pbstr=0x24d3070*="c:\\Windows\\System32\\") returned 1 [0256.907] GetLastError () returned 0x0 [0256.907] SetLastError (dwErrCode=0x0) [0256.907] GetLastError () returned 0x0 [0256.907] SetLastError (dwErrCode=0x0) [0256.907] GetLastError () returned 0x0 [0256.907] SetLastError (dwErrCode=0x0) [0256.907] GetLastError () returned 0x0 [0256.907] SetLastError (dwErrCode=0x0) [0256.907] GetLastError () returned 0x0 [0256.907] SetLastError (dwErrCode=0x0) [0256.907] GetLastError () returned 0x0 [0256.908] SetLastError (dwErrCode=0x0) [0256.908] GetLastError () returned 0x0 [0256.908] SetLastError (dwErrCode=0x0) [0256.908] GetLastError () returned 0x0 [0256.908] SetLastError (dwErrCode=0x0) [0256.908] SysReAllocStringLen (in: pbstr=0x24d3078*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x24d3078*="c:\\") returned 1 [0256.908] GetTempPathW (in: nBufferLength=0xfffe, lpBuffer=0x2871fe0 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0256.908] GetLastError () returned 0x0 [0256.908] SetLastError (dwErrCode=0x0) [0256.908] GetLastError () returned 0x0 [0256.908] SetLastError (dwErrCode=0x0) [0256.908] GetLastError () returned 0x0 [0256.908] SetLastError (dwErrCode=0x0) [0256.908] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", len=0x25 | out: pbstr=0x7ff970*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 1 [0256.908] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", cchLength=0x25 | out: lpsz="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\") returned 0x25 [0256.908] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\", len=0x25 | out: pbstr=0xac57e8*="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\") returned 1 [0256.908] GetLastError () returned 0x0 [0256.908] SetLastError (dwErrCode=0x0) [0256.908] GetLastError () returned 0x0 [0256.908] SetLastError (dwErrCode=0x0) [0256.909] GetLastError () returned 0x0 [0256.909] SetLastError (dwErrCode=0x0) [0256.909] GetLastError () returned 0x0 [0256.909] SetLastError (dwErrCode=0x0) [0256.909] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0256.909] GetLastError () returned 0x0 [0256.909] SetLastError (dwErrCode=0x0) [0256.909] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="users", len=0x5 | out: pbstr=0xad3780*="users") returned 1 [0256.909] GetLastError () returned 0x0 [0256.909] SetLastError (dwErrCode=0x0) [0256.909] GetLastError () returned 0x0 [0256.909] SetLastError (dwErrCode=0x0) [0256.909] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="rdhj0c~1", len=0x8 | out: pbstr=0xad37a0*="rdhj0c~1") returned 1 [0256.909] GetLastError () returned 0x0 [0256.909] SetLastError (dwErrCode=0x0) [0256.909] SysReAllocStringLen (in: pbstr=0xad37c0*=0x0, psz="appdata", len=0x7 | out: pbstr=0xad37c0*="appdata") returned 1 [0256.909] GetLastError () returned 0x0 [0256.909] SetLastError (dwErrCode=0x0) [0256.909] SysReAllocStringLen (in: pbstr=0xad37e0*=0x0, psz="local", len=0x5 | out: pbstr=0xad37e0*="local") returned 1 [0256.910] GetLastError () returned 0x0 [0256.910] SetLastError (dwErrCode=0x0) [0256.910] SysReAllocStringLen (in: pbstr=0xad3800*=0x0, psz="temp", len=0x4 | out: pbstr=0xad3800*="temp") returned 1 [0256.910] GetLastError () returned 0x0 [0256.910] SetLastError (dwErrCode=0x0) [0256.910] GetLastError () returned 0x0 [0256.910] SetLastError (dwErrCode=0x0) [0256.910] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0256.910] GetLastError () returned 0x0 [0256.910] SetLastError (dwErrCode=0x0) [0256.910] GetLastError () returned 0x0 [0256.910] SetLastError (dwErrCode=0x0) [0256.910] GetLastError () returned 0x0 [0256.910] SetLastError (dwErrCode=0x0) [0256.910] GetLastError () returned 0x0 [0256.910] SetLastError (dwErrCode=0x0) [0256.911] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0256.911] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x7ffa00*="users") returned 1 [0256.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.911] GetLastError () returned 0x0 [0256.911] SetLastError (dwErrCode=0x0) [0256.911] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0256.911] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0256.911] GetLastError () returned 0x0 [0256.911] SetLastError (dwErrCode=0x0) [0256.911] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpWideCharStr=0xac5878, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0256.911] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x24d1560 [0256.911] FindNextFileW (in: hFindFile=0x24d1560, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0256.911] GetLastError () returned 0x12 [0256.911] FindClose (in: hFindFile=0x24d1560 | out: hFindFile=0x24d1560) returned 1 [0256.911] GetLastError () returned 0x12 [0256.911] SetLastError (dwErrCode=0x12) [0256.911] GetLastError () returned 0x12 [0256.911] SetLastError (dwErrCode=0x12) [0256.912] GetLastError () returned 0x0 [0256.912] SetLastError (dwErrCode=0x0) [0256.912] GetLastError () returned 0x0 [0256.912] SetLastError (dwErrCode=0x0) [0256.912] GetLastError () returned 0x0 [0256.912] SetLastError (dwErrCode=0x0) [0256.912] GetLastError () returned 0x0 [0256.912] SetLastError (dwErrCode=0x0) [0256.912] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x7ffd08*="c:\\Users\\") returned 1 [0256.912] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\", psz="rdhj0c~1", len=0x8 | out: pbstr=0x7ffa00*="rdhj0c~1") returned 1 [0256.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0c~1", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0256.912] GetLastError () returned 0x0 [0256.912] SetLastError (dwErrCode=0x0) [0256.912] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0c~1", cchWideChar=17, lpMultiByteStr=0xac5878, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0c~1", lpUsedDefaultChar=0x0) returned 17 [0256.912] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=17, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0256.912] GetLastError () returned 0x0 [0256.912] SetLastError (dwErrCode=0x0) [0256.912] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=17, lpWideCharStr=0xabb948, cchWideChar=17 | out: lpWideCharStr="c:\\Users\\rdhj0c~1") returned 17 [0256.912] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0c~1", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x24d15c0 [0256.912] FindNextFileW (in: hFindFile=0x24d15c0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0256.912] GetLastError () returned 0x12 [0256.913] FindClose (in: hFindFile=0x24d15c0 | out: hFindFile=0x24d15c0) returned 1 [0256.913] GetLastError () returned 0x12 [0256.913] SetLastError (dwErrCode=0x12) [0256.913] GetLastError () returned 0x12 [0256.913] SetLastError (dwErrCode=0x12) [0256.913] GetLastError () returned 0x0 [0256.913] SetLastError (dwErrCode=0x0) [0256.913] GetLastError () returned 0x0 [0256.913] SetLastError (dwErrCode=0x0) [0256.913] GetLastError () returned 0x0 [0256.913] SetLastError (dwErrCode=0x0) [0256.913] GetLastError () returned 0x0 [0256.913] SetLastError (dwErrCode=0x0) [0256.913] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0256.913] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x7ffa00*="appdata") returned 1 [0256.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0256.913] GetLastError () returned 0x0 [0256.913] SetLastError (dwErrCode=0x0) [0256.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0xac5878, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0256.914] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0256.914] GetLastError () returned 0x0 [0256.914] SetLastError (dwErrCode=0x0) [0256.914] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=29, lpWideCharStr=0xabb8e8, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0256.914] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x24d2040 [0256.914] FindNextFileW (in: hFindFile=0x24d2040, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0256.914] GetLastError () returned 0x12 [0256.914] FindClose (in: hFindFile=0x24d2040 | out: hFindFile=0x24d2040) returned 1 [0256.914] GetLastError () returned 0x12 [0256.914] SetLastError (dwErrCode=0x12) [0256.914] GetLastError () returned 0x12 [0256.914] SetLastError (dwErrCode=0x12) [0256.914] GetLastError () returned 0x0 [0256.914] SetLastError (dwErrCode=0x0) [0256.914] GetLastError () returned 0x0 [0256.914] SetLastError (dwErrCode=0x0) [0256.914] GetLastError () returned 0x0 [0256.915] SetLastError (dwErrCode=0x0) [0256.915] GetLastError () returned 0x0 [0256.915] SetLastError (dwErrCode=0x0) [0256.915] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0256.915] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="local", len=0x5 | out: pbstr=0x7ffa00*="local") returned 1 [0256.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0256.915] GetLastError () returned 0x0 [0256.915] SetLastError (dwErrCode=0x0) [0256.915] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0xabb948, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpUsedDefaultChar=0x0) returned 35 [0256.915] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb948, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0256.915] GetLastError () returned 0x0 [0256.915] SetLastError (dwErrCode=0x0) [0256.915] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb948, cbMultiByte=35, lpWideCharStr=0xadb628, cchWideChar=35 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local") returned 35 [0256.915] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x24d1560 [0256.915] FindNextFileW (in: hFindFile=0x24d1560, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0256.915] GetLastError () returned 0x12 [0256.915] FindClose (in: hFindFile=0x24d1560 | out: hFindFile=0x24d1560) returned 1 [0256.915] GetLastError () returned 0x12 [0256.916] SetLastError (dwErrCode=0x12) [0256.916] GetLastError () returned 0x12 [0256.916] SetLastError (dwErrCode=0x12) [0256.916] GetLastError () returned 0x0 [0256.916] SetLastError (dwErrCode=0x0) [0256.916] GetLastError () returned 0x0 [0256.916] SetLastError (dwErrCode=0x0) [0256.916] GetLastError () returned 0x0 [0256.916] SetLastError (dwErrCode=0x0) [0256.916] GetLastError () returned 0x0 [0256.916] SetLastError (dwErrCode=0x0) [0256.916] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0256.916] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", psz="temp", len=0x4 | out: pbstr=0x7ffa00*="temp") returned 1 [0256.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0256.916] GetLastError () returned 0x0 [0256.916] SetLastError (dwErrCode=0x0) [0256.916] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp", cchWideChar=40, lpMultiByteStr=0xabb948, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp", lpUsedDefaultChar=0x0) returned 40 [0256.916] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb948, cbMultiByte=40, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0256.917] GetLastError () returned 0x0 [0256.917] SetLastError (dwErrCode=0x0) [0256.917] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb948, cbMultiByte=40, lpWideCharStr=0xadb4a8, cchWideChar=40 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp") returned 40 [0256.917] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xb12b8d, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0x24d1920 [0256.917] FindNextFileW (in: hFindFile=0x24d1920, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xb12b8d, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0256.917] GetLastError () returned 0x12 [0256.917] FindClose (in: hFindFile=0x24d1920 | out: hFindFile=0x24d1920) returned 1 [0256.917] GetLastError () returned 0x12 [0256.917] SetLastError (dwErrCode=0x12) [0256.917] GetLastError () returned 0x12 [0256.917] SetLastError (dwErrCode=0x12) [0256.917] GetLastError () returned 0x0 [0256.917] SetLastError (dwErrCode=0x0) [0256.917] GetLastError () returned 0x0 [0256.917] SetLastError (dwErrCode=0x0) [0256.918] GetLastError () returned 0x0 [0256.918] SetLastError (dwErrCode=0x0) [0256.918] GetLastError () returned 0x0 [0256.918] SetLastError (dwErrCode=0x0) [0256.918] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0256.918] GetLastError () returned 0x0 [0256.918] SetLastError (dwErrCode=0x0) [0256.918] GetLastError () returned 0x0 [0256.918] SetLastError (dwErrCode=0x0) [0256.918] GetLastError () returned 0x0 [0256.918] SetLastError (dwErrCode=0x0) [0256.918] GetLastError () returned 0x0 [0256.918] SetLastError (dwErrCode=0x0) [0256.918] GetLastError () returned 0x0 [0256.918] SetLastError (dwErrCode=0x0) [0256.918] GetLastError () returned 0x0 [0256.918] SetLastError (dwErrCode=0x0) [0256.918] GetLastError () returned 0x0 [0256.918] SetLastError (dwErrCode=0x0) [0256.918] GetLastError () returned 0x0 [0256.918] SetLastError (dwErrCode=0x0) [0256.919] GetLastError () returned 0x0 [0256.919] SetLastError (dwErrCode=0x0) [0256.919] GetLastError () returned 0x0 [0256.919] SetLastError (dwErrCode=0x0) [0256.919] GetLastError () returned 0x0 [0256.919] SetLastError (dwErrCode=0x0) [0256.919] GetLastError () returned 0x0 [0256.919] SetLastError (dwErrCode=0x0) [0256.919] GetLastError () returned 0x0 [0256.919] SetLastError (dwErrCode=0x0) [0256.919] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", len=0x28 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp") returned 1 [0256.919] GetLastError () returned 0x0 [0256.919] SetLastError (dwErrCode=0x0) [0256.919] GetLastError () returned 0x0 [0256.919] SetLastError (dwErrCode=0x0) [0256.919] GetLastError () returned 0x0 [0256.920] SetLastError (dwErrCode=0x0) [0256.920] GetLastError () returned 0x0 [0256.920] SetLastError (dwErrCode=0x0) [0256.920] SysReAllocStringLen (in: pbstr=0x24d3088*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x24d3088*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0256.920] GetWindowsDirectoryW (in: lpBuffer=0x2871fe0, uSize=0xfffe | out: lpBuffer="C:\\Windows") returned 0xa [0256.920] GetLastError () returned 0x0 [0256.920] SetLastError (dwErrCode=0x0) [0256.920] GetLastError () returned 0x0 [0256.920] SetLastError (dwErrCode=0x0) [0256.920] GetLastError () returned 0x0 [0256.920] SetLastError (dwErrCode=0x0) [0256.920] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Windows", len=0xa | out: pbstr=0x7ff970*="C:\\Windows") returned 1 [0256.920] CharLowerBuffW (in: lpsz="C:\\Windows", cchLength=0xa | out: lpsz="c:\\windows") returned 0xa [0256.920] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\windows", len=0xa | out: pbstr=0xac57e8*="c:\\windows") returned 1 [0256.920] GetLastError () returned 0x0 [0256.920] SetLastError (dwErrCode=0x0) [0256.920] GetLastError () returned 0x0 [0256.920] SetLastError (dwErrCode=0x0) [0256.921] GetLastError () returned 0x0 [0256.921] SetLastError (dwErrCode=0x0) [0256.921] GetLastError () returned 0x0 [0256.921] SetLastError (dwErrCode=0x0) [0256.921] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0256.921] GetLastError () returned 0x0 [0256.921] SetLastError (dwErrCode=0x0) [0256.921] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="windows", len=0x7 | out: pbstr=0xad3780*="windows") returned 1 [0256.921] GetLastError () returned 0x0 [0256.921] SetLastError (dwErrCode=0x0) [0256.921] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0256.921] GetLastError () returned 0x0 [0256.921] SetLastError (dwErrCode=0x0) [0256.921] GetLastError () returned 0x0 [0256.921] SetLastError (dwErrCode=0x0) [0256.921] GetLastError () returned 0x0 [0256.921] SetLastError (dwErrCode=0x0) [0256.921] GetLastError () returned 0x0 [0256.922] SetLastError (dwErrCode=0x0) [0256.922] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0256.922] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="windows", len=0x7 | out: pbstr=0x7ffa00*="windows") returned 1 [0256.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\windows", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0256.922] GetLastError () returned 0x0 [0256.922] SetLastError (dwErrCode=0x0) [0256.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\windows", cchWideChar=10, lpMultiByteStr=0xac58f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\windows", lpUsedDefaultChar=0x0) returned 10 [0256.922] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0256.922] GetLastError () returned 0x0 [0256.922] SetLastError (dwErrCode=0x0) [0256.922] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=10, lpWideCharStr=0xac5878, cchWideChar=10 | out: lpWideCharStr="c:\\windows") returned 10 [0256.922] FindFirstFileW (in: lpFileName="c:\\windows", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x24d1d40 [0256.922] FindNextFileW (in: hFindFile=0x24d1d40, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0256.922] GetLastError () returned 0x12 [0256.922] FindClose (in: hFindFile=0x24d1d40 | out: hFindFile=0x24d1d40) returned 1 [0256.922] GetLastError () returned 0x12 [0256.922] SetLastError (dwErrCode=0x12) [0256.922] GetLastError () returned 0x12 [0256.922] SetLastError (dwErrCode=0x12) [0256.923] GetLastError () returned 0x0 [0256.923] SetLastError (dwErrCode=0x0) [0256.923] GetLastError () returned 0x0 [0256.923] SetLastError (dwErrCode=0x0) [0256.923] GetLastError () returned 0x0 [0256.923] SetLastError (dwErrCode=0x0) [0256.923] GetLastError () returned 0x0 [0256.923] SetLastError (dwErrCode=0x0) [0256.923] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Windows", psz="c:\\Windows\\", len=0xb | out: pbstr=0x7ffd08*="c:\\Windows\\") returned 1 [0256.923] GetLastError () returned 0x0 [0256.923] SetLastError (dwErrCode=0x0) [0256.923] GetLastError () returned 0x0 [0256.923] SetLastError (dwErrCode=0x0) [0256.923] GetLastError () returned 0x0 [0256.923] SetLastError (dwErrCode=0x0) [0256.923] GetLastError () returned 0x0 [0256.923] SetLastError (dwErrCode=0x0) [0256.923] GetLastError () returned 0x0 [0256.923] SetLastError (dwErrCode=0x0) [0256.923] GetLastError () returned 0x0 [0256.923] SetLastError (dwErrCode=0x0) [0256.923] GetLastError () returned 0x0 [0256.923] SetLastError (dwErrCode=0x0) [0256.924] GetLastError () returned 0x0 [0256.924] SetLastError (dwErrCode=0x0) [0256.924] GetLastError () returned 0x0 [0256.924] SetLastError (dwErrCode=0x0) [0256.924] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Windows\\", psz="c:\\Windows", len=0xa | out: pbstr=0x7ffd08*="c:\\Windows") returned 1 [0256.924] GetLastError () returned 0x0 [0256.924] SetLastError (dwErrCode=0x0) [0256.924] GetLastError () returned 0x0 [0256.924] SetLastError (dwErrCode=0x0) [0256.924] GetLastError () returned 0x0 [0256.924] SetLastError (dwErrCode=0x0) [0256.924] GetLastError () returned 0x0 [0256.924] SetLastError (dwErrCode=0x0) [0256.924] SysReAllocStringLen (in: pbstr=0x24d3068*=0x0, psz="c:\\Windows\\", len=0xb | out: pbstr=0x24d3068*="c:\\Windows\\") returned 1 [0256.924] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x2871fe0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Documents") returned 0x0 [0256.925] GetLastError () returned 0x0 [0256.925] SetLastError (dwErrCode=0x0) [0256.925] GetLastError () returned 0x0 [0256.925] SetLastError (dwErrCode=0x0) [0256.925] GetLastError () returned 0x0 [0256.925] SetLastError (dwErrCode=0x0) [0256.925] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\Documents", len=0x1f | out: pbstr=0x7ff970*="C:\\Users\\RDhJ0CNFevzX\\Documents") returned 1 [0256.925] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\Documents", cchLength=0x1f | out: lpsz="c:\\users\\rdhj0cnfevzx\\documents") returned 0x1f [0256.925] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\users\\rdhj0cnfevzx\\documents", len=0x1f | out: pbstr=0xac57e8*="c:\\users\\rdhj0cnfevzx\\documents") returned 1 [0256.926] GetLastError () returned 0x0 [0256.926] SetLastError (dwErrCode=0x0) [0256.926] GetLastError () returned 0x0 [0256.926] SetLastError (dwErrCode=0x0) [0256.926] GetLastError () returned 0x0 [0256.926] SetLastError (dwErrCode=0x0) [0256.926] GetLastError () returned 0x0 [0256.926] SetLastError (dwErrCode=0x0) [0256.926] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0256.926] GetLastError () returned 0x0 [0256.926] SetLastError (dwErrCode=0x0) [0256.926] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="users", len=0x5 | out: pbstr=0xad3780*="users") returned 1 [0256.926] GetLastError () returned 0x0 [0256.926] SetLastError (dwErrCode=0x0) [0256.927] GetLastError () returned 0x0 [0256.927] SetLastError (dwErrCode=0x0) [0256.927] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0xad37a0*="rdhj0cnfevzx") returned 1 [0256.927] GetLastError () returned 0x0 [0256.927] SetLastError (dwErrCode=0x0) [0256.927] SysReAllocStringLen (in: pbstr=0xad37c0*=0x0, psz="documents", len=0x9 | out: pbstr=0xad37c0*="documents") returned 1 [0256.927] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0256.927] GetLastError () returned 0x0 [0256.927] SetLastError (dwErrCode=0x0) [0256.927] GetLastError () returned 0x0 [0256.927] SetLastError (dwErrCode=0x0) [0256.927] GetLastError () returned 0x0 [0256.927] SetLastError (dwErrCode=0x0) [0256.927] GetLastError () returned 0x0 [0256.927] SetLastError (dwErrCode=0x0) [0256.927] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0256.927] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x7ffa00*="users") returned 1 [0256.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.928] GetLastError () returned 0x0 [0256.928] SetLastError (dwErrCode=0x0) [0256.928] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0xac58f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0256.928] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0256.928] GetLastError () returned 0x0 [0256.928] SetLastError (dwErrCode=0x0) [0256.928] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=8, lpWideCharStr=0xac5878, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0256.928] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x24d1da0 [0256.928] FindNextFileW (in: hFindFile=0x24d1da0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0256.928] GetLastError () returned 0x12 [0256.928] FindClose (in: hFindFile=0x24d1da0 | out: hFindFile=0x24d1da0) returned 1 [0256.928] GetLastError () returned 0x12 [0256.928] SetLastError (dwErrCode=0x12) [0256.928] GetLastError () returned 0x12 [0256.928] SetLastError (dwErrCode=0x12) [0256.928] GetLastError () returned 0x0 [0256.928] SetLastError (dwErrCode=0x0) [0256.928] GetLastError () returned 0x0 [0256.928] SetLastError (dwErrCode=0x0) [0256.928] GetLastError () returned 0x0 [0256.929] SetLastError (dwErrCode=0x0) [0256.929] GetLastError () returned 0x0 [0256.929] SetLastError (dwErrCode=0x0) [0256.929] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x7ffd08*="c:\\Users\\") returned 1 [0256.929] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x7ffa00*="rdhj0cnfevzx") returned 1 [0256.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0256.929] GetLastError () returned 0x0 [0256.929] SetLastError (dwErrCode=0x0) [0256.929] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0xac5878, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0256.929] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0256.929] GetLastError () returned 0x0 [0256.929] SetLastError (dwErrCode=0x0) [0256.929] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=21, lpWideCharStr=0xabb948, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0256.929] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x24d1920 [0256.929] FindNextFileW (in: hFindFile=0x24d1920, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0256.929] GetLastError () returned 0x12 [0256.929] FindClose (in: hFindFile=0x24d1920 | out: hFindFile=0x24d1920) returned 1 [0256.930] GetLastError () returned 0x12 [0256.930] SetLastError (dwErrCode=0x12) [0256.930] GetLastError () returned 0x12 [0256.930] SetLastError (dwErrCode=0x12) [0256.930] GetLastError () returned 0x0 [0256.930] SetLastError (dwErrCode=0x0) [0256.930] GetLastError () returned 0x0 [0256.930] SetLastError (dwErrCode=0x0) [0256.930] GetLastError () returned 0x0 [0256.930] SetLastError (dwErrCode=0x0) [0256.930] GetLastError () returned 0x0 [0256.930] SetLastError (dwErrCode=0x0) [0256.930] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0256.930] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="documents", len=0x9 | out: pbstr=0x7ffa00*="documents") returned 1 [0256.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\documents", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0256.930] GetLastError () returned 0x0 [0256.930] SetLastError (dwErrCode=0x0) [0256.930] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\documents", cchWideChar=31, lpMultiByteStr=0xac5878, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\documents", lpUsedDefaultChar=0x0) returned 31 [0256.930] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0256.930] GetLastError () returned 0x0 [0256.930] SetLastError (dwErrCode=0x0) [0256.931] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=31, lpWideCharStr=0xabb8e8, cchWideChar=31 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\documents") returned 31 [0256.931] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\documents", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb8a6983f, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb8a6983f, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0x24d1560 [0256.931] FindNextFileW (in: hFindFile=0x24d1560, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb8a6983f, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb8a6983f, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0256.931] GetLastError () returned 0x12 [0256.931] FindClose (in: hFindFile=0x24d1560 | out: hFindFile=0x24d1560) returned 1 [0256.931] GetLastError () returned 0x12 [0256.931] SetLastError (dwErrCode=0x12) [0256.931] GetLastError () returned 0x12 [0256.931] SetLastError (dwErrCode=0x12) [0256.931] GetLastError () returned 0x0 [0256.931] SetLastError (dwErrCode=0x0) [0256.931] GetLastError () returned 0x0 [0256.931] SetLastError (dwErrCode=0x0) [0256.931] GetLastError () returned 0x0 [0256.931] SetLastError (dwErrCode=0x0) [0256.931] GetLastError () returned 0x0 [0256.931] SetLastError (dwErrCode=0x0) [0256.932] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\Documents", psz="c:\\Users\\RDhJ0CNFevzX\\Documents\\", len=0x20 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\Documents\\") returned 1 [0256.932] GetLastError () returned 0x0 [0256.932] SetLastError (dwErrCode=0x0) [0256.932] GetLastError () returned 0x0 [0256.932] SetLastError (dwErrCode=0x0) [0256.932] GetLastError () returned 0x0 [0256.932] SetLastError (dwErrCode=0x0) [0256.932] GetLastError () returned 0x0 [0256.932] SetLastError (dwErrCode=0x0) [0256.932] GetLastError () returned 0x0 [0256.932] SetLastError (dwErrCode=0x0) [0256.932] GetLastError () returned 0x0 [0256.932] SetLastError (dwErrCode=0x0) [0256.932] GetLastError () returned 0x0 [0256.932] SetLastError (dwErrCode=0x0) [0256.932] GetLastError () returned 0x0 [0256.932] SetLastError (dwErrCode=0x0) [0256.932] GetLastError () returned 0x0 [0256.932] SetLastError (dwErrCode=0x0) [0256.932] GetLastError () returned 0x0 [0256.932] SetLastError (dwErrCode=0x0) [0256.933] GetLastError () returned 0x0 [0256.933] SetLastError (dwErrCode=0x0) [0256.933] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\Documents\\", psz="c:\\Users\\RDhJ0CNFevzX\\Documents", len=0x1f | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\Documents") returned 1 [0256.933] GetLastError () returned 0x0 [0256.933] SetLastError (dwErrCode=0x0) [0256.933] GetLastError () returned 0x0 [0256.933] SetLastError (dwErrCode=0x0) [0256.933] GetLastError () returned 0x0 [0256.933] SetLastError (dwErrCode=0x0) [0256.933] GetLastError () returned 0x0 [0256.933] SetLastError (dwErrCode=0x0) [0256.933] SysReAllocStringLen (in: pbstr=0x24d3060*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\Documents\\", len=0x20 | out: pbstr=0x24d3060*="c:\\Users\\RDhJ0CNFevzX\\Documents\\") returned 1 [0256.933] SHGetFolderPathW (in: hwnd=0x0, csidl=46, hToken=0x0, dwFlags=0x0, pszPath=0x2871fe0 | out: pszPath="C:\\Users\\Public\\Documents") returned 0x0 [0256.933] GetLastError () returned 0x0 [0256.933] SetLastError (dwErrCode=0x0) [0256.933] GetLastError () returned 0x0 [0256.933] SetLastError (dwErrCode=0x0) [0256.934] GetLastError () returned 0x0 [0256.934] SetLastError (dwErrCode=0x0) [0256.934] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Users\\Public\\Documents", len=0x19 | out: pbstr=0x7ff970*="C:\\Users\\Public\\Documents") returned 1 [0256.934] CharLowerBuffW (in: lpsz="C:\\Users\\Public\\Documents", cchLength=0x19 | out: lpsz="c:\\users\\public\\documents") returned 0x19 [0256.934] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\users\\public\\documents", len=0x19 | out: pbstr=0xac57e8*="c:\\users\\public\\documents") returned 1 [0256.934] GetLastError () returned 0x0 [0256.934] SetLastError (dwErrCode=0x0) [0256.934] GetLastError () returned 0x0 [0256.934] SetLastError (dwErrCode=0x0) [0256.934] GetLastError () returned 0x0 [0256.934] SetLastError (dwErrCode=0x0) [0256.934] GetLastError () returned 0x0 [0256.934] SetLastError (dwErrCode=0x0) [0256.934] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0256.934] GetLastError () returned 0x0 [0256.934] SetLastError (dwErrCode=0x0) [0256.934] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="users", len=0x5 | out: pbstr=0xad3780*="users") returned 1 [0256.934] GetLastError () returned 0x0 [0256.934] SetLastError (dwErrCode=0x0) [0256.934] GetLastError () returned 0x0 [0256.934] SetLastError (dwErrCode=0x0) [0256.935] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="public", len=0x6 | out: pbstr=0xad37a0*="public") returned 1 [0256.935] GetLastError () returned 0x0 [0256.935] SetLastError (dwErrCode=0x0) [0256.935] SysReAllocStringLen (in: pbstr=0xad37c0*=0x0, psz="documents", len=0x9 | out: pbstr=0xad37c0*="documents") returned 1 [0256.935] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0256.935] GetLastError () returned 0x0 [0256.935] SetLastError (dwErrCode=0x0) [0256.935] GetLastError () returned 0x0 [0256.935] SetLastError (dwErrCode=0x0) [0256.935] GetLastError () returned 0x0 [0256.935] SetLastError (dwErrCode=0x0) [0256.935] GetLastError () returned 0x0 [0256.935] SetLastError (dwErrCode=0x0) [0256.935] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0256.936] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x7ffa00*="users") returned 1 [0256.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.936] GetLastError () returned 0x0 [0256.936] SetLastError (dwErrCode=0x0) [0256.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0xac58f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0256.936] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0256.936] GetLastError () returned 0x0 [0256.936] SetLastError (dwErrCode=0x0) [0256.936] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=8, lpWideCharStr=0xac5878, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0256.936] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x24d1f20 [0256.936] FindNextFileW (in: hFindFile=0x24d1f20, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0256.936] GetLastError () returned 0x12 [0256.936] FindClose (in: hFindFile=0x24d1f20 | out: hFindFile=0x24d1f20) returned 1 [0256.936] GetLastError () returned 0x12 [0256.936] SetLastError (dwErrCode=0x12) [0256.936] GetLastError () returned 0x12 [0256.936] SetLastError (dwErrCode=0x12) [0256.937] GetLastError () returned 0x0 [0256.937] SetLastError (dwErrCode=0x0) [0256.937] GetLastError () returned 0x0 [0256.938] SetLastError (dwErrCode=0x0) [0256.938] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x7ffd08*="c:\\Users\\") returned 1 [0256.938] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\", psz="public", len=0x6 | out: pbstr=0x7ffa00*="public") returned 1 [0256.938] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\public", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0256.938] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0256.938] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=15, lpWideCharStr=0xac58f8, cchWideChar=15 | out: lpWideCharStr="c:\\Users\\public") returned 15 [0256.938] FindFirstFileW (in: lpFileName="c:\\Users\\public", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0x24d1aa0 [0256.938] FindNextFileW (in: hFindFile=0x24d1aa0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0256.938] FindClose (in: hFindFile=0x24d1aa0 | out: hFindFile=0x24d1aa0) returned 1 [0256.938] GetLastError () returned 0x12 [0256.938] SetLastError (dwErrCode=0x12) [0256.938] GetLastError () returned 0x12 [0256.938] SetLastError (dwErrCode=0x12) [0256.939] GetLastError () returned 0x0 [0256.939] SetLastError (dwErrCode=0x0) [0256.939] GetLastError () returned 0x0 [0256.939] SetLastError (dwErrCode=0x0) [0256.939] GetLastError () returned 0x0 [0256.939] SetLastError (dwErrCode=0x0) [0256.939] GetLastError () returned 0x0 [0256.939] SetLastError (dwErrCode=0x0) [0256.939] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\Public", psz="c:\\Users\\Public\\", len=0x10 | out: pbstr=0x7ffd08*="c:\\Users\\Public\\") returned 1 [0256.939] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\Public\\", psz="documents", len=0x9 | out: pbstr=0x7ffa00*="documents") returned 1 [0256.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\Public\\documents", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0256.939] GetLastError () returned 0x0 [0256.939] SetLastError (dwErrCode=0x0) [0256.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\Public\\documents", cchWideChar=25, lpMultiByteStr=0xac5878, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\Public\\documents", lpUsedDefaultChar=0x0) returned 25 [0256.939] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0256.939] GetLastError () returned 0x0 [0256.939] SetLastError (dwErrCode=0x0) [0256.939] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=25, lpWideCharStr=0xabb8e8, cchWideChar=25 | out: lpWideCharStr="c:\\Users\\Public\\documents") returned 25 [0256.939] FindFirstFileW (in: lpFileName="c:\\Users\\Public\\documents", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0x24d1920 [0256.940] FindNextFileW (in: hFindFile=0x24d1920, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0256.940] GetLastError () returned 0x12 [0256.940] FindClose (in: hFindFile=0x24d1920 | out: hFindFile=0x24d1920) returned 1 [0256.940] GetLastError () returned 0x12 [0256.940] SetLastError (dwErrCode=0x12) [0256.940] GetLastError () returned 0x12 [0256.940] SetLastError (dwErrCode=0x12) [0256.940] GetLastError () returned 0x0 [0256.940] SetLastError (dwErrCode=0x0) [0256.940] GetLastError () returned 0x0 [0256.940] SetLastError (dwErrCode=0x0) [0256.940] GetLastError () returned 0x0 [0256.940] SetLastError (dwErrCode=0x0) [0256.940] GetLastError () returned 0x0 [0256.940] SetLastError (dwErrCode=0x0) [0256.940] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\Public\\Documents", psz="c:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x7ffd08*="c:\\Users\\Public\\Documents\\") returned 1 [0256.941] GetLastError () returned 0x0 [0256.941] SetLastError (dwErrCode=0x0) [0256.941] GetLastError () returned 0x0 [0256.941] SetLastError (dwErrCode=0x0) [0256.941] GetLastError () returned 0x0 [0256.941] SetLastError (dwErrCode=0x0) [0256.941] GetLastError () returned 0x0 [0256.941] SetLastError (dwErrCode=0x0) [0256.941] GetLastError () returned 0x0 [0256.941] SetLastError (dwErrCode=0x0) [0256.941] GetLastError () returned 0x0 [0256.941] SetLastError (dwErrCode=0x0) [0256.941] GetLastError () returned 0x0 [0256.941] SetLastError (dwErrCode=0x0) [0256.941] GetLastError () returned 0x0 [0256.941] SetLastError (dwErrCode=0x0) [0256.941] GetLastError () returned 0x0 [0256.941] SetLastError (dwErrCode=0x0) [0256.941] GetLastError () returned 0x0 [0256.941] SetLastError (dwErrCode=0x0) [0256.941] GetLastError () returned 0x0 [0256.942] SetLastError (dwErrCode=0x0) [0256.942] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\Public\\Documents\\", psz="c:\\Users\\Public\\Documents", len=0x19 | out: pbstr=0x7ffd08*="c:\\Users\\Public\\Documents") returned 1 [0256.942] GetLastError () returned 0x0 [0256.942] SetLastError (dwErrCode=0x0) [0256.942] GetLastError () returned 0x0 [0256.942] SetLastError (dwErrCode=0x0) [0256.942] GetLastError () returned 0x0 [0256.942] SetLastError (dwErrCode=0x0) [0256.942] GetLastError () returned 0x0 [0256.942] SetLastError (dwErrCode=0x0) [0256.942] SysReAllocStringLen (in: pbstr=0x24d3090*=0x0, psz="c:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x24d3090*="c:\\Users\\Public\\Documents\\") returned 1 [0256.942] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x2871fe0 | out: pszPath="C:\\Program Files") returned 0x0 [0256.942] GetLastError () returned 0x0 [0256.942] SetLastError (dwErrCode=0x0) [0256.942] GetLastError () returned 0x0 [0256.942] SetLastError (dwErrCode=0x0) [0256.942] GetLastError () returned 0x0 [0256.942] SetLastError (dwErrCode=0x0) [0256.943] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Program Files", len=0x10 | out: pbstr=0x7ff970*="C:\\Program Files") returned 1 [0256.943] CharLowerBuffW (in: lpsz="C:\\Program Files", cchLength=0x10 | out: lpsz="c:\\program files") returned 0x10 [0256.943] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\program files", len=0x10 | out: pbstr=0xac57e8*="c:\\program files") returned 1 [0256.943] GetLastError () returned 0x0 [0256.943] SetLastError (dwErrCode=0x0) [0256.943] GetLastError () returned 0x0 [0256.943] SetLastError (dwErrCode=0x0) [0256.943] GetLastError () returned 0x0 [0256.943] SetLastError (dwErrCode=0x0) [0256.943] GetLastError () returned 0x0 [0256.943] SetLastError (dwErrCode=0x0) [0256.943] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0256.943] GetLastError () returned 0x0 [0256.943] SetLastError (dwErrCode=0x0) [0256.943] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="program files", len=0xd | out: pbstr=0xad3780*="program files") returned 1 [0256.943] GetLastError () returned 0x0 [0256.943] SetLastError (dwErrCode=0x0) [0256.943] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0256.944] GetLastError () returned 0x0 [0256.944] SetLastError (dwErrCode=0x0) [0256.944] GetLastError () returned 0x0 [0256.944] SetLastError (dwErrCode=0x0) [0256.944] GetLastError () returned 0x0 [0256.944] SetLastError (dwErrCode=0x0) [0256.944] GetLastError () returned 0x0 [0256.944] SetLastError (dwErrCode=0x0) [0256.944] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0256.944] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="program files", len=0xd | out: pbstr=0x7ffa00*="program files") returned 1 [0256.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\program files", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0256.944] GetLastError () returned 0x0 [0256.944] SetLastError (dwErrCode=0x0) [0256.944] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\program files", cchWideChar=16, lpMultiByteStr=0xac58f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\program files", lpUsedDefaultChar=0x0) returned 16 [0256.944] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0256.944] GetLastError () returned 0x0 [0256.944] SetLastError (dwErrCode=0x0) [0256.944] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=16, lpWideCharStr=0xabb948, cchWideChar=16 | out: lpWideCharStr="c:\\program files") returned 16 [0256.944] FindFirstFileW (in: lpFileName="c:\\program files", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc4bf156c, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc4bf156c, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x24d1ce0 [0256.944] FindNextFileW (in: hFindFile=0x24d1ce0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc4bf156c, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc4bf156c, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0 [0256.944] GetLastError () returned 0x12 [0256.945] FindClose (in: hFindFile=0x24d1ce0 | out: hFindFile=0x24d1ce0) returned 1 [0256.945] GetLastError () returned 0x12 [0256.945] SetLastError (dwErrCode=0x12) [0256.945] GetLastError () returned 0x12 [0256.945] SetLastError (dwErrCode=0x12) [0256.945] GetLastError () returned 0x0 [0256.945] SetLastError (dwErrCode=0x0) [0256.945] GetLastError () returned 0x0 [0256.945] SetLastError (dwErrCode=0x0) [0256.945] GetLastError () returned 0x0 [0256.945] SetLastError (dwErrCode=0x0) [0256.945] GetLastError () returned 0x0 [0256.945] SetLastError (dwErrCode=0x0) [0256.945] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Program Files", psz="c:\\Program Files\\", len=0x11 | out: pbstr=0x7ffd08*="c:\\Program Files\\") returned 1 [0256.945] GetLastError () returned 0x0 [0256.945] SetLastError (dwErrCode=0x0) [0256.945] GetLastError () returned 0x0 [0256.945] SetLastError (dwErrCode=0x0) [0256.945] GetLastError () returned 0x0 [0256.945] SetLastError (dwErrCode=0x0) [0256.946] GetLastError () returned 0x0 [0256.946] SetLastError (dwErrCode=0x0) [0256.946] GetLastError () returned 0x0 [0256.946] SetLastError (dwErrCode=0x0) [0256.946] GetLastError () returned 0x0 [0256.946] SetLastError (dwErrCode=0x0) [0256.946] GetLastError () returned 0x0 [0256.946] SetLastError (dwErrCode=0x0) [0256.946] GetLastError () returned 0x0 [0256.946] SetLastError (dwErrCode=0x0) [0256.946] GetLastError () returned 0x0 [0256.946] SetLastError (dwErrCode=0x0) [0256.946] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Program Files\\", psz="c:\\Program Files", len=0x10 | out: pbstr=0x7ffd08*="c:\\Program Files") returned 1 [0256.946] GetLastError () returned 0x0 [0256.946] SetLastError (dwErrCode=0x0) [0256.946] GetLastError () returned 0x0 [0256.946] SetLastError (dwErrCode=0x0) [0256.946] GetLastError () returned 0x0 [0256.946] SetLastError (dwErrCode=0x0) [0256.947] GetLastError () returned 0x0 [0256.947] SetLastError (dwErrCode=0x0) [0256.947] SysReAllocStringLen (in: pbstr=0x24d3098*=0x0, psz="c:\\Program Files\\", len=0x11 | out: pbstr=0x24d3098*="c:\\Program Files\\") returned 1 [0256.947] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x2871fe0 | out: pszPath="C:\\ProgramData") returned 0x0 [0256.947] GetLastError () returned 0x0 [0256.947] SetLastError (dwErrCode=0x0) [0256.947] GetLastError () returned 0x0 [0256.947] SetLastError (dwErrCode=0x0) [0256.947] GetLastError () returned 0x0 [0256.947] SetLastError (dwErrCode=0x0) [0256.947] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\ProgramData", len=0xe | out: pbstr=0x7ff970*="C:\\ProgramData") returned 1 [0256.947] CharLowerBuffW (in: lpsz="C:\\ProgramData", cchLength=0xe | out: lpsz="c:\\programdata") returned 0xe [0256.947] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0xac57e8*="c:\\programdata") returned 1 [0256.947] GetLastError () returned 0x0 [0256.948] SetLastError (dwErrCode=0x0) [0256.948] GetLastError () returned 0x0 [0256.948] SetLastError (dwErrCode=0x0) [0256.948] GetLastError () returned 0x0 [0256.948] SetLastError (dwErrCode=0x0) [0256.948] GetLastError () returned 0x0 [0256.948] SetLastError (dwErrCode=0x0) [0256.948] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0256.948] GetLastError () returned 0x0 [0256.948] SetLastError (dwErrCode=0x0) [0256.948] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="programdata", len=0xb | out: pbstr=0xad3780*="programdata") returned 1 [0256.948] GetLastError () returned 0x0 [0256.948] SetLastError (dwErrCode=0x0) [0256.948] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0256.948] GetLastError () returned 0x0 [0256.948] SetLastError (dwErrCode=0x0) [0256.948] GetLastError () returned 0x0 [0256.948] SetLastError (dwErrCode=0x0) [0256.948] GetLastError () returned 0x0 [0256.949] SetLastError (dwErrCode=0x0) [0256.949] GetLastError () returned 0x0 [0256.949] SetLastError (dwErrCode=0x0) [0256.949] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0256.949] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="programdata", len=0xb | out: pbstr=0x7ffa00*="programdata") returned 1 [0256.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\programdata", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0256.949] GetLastError () returned 0x0 [0256.949] SetLastError (dwErrCode=0x0) [0256.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\programdata", cchWideChar=14, lpMultiByteStr=0xac5878, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\programdata", lpUsedDefaultChar=0x0) returned 14 [0256.949] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0256.949] GetLastError () returned 0x0 [0256.949] SetLastError (dwErrCode=0x0) [0256.949] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=14, lpWideCharStr=0xac58b8, cchWideChar=14 | out: lpWideCharStr="c:\\programdata") returned 14 [0256.949] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x387f5bb4, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x387f5bb4, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x24d1da0 [0256.949] FindNextFileW (in: hFindFile=0x24d1da0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x387f5bb4, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x387f5bb4, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0256.949] GetLastError () returned 0x12 [0256.949] FindClose (in: hFindFile=0x24d1da0 | out: hFindFile=0x24d1da0) returned 1 [0256.949] GetLastError () returned 0x12 [0256.949] SetLastError (dwErrCode=0x12) [0256.951] GetLastError () returned 0x12 [0256.951] SetLastError (dwErrCode=0x12) [0256.951] GetLastError () returned 0x0 [0256.951] SetLastError (dwErrCode=0x0) [0256.951] GetLastError () returned 0x0 [0256.951] SetLastError (dwErrCode=0x0) [0256.951] GetLastError () returned 0x0 [0256.951] SetLastError (dwErrCode=0x0) [0256.951] GetLastError () returned 0x0 [0256.952] SetLastError (dwErrCode=0x0) [0256.952] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x7ffd08*="c:\\ProgramData\\") returned 1 [0256.952] GetLastError () returned 0x0 [0256.952] SetLastError (dwErrCode=0x0) [0256.952] GetLastError () returned 0x0 [0256.952] SetLastError (dwErrCode=0x0) [0256.952] GetLastError () returned 0x0 [0256.952] SetLastError (dwErrCode=0x0) [0256.952] GetLastError () returned 0x0 [0256.952] SetLastError (dwErrCode=0x0) [0256.952] GetLastError () returned 0x0 [0256.952] SetLastError (dwErrCode=0x0) [0256.952] GetLastError () returned 0x0 [0256.952] SetLastError (dwErrCode=0x0) [0256.952] GetLastError () returned 0x0 [0256.952] SetLastError (dwErrCode=0x0) [0256.952] GetLastError () returned 0x0 [0256.952] SetLastError (dwErrCode=0x0) [0256.952] GetLastError () returned 0x0 [0256.952] SetLastError (dwErrCode=0x0) [0256.952] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\ProgramData\\", psz="c:\\ProgramData", len=0xe | out: pbstr=0x7ffd08*="c:\\ProgramData") returned 1 [0256.953] GetLastError () returned 0x0 [0256.953] SetLastError (dwErrCode=0x0) [0256.953] GetLastError () returned 0x0 [0256.953] SetLastError (dwErrCode=0x0) [0256.953] GetLastError () returned 0x0 [0256.953] SetLastError (dwErrCode=0x0) [0256.953] GetLastError () returned 0x0 [0256.953] SetLastError (dwErrCode=0x0) [0256.953] SysReAllocStringLen (in: pbstr=0x24d30a0*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x24d30a0*="c:\\ProgramData\\") returned 1 [0256.953] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0x2871fe0 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0256.953] GetLastError () returned 0x0 [0256.953] SetLastError (dwErrCode=0x0) [0256.953] GetLastError () returned 0x0 [0256.953] SetLastError (dwErrCode=0x0) [0256.953] GetLastError () returned 0x0 [0256.953] SetLastError (dwErrCode=0x0) [0256.953] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Program Files\\Common Files", len=0x1d | out: pbstr=0x7ff970*="C:\\Program Files\\Common Files") returned 1 [0256.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files", cchLength=0x1d | out: lpsz="c:\\program files\\common files") returned 0x1d [0256.953] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\program files\\common files", len=0x1d | out: pbstr=0xac57e8*="c:\\program files\\common files") returned 1 [0256.954] GetLastError () returned 0x0 [0256.954] SetLastError (dwErrCode=0x0) [0256.954] GetLastError () returned 0x0 [0256.954] SetLastError (dwErrCode=0x0) [0256.954] GetLastError () returned 0x0 [0256.954] SetLastError (dwErrCode=0x0) [0256.954] GetLastError () returned 0x0 [0256.954] SetLastError (dwErrCode=0x0) [0256.954] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0256.954] GetLastError () returned 0x0 [0256.954] SetLastError (dwErrCode=0x0) [0256.954] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="program files", len=0xd | out: pbstr=0xad3780*="program files") returned 1 [0256.954] GetLastError () returned 0x0 [0256.954] SetLastError (dwErrCode=0x0) [0256.954] GetLastError () returned 0x0 [0256.954] SetLastError (dwErrCode=0x0) [0256.954] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="common files", len=0xc | out: pbstr=0xad37a0*="common files") returned 1 [0256.954] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0256.955] GetLastError () returned 0x0 [0256.955] SetLastError (dwErrCode=0x0) [0256.955] GetLastError () returned 0x0 [0256.955] SetLastError (dwErrCode=0x0) [0256.955] GetLastError () returned 0x0 [0256.955] SetLastError (dwErrCode=0x0) [0256.955] GetLastError () returned 0x0 [0256.955] SetLastError (dwErrCode=0x0) [0256.955] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0256.955] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="program files", len=0xd | out: pbstr=0x7ffa00*="program files") returned 1 [0256.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\program files", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0256.955] GetLastError () returned 0x0 [0256.955] SetLastError (dwErrCode=0x0) [0256.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\program files", cchWideChar=16, lpMultiByteStr=0xac5878, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\program files", lpUsedDefaultChar=0x0) returned 16 [0256.955] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0256.955] GetLastError () returned 0x0 [0256.955] SetLastError (dwErrCode=0x0) [0256.955] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=16, lpWideCharStr=0xabb8e8, cchWideChar=16 | out: lpWideCharStr="c:\\program files") returned 16 [0256.955] FindFirstFileW (in: lpFileName="c:\\program files", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc4bf156c, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc4bf156c, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x24d1e60 [0256.955] FindNextFileW (in: hFindFile=0x24d1e60, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc4bf156c, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc4bf156c, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0 [0256.956] GetLastError () returned 0x12 [0256.956] FindClose (in: hFindFile=0x24d1e60 | out: hFindFile=0x24d1e60) returned 1 [0256.956] GetLastError () returned 0x12 [0256.956] SetLastError (dwErrCode=0x12) [0256.956] GetLastError () returned 0x12 [0256.956] SetLastError (dwErrCode=0x12) [0256.956] GetLastError () returned 0x0 [0256.956] SetLastError (dwErrCode=0x0) [0256.956] GetLastError () returned 0x0 [0256.956] SetLastError (dwErrCode=0x0) [0256.956] GetLastError () returned 0x0 [0256.956] SetLastError (dwErrCode=0x0) [0256.956] GetLastError () returned 0x0 [0256.956] SetLastError (dwErrCode=0x0) [0256.956] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Program Files", psz="c:\\Program Files\\", len=0x11 | out: pbstr=0x7ffd08*="c:\\Program Files\\") returned 1 [0256.956] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Program Files\\", psz="common files", len=0xc | out: pbstr=0x7ffa00*="common files") returned 1 [0256.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Program Files\\common files", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0256.956] GetLastError () returned 0x0 [0256.957] SetLastError (dwErrCode=0x0) [0256.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Program Files\\common files", cchWideChar=29, lpMultiByteStr=0xac5878, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Program Files\\common files", lpUsedDefaultChar=0x0) returned 29 [0256.957] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0256.957] GetLastError () returned 0x0 [0256.957] SetLastError (dwErrCode=0x0) [0256.957] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=29, lpWideCharStr=0xabb948, cchWideChar=29 | out: lpWideCharStr="c:\\Program Files\\common files") returned 29 [0256.957] FindFirstFileW (in: lpFileName="c:\\Program Files\\common files", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb953a580, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb953a580, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 0x24d1560 [0256.957] FindNextFileW (in: hFindFile=0x24d1560, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb953a580, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb953a580, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 0 [0256.957] GetLastError () returned 0x12 [0256.957] FindClose (in: hFindFile=0x24d1560 | out: hFindFile=0x24d1560) returned 1 [0256.957] GetLastError () returned 0x12 [0256.957] SetLastError (dwErrCode=0x12) [0256.957] GetLastError () returned 0x12 [0256.957] SetLastError (dwErrCode=0x12) [0256.957] GetLastError () returned 0x0 [0256.958] SetLastError (dwErrCode=0x0) [0256.958] GetLastError () returned 0x0 [0256.958] SetLastError (dwErrCode=0x0) [0256.958] GetLastError () returned 0x0 [0256.958] SetLastError (dwErrCode=0x0) [0256.958] GetLastError () returned 0x0 [0256.958] SetLastError (dwErrCode=0x0) [0256.958] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Program Files\\Common Files", psz="c:\\Program Files\\Common Files\\", len=0x1e | out: pbstr=0x7ffd08*="c:\\Program Files\\Common Files\\") returned 1 [0256.958] GetLastError () returned 0x0 [0256.958] SetLastError (dwErrCode=0x0) [0256.958] GetLastError () returned 0x0 [0256.958] SetLastError (dwErrCode=0x0) [0256.958] GetLastError () returned 0x0 [0256.958] SetLastError (dwErrCode=0x0) [0256.958] GetLastError () returned 0x0 [0256.958] SetLastError (dwErrCode=0x0) [0256.958] GetLastError () returned 0x0 [0256.958] SetLastError (dwErrCode=0x0) [0256.958] GetLastError () returned 0x0 [0256.958] SetLastError (dwErrCode=0x0) [0256.958] GetLastError () returned 0x0 [0256.958] SetLastError (dwErrCode=0x0) [0256.958] GetLastError () returned 0x0 [0256.959] SetLastError (dwErrCode=0x0) [0256.959] GetLastError () returned 0x0 [0256.959] SetLastError (dwErrCode=0x0) [0256.959] GetLastError () returned 0x0 [0256.959] SetLastError (dwErrCode=0x0) [0256.959] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Program Files\\Common Files\\", psz="c:\\Program Files\\Common Files", len=0x1d | out: pbstr=0x7ffd08*="c:\\Program Files\\Common Files") returned 1 [0256.959] GetLastError () returned 0x0 [0256.959] SetLastError (dwErrCode=0x0) [0256.959] GetLastError () returned 0x0 [0256.959] SetLastError (dwErrCode=0x0) [0256.959] GetLastError () returned 0x0 [0256.959] SetLastError (dwErrCode=0x0) [0256.959] GetLastError () returned 0x0 [0256.959] SetLastError (dwErrCode=0x0) [0256.959] SysReAllocStringLen (in: pbstr=0x24d30a8*=0x0, psz="c:\\Program Files\\Common Files\\", len=0x1e | out: pbstr=0x24d30a8*="c:\\Program Files\\Common Files\\") returned 1 [0256.959] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x2871fe0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Pictures") returned 0x0 [0256.960] GetLastError () returned 0x0 [0256.960] SetLastError (dwErrCode=0x0) [0256.960] GetLastError () returned 0x0 [0256.960] SetLastError (dwErrCode=0x0) [0256.960] GetLastError () returned 0x0 [0256.960] SetLastError (dwErrCode=0x0) [0256.960] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\Pictures", len=0x1e | out: pbstr=0x7ff970*="C:\\Users\\RDhJ0CNFevzX\\Pictures") returned 1 [0256.960] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\Pictures", cchLength=0x1e | out: lpsz="c:\\users\\rdhj0cnfevzx\\pictures") returned 0x1e [0256.960] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\users\\rdhj0cnfevzx\\pictures", len=0x1e | out: pbstr=0xac57e8*="c:\\users\\rdhj0cnfevzx\\pictures") returned 1 [0256.960] GetLastError () returned 0x0 [0256.960] SetLastError (dwErrCode=0x0) [0256.960] GetLastError () returned 0x0 [0256.960] SetLastError (dwErrCode=0x0) [0256.960] GetLastError () returned 0x0 [0256.960] SetLastError (dwErrCode=0x0) [0256.960] GetLastError () returned 0x0 [0256.960] SetLastError (dwErrCode=0x0) [0256.960] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0256.960] GetLastError () returned 0x0 [0256.960] SetLastError (dwErrCode=0x0) [0256.960] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="users", len=0x5 | out: pbstr=0xad3780*="users") returned 1 [0256.961] GetLastError () returned 0x0 [0256.961] SetLastError (dwErrCode=0x0) [0256.961] GetLastError () returned 0x0 [0256.961] SetLastError (dwErrCode=0x0) [0256.961] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0xad37a0*="rdhj0cnfevzx") returned 1 [0256.961] GetLastError () returned 0x0 [0256.961] SetLastError (dwErrCode=0x0) [0256.961] SysReAllocStringLen (in: pbstr=0xad37c0*=0x0, psz="pictures", len=0x8 | out: pbstr=0xad37c0*="pictures") returned 1 [0256.961] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0256.961] GetLastError () returned 0x0 [0256.961] SetLastError (dwErrCode=0x0) [0256.961] GetLastError () returned 0x0 [0256.961] SetLastError (dwErrCode=0x0) [0256.961] GetLastError () returned 0x0 [0256.961] SetLastError (dwErrCode=0x0) [0256.961] GetLastError () returned 0x0 [0256.962] SetLastError (dwErrCode=0x0) [0256.962] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0256.962] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x7ffa00*="users") returned 1 [0256.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.962] GetLastError () returned 0x0 [0256.962] SetLastError (dwErrCode=0x0) [0256.962] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0256.962] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0256.962] GetLastError () returned 0x0 [0256.962] SetLastError (dwErrCode=0x0) [0256.962] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpWideCharStr=0xac5878, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0256.962] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x24d13e0 [0256.962] FindNextFileW (in: hFindFile=0x24d13e0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0256.962] GetLastError () returned 0x12 [0256.962] FindClose (in: hFindFile=0x24d13e0 | out: hFindFile=0x24d13e0) returned 1 [0256.962] GetLastError () returned 0x12 [0256.962] SetLastError (dwErrCode=0x12) [0256.962] GetLastError () returned 0x12 [0256.963] SetLastError (dwErrCode=0x12) [0256.963] GetLastError () returned 0x0 [0256.963] SetLastError (dwErrCode=0x0) [0256.963] GetLastError () returned 0x0 [0256.963] SetLastError (dwErrCode=0x0) [0256.963] GetLastError () returned 0x0 [0256.963] SetLastError (dwErrCode=0x0) [0256.963] GetLastError () returned 0x0 [0256.963] SetLastError (dwErrCode=0x0) [0256.963] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x7ffd08*="c:\\Users\\") returned 1 [0256.963] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x7ffa00*="rdhj0cnfevzx") returned 1 [0256.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0256.963] GetLastError () returned 0x0 [0256.963] SetLastError (dwErrCode=0x0) [0256.963] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0xac5878, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0256.963] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0256.963] GetLastError () returned 0x0 [0256.964] SetLastError (dwErrCode=0x0) [0256.964] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=21, lpWideCharStr=0xabb8e8, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0256.964] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x24d1920 [0256.964] FindNextFileW (in: hFindFile=0x24d1920, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0256.964] GetLastError () returned 0x12 [0256.964] FindClose (in: hFindFile=0x24d1920 | out: hFindFile=0x24d1920) returned 1 [0256.964] GetLastError () returned 0x12 [0256.964] SetLastError (dwErrCode=0x12) [0256.964] GetLastError () returned 0x12 [0256.964] SetLastError (dwErrCode=0x12) [0256.964] GetLastError () returned 0x0 [0256.964] SetLastError (dwErrCode=0x0) [0256.964] GetLastError () returned 0x0 [0256.965] SetLastError (dwErrCode=0x0) [0256.965] GetLastError () returned 0x0 [0256.965] SetLastError (dwErrCode=0x0) [0256.965] GetLastError () returned 0x0 [0256.965] SetLastError (dwErrCode=0x0) [0256.965] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0256.965] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="pictures", len=0x8 | out: pbstr=0x7ffa00*="pictures") returned 1 [0256.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\pictures", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0256.965] GetLastError () returned 0x0 [0256.965] SetLastError (dwErrCode=0x0) [0256.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\pictures", cchWideChar=30, lpMultiByteStr=0xac5878, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\pictures", lpUsedDefaultChar=0x0) returned 30 [0256.965] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=30, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0256.965] GetLastError () returned 0x0 [0256.965] SetLastError (dwErrCode=0x0) [0256.965] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=30, lpWideCharStr=0xabb948, cchWideChar=30 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\pictures") returned 30 [0256.965] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\pictures", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb85b0d8b, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb85b0d8b, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 0x24d1d40 [0256.966] FindNextFileW (in: hFindFile=0x24d1d40, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb85b0d8b, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb85b0d8b, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 0 [0256.966] GetLastError () returned 0x12 [0256.966] FindClose (in: hFindFile=0x24d1d40 | out: hFindFile=0x24d1d40) returned 1 [0256.966] GetLastError () returned 0x12 [0256.966] SetLastError (dwErrCode=0x12) [0256.966] GetLastError () returned 0x12 [0256.966] SetLastError (dwErrCode=0x12) [0256.966] GetLastError () returned 0x0 [0256.966] SetLastError (dwErrCode=0x0) [0256.966] GetLastError () returned 0x0 [0256.966] SetLastError (dwErrCode=0x0) [0256.966] GetLastError () returned 0x0 [0256.966] SetLastError (dwErrCode=0x0) [0256.966] GetLastError () returned 0x0 [0256.966] SetLastError (dwErrCode=0x0) [0256.966] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\Pictures", psz="c:\\Users\\RDhJ0CNFevzX\\Pictures\\", len=0x1f | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\Pictures\\") returned 1 [0256.966] GetLastError () returned 0x0 [0256.966] SetLastError (dwErrCode=0x0) [0256.967] GetLastError () returned 0x0 [0256.967] SetLastError (dwErrCode=0x0) [0256.967] GetLastError () returned 0x0 [0256.967] SetLastError (dwErrCode=0x0) [0256.967] GetLastError () returned 0x0 [0256.967] SetLastError (dwErrCode=0x0) [0256.967] GetLastError () returned 0x0 [0256.967] SetLastError (dwErrCode=0x0) [0256.967] GetLastError () returned 0x0 [0256.967] SetLastError (dwErrCode=0x0) [0256.967] GetLastError () returned 0x0 [0256.967] SetLastError (dwErrCode=0x0) [0256.967] GetLastError () returned 0x0 [0256.967] SetLastError (dwErrCode=0x0) [0256.967] GetLastError () returned 0x0 [0256.967] SetLastError (dwErrCode=0x0) [0256.967] GetLastError () returned 0x0 [0256.967] SetLastError (dwErrCode=0x0) [0256.967] GetLastError () returned 0x0 [0256.967] SetLastError (dwErrCode=0x0) [0256.968] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\Pictures\\", psz="c:\\Users\\RDhJ0CNFevzX\\Pictures", len=0x1e | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\Pictures") returned 1 [0256.968] GetLastError () returned 0x0 [0256.968] SetLastError (dwErrCode=0x0) [0256.968] GetLastError () returned 0x0 [0256.968] SetLastError (dwErrCode=0x0) [0256.968] GetLastError () returned 0x0 [0256.968] SetLastError (dwErrCode=0x0) [0256.968] GetLastError () returned 0x0 [0256.968] SetLastError (dwErrCode=0x0) [0256.968] SysReAllocStringLen (in: pbstr=0x24d30b0*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\Pictures\\", len=0x1f | out: pbstr=0x24d30b0*="c:\\Users\\RDhJ0CNFevzX\\Pictures\\") returned 1 [0256.968] SHGetFolderPathW (in: hwnd=0x0, csidl=34, hToken=0x0, dwFlags=0x0, pszPath=0x2871fe0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x0 [0256.968] GetLastError () returned 0x0 [0256.968] SetLastError (dwErrCode=0x0) [0256.968] GetLastError () returned 0x0 [0256.968] SetLastError (dwErrCode=0x0) [0256.968] GetLastError () returned 0x0 [0256.969] SetLastError (dwErrCode=0x0) [0256.969] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History", len=0x3d | out: pbstr=0x7ff970*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History") returned 1 [0256.969] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History", cchLength=0x3d | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history") returned 0x3d [0256.969] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history", len=0x3d | out: pbstr=0xac57e8*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history") returned 1 [0256.969] GetLastError () returned 0x0 [0256.969] SetLastError (dwErrCode=0x0) [0256.969] GetLastError () returned 0x0 [0256.969] SetLastError (dwErrCode=0x0) [0256.969] GetLastError () returned 0x0 [0256.969] SetLastError (dwErrCode=0x0) [0256.969] GetLastError () returned 0x0 [0256.969] SetLastError (dwErrCode=0x0) [0256.969] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0256.969] GetLastError () returned 0x0 [0256.969] SetLastError (dwErrCode=0x0) [0256.969] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="users", len=0x5 | out: pbstr=0xad3780*="users") returned 1 [0256.969] GetLastError () returned 0x0 [0256.970] SetLastError (dwErrCode=0x0) [0256.970] GetLastError () returned 0x0 [0256.970] SetLastError (dwErrCode=0x0) [0256.970] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0xad37a0*="rdhj0cnfevzx") returned 1 [0256.970] GetLastError () returned 0x0 [0256.970] SetLastError (dwErrCode=0x0) [0256.970] SysReAllocStringLen (in: pbstr=0xad37c0*=0x0, psz="appdata", len=0x7 | out: pbstr=0xad37c0*="appdata") returned 1 [0256.970] GetLastError () returned 0x0 [0256.970] SetLastError (dwErrCode=0x0) [0256.970] SysReAllocStringLen (in: pbstr=0xad37e0*=0x0, psz="local", len=0x5 | out: pbstr=0xad37e0*="local") returned 1 [0256.970] GetLastError () returned 0x0 [0256.970] SetLastError (dwErrCode=0x0) [0256.970] SysReAllocStringLen (in: pbstr=0xad3800*=0x0, psz="microsoft", len=0x9 | out: pbstr=0xad3800*="microsoft") returned 1 [0256.970] GetLastError () returned 0x0 [0256.970] SetLastError (dwErrCode=0x0) [0256.970] GetLastError () returned 0x0 [0256.970] SetLastError (dwErrCode=0x0) [0256.970] GetLastError () returned 0x0 [0256.970] SetLastError (dwErrCode=0x0) [0256.970] SysReAllocStringLen (in: pbstr=0xad3820*=0x0, psz="windows", len=0x7 | out: pbstr=0xad3820*="windows") returned 1 [0256.971] GetLastError () returned 0x0 [0256.971] SetLastError (dwErrCode=0x0) [0256.971] SysReAllocStringLen (in: pbstr=0xad3840*=0x0, psz="history", len=0x7 | out: pbstr=0xad3840*="history") returned 1 [0256.971] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0256.971] GetLastError () returned 0x0 [0256.971] SetLastError (dwErrCode=0x0) [0256.971] GetLastError () returned 0x0 [0256.971] SetLastError (dwErrCode=0x0) [0256.971] GetLastError () returned 0x0 [0256.971] SetLastError (dwErrCode=0x0) [0256.971] GetLastError () returned 0x0 [0256.971] SetLastError (dwErrCode=0x0) [0256.971] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0256.971] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x7ffa00*="users") returned 1 [0256.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.972] GetLastError () returned 0x0 [0256.972] SetLastError (dwErrCode=0x0) [0256.972] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0xac5878, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0256.972] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0256.972] GetLastError () returned 0x0 [0256.972] SetLastError (dwErrCode=0x0) [0256.972] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=8, lpWideCharStr=0xac58f8, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0256.972] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x24d22e0 [0256.972] FindNextFileW (in: hFindFile=0x24d22e0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0256.972] GetLastError () returned 0x12 [0256.972] FindClose (in: hFindFile=0x24d22e0 | out: hFindFile=0x24d22e0) returned 1 [0256.972] GetLastError () returned 0x12 [0256.972] SetLastError (dwErrCode=0x12) [0256.972] GetLastError () returned 0x12 [0256.972] SetLastError (dwErrCode=0x12) [0256.972] GetLastError () returned 0x0 [0256.973] SetLastError (dwErrCode=0x0) [0256.973] GetLastError () returned 0x0 [0256.973] SetLastError (dwErrCode=0x0) [0256.973] GetLastError () returned 0x0 [0256.973] SetLastError (dwErrCode=0x0) [0256.973] GetLastError () returned 0x0 [0256.973] SetLastError (dwErrCode=0x0) [0256.973] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x7ffd08*="c:\\Users\\") returned 1 [0256.973] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x7ffa00*="rdhj0cnfevzx") returned 1 [0256.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0256.973] GetLastError () returned 0x0 [0256.973] SetLastError (dwErrCode=0x0) [0256.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0xac58f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0256.973] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0256.973] GetLastError () returned 0x0 [0256.973] SetLastError (dwErrCode=0x0) [0256.973] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=21, lpWideCharStr=0xabb8e8, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0256.973] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x24d15c0 [0256.973] FindNextFileW (in: hFindFile=0x24d15c0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0256.974] GetLastError () returned 0x12 [0256.974] FindClose (in: hFindFile=0x24d15c0 | out: hFindFile=0x24d15c0) returned 1 [0256.974] GetLastError () returned 0x12 [0256.974] SetLastError (dwErrCode=0x12) [0256.974] GetLastError () returned 0x12 [0256.974] SetLastError (dwErrCode=0x12) [0256.974] GetLastError () returned 0x0 [0256.974] SetLastError (dwErrCode=0x0) [0256.974] GetLastError () returned 0x0 [0256.974] SetLastError (dwErrCode=0x0) [0256.974] GetLastError () returned 0x0 [0256.974] SetLastError (dwErrCode=0x0) [0256.974] GetLastError () returned 0x0 [0256.974] SetLastError (dwErrCode=0x0) [0256.974] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0256.974] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x7ffa00*="appdata") returned 1 [0256.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0256.974] GetLastError () returned 0x0 [0256.974] SetLastError (dwErrCode=0x0) [0256.975] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0xac58f8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0256.975] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0256.975] GetLastError () returned 0x0 [0256.975] SetLastError (dwErrCode=0x0) [0256.975] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=29, lpWideCharStr=0xabb948, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0256.975] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x24d1f20 [0256.975] FindNextFileW (in: hFindFile=0x24d1f20, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0256.975] GetLastError () returned 0x12 [0256.975] FindClose (in: hFindFile=0x24d1f20 | out: hFindFile=0x24d1f20) returned 1 [0256.975] GetLastError () returned 0x12 [0256.975] SetLastError (dwErrCode=0x12) [0256.975] GetLastError () returned 0x12 [0256.975] SetLastError (dwErrCode=0x12) [0256.975] GetLastError () returned 0x0 [0256.975] SetLastError (dwErrCode=0x0) [0256.975] GetLastError () returned 0x0 [0256.975] SetLastError (dwErrCode=0x0) [0256.976] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0256.976] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="local", len=0x5 | out: pbstr=0x7ffa00*="local") returned 1 [0256.976] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0256.976] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0256.976] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpWideCharStr=0xadb628, cchWideChar=35 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local") returned 35 [0256.976] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x24d1c80 [0256.976] FindNextFileW (in: hFindFile=0x24d1c80, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0256.976] FindClose (in: hFindFile=0x24d1c80 | out: hFindFile=0x24d1c80) returned 1 [0256.976] GetLastError () returned 0x12 [0256.976] SetLastError (dwErrCode=0x12) [0256.976] GetLastError () returned 0x12 [0256.976] SetLastError (dwErrCode=0x12) [0256.976] GetLastError () returned 0x0 [0256.976] SetLastError (dwErrCode=0x0) [0256.976] GetLastError () returned 0x0 [0256.977] SetLastError (dwErrCode=0x0) [0256.977] GetLastError () returned 0x0 [0256.977] SetLastError (dwErrCode=0x0) [0256.977] GetLastError () returned 0x0 [0256.977] SetLastError (dwErrCode=0x0) [0256.977] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0256.977] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", psz="microsoft", len=0x9 | out: pbstr=0x7ffa00*="microsoft") returned 1 [0256.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0256.977] GetLastError () returned 0x0 [0256.977] SetLastError (dwErrCode=0x0) [0256.977] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", cchWideChar=45, lpMultiByteStr=0xabb8e8, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", lpUsedDefaultChar=0x0) returned 45 [0256.977] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0256.977] GetLastError () returned 0x0 [0256.977] SetLastError (dwErrCode=0x0) [0256.977] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=45, lpWideCharStr=0xadb4a8, cchWideChar=45 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft") returned 45 [0256.977] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x24d1fe0 [0256.977] FindNextFileW (in: hFindFile=0x24d1fe0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0256.978] GetLastError () returned 0x12 [0256.978] FindClose (in: hFindFile=0x24d1fe0 | out: hFindFile=0x24d1fe0) returned 1 [0256.978] GetLastError () returned 0x12 [0256.978] SetLastError (dwErrCode=0x12) [0256.978] GetLastError () returned 0x12 [0256.978] SetLastError (dwErrCode=0x12) [0256.978] GetLastError () returned 0x0 [0256.978] SetLastError (dwErrCode=0x0) [0256.978] GetLastError () returned 0x0 [0256.978] SetLastError (dwErrCode=0x0) [0256.978] GetLastError () returned 0x0 [0256.978] SetLastError (dwErrCode=0x0) [0256.978] GetLastError () returned 0x0 [0256.978] SetLastError (dwErrCode=0x0) [0256.978] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", len=0x2e | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\") returned 1 [0256.978] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", psz="windows", len=0x7 | out: pbstr=0x7ffa00*="windows") returned 1 [0256.978] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0256.978] GetLastError () returned 0x0 [0256.979] SetLastError (dwErrCode=0x0) [0256.979] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", cchWideChar=53, lpMultiByteStr=0xabb8e8, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", lpUsedDefaultChar=0x0) returned 53 [0256.979] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0256.979] GetLastError () returned 0x0 [0256.979] SetLastError (dwErrCode=0x0) [0256.979] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=53, lpWideCharStr=0x24d2de8, cchWideChar=53 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows") returned 53 [0256.979] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x24d2280 [0256.979] FindNextFileW (in: hFindFile=0x24d2280, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0256.979] GetLastError () returned 0x12 [0256.979] FindClose (in: hFindFile=0x24d2280 | out: hFindFile=0x24d2280) returned 1 [0256.979] GetLastError () returned 0x12 [0256.979] SetLastError (dwErrCode=0x12) [0256.979] GetLastError () returned 0x12 [0256.979] SetLastError (dwErrCode=0x12) [0256.979] GetLastError () returned 0x0 [0256.979] SetLastError (dwErrCode=0x0) [0256.979] GetLastError () returned 0x0 [0256.980] SetLastError (dwErrCode=0x0) [0256.980] GetLastError () returned 0x0 [0256.980] SetLastError (dwErrCode=0x0) [0256.980] GetLastError () returned 0x0 [0256.980] SetLastError (dwErrCode=0x0) [0256.980] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\", len=0x36 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\") returned 1 [0256.980] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\", psz="history", len=0x7 | out: pbstr=0x7ffa00*="history") returned 1 [0256.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\history", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0256.980] GetLastError () returned 0x0 [0256.980] SetLastError (dwErrCode=0x0) [0256.980] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\history", cchWideChar=61, lpMultiByteStr=0xabb8e8, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\history", lpUsedDefaultChar=0x0) returned 61 [0256.980] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=61, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 61 [0256.980] GetLastError () returned 0x0 [0256.980] SetLastError (dwErrCode=0x0) [0256.980] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=61, lpWideCharStr=0x24d3108, cchWideChar=61 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\history") returned 61 [0256.980] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\history", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4f959ee, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4f959ee, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 0x24d2040 [0256.980] FindNextFileW (in: hFindFile=0x24d2040, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4f959ee, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4f959ee, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 0 [0256.980] GetLastError () returned 0x12 [0256.980] FindClose (in: hFindFile=0x24d2040 | out: hFindFile=0x24d2040) returned 1 [0256.981] GetLastError () returned 0x12 [0256.981] SetLastError (dwErrCode=0x12) [0256.981] GetLastError () returned 0x12 [0256.981] SetLastError (dwErrCode=0x12) [0256.981] GetLastError () returned 0x0 [0256.981] SetLastError (dwErrCode=0x0) [0256.981] GetLastError () returned 0x0 [0256.981] SetLastError (dwErrCode=0x0) [0256.981] GetLastError () returned 0x0 [0256.981] SetLastError (dwErrCode=0x0) [0256.981] GetLastError () returned 0x0 [0256.981] SetLastError (dwErrCode=0x0) [0256.981] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x3e | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0256.981] GetLastError () returned 0x0 [0256.981] SetLastError (dwErrCode=0x0) [0256.981] GetLastError () returned 0x0 [0256.981] SetLastError (dwErrCode=0x0) [0256.981] GetLastError () returned 0x0 [0256.982] SetLastError (dwErrCode=0x0) [0256.982] GetLastError () returned 0x0 [0256.982] SetLastError (dwErrCode=0x0) [0256.982] GetLastError () returned 0x0 [0256.982] SetLastError (dwErrCode=0x0) [0256.982] GetLastError () returned 0x0 [0256.982] SetLastError (dwErrCode=0x0) [0256.982] GetLastError () returned 0x0 [0256.982] SetLastError (dwErrCode=0x0) [0256.982] GetLastError () returned 0x0 [0256.982] SetLastError (dwErrCode=0x0) [0256.982] GetLastError () returned 0x0 [0256.982] SetLastError (dwErrCode=0x0) [0256.982] GetLastError () returned 0x0 [0256.982] SetLastError (dwErrCode=0x0) [0256.982] GetLastError () returned 0x0 [0256.982] SetLastError (dwErrCode=0x0) [0256.982] GetLastError () returned 0x0 [0256.982] SetLastError (dwErrCode=0x0) [0256.982] GetLastError () returned 0x0 [0256.982] SetLastError (dwErrCode=0x0) [0256.983] GetLastError () returned 0x0 [0256.983] SetLastError (dwErrCode=0x0) [0256.983] GetLastError () returned 0x0 [0256.983] SetLastError (dwErrCode=0x0) [0256.983] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History", len=0x3d | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History") returned 1 [0256.983] GetLastError () returned 0x0 [0256.983] SetLastError (dwErrCode=0x0) [0256.983] GetLastError () returned 0x0 [0256.983] SetLastError (dwErrCode=0x0) [0256.983] GetLastError () returned 0x0 [0256.983] SetLastError (dwErrCode=0x0) [0256.983] GetLastError () returned 0x0 [0256.983] SetLastError (dwErrCode=0x0) [0256.983] SysReAllocStringLen (in: pbstr=0x24d30b8*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x3e | out: pbstr=0x24d30b8*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0256.983] SHGetFolderPathW (in: hwnd=0x0, csidl=33, hToken=0x0, dwFlags=0x0, pszPath=0x2871fe0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies") returned 0x0 [0256.984] GetLastError () returned 0x0 [0256.984] SetLastError (dwErrCode=0x0) [0256.984] GetLastError () returned 0x0 [0256.984] SetLastError (dwErrCode=0x0) [0256.984] GetLastError () returned 0x0 [0256.984] SetLastError (dwErrCode=0x0) [0256.984] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies", len=0x41 | out: pbstr=0x7ff970*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies") returned 1 [0256.984] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies", cchLength=0x41 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies") returned 0x41 [0256.984] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies", len=0x41 | out: pbstr=0xac57e8*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies") returned 1 [0256.984] GetLastError () returned 0x0 [0256.984] SetLastError (dwErrCode=0x0) [0256.984] GetLastError () returned 0x0 [0256.984] SetLastError (dwErrCode=0x0) [0256.984] GetLastError () returned 0x0 [0256.984] SetLastError (dwErrCode=0x0) [0256.984] GetLastError () returned 0x0 [0256.984] SetLastError (dwErrCode=0x0) [0256.984] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0256.984] GetLastError () returned 0x0 [0256.984] SetLastError (dwErrCode=0x0) [0256.984] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="users", len=0x5 | out: pbstr=0xad3780*="users") returned 1 [0256.985] GetLastError () returned 0x0 [0256.985] SetLastError (dwErrCode=0x0) [0256.985] GetLastError () returned 0x0 [0256.985] SetLastError (dwErrCode=0x0) [0256.985] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0xad37a0*="rdhj0cnfevzx") returned 1 [0256.985] GetLastError () returned 0x0 [0256.985] SetLastError (dwErrCode=0x0) [0256.985] SysReAllocStringLen (in: pbstr=0xad37c0*=0x0, psz="appdata", len=0x7 | out: pbstr=0xad37c0*="appdata") returned 1 [0256.985] GetLastError () returned 0x0 [0256.985] SetLastError (dwErrCode=0x0) [0256.985] SysReAllocStringLen (in: pbstr=0xad37e0*=0x0, psz="local", len=0x5 | out: pbstr=0xad37e0*="local") returned 1 [0256.985] GetLastError () returned 0x0 [0256.985] SetLastError (dwErrCode=0x0) [0256.985] SysReAllocStringLen (in: pbstr=0xad3800*=0x0, psz="microsoft", len=0x9 | out: pbstr=0xad3800*="microsoft") returned 1 [0256.985] GetLastError () returned 0x0 [0256.985] SetLastError (dwErrCode=0x0) [0256.985] GetLastError () returned 0x0 [0256.985] SetLastError (dwErrCode=0x0) [0256.985] GetLastError () returned 0x0 [0256.985] SetLastError (dwErrCode=0x0) [0256.985] SysReAllocStringLen (in: pbstr=0xad3820*=0x0, psz="windows", len=0x7 | out: pbstr=0xad3820*="windows") returned 1 [0256.986] GetLastError () returned 0x0 [0256.986] SetLastError (dwErrCode=0x0) [0256.986] SysReAllocStringLen (in: pbstr=0xad3840*=0x0, psz="inetcookies", len=0xb | out: pbstr=0xad3840*="inetcookies") returned 1 [0256.986] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0256.986] GetLastError () returned 0x0 [0256.986] SetLastError (dwErrCode=0x0) [0256.986] GetLastError () returned 0x0 [0256.986] SetLastError (dwErrCode=0x0) [0256.986] GetLastError () returned 0x0 [0256.986] SetLastError (dwErrCode=0x0) [0256.986] GetLastError () returned 0x0 [0256.986] SetLastError (dwErrCode=0x0) [0256.986] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0256.987] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x7ffa00*="users") returned 1 [0256.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0256.987] GetLastError () returned 0x0 [0256.987] SetLastError (dwErrCode=0x0) [0256.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0xac5878, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0256.987] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0256.987] GetLastError () returned 0x0 [0256.987] SetLastError (dwErrCode=0x0) [0256.987] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=8, lpWideCharStr=0xac58f8, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0256.987] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x24d2160 [0256.987] FindNextFileW (in: hFindFile=0x24d2160, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0256.987] GetLastError () returned 0x12 [0256.987] FindClose (in: hFindFile=0x24d2160 | out: hFindFile=0x24d2160) returned 1 [0256.987] GetLastError () returned 0x12 [0256.987] SetLastError (dwErrCode=0x12) [0256.987] GetLastError () returned 0x12 [0256.987] SetLastError (dwErrCode=0x12) [0256.988] GetLastError () returned 0x0 [0256.988] SetLastError (dwErrCode=0x0) [0256.988] GetLastError () returned 0x0 [0256.988] SetLastError (dwErrCode=0x0) [0256.988] GetLastError () returned 0x0 [0256.988] SetLastError (dwErrCode=0x0) [0256.988] GetLastError () returned 0x0 [0256.988] SetLastError (dwErrCode=0x0) [0256.988] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x7ffd08*="c:\\Users\\") returned 1 [0256.988] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x7ffa00*="rdhj0cnfevzx") returned 1 [0256.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0256.988] GetLastError () returned 0x0 [0256.988] SetLastError (dwErrCode=0x0) [0256.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0xac58f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0256.988] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0256.988] GetLastError () returned 0x0 [0256.988] SetLastError (dwErrCode=0x0) [0256.988] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=21, lpWideCharStr=0xabb8e8, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0256.988] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x24d16e0 [0256.988] FindNextFileW (in: hFindFile=0x24d16e0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0256.988] GetLastError () returned 0x12 [0256.988] FindClose (in: hFindFile=0x24d16e0 | out: hFindFile=0x24d16e0) returned 1 [0256.989] GetLastError () returned 0x12 [0256.989] SetLastError (dwErrCode=0x12) [0256.989] GetLastError () returned 0x12 [0256.989] SetLastError (dwErrCode=0x12) [0256.989] GetLastError () returned 0x0 [0256.989] SetLastError (dwErrCode=0x0) [0256.989] GetLastError () returned 0x0 [0256.989] SetLastError (dwErrCode=0x0) [0256.989] GetLastError () returned 0x0 [0256.989] SetLastError (dwErrCode=0x0) [0256.989] GetLastError () returned 0x0 [0256.989] SetLastError (dwErrCode=0x0) [0256.989] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0256.989] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x7ffa00*="appdata") returned 1 [0256.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0256.989] GetLastError () returned 0x0 [0256.989] SetLastError (dwErrCode=0x0) [0256.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0xac58f8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0256.990] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0256.990] GetLastError () returned 0x0 [0256.990] SetLastError (dwErrCode=0x0) [0256.990] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=29, lpWideCharStr=0xabb948, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0256.990] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x24d1ce0 [0256.990] FindNextFileW (in: hFindFile=0x24d1ce0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0256.990] GetLastError () returned 0x12 [0256.990] FindClose (in: hFindFile=0x24d1ce0 | out: hFindFile=0x24d1ce0) returned 1 [0256.990] GetLastError () returned 0x12 [0256.990] SetLastError (dwErrCode=0x12) [0256.990] GetLastError () returned 0x12 [0256.990] SetLastError (dwErrCode=0x12) [0256.990] GetLastError () returned 0x0 [0256.990] SetLastError (dwErrCode=0x0) [0256.990] GetLastError () returned 0x0 [0256.990] SetLastError (dwErrCode=0x0) [0256.990] GetLastError () returned 0x0 [0256.990] SetLastError (dwErrCode=0x0) [0256.990] GetLastError () returned 0x0 [0256.990] SetLastError (dwErrCode=0x0) [0256.991] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0256.991] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="local", len=0x5 | out: pbstr=0x7ffa00*="local") returned 1 [0256.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0256.991] GetLastError () returned 0x0 [0256.991] SetLastError (dwErrCode=0x0) [0256.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpUsedDefaultChar=0x0) returned 35 [0256.991] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0256.991] GetLastError () returned 0x0 [0256.991] SetLastError (dwErrCode=0x0) [0256.991] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpWideCharStr=0xadb628, cchWideChar=35 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local") returned 35 [0256.991] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x24d1920 [0256.991] FindNextFileW (in: hFindFile=0x24d1920, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0256.991] GetLastError () returned 0x12 [0256.991] FindClose (in: hFindFile=0x24d1920 | out: hFindFile=0x24d1920) returned 1 [0256.991] GetLastError () returned 0x12 [0256.991] SetLastError (dwErrCode=0x12) [0256.991] GetLastError () returned 0x12 [0256.991] SetLastError (dwErrCode=0x12) [0256.992] GetLastError () returned 0x0 [0256.992] SetLastError (dwErrCode=0x0) [0256.992] GetLastError () returned 0x0 [0256.992] SetLastError (dwErrCode=0x0) [0256.992] GetLastError () returned 0x0 [0256.992] SetLastError (dwErrCode=0x0) [0256.992] GetLastError () returned 0x0 [0256.992] SetLastError (dwErrCode=0x0) [0256.992] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0256.992] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", psz="microsoft", len=0x9 | out: pbstr=0x7ffa00*="microsoft") returned 1 [0256.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0256.992] GetLastError () returned 0x0 [0256.992] SetLastError (dwErrCode=0x0) [0256.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", cchWideChar=45, lpMultiByteStr=0xabb8e8, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", lpUsedDefaultChar=0x0) returned 45 [0256.992] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0256.992] GetLastError () returned 0x0 [0256.992] SetLastError (dwErrCode=0x0) [0256.992] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=45, lpWideCharStr=0xadb4a8, cchWideChar=45 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft") returned 45 [0256.992] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x24d1c80 [0256.992] FindNextFileW (in: hFindFile=0x24d1c80, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0256.992] GetLastError () returned 0x12 [0256.992] FindClose (in: hFindFile=0x24d1c80 | out: hFindFile=0x24d1c80) returned 1 [0256.993] GetLastError () returned 0x12 [0256.993] SetLastError (dwErrCode=0x12) [0256.993] GetLastError () returned 0x12 [0256.993] SetLastError (dwErrCode=0x12) [0256.993] GetLastError () returned 0x0 [0256.993] SetLastError (dwErrCode=0x0) [0256.993] GetLastError () returned 0x0 [0256.993] SetLastError (dwErrCode=0x0) [0256.993] GetLastError () returned 0x0 [0256.993] SetLastError (dwErrCode=0x0) [0256.993] GetLastError () returned 0x0 [0256.993] SetLastError (dwErrCode=0x0) [0256.993] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", len=0x2e | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\") returned 1 [0256.993] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", psz="windows", len=0x7 | out: pbstr=0x7ffa00*="windows") returned 1 [0256.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0256.993] GetLastError () returned 0x0 [0256.993] SetLastError (dwErrCode=0x0) [0256.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", cchWideChar=53, lpMultiByteStr=0xabb8e8, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", lpUsedDefaultChar=0x0) returned 53 [0256.993] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0256.993] GetLastError () returned 0x0 [0256.993] SetLastError (dwErrCode=0x0) [0256.993] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=53, lpWideCharStr=0x24d2de8, cchWideChar=53 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows") returned 53 [0256.993] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x24d1e60 [0257.013] FindNextFileW (in: hFindFile=0x24d1e60, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0257.013] GetLastError () returned 0x12 [0257.013] FindClose (in: hFindFile=0x24d1e60 | out: hFindFile=0x24d1e60) returned 1 [0257.014] GetLastError () returned 0x12 [0257.014] SetLastError (dwErrCode=0x12) [0257.014] GetLastError () returned 0x12 [0257.014] SetLastError (dwErrCode=0x12) [0257.014] GetLastError () returned 0x0 [0257.014] SetLastError (dwErrCode=0x0) [0257.015] GetLastError () returned 0x0 [0257.015] SetLastError (dwErrCode=0x0) [0257.015] GetLastError () returned 0x0 [0257.015] SetLastError (dwErrCode=0x0) [0257.015] GetLastError () returned 0x0 [0257.015] SetLastError (dwErrCode=0x0) [0257.015] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\", len=0x36 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\") returned 1 [0257.015] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\", psz="inetcookies", len=0xb | out: pbstr=0x7ffa00*="inetcookies") returned 1 [0257.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcookies", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0257.015] GetLastError () returned 0x0 [0257.015] SetLastError (dwErrCode=0x0) [0257.015] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcookies", cchWideChar=65, lpMultiByteStr=0xadb628, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcookies", lpUsedDefaultChar=0x0) returned 65 [0257.015] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xadb628, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0257.015] GetLastError () returned 0x0 [0257.015] SetLastError (dwErrCode=0x0) [0257.015] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xadb628, cbMultiByte=65, lpWideCharStr=0x2501028, cchWideChar=65 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcookies") returned 65 [0257.016] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcookies", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc5e4ca02, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xc5e4ca02, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 0x24d16e0 [0257.016] FindNextFileW (in: hFindFile=0x24d16e0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc5e4ca02, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xc5e4ca02, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 0 [0257.016] GetLastError () returned 0x12 [0257.016] FindClose (in: hFindFile=0x24d16e0 | out: hFindFile=0x24d16e0) returned 1 [0257.016] GetLastError () returned 0x12 [0257.016] SetLastError (dwErrCode=0x12) [0257.016] GetLastError () returned 0x12 [0257.016] SetLastError (dwErrCode=0x12) [0257.016] GetLastError () returned 0x0 [0257.016] SetLastError (dwErrCode=0x0) [0257.016] GetLastError () returned 0x0 [0257.016] SetLastError (dwErrCode=0x0) [0257.016] GetLastError () returned 0x0 [0257.016] SetLastError (dwErrCode=0x0) [0257.016] GetLastError () returned 0x0 [0257.017] SetLastError (dwErrCode=0x0) [0257.017] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", len=0x42 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\") returned 1 [0257.017] GetLastError () returned 0x0 [0257.017] SetLastError (dwErrCode=0x0) [0257.017] GetLastError () returned 0x0 [0257.017] SetLastError (dwErrCode=0x0) [0257.017] GetLastError () returned 0x0 [0257.017] SetLastError (dwErrCode=0x0) [0257.017] GetLastError () returned 0x0 [0257.017] SetLastError (dwErrCode=0x0) [0257.017] GetLastError () returned 0x0 [0257.017] SetLastError (dwErrCode=0x0) [0257.017] GetLastError () returned 0x0 [0257.017] SetLastError (dwErrCode=0x0) [0257.017] GetLastError () returned 0x0 [0257.017] SetLastError (dwErrCode=0x0) [0257.017] GetLastError () returned 0x0 [0257.018] SetLastError (dwErrCode=0x0) [0257.018] GetLastError () returned 0x0 [0257.018] SetLastError (dwErrCode=0x0) [0257.018] GetLastError () returned 0x0 [0257.018] SetLastError (dwErrCode=0x0) [0257.018] GetLastError () returned 0x0 [0257.018] SetLastError (dwErrCode=0x0) [0257.018] GetLastError () returned 0x0 [0257.018] SetLastError (dwErrCode=0x0) [0257.018] GetLastError () returned 0x0 [0257.018] SetLastError (dwErrCode=0x0) [0257.018] GetLastError () returned 0x0 [0257.018] SetLastError (dwErrCode=0x0) [0257.018] GetLastError () returned 0x0 [0257.018] SetLastError (dwErrCode=0x0) [0257.018] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies", len=0x41 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies") returned 1 [0257.018] GetLastError () returned 0x0 [0257.018] SetLastError (dwErrCode=0x0) [0257.018] GetLastError () returned 0x0 [0257.018] SetLastError (dwErrCode=0x0) [0257.019] GetLastError () returned 0x0 [0257.019] SetLastError (dwErrCode=0x0) [0257.019] GetLastError () returned 0x0 [0257.019] SetLastError (dwErrCode=0x0) [0257.019] SysReAllocStringLen (in: pbstr=0x24d30c0*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", len=0x42 | out: pbstr=0x24d30c0*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\") returned 1 [0257.019] SHGetFolderPathW (in: hwnd=0x0, csidl=32, hToken=0x0, dwFlags=0x0, pszPath=0x2871fe0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache") returned 0x0 [0257.020] GetLastError () returned 0x0 [0257.020] SetLastError (dwErrCode=0x0) [0257.020] GetLastError () returned 0x0 [0257.020] SetLastError (dwErrCode=0x0) [0257.020] GetLastError () returned 0x0 [0257.020] SetLastError (dwErrCode=0x0) [0257.020] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache", len=0x3f | out: pbstr=0x7ff970*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache") returned 1 [0257.020] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache", cchLength=0x3f | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache") returned 0x3f [0257.020] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache", len=0x3f | out: pbstr=0xac57e8*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache") returned 1 [0257.020] GetLastError () returned 0x0 [0257.020] SetLastError (dwErrCode=0x0) [0257.020] GetLastError () returned 0x0 [0257.020] SetLastError (dwErrCode=0x0) [0257.020] GetLastError () returned 0x0 [0257.020] SetLastError (dwErrCode=0x0) [0257.020] GetLastError () returned 0x0 [0257.020] SetLastError (dwErrCode=0x0) [0257.020] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0257.020] GetLastError () returned 0x0 [0257.020] SetLastError (dwErrCode=0x0) [0257.021] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="users", len=0x5 | out: pbstr=0xad3780*="users") returned 1 [0257.021] GetLastError () returned 0x0 [0257.021] SetLastError (dwErrCode=0x0) [0257.021] GetLastError () returned 0x0 [0257.021] SetLastError (dwErrCode=0x0) [0257.021] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0xad37a0*="rdhj0cnfevzx") returned 1 [0257.021] GetLastError () returned 0x0 [0257.021] SetLastError (dwErrCode=0x0) [0257.021] SysReAllocStringLen (in: pbstr=0xad37c0*=0x0, psz="appdata", len=0x7 | out: pbstr=0xad37c0*="appdata") returned 1 [0257.021] GetLastError () returned 0x0 [0257.021] SetLastError (dwErrCode=0x0) [0257.021] SysReAllocStringLen (in: pbstr=0xad37e0*=0x0, psz="local", len=0x5 | out: pbstr=0xad37e0*="local") returned 1 [0257.021] GetLastError () returned 0x0 [0257.021] SetLastError (dwErrCode=0x0) [0257.021] SysReAllocStringLen (in: pbstr=0xad3800*=0x0, psz="microsoft", len=0x9 | out: pbstr=0xad3800*="microsoft") returned 1 [0257.021] GetLastError () returned 0x0 [0257.021] SetLastError (dwErrCode=0x0) [0257.021] GetLastError () returned 0x0 [0257.021] SetLastError (dwErrCode=0x0) [0257.021] GetLastError () returned 0x0 [0257.022] SetLastError (dwErrCode=0x0) [0257.022] SysReAllocStringLen (in: pbstr=0xad3820*=0x0, psz="windows", len=0x7 | out: pbstr=0xad3820*="windows") returned 1 [0257.022] GetLastError () returned 0x0 [0257.022] SetLastError (dwErrCode=0x0) [0257.022] SysReAllocStringLen (in: pbstr=0xad3840*=0x0, psz="inetcache", len=0x9 | out: pbstr=0xad3840*="inetcache") returned 1 [0257.022] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0257.022] GetLastError () returned 0x0 [0257.022] SetLastError (dwErrCode=0x0) [0257.022] GetLastError () returned 0x0 [0257.022] SetLastError (dwErrCode=0x0) [0257.022] GetLastError () returned 0x0 [0257.022] SetLastError (dwErrCode=0x0) [0257.022] GetLastError () returned 0x0 [0257.023] SetLastError (dwErrCode=0x0) [0257.023] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0257.023] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x7ffa00*="users") returned 1 [0257.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0257.023] GetLastError () returned 0x0 [0257.023] SetLastError (dwErrCode=0x0) [0257.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0xac5878, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0257.023] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0257.023] GetLastError () returned 0x0 [0257.023] SetLastError (dwErrCode=0x0) [0257.023] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=8, lpWideCharStr=0xac58f8, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0257.023] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x24d1920 [0257.023] FindNextFileW (in: hFindFile=0x24d1920, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0257.023] GetLastError () returned 0x12 [0257.023] FindClose (in: hFindFile=0x24d1920 | out: hFindFile=0x24d1920) returned 1 [0257.023] GetLastError () returned 0x12 [0257.024] SetLastError (dwErrCode=0x12) [0257.024] GetLastError () returned 0x12 [0257.024] SetLastError (dwErrCode=0x12) [0257.024] GetLastError () returned 0x0 [0257.024] SetLastError (dwErrCode=0x0) [0257.024] GetLastError () returned 0x0 [0257.024] SetLastError (dwErrCode=0x0) [0257.024] GetLastError () returned 0x0 [0257.024] SetLastError (dwErrCode=0x0) [0257.024] GetLastError () returned 0x0 [0257.024] SetLastError (dwErrCode=0x0) [0257.024] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x7ffd08*="c:\\Users\\") returned 1 [0257.024] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x7ffa00*="rdhj0cnfevzx") returned 1 [0257.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0257.024] GetLastError () returned 0x0 [0257.024] SetLastError (dwErrCode=0x0) [0257.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0xac58f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0257.024] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0257.024] GetLastError () returned 0x0 [0257.024] SetLastError (dwErrCode=0x0) [0257.024] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=21, lpWideCharStr=0xabb8e8, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0257.024] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x24d2160 [0257.025] FindNextFileW (in: hFindFile=0x24d2160, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0257.025] GetLastError () returned 0x12 [0257.025] FindClose (in: hFindFile=0x24d2160 | out: hFindFile=0x24d2160) returned 1 [0257.026] GetLastError () returned 0x12 [0257.026] SetLastError (dwErrCode=0x12) [0257.026] GetLastError () returned 0x12 [0257.026] SetLastError (dwErrCode=0x12) [0257.026] GetLastError () returned 0x0 [0257.026] SetLastError (dwErrCode=0x0) [0257.026] GetLastError () returned 0x0 [0257.026] SetLastError (dwErrCode=0x0) [0257.026] GetLastError () returned 0x0 [0257.026] SetLastError (dwErrCode=0x0) [0257.026] GetLastError () returned 0x0 [0257.026] SetLastError (dwErrCode=0x0) [0257.026] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0257.027] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x7ffa00*="appdata") returned 1 [0257.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0257.027] GetLastError () returned 0x0 [0257.027] SetLastError (dwErrCode=0x0) [0257.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0xac58f8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0257.027] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0257.027] GetLastError () returned 0x0 [0257.027] SetLastError (dwErrCode=0x0) [0257.027] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=29, lpWideCharStr=0xabb948, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0257.027] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x24d1c20 [0257.027] FindNextFileW (in: hFindFile=0x24d1c20, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0257.027] GetLastError () returned 0x12 [0257.027] FindClose (in: hFindFile=0x24d1c20 | out: hFindFile=0x24d1c20) returned 1 [0257.027] GetLastError () returned 0x12 [0257.027] SetLastError (dwErrCode=0x12) [0257.027] GetLastError () returned 0x12 [0257.027] SetLastError (dwErrCode=0x12) [0257.028] GetLastError () returned 0x0 [0257.028] SetLastError (dwErrCode=0x0) [0257.028] GetLastError () returned 0x0 [0257.028] SetLastError (dwErrCode=0x0) [0257.028] GetLastError () returned 0x0 [0257.028] SetLastError (dwErrCode=0x0) [0257.028] GetLastError () returned 0x0 [0257.028] SetLastError (dwErrCode=0x0) [0257.028] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0257.028] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="local", len=0x5 | out: pbstr=0x7ffa00*="local") returned 1 [0257.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0257.028] GetLastError () returned 0x0 [0257.028] SetLastError (dwErrCode=0x0) [0257.028] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpUsedDefaultChar=0x0) returned 35 [0257.028] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0257.028] GetLastError () returned 0x0 [0257.028] SetLastError (dwErrCode=0x0) [0257.028] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpWideCharStr=0xadb628, cchWideChar=35 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local") returned 35 [0257.028] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x24d1920 [0257.029] FindNextFileW (in: hFindFile=0x24d1920, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0257.029] GetLastError () returned 0x12 [0257.029] FindClose (in: hFindFile=0x24d1920 | out: hFindFile=0x24d1920) returned 1 [0257.029] GetLastError () returned 0x12 [0257.029] SetLastError (dwErrCode=0x12) [0257.029] GetLastError () returned 0x12 [0257.029] SetLastError (dwErrCode=0x12) [0257.029] GetLastError () returned 0x0 [0257.029] SetLastError (dwErrCode=0x0) [0257.029] GetLastError () returned 0x0 [0257.029] SetLastError (dwErrCode=0x0) [0257.029] GetLastError () returned 0x0 [0257.029] SetLastError (dwErrCode=0x0) [0257.029] GetLastError () returned 0x0 [0257.029] SetLastError (dwErrCode=0x0) [0257.029] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0257.029] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", psz="microsoft", len=0x9 | out: pbstr=0x7ffa00*="microsoft") returned 1 [0257.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0257.030] GetLastError () returned 0x0 [0257.030] SetLastError (dwErrCode=0x0) [0257.030] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", cchWideChar=45, lpMultiByteStr=0xabb8e8, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", lpUsedDefaultChar=0x0) returned 45 [0257.030] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0257.030] GetLastError () returned 0x0 [0257.030] SetLastError (dwErrCode=0x0) [0257.030] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=45, lpWideCharStr=0xadb4a8, cchWideChar=45 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft") returned 45 [0257.030] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x24d1560 [0257.030] FindNextFileW (in: hFindFile=0x24d1560, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0257.030] GetLastError () returned 0x12 [0257.030] FindClose (in: hFindFile=0x24d1560 | out: hFindFile=0x24d1560) returned 1 [0257.030] GetLastError () returned 0x12 [0257.030] SetLastError (dwErrCode=0x12) [0257.030] GetLastError () returned 0x12 [0257.030] SetLastError (dwErrCode=0x12) [0257.031] GetLastError () returned 0x0 [0257.031] SetLastError (dwErrCode=0x0) [0257.031] GetLastError () returned 0x0 [0257.031] SetLastError (dwErrCode=0x0) [0257.031] GetLastError () returned 0x0 [0257.031] SetLastError (dwErrCode=0x0) [0257.031] GetLastError () returned 0x0 [0257.031] SetLastError (dwErrCode=0x0) [0257.031] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", len=0x2e | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\") returned 1 [0257.031] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", psz="windows", len=0x7 | out: pbstr=0x7ffa00*="windows") returned 1 [0257.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0257.031] GetLastError () returned 0x0 [0257.031] SetLastError (dwErrCode=0x0) [0257.031] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", cchWideChar=53, lpMultiByteStr=0xabb8e8, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", lpUsedDefaultChar=0x0) returned 53 [0257.031] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0257.031] GetLastError () returned 0x0 [0257.031] SetLastError (dwErrCode=0x0) [0257.032] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=53, lpWideCharStr=0x24d3108, cchWideChar=53 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows") returned 53 [0257.032] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x24d1920 [0257.032] FindNextFileW (in: hFindFile=0x24d1920, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0257.032] GetLastError () returned 0x12 [0257.032] FindClose (in: hFindFile=0x24d1920 | out: hFindFile=0x24d1920) returned 1 [0257.032] GetLastError () returned 0x12 [0257.032] SetLastError (dwErrCode=0x12) [0257.032] GetLastError () returned 0x12 [0257.032] SetLastError (dwErrCode=0x12) [0257.032] GetLastError () returned 0x0 [0257.032] SetLastError (dwErrCode=0x0) [0257.032] GetLastError () returned 0x0 [0257.032] SetLastError (dwErrCode=0x0) [0257.033] GetLastError () returned 0x0 [0257.033] SetLastError (dwErrCode=0x0) [0257.033] GetLastError () returned 0x0 [0257.033] SetLastError (dwErrCode=0x0) [0257.033] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\", len=0x36 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\") returned 1 [0257.033] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\", psz="inetcache", len=0x9 | out: pbstr=0x7ffa00*="inetcache") returned 1 [0257.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcache", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0257.033] GetLastError () returned 0x0 [0257.033] SetLastError (dwErrCode=0x0) [0257.033] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcache", cchWideChar=63, lpMultiByteStr=0xabb8e8, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcache", lpUsedDefaultChar=0x0) returned 63 [0257.033] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0257.033] GetLastError () returned 0x0 [0257.033] SetLastError (dwErrCode=0x0) [0257.033] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=63, lpWideCharStr=0x24d2de8, cchWideChar=63 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcache") returned 63 [0257.033] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcache", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa49dfe15, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa49dfe15, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 0x24d1f80 [0257.034] FindNextFileW (in: hFindFile=0x24d1f80, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa49dfe15, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa49dfe15, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 0 [0257.034] GetLastError () returned 0x12 [0257.034] FindClose (in: hFindFile=0x24d1f80 | out: hFindFile=0x24d1f80) returned 1 [0257.034] GetLastError () returned 0x12 [0257.034] SetLastError (dwErrCode=0x12) [0257.034] GetLastError () returned 0x12 [0257.034] SetLastError (dwErrCode=0x12) [0257.034] GetLastError () returned 0x0 [0257.034] SetLastError (dwErrCode=0x0) [0257.034] GetLastError () returned 0x0 [0257.034] SetLastError (dwErrCode=0x0) [0257.035] GetLastError () returned 0x0 [0257.035] SetLastError (dwErrCode=0x0) [0257.035] GetLastError () returned 0x0 [0257.035] SetLastError (dwErrCode=0x0) [0257.035] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", len=0x40 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 1 [0257.035] GetLastError () returned 0x0 [0257.035] SetLastError (dwErrCode=0x0) [0257.035] GetLastError () returned 0x0 [0257.035] SetLastError (dwErrCode=0x0) [0257.035] GetLastError () returned 0x0 [0257.035] SetLastError (dwErrCode=0x0) [0257.035] GetLastError () returned 0x0 [0257.035] SetLastError (dwErrCode=0x0) [0257.035] GetLastError () returned 0x0 [0257.036] SetLastError (dwErrCode=0x0) [0257.036] GetLastError () returned 0x0 [0257.036] SetLastError (dwErrCode=0x0) [0257.036] GetLastError () returned 0x0 [0257.036] SetLastError (dwErrCode=0x0) [0257.036] GetLastError () returned 0x0 [0257.036] SetLastError (dwErrCode=0x0) [0257.036] GetLastError () returned 0x0 [0257.036] SetLastError (dwErrCode=0x0) [0257.036] GetLastError () returned 0x0 [0257.036] SetLastError (dwErrCode=0x0) [0257.036] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache", len=0x3f | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache") returned 1 [0257.037] SysReAllocStringLen (in: pbstr=0x24d30c8*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", len=0x40 | out: pbstr=0x24d30c8*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 1 [0257.037] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x2871fe0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0257.037] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", len=0x25 | out: pbstr=0x7ff970*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 1 [0257.037] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", cchLength=0x25 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming") returned 0x25 [0257.037] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming", len=0x25 | out: pbstr=0xac57e8*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming") returned 1 [0257.037] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0257.071] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="users", len=0x5 | out: pbstr=0xad3780*="users") returned 1 [0257.071] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0xad37a0*="rdhj0cnfevzx") returned 1 [0257.071] SysReAllocStringLen (in: pbstr=0xad37c0*=0x0, psz="appdata", len=0x7 | out: pbstr=0xad37c0*="appdata") returned 1 [0257.071] SysReAllocStringLen (in: pbstr=0xad37e0*=0x0, psz="roaming", len=0x7 | out: pbstr=0xad37e0*="roaming") returned 1 [0257.072] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0257.072] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0257.072] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x7ffa00*="users") returned 1 [0257.072] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0257.072] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0257.072] GetLastError () returned 0x0 [0257.072] SetLastError (dwErrCode=0x0) [0257.072] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpWideCharStr=0xac5878, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0257.072] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x24d1d40 [0257.072] FindNextFileW (in: hFindFile=0x24d1d40, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0257.073] GetLastError () returned 0x12 [0257.073] FindClose (in: hFindFile=0x24d1d40 | out: hFindFile=0x24d1d40) returned 1 [0257.073] GetLastError () returned 0x12 [0257.073] SetLastError (dwErrCode=0x12) [0257.073] GetLastError () returned 0x12 [0257.073] SetLastError (dwErrCode=0x12) [0257.073] GetLastError () returned 0x0 [0257.073] SetLastError (dwErrCode=0x0) [0257.073] GetLastError () returned 0x0 [0257.073] SetLastError (dwErrCode=0x0) [0257.073] GetLastError () returned 0x0 [0257.073] SetLastError (dwErrCode=0x0) [0257.073] GetLastError () returned 0x0 [0257.074] SetLastError (dwErrCode=0x0) [0257.074] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x7ffd08*="c:\\Users\\") returned 1 [0257.074] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x7ffa00*="rdhj0cnfevzx") returned 1 [0257.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0257.074] GetLastError () returned 0x0 [0257.074] SetLastError (dwErrCode=0x0) [0257.074] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0xac5878, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0257.074] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0257.074] GetLastError () returned 0x0 [0257.074] SetLastError (dwErrCode=0x0) [0257.074] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=21, lpWideCharStr=0xabb8e8, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0257.074] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x24d15c0 [0257.074] FindNextFileW (in: hFindFile=0x24d15c0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0257.074] GetLastError () returned 0x12 [0257.074] FindClose (in: hFindFile=0x24d15c0 | out: hFindFile=0x24d15c0) returned 1 [0257.074] GetLastError () returned 0x12 [0257.074] SetLastError (dwErrCode=0x12) [0257.074] GetLastError () returned 0x12 [0257.074] SetLastError (dwErrCode=0x12) [0257.075] GetLastError () returned 0x0 [0257.075] SetLastError (dwErrCode=0x0) [0257.075] GetLastError () returned 0x0 [0257.075] SetLastError (dwErrCode=0x0) [0257.075] GetLastError () returned 0x0 [0257.075] SetLastError (dwErrCode=0x0) [0257.075] GetLastError () returned 0x0 [0257.075] SetLastError (dwErrCode=0x0) [0257.075] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0257.075] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x7ffa00*="appdata") returned 1 [0257.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0257.075] GetLastError () returned 0x0 [0257.075] SetLastError (dwErrCode=0x0) [0257.075] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0xac5878, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0257.075] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0257.075] GetLastError () returned 0x0 [0257.075] SetLastError (dwErrCode=0x0) [0257.075] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=29, lpWideCharStr=0xabb948, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0257.075] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x24d1c80 [0257.076] FindNextFileW (in: hFindFile=0x24d1c80, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0257.076] GetLastError () returned 0x12 [0257.076] FindClose (in: hFindFile=0x24d1c80 | out: hFindFile=0x24d1c80) returned 1 [0257.076] GetLastError () returned 0x12 [0257.076] SetLastError (dwErrCode=0x12) [0257.076] GetLastError () returned 0x12 [0257.076] SetLastError (dwErrCode=0x12) [0257.076] GetLastError () returned 0x0 [0257.076] SetLastError (dwErrCode=0x0) [0257.076] GetLastError () returned 0x0 [0257.076] SetLastError (dwErrCode=0x0) [0257.076] GetLastError () returned 0x0 [0257.076] SetLastError (dwErrCode=0x0) [0257.076] GetLastError () returned 0x0 [0257.076] SetLastError (dwErrCode=0x0) [0257.076] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0257.076] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="roaming", len=0x7 | out: pbstr=0x7ffa00*="roaming") returned 1 [0257.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0257.077] GetLastError () returned 0x0 [0257.077] SetLastError (dwErrCode=0x0) [0257.077] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming", cchWideChar=37, lpMultiByteStr=0xabb8e8, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming", lpUsedDefaultChar=0x0) returned 37 [0257.077] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=37, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0257.077] GetLastError () returned 0x0 [0257.077] SetLastError (dwErrCode=0x0) [0257.077] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=37, lpWideCharStr=0xadb628, cchWideChar=37 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming") returned 37 [0257.077] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb8e6fbcd, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb8e6fbcd, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0x24d2040 [0257.077] FindNextFileW (in: hFindFile=0x24d2040, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb8e6fbcd, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb8e6fbcd, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0257.077] GetLastError () returned 0x12 [0257.077] FindClose (in: hFindFile=0x24d2040 | out: hFindFile=0x24d2040) returned 1 [0257.077] GetLastError () returned 0x12 [0257.077] SetLastError (dwErrCode=0x12) [0257.077] GetLastError () returned 0x12 [0257.077] SetLastError (dwErrCode=0x12) [0257.077] GetLastError () returned 0x0 [0257.077] SetLastError (dwErrCode=0x0) [0257.077] GetLastError () returned 0x0 [0257.077] SetLastError (dwErrCode=0x0) [0257.078] GetLastError () returned 0x0 [0257.078] SetLastError (dwErrCode=0x0) [0257.078] GetLastError () returned 0x0 [0257.078] SetLastError (dwErrCode=0x0) [0257.078] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", len=0x26 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\") returned 1 [0257.078] GetLastError () returned 0x0 [0257.078] SetLastError (dwErrCode=0x0) [0257.078] GetLastError () returned 0x0 [0257.078] SetLastError (dwErrCode=0x0) [0257.078] GetLastError () returned 0x0 [0257.078] SetLastError (dwErrCode=0x0) [0257.078] GetLastError () returned 0x0 [0257.078] SetLastError (dwErrCode=0x0) [0257.078] GetLastError () returned 0x0 [0257.078] SetLastError (dwErrCode=0x0) [0257.078] GetLastError () returned 0x0 [0257.078] SetLastError (dwErrCode=0x0) [0257.078] GetLastError () returned 0x0 [0257.078] SetLastError (dwErrCode=0x0) [0257.079] GetLastError () returned 0x0 [0257.079] SetLastError (dwErrCode=0x0) [0257.079] GetLastError () returned 0x0 [0257.079] SetLastError (dwErrCode=0x0) [0257.079] GetLastError () returned 0x0 [0257.079] SetLastError (dwErrCode=0x0) [0257.079] GetLastError () returned 0x0 [0257.079] SetLastError (dwErrCode=0x0) [0257.079] GetLastError () returned 0x0 [0257.079] SetLastError (dwErrCode=0x0) [0257.079] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", len=0x25 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 1 [0257.079] GetLastError () returned 0x0 [0257.079] SetLastError (dwErrCode=0x0) [0257.079] GetLastError () returned 0x0 [0257.079] SetLastError (dwErrCode=0x0) [0257.079] GetLastError () returned 0x0 [0257.079] SetLastError (dwErrCode=0x0) [0257.079] GetLastError () returned 0x0 [0257.079] SetLastError (dwErrCode=0x0) [0257.080] SysReAllocStringLen (in: pbstr=0x24d30d0*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", len=0x26 | out: pbstr=0x24d30d0*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\") returned 1 [0257.080] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x2871fe0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0257.081] GetLastError () returned 0x0 [0257.081] SetLastError (dwErrCode=0x0) [0257.081] GetLastError () returned 0x0 [0257.081] SetLastError (dwErrCode=0x0) [0257.082] GetLastError () returned 0x0 [0257.082] SetLastError (dwErrCode=0x0) [0257.082] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", len=0x23 | out: pbstr=0x7ff970*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 1 [0257.082] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", cchLength=0x23 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local") returned 0x23 [0257.082] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local", len=0x23 | out: pbstr=0xac57e8*="c:\\users\\rdhj0cnfevzx\\appdata\\local") returned 1 [0257.082] GetLastError () returned 0x0 [0257.082] SetLastError (dwErrCode=0x0) [0257.082] GetLastError () returned 0x0 [0257.082] SetLastError (dwErrCode=0x0) [0257.082] GetLastError () returned 0x0 [0257.082] SetLastError (dwErrCode=0x0) [0257.082] GetLastError () returned 0x0 [0257.082] SetLastError (dwErrCode=0x0) [0257.082] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0257.082] GetLastError () returned 0x0 [0257.082] SetLastError (dwErrCode=0x0) [0257.082] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="users", len=0x5 | out: pbstr=0xad3780*="users") returned 1 [0257.082] GetLastError () returned 0x0 [0257.082] SetLastError (dwErrCode=0x0) [0257.082] GetLastError () returned 0x0 [0257.083] SetLastError (dwErrCode=0x0) [0257.083] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0xad37a0*="rdhj0cnfevzx") returned 1 [0257.083] GetLastError () returned 0x0 [0257.083] SetLastError (dwErrCode=0x0) [0257.083] SysReAllocStringLen (in: pbstr=0xad37c0*=0x0, psz="appdata", len=0x7 | out: pbstr=0xad37c0*="appdata") returned 1 [0257.083] GetLastError () returned 0x0 [0257.083] SetLastError (dwErrCode=0x0) [0257.083] SysReAllocStringLen (in: pbstr=0xad37e0*=0x0, psz="local", len=0x5 | out: pbstr=0xad37e0*="local") returned 1 [0257.083] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0257.083] GetLastError () returned 0x0 [0257.083] SetLastError (dwErrCode=0x0) [0257.083] GetLastError () returned 0x0 [0257.083] SetLastError (dwErrCode=0x0) [0257.084] GetLastError () returned 0x0 [0257.084] SetLastError (dwErrCode=0x0) [0257.084] GetLastError () returned 0x0 [0257.084] SetLastError (dwErrCode=0x0) [0257.084] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0257.084] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x7ffa00*="users") returned 1 [0257.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0257.084] GetLastError () returned 0x0 [0257.084] SetLastError (dwErrCode=0x0) [0257.084] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0257.084] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0257.084] GetLastError () returned 0x0 [0257.084] SetLastError (dwErrCode=0x0) [0257.084] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpWideCharStr=0xac5878, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0257.084] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x24d1c20 [0257.084] FindNextFileW (in: hFindFile=0x24d1c20, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0257.084] GetLastError () returned 0x12 [0257.084] FindClose (in: hFindFile=0x24d1c20 | out: hFindFile=0x24d1c20) returned 1 [0257.084] GetLastError () returned 0x12 [0257.084] SetLastError (dwErrCode=0x12) [0257.084] GetLastError () returned 0x12 [0257.085] SetLastError (dwErrCode=0x12) [0257.085] GetLastError () returned 0x0 [0257.085] SetLastError (dwErrCode=0x0) [0257.085] GetLastError () returned 0x0 [0257.085] SetLastError (dwErrCode=0x0) [0257.085] GetLastError () returned 0x0 [0257.085] SetLastError (dwErrCode=0x0) [0257.085] GetLastError () returned 0x0 [0257.085] SetLastError (dwErrCode=0x0) [0257.085] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x7ffd08*="c:\\Users\\") returned 1 [0257.085] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x7ffa00*="rdhj0cnfevzx") returned 1 [0257.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0257.085] GetLastError () returned 0x0 [0257.085] SetLastError (dwErrCode=0x0) [0257.085] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0xac5878, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0257.085] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0257.085] GetLastError () returned 0x0 [0257.085] SetLastError (dwErrCode=0x0) [0257.086] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=21, lpWideCharStr=0xabb8e8, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0257.086] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x24d1440 [0257.086] FindNextFileW (in: hFindFile=0x24d1440, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0257.086] GetLastError () returned 0x12 [0257.086] FindClose (in: hFindFile=0x24d1440 | out: hFindFile=0x24d1440) returned 1 [0257.086] GetLastError () returned 0x12 [0257.086] SetLastError (dwErrCode=0x12) [0257.086] GetLastError () returned 0x12 [0257.086] SetLastError (dwErrCode=0x12) [0257.086] GetLastError () returned 0x0 [0257.086] SetLastError (dwErrCode=0x0) [0257.086] GetLastError () returned 0x0 [0257.086] SetLastError (dwErrCode=0x0) [0257.086] GetLastError () returned 0x0 [0257.086] SetLastError (dwErrCode=0x0) [0257.086] GetLastError () returned 0x0 [0257.086] SetLastError (dwErrCode=0x0) [0257.086] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0257.087] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x7ffa00*="appdata") returned 1 [0257.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0257.087] GetLastError () returned 0x0 [0257.087] SetLastError (dwErrCode=0x0) [0257.087] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0xac5878, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0257.087] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0257.087] GetLastError () returned 0x0 [0257.087] SetLastError (dwErrCode=0x0) [0257.087] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=29, lpWideCharStr=0xabb948, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0257.087] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x24d1e60 [0257.087] FindNextFileW (in: hFindFile=0x24d1e60, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0257.087] GetLastError () returned 0x12 [0257.087] FindClose (in: hFindFile=0x24d1e60 | out: hFindFile=0x24d1e60) returned 1 [0257.087] GetLastError () returned 0x12 [0257.087] SetLastError (dwErrCode=0x12) [0257.087] GetLastError () returned 0x12 [0257.087] SetLastError (dwErrCode=0x12) [0257.087] GetLastError () returned 0x0 [0257.087] SetLastError (dwErrCode=0x0) [0257.087] GetLastError () returned 0x0 [0257.088] SetLastError (dwErrCode=0x0) [0257.088] GetLastError () returned 0x0 [0257.088] SetLastError (dwErrCode=0x0) [0257.088] GetLastError () returned 0x0 [0257.088] SetLastError (dwErrCode=0x0) [0257.088] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0257.088] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="local", len=0x5 | out: pbstr=0x7ffa00*="local") returned 1 [0257.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0257.088] GetLastError () returned 0x0 [0257.088] SetLastError (dwErrCode=0x0) [0257.088] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpUsedDefaultChar=0x0) returned 35 [0257.088] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0257.088] GetLastError () returned 0x0 [0257.088] SetLastError (dwErrCode=0x0) [0257.088] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb8e8, cbMultiByte=35, lpWideCharStr=0xadb4a8, cchWideChar=35 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local") returned 35 [0257.088] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x24d19e0 [0257.088] FindNextFileW (in: hFindFile=0x24d19e0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0257.088] GetLastError () returned 0x12 [0257.088] FindClose (in: hFindFile=0x24d19e0 | out: hFindFile=0x24d19e0) returned 1 [0257.088] GetLastError () returned 0x12 [0257.089] SetLastError (dwErrCode=0x12) [0257.089] GetLastError () returned 0x12 [0257.089] SetLastError (dwErrCode=0x12) [0257.089] GetLastError () returned 0x0 [0257.089] SetLastError (dwErrCode=0x0) [0257.089] GetLastError () returned 0x0 [0257.089] SetLastError (dwErrCode=0x0) [0257.089] GetLastError () returned 0x0 [0257.089] SetLastError (dwErrCode=0x0) [0257.089] GetLastError () returned 0x0 [0257.089] SetLastError (dwErrCode=0x0) [0257.089] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0257.089] GetLastError () returned 0x0 [0257.089] SetLastError (dwErrCode=0x0) [0257.089] GetLastError () returned 0x0 [0257.089] SetLastError (dwErrCode=0x0) [0257.089] GetLastError () returned 0x0 [0257.089] SetLastError (dwErrCode=0x0) [0257.089] GetLastError () returned 0x0 [0257.090] SetLastError (dwErrCode=0x0) [0257.090] GetLastError () returned 0x0 [0257.090] SetLastError (dwErrCode=0x0) [0257.090] GetLastError () returned 0x0 [0257.090] SetLastError (dwErrCode=0x0) [0257.090] GetLastError () returned 0x0 [0257.090] SetLastError (dwErrCode=0x0) [0257.090] GetLastError () returned 0x0 [0257.090] SetLastError (dwErrCode=0x0) [0257.090] GetLastError () returned 0x0 [0257.090] SetLastError (dwErrCode=0x0) [0257.090] GetLastError () returned 0x0 [0257.090] SetLastError (dwErrCode=0x0) [0257.090] GetLastError () returned 0x0 [0257.090] SetLastError (dwErrCode=0x0) [0257.090] GetLastError () returned 0x0 [0257.090] SetLastError (dwErrCode=0x0) [0257.090] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", len=0x23 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 1 [0257.090] GetLastError () returned 0x0 [0257.090] SetLastError (dwErrCode=0x0) [0257.090] GetLastError () returned 0x0 [0257.091] SetLastError (dwErrCode=0x0) [0257.091] GetLastError () returned 0x0 [0257.091] SetLastError (dwErrCode=0x0) [0257.091] GetLastError () returned 0x0 [0257.091] SetLastError (dwErrCode=0x0) [0257.091] SysReAllocStringLen (in: pbstr=0x24d30d8*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x24d30d8*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0257.091] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x2871fe0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX") returned 0x0 [0257.093] GetLastError () returned 0x0 [0257.093] SetLastError (dwErrCode=0x0) [0257.093] GetLastError () returned 0x0 [0257.093] SetLastError (dwErrCode=0x0) [0257.093] GetLastError () returned 0x0 [0257.093] SetLastError (dwErrCode=0x0) [0257.093] SysReAllocStringLen (in: pbstr=0x7ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX", len=0x15 | out: pbstr=0x7ff970*="C:\\Users\\RDhJ0CNFevzX") returned 1 [0257.093] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX", cchLength=0x15 | out: lpsz="c:\\users\\rdhj0cnfevzx") returned 0x15 [0257.093] SysReAllocStringLen (in: pbstr=0xac57e8*=0x0, psz="c:\\users\\rdhj0cnfevzx", len=0x15 | out: pbstr=0xac57e8*="c:\\users\\rdhj0cnfevzx") returned 1 [0257.094] GetLastError () returned 0x0 [0257.094] SetLastError (dwErrCode=0x0) [0257.094] GetLastError () returned 0x0 [0257.094] SetLastError (dwErrCode=0x0) [0257.094] GetLastError () returned 0x0 [0257.094] SetLastError (dwErrCode=0x0) [0257.094] GetLastError () returned 0x0 [0257.094] SetLastError (dwErrCode=0x0) [0257.094] SysReAllocStringLen (in: pbstr=0xac57f0*=0x0, psz="c:", len=0x2 | out: pbstr=0xac57f0*="c:") returned 1 [0257.094] GetLastError () returned 0x0 [0257.094] SetLastError (dwErrCode=0x0) [0257.094] SysReAllocStringLen (in: pbstr=0xad3780*=0x0, psz="users", len=0x5 | out: pbstr=0xad3780*="users") returned 1 [0257.094] GetLastError () returned 0x0 [0257.094] SetLastError (dwErrCode=0x0) [0257.094] GetLastError () returned 0x0 [0257.094] SetLastError (dwErrCode=0x0) [0257.094] SysReAllocStringLen (in: pbstr=0xad37a0*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0xad37a0*="rdhj0cnfevzx") returned 1 [0257.095] SysReAllocStringLen (in: pbstr=0x7ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x7ffa00*="c:") returned 1 [0257.095] GetLastError () returned 0x0 [0257.095] SetLastError (dwErrCode=0x0) [0257.095] GetLastError () returned 0x0 [0257.095] SetLastError (dwErrCode=0x0) [0257.095] GetLastError () returned 0x0 [0257.095] SetLastError (dwErrCode=0x0) [0257.095] GetLastError () returned 0x0 [0257.095] SetLastError (dwErrCode=0x0) [0257.095] SysReAllocStringLen (in: pbstr=0x7ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x7ffd08*="c:\\") returned 1 [0257.095] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x7ffa00*="users") returned 1 [0257.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0257.095] GetLastError () returned 0x0 [0257.095] SetLastError (dwErrCode=0x0) [0257.095] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0257.095] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0257.095] GetLastError () returned 0x0 [0257.095] SetLastError (dwErrCode=0x0) [0257.095] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58b8, cbMultiByte=8, lpWideCharStr=0xac5878, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0257.096] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x24d1620 [0257.096] FindNextFileW (in: hFindFile=0x24d1620, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0257.096] GetLastError () returned 0x12 [0257.096] FindClose (in: hFindFile=0x24d1620 | out: hFindFile=0x24d1620) returned 1 [0257.096] GetLastError () returned 0x12 [0257.096] SetLastError (dwErrCode=0x12) [0257.096] GetLastError () returned 0x12 [0257.096] SetLastError (dwErrCode=0x12) [0257.096] GetLastError () returned 0x0 [0257.096] SetLastError (dwErrCode=0x0) [0257.096] GetLastError () returned 0x0 [0257.096] SetLastError (dwErrCode=0x0) [0257.096] GetLastError () returned 0x0 [0257.096] SetLastError (dwErrCode=0x0) [0257.096] GetLastError () returned 0x0 [0257.096] SetLastError (dwErrCode=0x0) [0257.097] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x7ffd08*="c:\\Users\\") returned 1 [0257.097] SysReAllocStringLen (in: pbstr=0x7ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x7ffa00*="rdhj0cnfevzx") returned 1 [0257.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0257.097] GetLastError () returned 0x0 [0257.097] SetLastError (dwErrCode=0x0) [0257.097] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0xac5878, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0257.097] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0257.097] GetLastError () returned 0x0 [0257.097] SetLastError (dwErrCode=0x0) [0257.097] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=21, lpWideCharStr=0xabb8e8, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0257.097] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x24d19e0 [0257.097] FindNextFileW (in: hFindFile=0x24d19e0, lpFindFileData=0x7ffa50 | out: lpFindFileData=0x7ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0257.097] GetLastError () returned 0x12 [0257.097] FindClose (in: hFindFile=0x24d19e0 | out: hFindFile=0x24d19e0) returned 1 [0257.097] GetLastError () returned 0x12 [0257.097] SetLastError (dwErrCode=0x12) [0257.097] GetLastError () returned 0x12 [0257.097] SetLastError (dwErrCode=0x12) [0257.097] GetLastError () returned 0x0 [0257.098] SetLastError (dwErrCode=0x0) [0257.098] GetLastError () returned 0x0 [0257.098] SetLastError (dwErrCode=0x0) [0257.098] GetLastError () returned 0x0 [0257.098] SetLastError (dwErrCode=0x0) [0257.098] GetLastError () returned 0x0 [0257.098] SetLastError (dwErrCode=0x0) [0257.098] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0257.098] GetLastError () returned 0x0 [0257.098] SetLastError (dwErrCode=0x0) [0257.098] GetLastError () returned 0x0 [0257.098] SetLastError (dwErrCode=0x0) [0257.098] GetLastError () returned 0x0 [0257.098] SetLastError (dwErrCode=0x0) [0257.098] GetLastError () returned 0x0 [0257.098] SetLastError (dwErrCode=0x0) [0257.098] GetLastError () returned 0x0 [0257.098] SetLastError (dwErrCode=0x0) [0257.098] GetLastError () returned 0x0 [0257.098] SetLastError (dwErrCode=0x0) [0257.098] GetLastError () returned 0x0 [0257.098] SetLastError (dwErrCode=0x0) [0257.099] GetLastError () returned 0x0 [0257.099] SetLastError (dwErrCode=0x0) [0257.099] GetLastError () returned 0x0 [0257.099] SetLastError (dwErrCode=0x0) [0257.099] GetLastError () returned 0x0 [0257.099] SetLastError (dwErrCode=0x0) [0257.099] SysReAllocStringLen (in: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX\\", psz="c:\\Users\\RDhJ0CNFevzX", len=0x15 | out: pbstr=0x7ffd08*="c:\\Users\\RDhJ0CNFevzX") returned 1 [0257.099] GetLastError () returned 0x0 [0257.099] SetLastError (dwErrCode=0x0) [0257.099] GetLastError () returned 0x0 [0257.099] SetLastError (dwErrCode=0x0) [0257.099] GetLastError () returned 0x0 [0257.099] SetLastError (dwErrCode=0x0) [0257.099] GetLastError () returned 0x0 [0257.099] SetLastError (dwErrCode=0x0) [0257.099] SysReAllocStringLen (in: pbstr=0x24d30e0*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x24d30e0*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0257.099] GetLastError () returned 0x0 [0257.099] SetLastError (dwErrCode=0x0) [0257.806] GetLastError () returned 0x0 [0257.806] SetLastError (dwErrCode=0x0) [0257.807] GetLastError () returned 0x0 [0257.807] SetLastError (dwErrCode=0x0) [0257.807] GetLastError () returned 0x0 [0257.807] SetLastError (dwErrCode=0x0) [0257.808] GetLastError () returned 0x0 [0257.808] SetLastError (dwErrCode=0x0) [0257.808] GetLastError () returned 0x0 [0257.808] SetLastError (dwErrCode=0x0) [0257.808] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0257.809] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="NtSetInformationThread") returned 0x7ffd50574ee0 [0257.809] GetCurrentThread () returned 0xfffffffffffffffe [0257.809] NtSetInformationThread (ThreadHandle=0xfffffffffffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0257.809] GetLastError () returned 0x0 [0257.809] SetLastError (dwErrCode=0x0) [0257.809] GetLastError () returned 0x0 [0257.809] SetLastError (dwErrCode=0x0) [0257.809] GetLastError () returned 0x0 [0257.809] SetLastError (dwErrCode=0x0) [0257.809] GetLastError () returned 0x0 [0257.809] GetLastError () returned 0x0 [0257.809] SetLastError (dwErrCode=0x0) [0257.809] SetLastError (dwErrCode=0x0) [0257.810] GetLastError () returned 0x0 [0257.810] SetLastError (dwErrCode=0x0) [0257.810] GetLastError () returned 0x0 [0257.810] SetLastError (dwErrCode=0x0) [0257.810] GetLastError () returned 0x0 [0257.810] SetLastError (dwErrCode=0x0) [0257.810] GetLastError () returned 0x0 [0257.810] SetLastError (dwErrCode=0x0) [0257.885] GetLastError () returned 0x0 [0257.885] SetLastError (dwErrCode=0x0) [0257.885] GetLastError () returned 0x0 [0257.885] SetLastError (dwErrCode=0x0) [0257.885] GetLastError () returned 0x0 [0257.886] SetLastError (dwErrCode=0x0) [0257.886] GetLastError () returned 0x0 [0257.886] SetLastError (dwErrCode=0x0) [0257.886] GetLastError () returned 0x0 [0257.886] SetLastError (dwErrCode=0x0) [0257.886] GetLastError () returned 0x0 [0257.886] GetLastError () returned 0x0 [0257.886] SetLastError (dwErrCode=0x0) [0257.886] SetLastError (dwErrCode=0x0) [0257.886] GetLastError () returned 0x0 [0257.887] SetLastError (dwErrCode=0x0) [0257.887] GetLastError () returned 0x0 [0257.887] SetLastError (dwErrCode=0x0) [0257.887] GetLastError () returned 0x0 [0257.887] SetLastError (dwErrCode=0x0) [0257.887] GetLastError () returned 0x0 [0257.887] SetLastError (dwErrCode=0x0) [0257.887] GetLastError () returned 0x0 [0257.887] SetLastError (dwErrCode=0x0) [0257.888] GetLastError () returned 0x0 [0257.888] SetLastError (dwErrCode=0x0) [0257.932] GetLastError () returned 0x0 [0257.932] SetLastError (dwErrCode=0x0) [0257.933] GetLastError () returned 0x0 [0257.933] SetLastError (dwErrCode=0x0) [0257.945] GetLastError () returned 0x0 [0257.945] SetLastError (dwErrCode=0x0) [0257.945] GetLastError () returned 0x0 [0257.945] SetLastError (dwErrCode=0x0) [0257.947] GetLastError () returned 0x0 [0257.947] SetLastError (dwErrCode=0x0) [0257.947] GetLastError () returned 0x0 [0257.947] SetLastError (dwErrCode=0x0) [0257.949] GetLastError () returned 0x0 [0257.949] SetLastError (dwErrCode=0x0) [0257.949] GetLastError () returned 0x0 [0257.949] SetLastError (dwErrCode=0x0) [0257.949] GetLastError () returned 0x0 [0257.949] SetLastError (dwErrCode=0x0) [0257.949] GetLastError () returned 0x0 [0257.949] SetLastError (dwErrCode=0x0) [0257.951] GetLastError () returned 0x0 [0257.951] SetLastError (dwErrCode=0x0) [0257.951] GetLastError () returned 0x0 [0257.951] SetLastError (dwErrCode=0x0) [0257.951] GetLastError () returned 0x0 [0257.951] SetLastError (dwErrCode=0x0) [0257.951] GetLastError () returned 0x0 [0257.951] SetLastError (dwErrCode=0x0) [0257.951] GetLastError () returned 0x0 [0257.951] SetLastError (dwErrCode=0x0) [0257.951] GetLastError () returned 0x0 [0257.951] SetLastError (dwErrCode=0x0) [0257.989] GetLastError () returned 0x0 [0257.989] SetLastError (dwErrCode=0x0) [0257.989] GetLastError () returned 0x0 [0257.989] SetLastError (dwErrCode=0x0) [0257.989] GetLastError () returned 0x0 [0257.990] SetLastError (dwErrCode=0x0) [0257.990] GetLastError () returned 0x0 [0257.990] SetLastError (dwErrCode=0x0) [0257.991] GetLastError () returned 0x0 [0257.991] SetLastError (dwErrCode=0x0) [0257.991] GetLastError () returned 0x0 [0257.991] SetLastError (dwErrCode=0x0) [0257.991] GetLastError () returned 0x0 [0257.991] GetLastError () returned 0x0 [0257.991] SetLastError (dwErrCode=0x0) [0257.991] SetLastError (dwErrCode=0x0) [0257.992] GetLastError () returned 0x0 [0257.992] SetLastError (dwErrCode=0x0) [0257.992] GetLastError () returned 0x0 [0257.992] SetLastError (dwErrCode=0x0) [0257.992] GetLastError () returned 0x0 [0257.992] SetLastError (dwErrCode=0x0) [0257.992] GetLastError () returned 0x0 [0257.992] SetLastError (dwErrCode=0x0) [0257.993] GetUserNameA (in: lpBuffer=0x7ff67d089ec0, pcbBuffer=0x7ff67d089eb0 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x7ff67d089eb0) returned 1 [0258.018] GetLastError () returned 0x0 [0258.018] SetLastError (dwErrCode=0x0) [0258.018] GetLastError () returned 0x0 [0258.018] GetLastError () returned 0x0 [0258.018] SetLastError (dwErrCode=0x0) [0258.018] SetLastError (dwErrCode=0x0) [0258.018] GetLastError () returned 0x0 [0258.018] SetLastError (dwErrCode=0x0) [0258.019] GetLastError () returned 0x0 [0258.019] SetLastError (dwErrCode=0x0) [0258.019] GetLastError () returned 0x0 [0258.019] SetLastError (dwErrCode=0x0) [0258.019] GetLastError () returned 0x0 [0258.019] SetLastError (dwErrCode=0x0) [0258.019] GetLastError () returned 0x0 [0258.019] SetLastError (dwErrCode=0x0) [0258.019] GetLastError () returned 0x0 [0258.019] SetLastError (dwErrCode=0x0) [0258.019] GetComputerNameA (in: lpBuffer=0x7ff67d089fe0, nSize=0x7ff67d089fd0 | out: lpBuffer="XC64ZB", nSize=0x7ff67d089fd0) returned 1 [0258.019] GetLastError () returned 0xcb [0258.019] SetLastError (dwErrCode=0xcb) [0258.019] GetLastError () returned 0xcb [0258.020] GetLastError () returned 0xcb [0258.020] SetLastError (dwErrCode=0xcb) [0258.020] SetLastError (dwErrCode=0xcb) [0258.020] GetLastError () returned 0xcb [0258.020] SetLastError (dwErrCode=0xcb) [0258.020] GetLastError () returned 0xcb [0258.020] SetLastError (dwErrCode=0xcb) [0258.020] GetLastError () returned 0xcb [0258.020] SetLastError (dwErrCode=0xcb) [0258.020] GetLastError () returned 0xcb [0258.020] SetLastError (dwErrCode=0xcb) [0258.021] GetLastError () returned 0xcb [0258.021] SetLastError (dwErrCode=0xcb) [0258.021] GetLastError () returned 0xcb [0258.021] SetLastError (dwErrCode=0xcb) [0258.021] GetLastError () returned 0xcb [0258.021] SetLastError (dwErrCode=0xcb) [0258.021] GetLastError () returned 0xcb [0258.021] SetLastError (dwErrCode=0xcb) [0258.021] GetLastError () returned 0xcb [0258.021] GetLastError () returned 0xcb [0258.021] SetLastError (dwErrCode=0xcb) [0258.021] SetLastError (dwErrCode=0xcb) [0258.021] GetLastError () returned 0xcb [0258.022] SetLastError (dwErrCode=0xcb) [0258.022] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb948, cbMultiByte=43, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0258.022] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xabb948, cbMultiByte=43, lpWideCharStr=0xae5c58, cchWideChar=43 | out: lpWideCharStr="Software\\Enigma Protector\\%.8x%.8x-%.8x%.8x") returned 43 [0258.022] GetLastError () returned 0x0 [0258.022] SetLastError (dwErrCode=0x0) [0258.022] GetLastError () returned 0x0 [0258.022] SetLastError (dwErrCode=0x0) [0258.022] GetLastError () returned 0x0 [0258.022] SetLastError (dwErrCode=0x0) [0258.023] SysReAllocStringLen (in: pbstr=0x7ffe00*=0x0, psz="Software\\Enigma Protector\\", len=0x1a | out: pbstr=0x7ffe00*="Software\\Enigma Protector\\") returned 1 [0258.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0258.023] GetLastError () returned 0x0 [0258.023] SetLastError (dwErrCode=0x0) [0258.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0xac57f8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8", lpUsedDefaultChar=0x0) returned 1 [0258.023] GetLastError () returned 0x0 [0258.023] SetLastError (dwErrCode=0x0) [0258.023] GetLastError () returned 0x0 [0258.023] SetLastError (dwErrCode=0x0) [0258.023] GetLastError () returned 0x0 [0258.023] SetLastError (dwErrCode=0x0) [0258.023] CharUpperBuffW (in: lpsz="x", cchLength=0x1 | out: lpsz="X") returned 0x1 [0258.023] GetLastError () returned 0x0 [0258.023] SetLastError (dwErrCode=0x0) [0258.023] GetLastError () returned 0x0 [0258.023] SetLastError (dwErrCode=0x0) [0258.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0258.023] GetLastError () returned 0x0 [0258.023] SetLastError (dwErrCode=0x0) [0258.023] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0xac57f8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0258.023] GetLastError () returned 0x0 [0258.023] SetLastError (dwErrCode=0x0) [0258.024] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ffb91, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0258.024] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ffb91, cbMultiByte=8, lpWideCharStr=0x24d24e8, cchWideChar=8 | out: lpWideCharStr="29AEB4A0") returned 8 [0258.024] SysReAllocStringLen (in: pbstr=0x7ffcc0*=0x0, psz="29AEB4A0", len=0x8 | out: pbstr=0x7ffcc0*="29AEB4A0") returned 1 [0258.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0258.024] GetLastError () returned 0x0 [0258.024] SetLastError (dwErrCode=0x0) [0258.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0xac57f8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8", lpUsedDefaultChar=0x0) returned 1 [0258.024] GetLastError () returned 0x0 [0258.024] SetLastError (dwErrCode=0x0) [0258.024] GetLastError () returned 0x0 [0258.024] SetLastError (dwErrCode=0x0) [0258.024] GetLastError () returned 0x0 [0258.024] SetLastError (dwErrCode=0x0) [0258.024] CharUpperBuffW (in: lpsz="x", cchLength=0x1 | out: lpsz="X") returned 0x1 [0258.024] GetLastError () returned 0x0 [0258.024] SetLastError (dwErrCode=0x0) [0258.024] GetLastError () returned 0x0 [0258.024] SetLastError (dwErrCode=0x0) [0258.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0258.024] GetLastError () returned 0x0 [0258.024] SetLastError (dwErrCode=0x0) [0258.024] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0xac57f8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0258.024] GetLastError () returned 0x0 [0258.024] SetLastError (dwErrCode=0x0) [0258.025] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ffb91, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0258.025] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ffb91, cbMultiByte=8, lpWideCharStr=0x24d2548, cchWideChar=8 | out: lpWideCharStr="365755F6") returned 8 [0258.025] SysReAllocStringLen (in: pbstr=0x7ffcc0*="29AEB4A0", psz="365755F6", len=0x8 | out: pbstr=0x7ffcc0*="365755F6") returned 1 [0258.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0258.025] GetLastError () returned 0x0 [0258.025] SetLastError (dwErrCode=0x0) [0258.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0xac57f8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8", lpUsedDefaultChar=0x0) returned 1 [0258.025] GetLastError () returned 0x0 [0258.025] SetLastError (dwErrCode=0x0) [0258.025] GetLastError () returned 0x0 [0258.025] SetLastError (dwErrCode=0x0) [0258.025] GetLastError () returned 0x0 [0258.025] SetLastError (dwErrCode=0x0) [0258.025] CharUpperBuffW (in: lpsz="x", cchLength=0x1 | out: lpsz="X") returned 0x1 [0258.025] GetLastError () returned 0x0 [0258.025] SetLastError (dwErrCode=0x0) [0258.025] GetLastError () returned 0x0 [0258.025] SetLastError (dwErrCode=0x0) [0258.025] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0258.025] GetLastError () returned 0x0 [0258.026] SetLastError (dwErrCode=0x0) [0258.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0xac57f8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0258.026] GetLastError () returned 0x0 [0258.026] SetLastError (dwErrCode=0x0) [0258.026] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ffb91, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0258.026] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ffb91, cbMultiByte=8, lpWideCharStr=0x24d2548, cchWideChar=8 | out: lpWideCharStr="B862CAE9") returned 8 [0258.026] SysReAllocStringLen (in: pbstr=0x7ffcc0*="365755F6", psz="B862CAE9", len=0x8 | out: pbstr=0x7ffcc0*="B862CAE9") returned 1 [0258.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0258.026] GetLastError () returned 0x0 [0258.026] SetLastError (dwErrCode=0x0) [0258.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0xac57f8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8", lpUsedDefaultChar=0x0) returned 1 [0258.026] GetLastError () returned 0x0 [0258.026] SetLastError (dwErrCode=0x0) [0258.026] GetLastError () returned 0x0 [0258.026] SetLastError (dwErrCode=0x0) [0258.026] GetLastError () returned 0x0 [0258.026] SetLastError (dwErrCode=0x0) [0258.026] CharUpperBuffW (in: lpsz="x", cchLength=0x1 | out: lpsz="X") returned 0x1 [0258.026] GetLastError () returned 0x0 [0258.026] SetLastError (dwErrCode=0x0) [0258.026] GetLastError () returned 0x0 [0258.026] SetLastError (dwErrCode=0x0) [0258.026] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0258.026] GetLastError () returned 0x0 [0258.026] SetLastError (dwErrCode=0x0) [0258.027] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0xac57f8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0258.027] GetLastError () returned 0x0 [0258.027] SetLastError (dwErrCode=0x0) [0258.027] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ffb91, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0258.027] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ffb91, cbMultiByte=8, lpWideCharStr=0x24d24e8, cchWideChar=8 | out: lpWideCharStr="84EA4D0E") returned 8 [0258.027] SysReAllocStringLen (in: pbstr=0x7ffcc0*="B862CAE9", psz="84EA4D0E", len=0x8 | out: pbstr=0x7ffcc0*="84EA4D0E") returned 1 [0258.027] GetLastError () returned 0x0 [0258.027] SetLastError (dwErrCode=0x0) [0258.027] GetLastError () returned 0x0 [0258.027] GetLastError () returned 0x0 [0258.027] SetLastError (dwErrCode=0x0) [0258.027] SetLastError (dwErrCode=0x0) [0258.027] GetLastError () returned 0x0 [0258.028] SetLastError (dwErrCode=0x0) [0258.028] SysReAllocStringLen (in: pbstr=0x27f0608*=0x0, psz="Software\\Enigma Protector\\29AEB4A0365755F6-B862CAE984EA4D0E", len=0x3b | out: pbstr=0x27f0608*="Software\\Enigma Protector\\29AEB4A0365755F6-B862CAE984EA4D0E") returned 1 [0258.068] GetLastError () returned 0x0 [0258.068] SetLastError (dwErrCode=0x0) [0258.068] GetLastError () returned 0x0 [0258.068] SetLastError (dwErrCode=0x0) [0258.068] GetLastError () returned 0x0 [0258.068] SetLastError (dwErrCode=0x0) [0258.068] GetWindowsDirectoryA (in: lpBuffer=0x7ffb30, uSize=0x105 | out: lpBuffer="C:\\Windows") returned 0xa [0258.068] GetLastError () returned 0x0 [0258.069] SetLastError (dwErrCode=0x0) [0258.069] GetLastError () returned 0x0 [0258.069] SetLastError (dwErrCode=0x0) [0258.069] GetLastError () returned 0x0 [0258.069] SetLastError (dwErrCode=0x0) [0258.069] GetLastError () returned 0x0 [0258.069] SetLastError (dwErrCode=0x0) [0258.069] CreateFileA (lpFileName="\\\\.\\C:" (normalized: "c:"), dwDesiredAccess=0x0, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0258.069] GetLastError () returned 0x0 [0258.069] SetLastError (dwErrCode=0x0) [0258.069] DeviceIoControl (in: hDevice=0x1e8, dwIoControlCode=0x2d1400, lpInBuffer=0x7ffc50*, nInBufferSize=0xc, lpOutBuffer=0x2811db0, nOutBufferSize=0x2710, lpBytesReturned=0x7ffc48, lpOverlapped=0x0 | out: lpInBuffer=0x7ffc50*, lpOutBuffer=0x2811db0*, lpBytesReturned=0x7ffc48*=0x148, lpOverlapped=0x0) returned 1 [0258.069] GetLastError () returned 0x0 [0258.069] SetLastError (dwErrCode=0x0) [0258.069] GetLastError () returned 0x0 [0258.070] SetLastError (dwErrCode=0x0) [0258.070] GetLastError () returned 0x0 [0258.070] SetLastError (dwErrCode=0x0) [0258.070] GetLastError () returned 0x0 [0258.070] SetLastError (dwErrCode=0x0) [0258.070] GetLastError () returned 0x0 [0258.070] SetLastError (dwErrCode=0x0) [0258.070] CloseHandle (hObject=0x1e8) returned 1 [0258.070] GetLastError () returned 0x0 [0258.070] SetLastError (dwErrCode=0x0) [0258.070] GetLastError () returned 0x0 [0258.070] SetLastError (dwErrCode=0x0) [0258.070] GetLastError () returned 0x0 [0258.070] SetLastError (dwErrCode=0x0) [0258.070] GetLastError () returned 0x0 [0258.070] SetLastError (dwErrCode=0x0) [0258.070] GetLastError () returned 0x0 [0258.070] SetLastError (dwErrCode=0x0) [0258.071] GetLastError () returned 0x0 [0258.071] SetLastError (dwErrCode=0x0) [0258.071] GetLastError () returned 0x0 [0258.071] SetLastError (dwErrCode=0x0) [0258.071] GetLastError () returned 0x0 [0258.071] SetLastError (dwErrCode=0x0) [0258.071] GetLastError () returned 0x0 [0258.071] SetLastError (dwErrCode=0x0) [0258.071] GetLastError () returned 0x0 [0258.071] GetLastError () returned 0x0 [0258.071] SetLastError (dwErrCode=0x0) [0258.071] SetLastError (dwErrCode=0x0) [0258.071] GetLastError () returned 0x0 [0258.071] SetLastError (dwErrCode=0x0) [0258.072] GetLastError () returned 0x0 [0258.072] SetLastError (dwErrCode=0x0) [0258.072] GetLastError () returned 0x0 [0258.072] SetLastError (dwErrCode=0x0) [0258.072] GetLastError () returned 0x0 [0258.072] SetLastError (dwErrCode=0x0) [0258.072] GetLastError () returned 0x0 [0258.072] SetLastError (dwErrCode=0x0) [0258.072] GetLastError () returned 0x0 [0258.073] GetLastError () returned 0x0 [0258.073] SetLastError (dwErrCode=0x0) [0258.073] SetLastError (dwErrCode=0x0) [0258.073] GetLastError () returned 0x0 [0258.073] SetLastError (dwErrCode=0x0) [0258.073] GetCurrentProcessId () returned 0x115c [0258.073] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x115c) returned 0x1ec [0258.077] Module32First (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.078] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.079] GetLastError () returned 0x0 [0258.079] SetLastError (dwErrCode=0x0) [0258.079] GetProcessHeap () returned 0x8f0000 [0258.079] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x8000) returned 0x28b4590 [0258.080] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.081] GetLastError () returned 0x0 [0258.081] SetLastError (dwErrCode=0x0) [0258.081] GetLastError () returned 0x0 [0258.081] SetLastError (dwErrCode=0x0) [0258.081] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.082] GetLastError () returned 0x0 [0258.082] SetLastError (dwErrCode=0x0) [0258.082] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.083] GetLastError () returned 0x0 [0258.084] SetLastError (dwErrCode=0x0) [0258.084] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.084] GetLastError () returned 0x0 [0258.084] SetLastError (dwErrCode=0x0) [0258.084] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.085] GetLastError () returned 0x0 [0258.086] SetLastError (dwErrCode=0x0) [0258.086] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.086] GetLastError () returned 0x0 [0258.086] SetLastError (dwErrCode=0x0) [0258.087] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.087] GetLastError () returned 0x0 [0258.087] SetLastError (dwErrCode=0x0) [0258.087] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.088] GetLastError () returned 0x0 [0258.088] SetLastError (dwErrCode=0x0) [0258.088] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.089] GetLastError () returned 0x0 [0258.089] SetLastError (dwErrCode=0x0) [0258.089] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.090] GetLastError () returned 0x0 [0258.090] SetLastError (dwErrCode=0x0) [0258.090] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.091] GetLastError () returned 0x0 [0258.091] SetLastError (dwErrCode=0x0) [0258.091] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.092] GetLastError () returned 0x0 [0258.092] SetLastError (dwErrCode=0x0) [0258.092] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.093] GetLastError () returned 0x0 [0258.093] SetLastError (dwErrCode=0x0) [0258.093] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.094] GetLastError () returned 0x0 [0258.094] SetLastError (dwErrCode=0x0) [0258.094] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.095] GetLastError () returned 0x0 [0258.095] SetLastError (dwErrCode=0x0) [0258.095] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.096] GetLastError () returned 0x0 [0258.096] SetLastError (dwErrCode=0x0) [0258.096] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.096] GetLastError () returned 0x0 [0258.096] SetLastError (dwErrCode=0x0) [0258.096] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.097] GetLastError () returned 0x0 [0258.097] SetLastError (dwErrCode=0x0) [0258.097] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.098] GetLastError () returned 0x0 [0258.098] SetLastError (dwErrCode=0x0) [0258.098] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.099] GetLastError () returned 0x0 [0258.099] SetLastError (dwErrCode=0x0) [0258.099] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.101] GetLastError () returned 0x0 [0258.101] SetLastError (dwErrCode=0x0) [0258.101] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.102] GetLastError () returned 0x0 [0258.102] SetLastError (dwErrCode=0x0) [0258.102] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.103] GetLastError () returned 0x0 [0258.103] SetLastError (dwErrCode=0x0) [0258.103] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.104] GetLastError () returned 0x0 [0258.104] SetLastError (dwErrCode=0x0) [0258.104] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.104] GetLastError () returned 0x0 [0258.104] SetLastError (dwErrCode=0x0) [0258.104] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.105] GetLastError () returned 0x0 [0258.105] SetLastError (dwErrCode=0x0) [0258.105] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.106] GetLastError () returned 0x0 [0258.106] SetLastError (dwErrCode=0x0) [0258.106] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.138] GetLastError () returned 0x0 [0258.138] SetLastError (dwErrCode=0x0) [0258.138] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 1 [0258.139] GetLastError () returned 0x0 [0258.139] SetLastError (dwErrCode=0x0) [0258.139] Module32Next (hSnapshot=0x1ec, lpme=0x7ffb08) returned 0 [0258.140] CloseHandle (hObject=0x1ec) returned 1 [0258.140] GetLastError () returned 0x12 [0258.140] SetLastError (dwErrCode=0x12) [0258.140] GetLastError () returned 0x12 [0258.140] SetLastError (dwErrCode=0x12) [0258.140] GetLastError () returned 0x12 [0258.140] SetLastError (dwErrCode=0x12) [0258.140] GetLastError () returned 0x12 [0258.141] SetLastError (dwErrCode=0x12) [0258.141] GetLastError () returned 0x12 [0258.141] GetLastError () returned 0x12 [0258.141] SetLastError (dwErrCode=0x12) [0258.141] SetLastError (dwErrCode=0x12) [0258.141] GetLastError () returned 0x12 [0258.141] SetLastError (dwErrCode=0x12) [0258.141] GetLastError () returned 0x12 [0258.141] SetLastError (dwErrCode=0x12) [0258.141] GetLastError () returned 0x12 [0258.141] SetLastError (dwErrCode=0x12) [0258.141] GetLastError () returned 0x12 [0258.141] SetLastError (dwErrCode=0x12) [0258.141] GetLastError () returned 0x12 [0258.142] SetLastError (dwErrCode=0x12) [0258.142] GetLastError () returned 0x12 [0258.142] GetLastError () returned 0x12 [0258.142] SetLastError (dwErrCode=0x12) [0258.142] SetLastError (dwErrCode=0x12) [0258.142] GetLastError () returned 0x12 [0258.142] SetLastError (dwErrCode=0x12) [0258.142] GetLastError () returned 0x12 [0258.142] SetLastError (dwErrCode=0x12) [0258.142] GetLastError () returned 0x12 [0258.142] SetLastError (dwErrCode=0x12) [0258.142] GetLastError () returned 0x12 [0258.143] SetLastError (dwErrCode=0x12) [0258.143] GetLastError () returned 0x12 [0258.143] SetLastError (dwErrCode=0x12) [0258.143] GetLastError () returned 0x12 [0258.143] GetLastError () returned 0x12 [0258.143] SetLastError (dwErrCode=0x12) [0258.143] SetLastError (dwErrCode=0x12) [0258.143] GetLastError () returned 0x12 [0258.143] SetLastError (dwErrCode=0x12) [0258.143] GetLastError () returned 0x12 [0258.143] SetLastError (dwErrCode=0x12) [0258.143] GetLastError () returned 0x12 [0258.144] SetLastError (dwErrCode=0x12) [0258.144] GetLastError () returned 0x12 [0258.144] SetLastError (dwErrCode=0x12) [0258.144] GetLastError () returned 0x12 [0258.144] SetLastError (dwErrCode=0x12) [0258.144] GetLastError () returned 0x12 [0258.144] GetLastError () returned 0x12 [0258.144] SetLastError (dwErrCode=0x12) [0258.144] SetLastError (dwErrCode=0x12) [0258.144] GetLastError () returned 0x12 [0258.144] SetLastError (dwErrCode=0x12) [0258.144] GetLastError () returned 0x12 [0258.144] SetLastError (dwErrCode=0x12) [0258.145] GetLastError () returned 0x12 [0258.145] SetLastError (dwErrCode=0x12) [0258.145] GetLastError () returned 0x12 [0258.145] SetLastError (dwErrCode=0x12) [0258.145] GetLastError () returned 0x12 [0258.145] SetLastError (dwErrCode=0x12) [0258.145] GetLastError () returned 0x12 [0258.145] GetLastError () returned 0x12 [0258.145] SetLastError (dwErrCode=0x12) [0258.145] SetLastError (dwErrCode=0x12) [0258.145] GetLastError () returned 0x12 [0258.145] SetLastError (dwErrCode=0x12) [0258.145] GetLastError () returned 0x12 [0258.146] SetLastError (dwErrCode=0x12) [0258.146] GetLastError () returned 0x12 [0258.146] SetLastError (dwErrCode=0x12) [0258.146] GetLastError () returned 0x12 [0258.146] SetLastError (dwErrCode=0x12) [0258.146] GetLastError () returned 0x12 [0258.146] SetLastError (dwErrCode=0x12) [0258.146] GetLastError () returned 0x12 [0258.146] GetLastError () returned 0x12 [0258.146] SetLastError (dwErrCode=0x12) [0258.146] SetLastError (dwErrCode=0x12) [0258.146] GetLastError () returned 0x12 [0258.146] SetLastError (dwErrCode=0x12) [0258.146] GetLastError () returned 0x12 [0258.146] SetLastError (dwErrCode=0x12) [0258.147] GetLastError () returned 0x12 [0258.147] SetLastError (dwErrCode=0x12) [0258.147] GetLastError () returned 0x12 [0258.147] SetLastError (dwErrCode=0x12) [0258.147] GetLastError () returned 0x12 [0258.147] SetLastError (dwErrCode=0x12) [0258.147] GetLastError () returned 0x12 [0258.147] SetLastError (dwErrCode=0x12) [0258.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SOFTWARE\\EnigmaDevelopers", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0258.147] GetLastError () returned 0x0 [0258.147] SetLastError (dwErrCode=0x0) [0258.147] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SOFTWARE\\EnigmaDevelopers", cchWideChar=25, lpMultiByteStr=0xac5938, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SOFTWARE\\EnigmaDevelopers", lpUsedDefaultChar=0x0) returned 25 [0258.147] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\EnigmaDevelopers", ulOptions=0x0, samDesired=0x20019, phkResult=0x7ffb68 | out: phkResult=0x7ffb68*=0x0) returned 0x2 [0258.147] GetLastError () returned 0x0 [0258.147] SetLastError (dwErrCode=0x0) [0258.147] GetLastError () returned 0x0 [0258.148] SetLastError (dwErrCode=0x0) [0258.148] GetLastError () returned 0x0 [0258.148] SetLastError (dwErrCode=0x0) [0258.148] GetLastError () returned 0x0 [0258.148] SetLastError (dwErrCode=0x0) [0258.148] GetLastError () returned 0x0 [0258.148] GetLastError () returned 0x0 [0258.148] SetLastError (dwErrCode=0x0) [0258.148] SetLastError (dwErrCode=0x0) [0258.148] GetLastError () returned 0x0 [0258.148] SetLastError (dwErrCode=0x0) [0258.148] GetLastError () returned 0x0 [0258.148] SetLastError (dwErrCode=0x0) [0258.148] GetLastError () returned 0x0 [0258.148] SetLastError (dwErrCode=0x0) [0258.149] GetLastError () returned 0x0 [0258.149] SetLastError (dwErrCode=0x0) [0258.149] GetLastError () returned 0x0 [0258.149] SetLastError (dwErrCode=0x0) [0258.149] GetLocalTime (in: lpSystemTime=0x7ffc40 | out: lpSystemTime=0x7ffc40*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2a, wSecond=0x2f, wMilliseconds=0x1)) [0258.149] GetLocalTime (in: lpSystemTime=0x7ffc40 | out: lpSystemTime=0x7ffc40*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2a, wSecond=0x2f, wMilliseconds=0x1)) [0258.149] GetLastError () returned 0x0 [0258.149] SetLastError (dwErrCode=0x0) [0258.149] GetLastError () returned 0x0 [0258.149] SetLastError (dwErrCode=0x0) [0258.149] GetLastError () returned 0x0 [0258.149] SetLastError (dwErrCode=0x0) [0258.149] GetLastError () returned 0x0 [0258.149] SetLastError (dwErrCode=0x0) [0258.149] GetLastError () returned 0x0 [0258.149] SetLastError (dwErrCode=0x0) [0258.149] GetLastError () returned 0x0 [0258.149] SetLastError (dwErrCode=0x0) [0258.149] GetLastError () returned 0x0 [0258.149] SetLastError (dwErrCode=0x0) [0258.149] GetLastError () returned 0x0 [0258.150] SetLastError (dwErrCode=0x0) [0258.150] GetLastError () returned 0x0 [0258.150] SetLastError (dwErrCode=0x0) [0258.150] GetLastError () returned 0x0 [0258.150] SetLastError (dwErrCode=0x0) [0258.150] GetLastError () returned 0x0 [0258.150] SetLastError (dwErrCode=0x0) [0258.150] GetLastError () returned 0x0 [0258.150] SetLastError (dwErrCode=0x0) [0258.150] GetLastError () returned 0x0 [0258.150] SetLastError (dwErrCode=0x0) [0258.150] GetLastError () returned 0x0 [0258.150] SetLastError (dwErrCode=0x0) [0258.150] GetLastError () returned 0x0 [0258.150] SetLastError (dwErrCode=0x0) [0258.150] GetLastError () returned 0x0 [0258.150] SetLastError (dwErrCode=0x0) [0258.150] GetLastError () returned 0x0 [0258.150] SetLastError (dwErrCode=0x0) [0258.150] GetLastError () returned 0x0 [0258.150] SetLastError (dwErrCode=0x0) [0258.150] GetLastError () returned 0x0 [0258.150] SetLastError (dwErrCode=0x0) [0258.150] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.151] GetLastError () returned 0x0 [0258.151] SetLastError (dwErrCode=0x0) [0258.152] GetLastError () returned 0x0 [0258.152] SetLastError (dwErrCode=0x0) [0258.152] GetLastError () returned 0x0 [0258.152] SetLastError (dwErrCode=0x0) [0258.152] GetLastError () returned 0x0 [0258.152] SetLastError (dwErrCode=0x0) [0258.152] GetLastError () returned 0x0 [0258.152] SetLastError (dwErrCode=0x0) [0258.152] GetLastError () returned 0x0 [0258.152] SetLastError (dwErrCode=0x0) [0258.152] GetLastError () returned 0x0 [0258.152] SetLastError (dwErrCode=0x0) [0258.152] GetLastError () returned 0x0 [0258.152] SetLastError (dwErrCode=0x0) [0258.152] GetLastError () returned 0x0 [0258.152] SetLastError (dwErrCode=0x0) [0258.152] GetLastError () returned 0x0 [0258.152] SetLastError (dwErrCode=0x0) [0258.152] GetLastError () returned 0x0 [0258.152] SetLastError (dwErrCode=0x0) [0258.152] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0258.152] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac58f8, cbMultiByte=8, lpWideCharStr=0x24d24e8, cchWideChar=8 | out: lpWideCharStr="80EB2F5C") returned 8 [0258.153] GetLocalTime (in: lpSystemTime=0x7ffae0 | out: lpSystemTime=0x7ffae0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2a, wSecond=0x2f, wMilliseconds=0x5)) [0258.153] GetLocalTime (in: lpSystemTime=0x7ffae0 | out: lpSystemTime=0x7ffae0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2a, wSecond=0x2f, wMilliseconds=0x5)) [0258.153] GetLocalTime (in: lpSystemTime=0x7ffae0 | out: lpSystemTime=0x7ffae0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2a, wSecond=0x2f, wMilliseconds=0x5)) [0258.153] GetLastError () returned 0x0 [0258.153] SetLastError (dwErrCode=0x0) [0258.153] GetLastError () returned 0x0 [0258.153] SetLastError (dwErrCode=0x0) [0258.153] RegOpenKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Enigma Protector\\29AEB4A0365755F6-B862CAE984EA4D0E\\02F01F553A112DCE-00C9DB38C18D5FD1", ulOptions=0x0, samDesired=0x20019, phkResult=0x7ffa98 | out: phkResult=0x7ffa98*=0x0) returned 0x2 [0258.153] GetLastError () returned 0x0 [0258.153] SetLastError (dwErrCode=0x0) [0258.153] GetLastError () returned 0x0 [0258.153] SetLastError (dwErrCode=0x0) [0258.153] CreateFileW (lpFileName="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\80EB2F5C" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\80eb2f5c"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0258.153] GetLocalTime (in: lpSystemTime=0x7ffae0 | out: lpSystemTime=0x7ffae0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2a, wSecond=0x2f, wMilliseconds=0x6)) [0258.153] GetLastError () returned 0x0 [0258.154] SetLastError (dwErrCode=0x0) [0258.154] GetLastError () returned 0x0 [0258.154] SetLastError (dwErrCode=0x0) [0258.154] GetLastError () returned 0x0 [0258.154] SetLastError (dwErrCode=0x0) [0258.154] GetLastError () returned 0x0 [0258.154] GetLastError () returned 0x0 [0258.154] SetLastError (dwErrCode=0x0) [0258.154] SetLastError (dwErrCode=0x0) [0258.154] GetLastError () returned 0x0 [0258.154] SetLastError (dwErrCode=0x0) [0258.154] GetLocalTime (in: lpSystemTime=0x7ffcd0 | out: lpSystemTime=0x7ffcd0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2a, wSecond=0x2f, wMilliseconds=0x6)) [0258.154] GetLastError () returned 0x0 [0258.154] SetLastError (dwErrCode=0x0) [0258.154] GetLastError () returned 0x0 [0258.154] SetLastError (dwErrCode=0x0) [0258.155] GetLastError () returned 0x0 [0258.155] SetLastError (dwErrCode=0x0) [0258.155] GetLastError () returned 0x0 [0258.155] SetLastError (dwErrCode=0x0) [0258.155] GetLastError () returned 0x0 [0258.155] SetLastError (dwErrCode=0x0) [0258.155] GetLastError () returned 0x0 [0258.155] GetLastError () returned 0x0 [0258.155] SetLastError (dwErrCode=0x0) [0258.155] SetLastError (dwErrCode=0x0) [0258.155] GetLastError () returned 0x0 [0258.155] SetLastError (dwErrCode=0x0) [0258.155] GetLastError () returned 0x0 [0258.156] SetLastError (dwErrCode=0x0) [0258.156] GetLastError () returned 0x0 [0258.156] SetLastError (dwErrCode=0x0) [0258.156] GetLastError () returned 0x0 [0258.156] SetLastError (dwErrCode=0x0) [0258.156] GetLastError () returned 0x0 [0258.156] SetLastError (dwErrCode=0x0) [0258.156] GetLastError () returned 0x0 [0258.156] GetLastError () returned 0x0 [0258.156] SetLastError (dwErrCode=0x0) [0258.156] SetLastError (dwErrCode=0x0) [0258.156] GetLastError () returned 0x0 [0258.156] SetLastError (dwErrCode=0x0) [0258.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x7ff67cd80640, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x7ffd40 | out: lpThreadId=0x7ffd40*=0x4ec) returned 0x1ec [0258.158] GetLastError () returned 0x0 [0258.158] SetLastError (dwErrCode=0x0) [0258.158] GetLastError () returned 0x0 [0258.158] SetLastError (dwErrCode=0x0) [0258.158] GetLastError () returned 0x0 [0258.158] SetLastError (dwErrCode=0x0) [0258.158] GetLastError () returned 0x0 [0258.158] SetLastError (dwErrCode=0x0) [0258.158] GetLastError () returned 0x0 [0258.158] GetLastError () returned 0x0 [0258.158] SetLastError (dwErrCode=0x0) [0258.158] SetLastError (dwErrCode=0x0) [0258.158] GetLastError () returned 0x0 [0258.158] SetLastError (dwErrCode=0x0) [0258.158] GetCurrentProcessId () returned 0x115c [0258.158] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x115c) returned 0x1f0 [0258.162] Module32First (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.163] GetLastError () returned 0x0 [0258.163] SetLastError (dwErrCode=0x0) [0258.163] GetLastError () returned 0x0 [0258.163] SetLastError (dwErrCode=0x0) [0258.163] GetLastError () returned 0x0 [0258.163] SetLastError (dwErrCode=0x0) [0258.163] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.164] GetLastError () returned 0x0 [0258.164] SetLastError (dwErrCode=0x0) [0258.164] GetLastError () returned 0x0 [0258.164] SetLastError (dwErrCode=0x0) [0258.164] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.165] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.165] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.165] GetLastError () returned 0x0 [0258.165] SetLastError (dwErrCode=0x0) [0258.165] GetLastError () returned 0x0 [0258.165] SetLastError (dwErrCode=0x0) [0258.166] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.166] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.174] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c208, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.174] VirtualAlloc (lpAddress=0x7ffd4e1c0000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0258.175] VirtualAlloc (lpAddress=0x7ffd4e1d0000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0258.175] VirtualAlloc (lpAddress=0x7ffd4e1e0000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0258.175] VirtualAlloc (lpAddress=0x7ffd4e1f0000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0258.175] VirtualAlloc (lpAddress=0x7ffd4e200000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0258.175] VirtualAlloc (lpAddress=0x7ffd4e210000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0258.175] VirtualAlloc (lpAddress=0x7ffd4e220000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0258.175] VirtualAlloc (lpAddress=0x7ffd4e230000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0258.175] VirtualAlloc (lpAddress=0x7ffd4e240000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0258.175] VirtualAlloc (lpAddress=0x7ffd4e250000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0258.175] VirtualAlloc (lpAddress=0x7ffd4e260000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0258.175] VirtualAlloc (lpAddress=0x7ffd4e270000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x7ffd4e270000 [0258.175] VirtualAlloc (lpAddress=0x7ffd4e270000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x40) returned 0x7ffd4e270000 [0258.176] GetLastError () returned 0x1e7 [0258.176] SetLastError (dwErrCode=0x1e7) [0258.176] GetLastError () returned 0x1e7 [0258.176] SetLastError (dwErrCode=0x1e7) [0258.176] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd5077f, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.177] GetCurrentProcess () returned 0xffffffffffffffff [0258.177] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c208, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.177] GetCurrentProcess () returned 0xffffffffffffffff [0258.177] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c2f8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.177] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.177] GetCurrentProcess () returned 0xffffffffffffffff [0258.177] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c2f8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.178] GetCurrentProcess () returned 0xffffffffffffffff [0258.178] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c2fc, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.178] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.178] GetCurrentProcess () returned 0xffffffffffffffff [0258.178] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c2fc, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.178] GetCurrentProcess () returned 0xffffffffffffffff [0258.178] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c30c, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.178] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.178] GetCurrentProcess () returned 0xffffffffffffffff [0258.178] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c30c, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.178] GetCurrentProcess () returned 0xffffffffffffffff [0258.179] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c318, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.179] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.179] GetCurrentProcess () returned 0xffffffffffffffff [0258.179] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c318, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.179] GetCurrentProcess () returned 0xffffffffffffffff [0258.179] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c6a8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.179] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.179] GetCurrentProcess () returned 0xffffffffffffffff [0258.179] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c6a8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.179] GetCurrentProcess () returned 0xffffffffffffffff [0258.179] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c6b8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.180] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.180] GetCurrentProcess () returned 0xffffffffffffffff [0258.180] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c6b8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.180] GetCurrentProcess () returned 0xffffffffffffffff [0258.180] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c754, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.180] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.180] GetCurrentProcess () returned 0xffffffffffffffff [0258.180] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c754, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.180] GetCurrentProcess () returned 0xffffffffffffffff [0258.180] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c758, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.181] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.181] GetCurrentProcess () returned 0xffffffffffffffff [0258.181] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c758, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.181] GetCurrentProcess () returned 0xffffffffffffffff [0258.181] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c858, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.181] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.181] GetCurrentProcess () returned 0xffffffffffffffff [0258.181] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c858, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.181] GetCurrentProcess () returned 0xffffffffffffffff [0258.181] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c85c, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.182] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.182] GetCurrentProcess () returned 0xffffffffffffffff [0258.182] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c85c, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.182] GetCurrentProcess () returned 0xffffffffffffffff [0258.182] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c924, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.182] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.182] GetCurrentProcess () returned 0xffffffffffffffff [0258.182] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c924, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.182] GetCurrentProcess () returned 0xffffffffffffffff [0258.182] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c9c4, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.183] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.183] GetCurrentProcess () returned 0xffffffffffffffff [0258.183] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c9c4, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.183] GetCurrentProcess () returned 0xffffffffffffffff [0258.183] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c9d0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.183] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.183] GetCurrentProcess () returned 0xffffffffffffffff [0258.183] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24c9d0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.183] GetCurrentProcess () returned 0xffffffffffffffff [0258.183] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24caac, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.184] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.184] GetCurrentProcess () returned 0xffffffffffffffff [0258.184] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24caac, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.184] GetCurrentProcess () returned 0xffffffffffffffff [0258.184] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24cc58, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.184] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.184] GetCurrentProcess () returned 0xffffffffffffffff [0258.184] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24cc58, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.184] GetCurrentProcess () returned 0xffffffffffffffff [0258.184] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24ced4, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.185] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.185] GetCurrentProcess () returned 0xffffffffffffffff [0258.185] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24ced4, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.185] GetCurrentProcess () returned 0xffffffffffffffff [0258.185] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24ced8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.185] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.185] GetCurrentProcess () returned 0xffffffffffffffff [0258.185] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24ced8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.185] GetCurrentProcess () returned 0xffffffffffffffff [0258.185] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24cedc, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.185] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.186] GetCurrentProcess () returned 0xffffffffffffffff [0258.186] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24cedc, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.186] GetCurrentProcess () returned 0xffffffffffffffff [0258.186] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24cee0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.186] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.186] GetCurrentProcess () returned 0xffffffffffffffff [0258.186] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24cee0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.186] GetCurrentProcess () returned 0xffffffffffffffff [0258.186] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24cf34, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.186] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.187] GetCurrentProcess () returned 0xffffffffffffffff [0258.187] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24cf34, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.187] GetCurrentProcess () returned 0xffffffffffffffff [0258.187] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24cf40, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.187] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.187] GetCurrentProcess () returned 0xffffffffffffffff [0258.187] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24cf40, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.187] GetCurrentProcess () returned 0xffffffffffffffff [0258.187] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24cf44, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.187] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.187] GetCurrentProcess () returned 0xffffffffffffffff [0258.188] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24cf44, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.188] GetCurrentProcess () returned 0xffffffffffffffff [0258.188] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24d194, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.188] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.188] GetCurrentProcess () returned 0xffffffffffffffff [0258.188] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24d194, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.188] GetCurrentProcess () returned 0xffffffffffffffff [0258.188] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24d474, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.188] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.189] GetCurrentProcess () returned 0xffffffffffffffff [0258.189] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24d474, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.189] GetCurrentProcess () returned 0xffffffffffffffff [0258.189] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24d6a8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.189] RtlUnwindEx (TargetFrame=0x7ff990, TargetIp=0x7ff67cd50646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x7ff510, HistoryTable=0x0) [0258.189] GetCurrentProcess () returned 0xffffffffffffffff [0258.189] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e24d6a8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e24d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.189] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.191] GetLastError () returned 0x1e7 [0258.191] SetLastError (dwErrCode=0x1e7) [0258.191] GetLastError () returned 0x1e7 [0258.191] SetLastError (dwErrCode=0x1e7) [0258.191] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.191] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.191] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.192] GetLastError () returned 0x1e7 [0258.192] SetLastError (dwErrCode=0x1e7) [0258.192] GetLastError () returned 0x1e7 [0258.192] SetLastError (dwErrCode=0x1e7) [0258.192] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.192] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.192] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4a8bf1b8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4a8bf000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.193] GetCurrentProcess () returned 0xffffffffffffffff [0258.193] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4a8bf1b8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4a8bf000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.193] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4a8bf1d0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4a8bf000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.193] GetCurrentProcess () returned 0xffffffffffffffff [0258.193] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4a8bf1d0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4a8bf000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.194] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.194] GetLastError () returned 0x1e7 [0258.194] SetLastError (dwErrCode=0x1e7) [0258.194] GetLastError () returned 0x1e7 [0258.194] SetLastError (dwErrCode=0x1e7) [0258.194] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.195] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.195] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4ea60748, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4ea60000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.195] GetCurrentProcess () returned 0xffffffffffffffff [0258.195] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4ea60748, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4ea60000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.195] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4ea60770, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4ea60000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.195] GetCurrentProcess () returned 0xffffffffffffffff [0258.195] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4ea60770, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4ea60000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.196] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.196] GetLastError () returned 0x1e7 [0258.197] SetLastError (dwErrCode=0x1e7) [0258.197] GetLastError () returned 0x1e7 [0258.197] SetLastError (dwErrCode=0x1e7) [0258.197] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.197] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.197] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d99b360, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d99b000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.197] GetCurrentProcess () returned 0xffffffffffffffff [0258.197] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d99b360, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d99b000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.197] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d99b368, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d99b000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.198] GetCurrentProcess () returned 0xffffffffffffffff [0258.198] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d99b368, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d99b000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.198] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.198] GetLastError () returned 0x1e7 [0258.199] SetLastError (dwErrCode=0x1e7) [0258.199] GetLastError () returned 0x1e7 [0258.199] SetLastError (dwErrCode=0x1e7) [0258.199] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.199] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.199] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4510, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.199] GetCurrentProcess () returned 0xffffffffffffffff [0258.199] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4510, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.199] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4528, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.200] GetCurrentProcess () returned 0xffffffffffffffff [0258.200] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4528, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.200] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4010, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.200] GetCurrentProcess () returned 0xffffffffffffffff [0258.200] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4010, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.200] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4028, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.201] GetCurrentProcess () returned 0xffffffffffffffff [0258.202] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4028, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.202] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4030, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.203] GetCurrentProcess () returned 0xffffffffffffffff [0258.203] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4030, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.203] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4038, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.204] GetCurrentProcess () returned 0xffffffffffffffff [0258.204] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4038, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.204] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4040, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.204] GetCurrentProcess () returned 0xffffffffffffffff [0258.204] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4040, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.205] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e40a8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.205] GetCurrentProcess () returned 0xffffffffffffffff [0258.205] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e40a8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.205] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e40d8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.206] GetCurrentProcess () returned 0xffffffffffffffff [0258.206] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e40d8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.206] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e40e0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.206] GetCurrentProcess () returned 0xffffffffffffffff [0258.206] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e40e0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.206] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e40f0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.207] GetCurrentProcess () returned 0xffffffffffffffff [0258.207] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e40f0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.207] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4190, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.208] GetCurrentProcess () returned 0xffffffffffffffff [0258.208] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4190, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.208] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e41a0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.208] GetCurrentProcess () returned 0xffffffffffffffff [0258.208] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e41a0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.208] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e41a8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.209] GetCurrentProcess () returned 0xffffffffffffffff [0258.209] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e41a8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.209] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e41b0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.209] GetCurrentProcess () returned 0xffffffffffffffff [0258.210] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e41b0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.210] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4290, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.210] GetCurrentProcess () returned 0xffffffffffffffff [0258.210] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e4290, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.210] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e42c8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.211] GetCurrentProcess () returned 0xffffffffffffffff [0258.211] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e4e42c8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.211] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.212] GetLastError () returned 0x1e7 [0258.212] SetLastError (dwErrCode=0x1e7) [0258.212] GetLastError () returned 0x1e7 [0258.212] SetLastError (dwErrCode=0x1e7) [0258.212] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.213] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.213] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4df75400, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4df75000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.213] GetCurrentProcess () returned 0xffffffffffffffff [0258.213] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4df75400, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4df75000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.214] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4df75440, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4df75000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.214] GetCurrentProcess () returned 0xffffffffffffffff [0258.214] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4df75440, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4df75000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.214] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.215] GetLastError () returned 0x1e7 [0258.215] SetLastError (dwErrCode=0x1e7) [0258.215] GetLastError () returned 0x1e7 [0258.215] SetLastError (dwErrCode=0x1e7) [0258.215] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.216] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.216] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e194388, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e194000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.216] GetCurrentProcess () returned 0xffffffffffffffff [0258.216] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e194388, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e194000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.216] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e1943e0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e194000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.217] GetCurrentProcess () returned 0xffffffffffffffff [0258.217] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e1943e0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e194000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.217] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.218] GetLastError () returned 0x1e7 [0258.218] SetLastError (dwErrCode=0x1e7) [0258.218] GetLastError () returned 0x1e7 [0258.218] SetLastError (dwErrCode=0x1e7) [0258.218] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.219] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.219] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4db3d1f8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4db3d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.219] GetCurrentProcess () returned 0xffffffffffffffff [0258.219] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4db3d1f8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4db3d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.219] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4db3d208, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4db3d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.220] GetCurrentProcess () returned 0xffffffffffffffff [0258.220] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4db3d208, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4db3d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.220] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.221] GetLastError () returned 0x1e7 [0258.221] SetLastError (dwErrCode=0x1e7) [0258.221] GetLastError () returned 0x1e7 [0258.221] SetLastError (dwErrCode=0x1e7) [0258.221] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.222] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.222] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4dc0d2e8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4dc0d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.235] GetCurrentProcess () returned 0xffffffffffffffff [0258.235] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4dc0d2e8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4dc0d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.235] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4dc0d318, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4dc0d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.236] GetCurrentProcess () returned 0xffffffffffffffff [0258.236] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4dc0d318, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4dc0d000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.236] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.237] GetLastError () returned 0x1e7 [0258.237] SetLastError (dwErrCode=0x1e7) [0258.237] GetLastError () returned 0x1e7 [0258.237] SetLastError (dwErrCode=0x1e7) [0258.237] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.238] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.238] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4de1f630, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4de1f000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.239] GetCurrentProcess () returned 0xffffffffffffffff [0258.239] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4de1f630, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4de1f000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.239] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4de1f650, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4de1f000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.239] GetCurrentProcess () returned 0xffffffffffffffff [0258.239] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4de1f650, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4de1f000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.240] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.241] GetLastError () returned 0x1e7 [0258.241] SetLastError (dwErrCode=0x1e7) [0258.241] GetLastError () returned 0x1e7 [0258.241] SetLastError (dwErrCode=0x1e7) [0258.241] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.241] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.241] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d8b2090, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d8b2000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.241] GetCurrentProcess () returned 0xffffffffffffffff [0258.242] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d8b2090, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d8b2000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.242] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.243] GetLastError () returned 0x1e7 [0258.243] SetLastError (dwErrCode=0x1e7) [0258.243] GetLastError () returned 0x1e7 [0258.243] SetLastError (dwErrCode=0x1e7) [0258.243] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.243] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.244] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4f10a3d0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4f10a000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.244] GetCurrentProcess () returned 0xffffffffffffffff [0258.244] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4f10a3d0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4f10a000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.244] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4f10a438, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4f10a000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.245] GetCurrentProcess () returned 0xffffffffffffffff [0258.245] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4f10a438, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4f10a000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.245] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.246] GetLastError () returned 0x1e7 [0258.246] SetLastError (dwErrCode=0x1e7) [0258.246] GetLastError () returned 0x1e7 [0258.247] SetLastError (dwErrCode=0x1e7) [0258.247] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.247] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.247] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cbaf250, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cbaf000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.248] GetCurrentProcess () returned 0xffffffffffffffff [0258.248] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cbaf250, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cbaf000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.248] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cbaf260, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cbaf000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.248] GetCurrentProcess () returned 0xffffffffffffffff [0258.248] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cbaf260, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cbaf000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.249] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.250] GetLastError () returned 0x1e7 [0258.250] SetLastError (dwErrCode=0x1e7) [0258.250] GetLastError () returned 0x1e7 [0258.250] SetLastError (dwErrCode=0x1e7) [0258.250] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.250] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.250] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d1946a8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d194000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.251] GetCurrentProcess () returned 0xffffffffffffffff [0258.251] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d1946a8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d194000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.277] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d1946c8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d194000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.278] GetCurrentProcess () returned 0xffffffffffffffff [0258.278] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d1946c8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d194000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.278] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.279] GetLastError () returned 0x1e7 [0258.279] SetLastError (dwErrCode=0x1e7) [0258.279] GetLastError () returned 0x1e7 [0258.279] SetLastError (dwErrCode=0x1e7) [0258.279] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.279] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.279] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd5011b528, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd5011b000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.280] GetCurrentProcess () returned 0xffffffffffffffff [0258.280] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd5011b528, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd5011b000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.280] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd5011b558, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd5011b000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.281] GetCurrentProcess () returned 0xffffffffffffffff [0258.281] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd5011b558, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd5011b000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.281] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.282] GetLastError () returned 0x1e7 [0258.282] SetLastError (dwErrCode=0x1e7) [0258.282] GetLastError () returned 0x1e7 [0258.282] SetLastError (dwErrCode=0x1e7) [0258.283] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.283] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.283] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cb745f8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cb74000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.283] GetCurrentProcess () returned 0xffffffffffffffff [0258.283] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cb745f8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cb74000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.284] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.285] GetLastError () returned 0x1e7 [0258.285] SetLastError (dwErrCode=0x1e7) [0258.285] GetLastError () returned 0x1e7 [0258.285] SetLastError (dwErrCode=0x1e7) [0258.285] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.285] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.285] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d62a320, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d62a000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.286] GetCurrentProcess () returned 0xffffffffffffffff [0258.286] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d62a320, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d62a000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.286] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d62a330, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d62a000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.286] GetCurrentProcess () returned 0xffffffffffffffff [0258.286] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4d62a330, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4d62a000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.286] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.287] GetLastError () returned 0x1e7 [0258.287] SetLastError (dwErrCode=0x1e7) [0258.287] GetLastError () returned 0x1e7 [0258.287] SetLastError (dwErrCode=0x1e7) [0258.288] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.288] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.288] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cb230f8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cb23000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.288] GetCurrentProcess () returned 0xffffffffffffffff [0258.288] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cb230f8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cb23000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.288] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cb23100, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cb23000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.289] GetCurrentProcess () returned 0xffffffffffffffff [0258.289] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cb23100, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cb23000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.289] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.290] GetLastError () returned 0x1e7 [0258.290] SetLastError (dwErrCode=0x1e7) [0258.290] GetLastError () returned 0x1e7 [0258.290] SetLastError (dwErrCode=0x1e7) [0258.290] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.290] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.290] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cafa158, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cafa000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.290] GetCurrentProcess () returned 0xffffffffffffffff [0258.291] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cafa158, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cafa000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.291] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cafa168, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cafa000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.291] GetCurrentProcess () returned 0xffffffffffffffff [0258.291] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4cafa168, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4cafa000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.291] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.292] GetLastError () returned 0x1e7 [0258.292] SetLastError (dwErrCode=0x1e7) [0258.292] GetLastError () returned 0x1e7 [0258.293] SetLastError (dwErrCode=0x1e7) [0258.293] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.293] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.293] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd50444000, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd50444000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.293] GetCurrentProcess () returned 0xffffffffffffffff [0258.293] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd50444000, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd50444000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.294] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd50444008, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd50444000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.294] GetCurrentProcess () returned 0xffffffffffffffff [0258.294] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd50444008, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd50444000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.294] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd504432d0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd50443000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.294] GetCurrentProcess () returned 0xffffffffffffffff [0258.294] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd504432d0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd50443000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.295] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.295] GetLastError () returned 0x1e7 [0258.295] SetLastError (dwErrCode=0x1e7) [0258.295] GetLastError () returned 0x1e7 [0258.295] SetLastError (dwErrCode=0x1e7) [0258.296] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.296] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.296] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd41d74158, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd41d74000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.296] GetCurrentProcess () returned 0xffffffffffffffff [0258.296] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd41d74158, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd41d74000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.296] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd41d74170, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd41d74000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.297] GetCurrentProcess () returned 0xffffffffffffffff [0258.297] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd41d74170, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd41d74000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.297] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.298] GetLastError () returned 0x1e7 [0258.298] SetLastError (dwErrCode=0x1e7) [0258.298] GetLastError () returned 0x1e7 [0258.298] SetLastError (dwErrCode=0x1e7) [0258.298] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.298] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.298] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e3063c8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e306000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.299] GetCurrentProcess () returned 0xffffffffffffffff [0258.299] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e3063c8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e306000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.299] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e3063f8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e306000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.299] GetCurrentProcess () returned 0xffffffffffffffff [0258.299] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e3063f8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e306000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.299] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.300] GetLastError () returned 0x1e7 [0258.300] SetLastError (dwErrCode=0x1e7) [0258.300] GetLastError () returned 0x1e7 [0258.300] SetLastError (dwErrCode=0x1e7) [0258.301] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.301] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.301] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33310, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.301] GetCurrentProcess () returned 0xffffffffffffffff [0258.301] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33310, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.301] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33328, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.302] GetCurrentProcess () returned 0xffffffffffffffff [0258.302] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33328, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.302] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33338, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.302] GetCurrentProcess () returned 0xffffffffffffffff [0258.302] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33338, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.303] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33340, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.303] GetCurrentProcess () returned 0xffffffffffffffff [0258.303] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33340, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.303] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b333a0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.303] GetCurrentProcess () returned 0xffffffffffffffff [0258.303] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b333a0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.303] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b333b8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.304] GetCurrentProcess () returned 0xffffffffffffffff [0258.304] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b333b8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.304] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b333c0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.304] GetCurrentProcess () returned 0xffffffffffffffff [0258.304] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b333c0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.305] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b333c8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.305] GetCurrentProcess () returned 0xffffffffffffffff [0258.305] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b333c8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.305] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33438, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.307] GetCurrentProcess () returned 0xffffffffffffffff [0258.307] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33438, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.307] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33528, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.307] GetCurrentProcess () returned 0xffffffffffffffff [0258.307] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33528, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.307] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33530, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.308] GetCurrentProcess () returned 0xffffffffffffffff [0258.308] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33530, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.308] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33538, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.308] GetCurrentProcess () returned 0xffffffffffffffff [0258.308] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33538, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.308] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33540, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.309] GetCurrentProcess () returned 0xffffffffffffffff [0258.309] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33540, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.309] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33548, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.309] GetCurrentProcess () returned 0xffffffffffffffff [0258.309] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33548, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.309] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33550, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.310] GetCurrentProcess () returned 0xffffffffffffffff [0258.310] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33550, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.310] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33660, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.310] GetCurrentProcess () returned 0xffffffffffffffff [0258.310] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33660, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.310] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33678, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.311] GetCurrentProcess () returned 0xffffffffffffffff [0258.311] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd40b33678, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.311] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.312] GetLastError () returned 0x1e7 [0258.312] SetLastError (dwErrCode=0x1e7) [0258.312] GetLastError () returned 0x1e7 [0258.312] SetLastError (dwErrCode=0x1e7) [0258.312] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.312] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.312] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e962028, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e962000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.313] GetCurrentProcess () returned 0xffffffffffffffff [0258.313] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e962028, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e962000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.313] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e962030, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e962000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.313] GetCurrentProcess () returned 0xffffffffffffffff [0258.313] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4e962030, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4e962000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.313] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.314] GetLastError () returned 0x1e7 [0258.314] SetLastError (dwErrCode=0x1e7) [0258.314] GetLastError () returned 0x1e7 [0258.314] SetLastError (dwErrCode=0x1e7) [0258.314] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.314] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.315] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4b4c78d0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4b4c7000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.315] GetCurrentProcess () returned 0xffffffffffffffff [0258.315] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4b4c78d0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4b4c7000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.315] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4b4c7900, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4b4c7000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.315] GetCurrentProcess () returned 0xffffffffffffffff [0258.315] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4b4c7900, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4b4c7000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.316] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.317] GetLastError () returned 0x1e7 [0258.317] SetLastError (dwErrCode=0x1e7) [0258.317] GetLastError () returned 0x1e7 [0258.317] SetLastError (dwErrCode=0x1e7) [0258.317] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.317] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.317] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd45f82050, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd45f82000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.317] GetCurrentProcess () returned 0xffffffffffffffff [0258.318] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd45f82050, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd45f82000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.318] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd45f82058, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd45f82000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.318] GetCurrentProcess () returned 0xffffffffffffffff [0258.318] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd45f82058, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd45f82000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.318] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.319] GetLastError () returned 0x1e7 [0258.319] SetLastError (dwErrCode=0x1e7) [0258.319] GetLastError () returned 0x1e7 [0258.319] SetLastError (dwErrCode=0x1e7) [0258.319] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.319] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.319] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd31cc2078, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd31cc2000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.320] GetCurrentProcess () returned 0xffffffffffffffff [0258.320] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd31cc2078, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd31cc2000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.320] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd31cc2080, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd31cc2000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.320] GetCurrentProcess () returned 0xffffffffffffffff [0258.320] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd31cc2080, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd31cc2000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.321] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 1 [0258.321] GetLastError () returned 0x1e7 [0258.321] SetLastError (dwErrCode=0x1e7) [0258.322] GetLastError () returned 0x1e7 [0258.322] SetLastError (dwErrCode=0x1e7) [0258.322] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0258.322] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0258.322] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4c78e1d8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4c78e000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.322] GetCurrentProcess () returned 0xffffffffffffffff [0258.322] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4c78e1d8, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4c78e000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.323] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4c78e1f0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x4, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4c78e000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x2) returned 0x0 [0258.323] GetCurrentProcess () returned 0xffffffffffffffff [0258.323] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x7ff978*=0x7ffd4c78e1f0, NumberOfBytesToProtect=0x7ff970, NewAccessProtection=0x2, OldAccessProtection=0x7ffa50 | out: BaseAddress=0x7ff978*=0x7ffd4c78e000, NumberOfBytesToProtect=0x7ff970, OldAccessProtection=0x7ffa50*=0x4) returned 0x0 [0258.323] Module32Next (hSnapshot=0x1f0, lpme=0x7ffb08) returned 0 [0258.324] CloseHandle (hObject=0x1f0) returned 1 [0258.324] GetLastError () returned 0x12 [0258.324] SetLastError (dwErrCode=0x12) [0258.324] GetLastError () returned 0x12 [0258.324] SetLastError (dwErrCode=0x12) [0258.324] GetLastError () returned 0x12 [0258.324] SetLastError (dwErrCode=0x12) [0258.325] GetLastError () returned 0x12 [0258.325] SetLastError (dwErrCode=0x12) [0258.325] GetLastError () returned 0x12 [0258.325] SetLastError (dwErrCode=0x12) [0258.336] GetLastError () returned 0x12 [0258.336] SetLastError (dwErrCode=0x12) [0258.336] GetLastError () returned 0x12 [0258.336] SetLastError (dwErrCode=0x12) [0258.340] GetLastError () returned 0x12 [0258.340] SetLastError (dwErrCode=0x12) [0258.340] GetLastError () returned 0x12 [0258.341] SetLastError (dwErrCode=0x12) [0258.341] GetProcessHeap () returned 0x8f0000 [0258.341] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x500000) returned 0x3191040 [0258.870] GetProcessHeap () returned 0x8f0000 [0258.895] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x3191040 | out: hHeap=0x8f0000) returned 1 [0258.959] GetLastError () returned 0x12 [0258.959] SetLastError (dwErrCode=0x12) [0258.959] GetLastError () returned 0x12 [0258.960] SetLastError (dwErrCode=0x12) [0258.960] GetLastError () returned 0x12 [0258.960] SetLastError (dwErrCode=0x12) [0258.960] GetLastError () returned 0x12 [0258.960] SetLastError (dwErrCode=0x12) [0258.960] GetLastError () returned 0x12 [0258.960] SetLastError (dwErrCode=0x12) [0258.960] GetLastError () returned 0x12 [0258.960] GetLastError () returned 0x12 [0258.960] SetLastError (dwErrCode=0x12) [0258.960] SetLastError (dwErrCode=0x12) [0258.960] GetLastError () returned 0x12 [0258.961] SetLastError (dwErrCode=0x12) [0258.961] GetLastError () returned 0x12 [0258.961] SetLastError (dwErrCode=0x12) [0258.961] GetLastError () returned 0x12 [0258.961] SetLastError (dwErrCode=0x12) [0258.961] GetLastError () returned 0x12 [0258.961] SetLastError (dwErrCode=0x12) [0258.961] GetLastError () returned 0x12 [0258.961] SetLastError (dwErrCode=0x12) [0258.961] GetLastError () returned 0x12 [0258.962] SetLastError (dwErrCode=0x12) [0258.962] GetLastError () returned 0x12 [0258.962] SetLastError (dwErrCode=0x12) [0258.962] GetLastError () returned 0x12 [0258.962] SetLastError (dwErrCode=0x12) [0258.962] GetLastError () returned 0x12 [0258.962] GetLastError () returned 0x12 [0258.962] SetLastError (dwErrCode=0x12) [0258.962] SetLastError (dwErrCode=0x12) [0258.962] GetLastError () returned 0x12 [0258.963] SetLastError (dwErrCode=0x12) [0258.963] GetLastError () returned 0x12 [0258.963] SetLastError (dwErrCode=0x12) [0258.963] GetLastError () returned 0x12 [0258.963] SetLastError (dwErrCode=0x12) [0258.963] GetLastError () returned 0x12 [0258.963] SetLastError (dwErrCode=0x12) [0258.963] GetLastError () returned 0x12 [0258.963] SetLastError (dwErrCode=0x12) [0258.963] GetLastError () returned 0x12 [0258.963] SetLastError (dwErrCode=0x12) [0258.963] GetLastError () returned 0x12 [0258.963] SetLastError (dwErrCode=0x12) [0258.963] GetLastError () returned 0x12 [0258.964] SetLastError (dwErrCode=0x12) [0258.964] GetLastError () returned 0x12 [0258.964] SetLastError (dwErrCode=0x12) [0258.964] GetLastError () returned 0x12 [0258.964] SetLastError (dwErrCode=0x12) [0258.964] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0258.964] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=10, lpWideCharStr=0x24d24e8, cchWideChar=10 | out: lpWideCharStr="USER32.dll") returned 10 [0258.964] GetLastError () returned 0x0 [0258.964] SetLastError (dwErrCode=0x0) [0258.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="USER32.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0258.964] GetLastError () returned 0x0 [0258.964] SetLastError (dwErrCode=0x0) [0258.964] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="USER32.dll", cchWideChar=10, lpMultiByteStr=0xac5878, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USER32.dll", lpUsedDefaultChar=0x0) returned 10 [0258.964] GetLastError () returned 0x0 [0258.964] SetLastError (dwErrCode=0x0) [0258.964] GetLastError () returned 0x0 [0258.964] SetLastError (dwErrCode=0x0) [0258.964] GetLastError () returned 0x0 [0258.964] SetLastError (dwErrCode=0x0) [0258.965] GetLastError () returned 0x0 [0258.965] SetLastError (dwErrCode=0x0) [0258.965] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="EnumDisplayDevicesA" | out: DestinationString="EnumDisplayDevicesA") [0258.965] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e9d0000, Name="EnumDisplayDevicesA", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e9f2800) returned 0x0 [0258.965] GetLastError () returned 0x0 [0258.965] SetLastError (dwErrCode=0x0) [0258.965] GetLastError () returned 0x0 [0258.965] SetLastError (dwErrCode=0x0) [0258.965] GetLastError () returned 0x0 [0258.965] SetLastError (dwErrCode=0x0) [0258.965] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0258.965] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=12, lpWideCharStr=0xae3a38, cchWideChar=12 | out: lpWideCharStr="ADVAPI32.dll") returned 12 [0258.965] GetLastError () returned 0x0 [0258.965] SetLastError (dwErrCode=0x0) [0258.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADVAPI32.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0258.965] GetLastError () returned 0x0 [0258.966] SetLastError (dwErrCode=0x0) [0258.966] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADVAPI32.dll", cchWideChar=12, lpMultiByteStr=0xac5878, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.dll", lpUsedDefaultChar=0x0) returned 12 [0258.966] GetLastError () returned 0x0 [0258.966] SetLastError (dwErrCode=0x0) [0258.966] GetLastError () returned 0x0 [0258.966] SetLastError (dwErrCode=0x0) [0258.966] GetLastError () returned 0x0 [0258.966] SetLastError (dwErrCode=0x0) [0258.966] GetLastError () returned 0x0 [0258.966] SetLastError (dwErrCode=0x0) [0258.966] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RegCreateKeyExA" | out: DestinationString="RegCreateKeyExA") [0258.966] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegCreateKeyExA", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e498000) returned 0x0 [0258.966] GetLastError () returned 0x0 [0258.966] SetLastError (dwErrCode=0x0) [0258.966] GetLastError () returned 0x0 [0258.966] SetLastError (dwErrCode=0x0) [0258.966] GetLastError () returned 0x0 [0258.967] SetLastError (dwErrCode=0x0) [0258.967] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RegSetValueExA" | out: DestinationString="RegSetValueExA") [0258.967] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegSetValueExA", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e482520) returned 0x0 [0258.967] GetLastError () returned 0x0 [0258.967] SetLastError (dwErrCode=0x0) [0258.967] GetLastError () returned 0x0 [0259.042] SetLastError (dwErrCode=0x0) [0259.042] GetLastError () returned 0x0 [0259.042] SetLastError (dwErrCode=0x0) [0259.042] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="OpenProcessToken" | out: DestinationString="OpenProcessToken") [0259.042] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="OpenProcessToken", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e497180) returned 0x0 [0259.042] GetLastError () returned 0x0 [0259.042] SetLastError (dwErrCode=0x0) [0259.042] GetLastError () returned 0x0 [0259.042] SetLastError (dwErrCode=0x0) [0259.042] GetLastError () returned 0x0 [0259.042] SetLastError (dwErrCode=0x0) [0259.042] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetTokenInformation" | out: DestinationString="GetTokenInformation") [0259.043] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="GetTokenInformation", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e496610) returned 0x0 [0259.043] GetLastError () returned 0x0 [0259.043] SetLastError (dwErrCode=0x0) [0259.043] GetLastError () returned 0x0 [0259.043] SetLastError (dwErrCode=0x0) [0259.043] GetLastError () returned 0x0 [0259.043] SetLastError (dwErrCode=0x0) [0259.043] GetLastError () returned 0x0 [0259.043] SetLastError (dwErrCode=0x0) [0259.043] GetLastError () returned 0x0 [0259.043] SetLastError (dwErrCode=0x0) [0259.043] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="InitializeSecurityDescriptor" | out: DestinationString="InitializeSecurityDescriptor") [0259.043] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="InitializeSecurityDescriptor", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e497de0) returned 0x0 [0259.043] GetLastError () returned 0x0 [0259.043] SetLastError (dwErrCode=0x0) [0259.043] GetLastError () returned 0x0 [0259.044] SetLastError (dwErrCode=0x0) [0259.044] GetLastError () returned 0x0 [0259.044] SetLastError (dwErrCode=0x0) [0259.044] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="SetSecurityDescriptorDacl" | out: DestinationString="SetSecurityDescriptorDacl") [0259.044] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="SetSecurityDescriptorDacl", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e497dd0) returned 0x0 [0259.044] GetLastError () returned 0x0 [0259.044] SetLastError (dwErrCode=0x0) [0259.044] GetLastError () returned 0x0 [0259.044] SetLastError (dwErrCode=0x0) [0259.044] GetLastError () returned 0x0 [0259.044] SetLastError (dwErrCode=0x0) [0259.044] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RegCloseKey" | out: DestinationString="RegCloseKey") [0259.044] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegCloseKey", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e496620) returned 0x0 [0259.044] GetLastError () returned 0x0 [0259.044] SetLastError (dwErrCode=0x0) [0259.044] GetLastError () returned 0x0 [0259.045] SetLastError (dwErrCode=0x0) [0259.045] GetLastError () returned 0x0 [0259.045] SetLastError (dwErrCode=0x0) [0259.045] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RegOpenKeyExA" | out: DestinationString="RegOpenKeyExA") [0259.045] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegOpenKeyExA", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e497200) returned 0x0 [0259.045] GetLastError () returned 0x0 [0259.045] SetLastError (dwErrCode=0x0) [0259.045] GetLastError () returned 0x0 [0259.045] SetLastError (dwErrCode=0x0) [0259.045] GetLastError () returned 0x0 [0259.045] SetLastError (dwErrCode=0x0) [0259.045] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RegDeleteKeyA" | out: DestinationString="RegDeleteKeyA") [0259.045] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegDeleteKeyA", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e482480) returned 0x0 [0259.045] GetLastError () returned 0x0 [0259.045] SetLastError (dwErrCode=0x0) [0259.046] GetLastError () returned 0x0 [0259.046] SetLastError (dwErrCode=0x0) [0259.046] GetLastError () returned 0x0 [0259.046] SetLastError (dwErrCode=0x0) [0259.046] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RegDeleteValueA" | out: DestinationString="RegDeleteValueA") [0259.046] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegDeleteValueA", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e482800) returned 0x0 [0259.046] GetLastError () returned 0x0 [0259.046] SetLastError (dwErrCode=0x0) [0259.046] GetLastError () returned 0x0 [0259.046] SetLastError (dwErrCode=0x0) [0259.046] GetLastError () returned 0x0 [0259.046] SetLastError (dwErrCode=0x0) [0259.046] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RegQueryValueExA" | out: DestinationString="RegQueryValueExA") [0259.046] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegQueryValueExA", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e4972d0) returned 0x0 [0259.046] GetLastError () returned 0x0 [0259.046] SetLastError (dwErrCode=0x0) [0259.046] GetLastError () returned 0x0 [0259.047] SetLastError (dwErrCode=0x0) [0259.047] GetLastError () returned 0x0 [0259.047] SetLastError (dwErrCode=0x0) [0259.047] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0259.047] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0xac5878, cbMultiByte=12, lpWideCharStr=0xae3a38, cchWideChar=12 | out: lpWideCharStr="KERNEL32.dll") returned 12 [0259.047] GetLastError () returned 0x0 [0259.047] SetLastError (dwErrCode=0x0) [0259.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KERNEL32.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0259.047] GetLastError () returned 0x0 [0259.047] SetLastError (dwErrCode=0x0) [0259.047] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KERNEL32.dll", cchWideChar=12, lpMultiByteStr=0xac5878, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KERNEL32.dll", lpUsedDefaultChar=0x0) returned 12 [0259.047] GetLastError () returned 0x0 [0259.047] SetLastError (dwErrCode=0x0) [0259.047] GetLastError () returned 0x0 [0259.047] SetLastError (dwErrCode=0x0) [0259.047] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RtlUnwind" | out: DestinationString="RtlUnwind") [0259.048] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RtlUnwind", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e206850) returned 0x0 [0259.048] GetLastError () returned 0x0 [0259.048] SetLastError (dwErrCode=0x0) [0259.048] GetLastError () returned 0x0 [0259.048] SetLastError (dwErrCode=0x0) [0259.048] GetLastError () returned 0x0 [0259.048] SetLastError (dwErrCode=0x0) [0259.048] GetLastError () returned 0x0 [0259.048] SetLastError (dwErrCode=0x0) [0259.048] GetLastError () returned 0x0 [0259.048] SetLastError (dwErrCode=0x0) [0259.048] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="SetEndOfFile" | out: DestinationString="SetEndOfFile") [0259.048] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetEndOfFile", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1edc20) returned 0x0 [0259.049] GetLastError () returned 0x0 [0259.049] SetLastError (dwErrCode=0x0) [0259.049] GetLastError () returned 0x0 [0259.049] SetLastError (dwErrCode=0x0) [0259.049] GetLastError () returned 0x0 [0259.049] SetLastError (dwErrCode=0x0) [0259.049] GetLastError () returned 0x0 [0259.049] SetLastError (dwErrCode=0x0) [0259.049] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="SetLastError" | out: DestinationString="SetLastError") [0259.049] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetLastError", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1db730) returned 0x0 [0259.049] GetLastError () returned 0x0 [0259.049] SetLastError (dwErrCode=0x0) [0259.049] GetLastError () returned 0x0 [0259.049] SetLastError (dwErrCode=0x0) [0259.049] GetLastError () returned 0x0 [0259.050] SetLastError (dwErrCode=0x0) [0259.050] GetLastError () returned 0x0 [0259.050] SetLastError (dwErrCode=0x0) [0259.050] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="WaitForSingleObject" | out: DestinationString="WaitForSingleObject") [0259.050] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="WaitForSingleObject", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ed840) returned 0x0 [0259.050] GetLastError () returned 0x0 [0259.050] SetLastError (dwErrCode=0x0) [0259.050] GetLastError () returned 0x0 [0259.050] SetLastError (dwErrCode=0x0) [0259.050] GetLastError () returned 0x0 [0259.050] SetLastError (dwErrCode=0x0) [0259.050] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="ResumeThread" | out: DestinationString="ResumeThread") [0259.050] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="ResumeThread", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e4e70) returned 0x0 [0259.050] GetLastError () returned 0x0 [0259.050] SetLastError (dwErrCode=0x0) [0259.050] GetLastError () returned 0x0 [0259.051] SetLastError (dwErrCode=0x0) [0259.051] GetLastError () returned 0x0 [0259.051] SetLastError (dwErrCode=0x0) [0259.051] GetLastError () returned 0x0 [0259.051] SetLastError (dwErrCode=0x0) [0259.051] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="CreateProcessA" | out: DestinationString="CreateProcessA") [0259.051] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="CreateProcessA", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e3600) returned 0x0 [0259.051] GetLastError () returned 0x0 [0259.051] SetLastError (dwErrCode=0x0) [0259.051] GetLastError () returned 0x0 [0259.051] SetLastError (dwErrCode=0x0) [0259.051] GetLastError () returned 0x0 [0259.051] SetLastError (dwErrCode=0x0) [0259.051] GetLastError () returned 0x0 [0259.051] SetLastError (dwErrCode=0x0) [0259.051] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="SetPriorityClass" | out: DestinationString="SetPriorityClass") [0259.052] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetPriorityClass", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e8b20) returned 0x0 [0259.052] GetLastError () returned 0x0 [0259.052] SetLastError (dwErrCode=0x0) [0259.052] GetLastError () returned 0x0 [0259.052] SetLastError (dwErrCode=0x0) [0259.052] GetLastError () returned 0x0 [0259.052] SetLastError (dwErrCode=0x0) [0259.052] GetLastError () returned 0x0 [0259.052] SetLastError (dwErrCode=0x0) [0259.052] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetThreadContext" | out: DestinationString="GetThreadContext") [0259.052] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetThreadContext", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e6780) returned 0x0 [0259.052] GetLastError () returned 0x0 [0259.052] SetLastError (dwErrCode=0x0) [0259.052] GetLastError () returned 0x0 [0259.052] SetLastError (dwErrCode=0x0) [0259.052] GetLastError () returned 0x0 [0259.053] SetLastError (dwErrCode=0x0) [0259.053] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="SetThreadContext" | out: DestinationString="SetThreadContext") [0259.053] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetThreadContext", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ec890) returned 0x0 [0259.053] GetLastError () returned 0x0 [0259.053] SetLastError (dwErrCode=0x0) [0259.053] GetLastError () returned 0x0 [0259.053] SetLastError (dwErrCode=0x0) [0259.053] GetLastError () returned 0x0 [0259.053] SetLastError (dwErrCode=0x0) [0259.053] GetLastError () returned 0x0 [0259.053] SetLastError (dwErrCode=0x0) [0259.053] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="VirtualAlloc" | out: DestinationString="VirtualAlloc") [0259.053] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e28c0) returned 0x0 [0259.053] GetLastError () returned 0x0 [0259.053] SetLastError (dwErrCode=0x0) [0259.053] GetLastError () returned 0x0 [0259.054] SetLastError (dwErrCode=0x0) [0259.054] GetLastError () returned 0x0 [0259.054] SetLastError (dwErrCode=0x0) [0259.054] GetLastError () returned 0x0 [0259.054] SetLastError (dwErrCode=0x0) [0259.054] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="VirtualAllocEx" | out: DestinationString="VirtualAllocEx") [0259.054] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="VirtualAllocEx", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ea400) returned 0x0 [0259.054] GetLastError () returned 0x0 [0259.054] SetLastError (dwErrCode=0x0) [0259.054] GetLastError () returned 0x0 [0259.054] SetLastError (dwErrCode=0x0) [0259.054] GetLastError () returned 0x0 [0259.054] SetLastError (dwErrCode=0x0) [0259.054] GetLastError () returned 0x0 [0259.054] SetLastError (dwErrCode=0x0) [0259.054] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="WriteProcessMemory" | out: DestinationString="WriteProcessMemory") [0259.054] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="WriteProcessMemory", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ea3f0) returned 0x0 [0259.055] GetLastError () returned 0x0 [0259.055] SetLastError (dwErrCode=0x0) [0259.055] GetLastError () returned 0x0 [0259.055] SetLastError (dwErrCode=0x0) [0259.055] GetLastError () returned 0x0 [0259.055] SetLastError (dwErrCode=0x0) [0259.055] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="WinExec" | out: DestinationString="WinExec") [0259.055] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="WinExec", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e205290) returned 0x0 [0259.055] GetLastError () returned 0x0 [0259.055] SetLastError (dwErrCode=0x0) [0259.055] GetLastError () returned 0x0 [0259.055] SetLastError (dwErrCode=0x0) [0259.055] GetLastError () returned 0x0 [0259.055] SetLastError (dwErrCode=0x0) [0259.055] GetLastError () returned 0x0 [0259.055] SetLastError (dwErrCode=0x0) [0259.055] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="lstrlenA" | out: DestinationString="lstrlenA") [0259.056] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="lstrlenA", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e0c60) returned 0x0 [0259.056] GetLastError () returned 0x0 [0259.056] SetLastError (dwErrCode=0x0) [0259.056] GetLastError () returned 0x0 [0259.056] SetLastError (dwErrCode=0x0) [0259.056] GetLastError () returned 0x0 [0259.056] SetLastError (dwErrCode=0x0) [0259.056] GetLastError () returned 0x0 [0259.056] SetLastError (dwErrCode=0x0) [0259.056] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="FreeConsole" | out: DestinationString="FreeConsole") [0259.056] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FreeConsole", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ee0c0) returned 0x0 [0259.056] GetLastError () returned 0x0 [0259.056] SetLastError (dwErrCode=0x0) [0259.056] GetLastError () returned 0x0 [0259.057] SetLastError (dwErrCode=0x0) [0259.057] GetLastError () returned 0x0 [0259.057] SetLastError (dwErrCode=0x0) [0259.057] GetLastError () returned 0x0 [0259.057] SetLastError (dwErrCode=0x0) [0259.057] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="EnterCriticalSection" | out: DestinationString="EnterCriticalSection") [0259.057] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="EnterCriticalSection", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd504fe600) returned 0x0 [0259.061] GetLastError () returned 0x0 [0259.061] SetLastError (dwErrCode=0x0) [0259.061] GetLastError () returned 0x0 [0259.061] SetLastError (dwErrCode=0x0) [0259.061] GetLastError () returned 0x0 [0259.061] SetLastError (dwErrCode=0x0) [0259.061] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="LeaveCriticalSection" | out: DestinationString="LeaveCriticalSection") [0259.061] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="LeaveCriticalSection", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd504feb00) returned 0x0 [0259.061] GetLastError () returned 0x0 [0259.061] SetLastError (dwErrCode=0x0) [0259.061] GetLastError () returned 0x0 [0259.062] SetLastError (dwErrCode=0x0) [0259.062] GetLastError () returned 0x0 [0259.062] SetLastError (dwErrCode=0x0) [0259.062] GetLastError () returned 0x0 [0259.062] SetLastError (dwErrCode=0x0) [0259.062] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="InitializeCriticalSectionEx" | out: DestinationString="InitializeCriticalSectionEx") [0259.062] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="InitializeCriticalSectionEx", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ed760) returned 0x0 [0259.062] GetLastError () returned 0x0 [0259.062] SetLastError (dwErrCode=0x0) [0259.062] GetLastError () returned 0x0 [0259.062] SetLastError (dwErrCode=0x0) [0259.062] GetLastError () returned 0x0 [0259.062] SetLastError (dwErrCode=0x0) [0259.062] GetLastError () returned 0x0 [0259.062] SetLastError (dwErrCode=0x0) [0259.062] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="DeleteCriticalSection" | out: DestinationString="DeleteCriticalSection") [0259.063] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="DeleteCriticalSection", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd505299d0) returned 0x0 [0259.063] GetLastError () returned 0x0 [0259.063] SetLastError (dwErrCode=0x0) [0259.063] GetLastError () returned 0x0 [0259.063] SetLastError (dwErrCode=0x0) [0259.063] GetLastError () returned 0x0 [0259.063] SetLastError (dwErrCode=0x0) [0259.063] GetLastError () returned 0x0 [0259.063] SetLastError (dwErrCode=0x0) [0259.063] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="EncodePointer" | out: DestinationString="EncodePointer") [0259.063] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="EncodePointer", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd50542780) returned 0x0 [0259.063] GetLastError () returned 0x0 [0259.063] SetLastError (dwErrCode=0x0) [0259.063] GetLastError () returned 0x0 [0259.063] SetLastError (dwErrCode=0x0) [0259.063] GetLastError () returned 0x0 [0259.063] SetLastError (dwErrCode=0x0) [0259.064] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="DecodePointer" | out: DestinationString="DecodePointer") [0259.064] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="DecodePointer", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd5052c630) returned 0x0 [0259.064] GetLastError () returned 0x0 [0259.064] SetLastError (dwErrCode=0x0) [0259.064] GetLastError () returned 0x0 [0259.064] SetLastError (dwErrCode=0x0) [0259.064] GetLastError () returned 0x0 [0259.064] SetLastError (dwErrCode=0x0) [0259.064] GetLastError () returned 0x0 [0259.064] SetLastError (dwErrCode=0x0) [0259.064] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="MultiByteToWideChar" | out: DestinationString="MultiByteToWideChar") [0259.064] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="MultiByteToWideChar", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1dd500) returned 0x0 [0259.064] GetLastError () returned 0x0 [0259.064] SetLastError (dwErrCode=0x0) [0259.064] GetLastError () returned 0x0 [0259.065] SetLastError (dwErrCode=0x0) [0259.065] GetLastError () returned 0x0 [0259.065] SetLastError (dwErrCode=0x0) [0259.065] GetLastError () returned 0x0 [0259.065] SetLastError (dwErrCode=0x0) [0259.065] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="WideCharToMultiByte" | out: DestinationString="WideCharToMultiByte") [0259.065] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="WideCharToMultiByte", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1db490) returned 0x0 [0259.065] GetLastError () returned 0x0 [0259.065] SetLastError (dwErrCode=0x0) [0259.065] GetLastError () returned 0x0 [0259.065] SetLastError (dwErrCode=0x0) [0259.065] GetLastError () returned 0x0 [0259.065] SetLastError (dwErrCode=0x0) [0259.065] GetLastError () returned 0x0 [0259.065] SetLastError (dwErrCode=0x0) [0259.065] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="LCMapStringEx" | out: DestinationString="LCMapStringEx") [0259.065] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="LCMapStringEx", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1dd560) returned 0x0 [0259.066] GetLastError () returned 0x0 [0259.066] SetLastError (dwErrCode=0x0) [0259.066] GetLastError () returned 0x0 [0259.066] SetLastError (dwErrCode=0x0) [0259.066] GetLastError () returned 0x0 [0259.066] SetLastError (dwErrCode=0x0) [0259.066] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetStringTypeW" | out: DestinationString="GetStringTypeW") [0259.066] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetStringTypeW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e4bf0) returned 0x0 [0259.066] GetLastError () returned 0x0 [0259.066] SetLastError (dwErrCode=0x0) [0259.066] GetLastError () returned 0x0 [0259.066] SetLastError (dwErrCode=0x0) [0259.066] GetLastError () returned 0x0 [0259.066] SetLastError (dwErrCode=0x0) [0259.066] GetLastError () returned 0x0 [0259.066] SetLastError (dwErrCode=0x0) [0259.067] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetCPInfo" | out: DestinationString="GetCPInfo") [0259.067] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetCPInfo", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e31e0) returned 0x0 [0259.067] GetLastError () returned 0x0 [0259.067] SetLastError (dwErrCode=0x0) [0259.067] GetLastError () returned 0x0 [0259.067] SetLastError (dwErrCode=0x0) [0259.067] GetLastError () returned 0x0 [0259.067] SetLastError (dwErrCode=0x0) [0259.067] GetLastError () returned 0x0 [0259.067] SetLastError (dwErrCode=0x0) [0259.067] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RtlCaptureContext" | out: DestinationString="RtlCaptureContext") [0259.067] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RtlCaptureContext", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ed410) returned 0x0 [0259.067] GetLastError () returned 0x0 [0259.067] SetLastError (dwErrCode=0x0) [0259.067] GetLastError () returned 0x0 [0259.067] SetLastError (dwErrCode=0x0) [0259.067] GetLastError () returned 0x0 [0259.068] SetLastError (dwErrCode=0x0) [0259.068] GetLastError () returned 0x0 [0259.068] SetLastError (dwErrCode=0x0) [0259.068] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RtlLookupFunctionEntry" | out: DestinationString="RtlLookupFunctionEntry") [0259.068] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RtlLookupFunctionEntry", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e6e60) returned 0x0 [0259.068] GetLastError () returned 0x0 [0259.068] SetLastError (dwErrCode=0x0) [0259.068] GetLastError () returned 0x0 [0259.068] SetLastError (dwErrCode=0x0) [0259.068] GetLastError () returned 0x0 [0259.068] SetLastError (dwErrCode=0x0) [0259.068] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RtlVirtualUnwind" | out: DestinationString="RtlVirtualUnwind") [0259.068] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RtlVirtualUnwind", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ea410) returned 0x0 [0259.068] GetLastError () returned 0x0 [0259.068] SetLastError (dwErrCode=0x0) [0259.068] GetLastError () returned 0x0 [0259.069] SetLastError (dwErrCode=0x0) [0259.069] GetLastError () returned 0x0 [0259.069] SetLastError (dwErrCode=0x0) [0259.069] GetLastError () returned 0x0 [0259.069] SetLastError (dwErrCode=0x0) [0259.069] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="UnhandledExceptionFilter" | out: DestinationString="UnhandledExceptionFilter") [0259.069] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="UnhandledExceptionFilter", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e206a20) returned 0x0 [0259.069] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="SetUnhandledExceptionFilter" | out: DestinationString="SetUnhandledExceptionFilter") [0259.069] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetUnhandledExceptionFilter", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e6ea0) returned 0x0 [0259.069] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="TerminateProcess" | out: DestinationString="TerminateProcess") [0259.070] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="TerminateProcess", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e8cf0) returned 0x0 [0259.070] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="IsProcessorFeaturePresent" | out: DestinationString="IsProcessorFeaturePresent") [0259.070] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="IsProcessorFeaturePresent", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e3d30) returned 0x0 [0259.070] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="IsDebuggerPresent" | out: DestinationString="IsDebuggerPresent") [0259.070] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="IsDebuggerPresent", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e7460) returned 0x0 [0259.070] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetStartupInfoW" | out: DestinationString="GetStartupInfoW") [0259.070] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetStartupInfoW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e4c00) returned 0x0 [0259.070] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="QueryPerformanceCounter" | out: DestinationString="QueryPerformanceCounter") [0259.070] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="QueryPerformanceCounter", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1db720) returned 0x0 [0259.071] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetCurrentThreadId" | out: DestinationString="GetCurrentThreadId") [0259.071] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetCurrentThreadId", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1db460) returned 0x0 [0259.071] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetSystemTimeAsFileTime" | out: DestinationString="GetSystemTimeAsFileTime") [0259.071] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetSystemTimeAsFileTime", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ddf70) returned 0x0 [0259.071] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="InitializeSListHead" | out: DestinationString="InitializeSListHead") [0259.071] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="InitializeSListHead", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd505421c0) returned 0x0 [0259.071] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="HeapSize" | out: DestinationString="HeapSize") [0259.072] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="HeapSize", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd504eb780) returned 0x0 [0259.072] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RtlPcToFileHeader" | out: DestinationString="RtlPcToFileHeader") [0259.072] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RtlPcToFileHeader", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e5170) returned 0x0 [0259.072] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RaiseException" | out: DestinationString="RaiseException") [0259.072] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RaiseException", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e4d70) returned 0x0 [0259.072] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="RtlUnwindEx" | out: DestinationString="RtlUnwindEx") [0259.072] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RtlUnwindEx", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e6ba0) returned 0x0 [0259.072] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetLastError" | out: DestinationString="GetLastError") [0259.073] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetLastError", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1db710) returned 0x0 [0259.073] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="InitializeCriticalSectionAndSpinCount" | out: DestinationString="InitializeCriticalSectionAndSpinCount") [0259.073] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="InitializeCriticalSectionAndSpinCount", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ed750) returned 0x0 [0259.073] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="TlsAlloc" | out: DestinationString="TlsAlloc") [0259.073] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="TlsAlloc", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e3ad0) returned 0x0 [0259.073] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="TlsGetValue" | out: DestinationString="TlsGetValue") [0259.073] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="TlsGetValue", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1db450) returned 0x0 [0259.073] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="TlsSetValue" | out: DestinationString="TlsSetValue") [0259.074] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="TlsSetValue", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1db7d0) returned 0x0 [0259.074] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="TlsFree" | out: DestinationString="TlsFree") [0259.074] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="TlsFree", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e3e40) returned 0x0 [0259.075] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="ExitProcess" | out: DestinationString="ExitProcess") [0259.075] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="ExitProcess", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e4d80) returned 0x0 [0259.075] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetModuleHandleExW" | out: DestinationString="GetModuleHandleExW") [0259.075] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetModuleHandleExW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e6b90) returned 0x0 [0259.075] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetModuleFileNameW" | out: DestinationString="GetModuleFileNameW") [0259.075] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetModuleFileNameW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e4840) returned 0x0 [0259.075] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetStdHandle" | out: DestinationString="GetStdHandle") [0259.076] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetStdHandle", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e3e80) returned 0x0 [0259.076] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="WriteFile" | out: DestinationString="WriteFile") [0259.076] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="WriteFile", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1edcc0) returned 0x0 [0259.076] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="HeapFree" | out: DestinationString="HeapFree") [0259.076] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="HeapFree", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1db480) returned 0x0 [0259.076] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="HeapAlloc" | out: DestinationString="HeapAlloc") [0259.076] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="HeapAlloc", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd504f52d0) returned 0x0 [0259.076] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="FlsAlloc" | out: DestinationString="FlsAlloc") [0259.076] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FlsAlloc", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e6cd0) returned 0x0 [0259.077] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="FlsGetValue" | out: DestinationString="FlsGetValue") [0259.077] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FlsGetValue", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1dd6e0) returned 0x0 [0259.077] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="FlsSetValue" | out: DestinationString="FlsSetValue") [0259.077] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FlsSetValue", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e3ae0) returned 0x0 [0259.077] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="FlsFree" | out: DestinationString="FlsFree") [0259.077] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FlsFree", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e7660) returned 0x0 [0259.077] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="CompareStringW" | out: DestinationString="CompareStringW") [0259.077] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="CompareStringW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e2ce0) returned 0x0 [0259.077] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="LCMapStringW" | out: DestinationString="LCMapStringW") [0259.078] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="LCMapStringW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ddd00) returned 0x0 [0259.078] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetLocaleInfoW" | out: DestinationString="GetLocaleInfoW") [0259.078] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetLocaleInfoW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e72a0) returned 0x0 [0259.078] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="IsValidLocale" | out: DestinationString="IsValidLocale") [0259.078] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="IsValidLocale", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e3a80) returned 0x0 [0259.078] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetUserDefaultLCID" | out: DestinationString="GetUserDefaultLCID") [0259.078] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetUserDefaultLCID", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e3a70) returned 0x0 [0259.078] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="EnumSystemLocalesW" | out: DestinationString="EnumSystemLocalesW") [0259.079] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="EnumSystemLocalesW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e205d30) returned 0x0 [0259.079] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetFileType" | out: DestinationString="GetFileType") [0259.079] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetFileType", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1edac0) returned 0x0 [0259.079] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="FlushFileBuffers" | out: DestinationString="FlushFileBuffers") [0259.079] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FlushFileBuffers", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ed9d0) returned 0x0 [0259.079] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetConsoleOutputCP" | out: DestinationString="GetConsoleOutputCP") [0259.079] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetConsoleOutputCP", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1edfb0) returned 0x0 [0259.079] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetConsoleMode" | out: DestinationString="GetConsoleMode") [0259.079] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetConsoleMode", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1edfa0) returned 0x0 [0259.079] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetFileSizeEx" | out: DestinationString="GetFileSizeEx") [0259.080] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetFileSizeEx", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1edaa0) returned 0x0 [0259.080] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="SetFilePointerEx" | out: DestinationString="SetFilePointerEx") [0259.080] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetFilePointerEx", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1edc70) returned 0x0 [0259.080] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="ReadConsoleW" | out: DestinationString="ReadConsoleW") [0259.080] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="ReadConsoleW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ee010) returned 0x0 [0259.080] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="HeapReAlloc" | out: DestinationString="HeapReAlloc") [0259.080] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="HeapReAlloc", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd504f39f0) returned 0x0 [0259.080] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="FindClose" | out: DestinationString="FindClose") [0259.080] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FindClose", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ed900) returned 0x0 [0259.081] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="FindFirstFileExW" | out: DestinationString="FindFirstFileExW") [0259.081] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FindFirstFileExW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ed960) returned 0x0 [0259.081] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="FindNextFileW" | out: DestinationString="FindNextFileW") [0259.081] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FindNextFileW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ed9c0) returned 0x0 [0259.081] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="IsValidCodePage" | out: DestinationString="IsValidCodePage") [0259.081] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="IsValidCodePage", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e31d0) returned 0x0 [0259.081] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetACP" | out: DestinationString="GetACP") [0259.081] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetACP", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1dd720) returned 0x0 [0259.081] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetOEMCP" | out: DestinationString="GetOEMCP") [0259.082] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetOEMCP", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ec840) returned 0x0 [0259.082] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetEnvironmentStringsW" | out: DestinationString="GetEnvironmentStringsW") [0259.082] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetEnvironmentStringsW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e6790) returned 0x0 [0259.082] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="FreeEnvironmentStringsW" | out: DestinationString="FreeEnvironmentStringsW") [0259.082] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FreeEnvironmentStringsW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e67a0) returned 0x0 [0259.082] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="SetEnvironmentVariableW" | out: DestinationString="SetEnvironmentVariableW") [0259.083] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetEnvironmentVariableW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e7500) returned 0x0 [0259.083] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="GetProcessHeap" | out: DestinationString="GetProcessHeap") [0259.083] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetProcessHeap", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1dd4f0) returned 0x0 [0259.083] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="SetStdHandle" | out: DestinationString="SetStdHandle") [0259.083] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetStdHandle", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1e7190) returned 0x0 [0259.083] RtlInitAnsiString (in: DestinationString=0x7ffb88, SourceString="WriteConsoleW" | out: DestinationString="WriteConsoleW") [0259.083] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="WriteConsoleW", Ordinal=0x0, ProcedureAddress=0x7ffb98 | out: ProcedureAddress=0x7ffb98*=0x7ffd4e1ee050) returned 0x0 [0259.083] SetLastError (dwErrCode=0x0) [0259.084] GetLastError () returned 0x0 [0259.084] SetLastError (dwErrCode=0x0) [0259.084] GetLastError () returned 0x0 [0259.084] SetLastError (dwErrCode=0x0) [0259.085] GetLastError () returned 0x0 [0259.085] SetLastError (dwErrCode=0x0) [0259.085] GetLastError () returned 0x0 [0259.085] GetLastError () returned 0x0 [0259.085] SetLastError (dwErrCode=0x0) [0259.085] SetLastError (dwErrCode=0x0) [0259.085] GetLastError () returned 0x0 [0259.085] SetLastError (dwErrCode=0x0) [0259.086] GetLastError () returned 0x0 [0259.086] SetLastError (dwErrCode=0x0) [0259.086] GetLastError () returned 0x0 [0259.086] SetLastError (dwErrCode=0x0) [0259.086] GetLastError () returned 0x0 [0259.086] SetLastError (dwErrCode=0x0) [0259.086] GetLastError () returned 0x0 [0259.086] SetLastError (dwErrCode=0x0) [0259.086] GetLastError () returned 0x0 [0259.086] GetLastError () returned 0x0 [0259.086] SetLastError (dwErrCode=0x0) [0259.087] SetLastError (dwErrCode=0x0) [0259.087] GetLastError () returned 0x0 [0259.087] SetLastError (dwErrCode=0x0) [0259.087] GetLastError () returned 0x0 [0259.087] SetLastError (dwErrCode=0x0) [0259.087] GetLastError () returned 0x0 [0259.087] SetLastError (dwErrCode=0x0) [0259.087] GetLastError () returned 0x0 [0259.087] SetLastError (dwErrCode=0x0) [0259.087] VirtualProtect (in: lpAddress=0x7ff67c4a0000, dwSize=0x400, flNewProtect=0x4, lpflOldProtect=0x7ffd30 | out: lpflOldProtect=0x7ffd30*=0x2) returned 1 [0259.088] VirtualProtect (in: lpAddress=0x7ff67c4a0000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x7ffd28 | out: lpflOldProtect=0x7ffd28*=0x4) returned 1 [0259.088] GetLastError () returned 0x0 [0259.088] SetLastError (dwErrCode=0x0) [0259.088] GetLastError () returned 0x0 [0259.089] GetLastError () returned 0x0 [0259.089] SetLastError (dwErrCode=0x0) [0259.089] SetLastError (dwErrCode=0x0) [0259.089] GetLastError () returned 0x0 [0259.089] SetLastError (dwErrCode=0x0) [0259.089] VirtualProtect (in: lpAddress=0x7ff67c4a1000, dwSize=0x33b0c, flNewProtect=0x20, lpflOldProtect=0x7ffd40 | out: lpflOldProtect=0x7ffd40*=0x40) returned 1 [0259.090] VirtualProtect (in: lpAddress=0x7ff67c4d5000, dwSize=0x125ec, flNewProtect=0x2, lpflOldProtect=0x7ffd40 | out: lpflOldProtect=0x7ffd40*=0x40) returned 1 [0259.091] VirtualProtect (in: lpAddress=0x7ff67c4e8000, dwSize=0x825e9c, flNewProtect=0x4, lpflOldProtect=0x7ffd40 | out: lpflOldProtect=0x7ffd40*=0x40) returned 1 [0259.117] VirtualProtect (in: lpAddress=0x7ff67cd0e000, dwSize=0x2fdc, flNewProtect=0x2, lpflOldProtect=0x7ffd40 | out: lpflOldProtect=0x7ffd40*=0x80) returned 1 [0259.118] VirtualProtect (in: lpAddress=0x7ff67cd11000, dwSize=0xf4, flNewProtect=0x2, lpflOldProtect=0x7ffd40 | out: lpflOldProtect=0x7ffd40*=0x40) returned 1 [0259.118] VirtualProtect (in: lpAddress=0x7ff67cd12000, dwSize=0x96c, flNewProtect=0x2, lpflOldProtect=0x7ffd40 | out: lpflOldProtect=0x7ffd40*=0x40) returned 1 [0259.118] GetLastError () returned 0x0 [0259.118] SetLastError (dwErrCode=0x0) [0259.118] GetLastError () returned 0x0 [0259.119] SetLastError (dwErrCode=0x0) [0259.119] GetLastError () returned 0x0 [0259.119] SetLastError (dwErrCode=0x0) [0259.119] GetLastError () returned 0x0 [0259.119] SetLastError (dwErrCode=0x0) [0259.119] GetLastError () returned 0x0 [0259.119] GetLastError () returned 0x0 [0259.119] SetLastError (dwErrCode=0x0) [0259.119] SetLastError (dwErrCode=0x0) [0259.119] GetLastError () returned 0x0 [0259.120] SetLastError (dwErrCode=0x0) [0259.120] GetLastError () returned 0x0 [0259.120] SetLastError (dwErrCode=0x0) [0259.120] GetLastError () returned 0x0 [0259.120] SetLastError (dwErrCode=0x0) [0259.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x400000, lpStartAddress=0x7ff67cd27e30, lpParameter=0xad3780, dwCreationFlags=0x10004, lpThreadId=0x7ffbb8 | out: lpThreadId=0x7ffbb8*=0xf1c) returned 0x1f0 [0259.120] GetLocalTime (in: lpSystemTime=0x7ffcb0 | out: lpSystemTime=0x7ffcb0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2a, wSecond=0x2f, wMilliseconds=0x3cd)) [0259.121] ResumeThread (hThread=0x1f0) returned 0x1 [0259.121] SetTimer (hWnd=0x0, nIDEvent=0x1, uElapse=0x10d6, lpTimerFunc=0x7ff67cd6f060) returned 0x7f5c [0259.121] GetLastError () returned 0x0 [0259.121] SetLastError (dwErrCode=0x0) [0259.121] GetLastError () returned 0x0 [0259.121] SetLastError (dwErrCode=0x0) [0259.121] GetLastError () returned 0x0 [0259.122] SetLastError (dwErrCode=0x0) [0259.122] GetLastError () returned 0x0 [0259.122] SetLastError (dwErrCode=0x0) [0259.122] GetLastError () returned 0x0 [0259.122] SetLastError (dwErrCode=0x0) [0259.122] GetLastError () returned 0x0 [0259.122] GetLastError () returned 0x0 [0259.122] SetLastError (dwErrCode=0x0) [0259.122] SetLastError (dwErrCode=0x0) [0259.122] GetLastError () returned 0x0 [0259.123] SetLastError (dwErrCode=0x0) [0259.123] GetLastError () returned 0x0 [0259.123] SetLastError (dwErrCode=0x0) [0259.123] GetLastError () returned 0x0 [0259.123] SetLastError (dwErrCode=0x0) [0259.123] GetLastError () returned 0x0 [0259.123] SetLastError (dwErrCode=0x0) [0259.124] GetLastError () returned 0x0 [0259.124] SetLastError (dwErrCode=0x0) [0259.124] GetLastError () returned 0x0 [0259.124] SetLastError (dwErrCode=0x0) [0259.124] GetLastError () returned 0x0 [0259.124] SetLastError (dwErrCode=0x0) [0259.124] GetLastError () returned 0x0 [0259.124] SetLastError (dwErrCode=0x0) [0259.125] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x7ffdb8 | out: lpSystemTimeAsFileTime=0x7ffdb8*(dwLowDateTime=0xe847ff6, dwHighDateTime=0x1d7fc90)) [0259.125] GetCurrentThreadId () returned 0x1160 [0259.125] QueryPerformanceCounter (in: lpPerformanceCount=0x7ffdc0 | out: lpPerformanceCount=0x7ffdc0*=1217933454564) returned 1 [0259.125] GetLastError () returned 0x0 [0259.125] SetLastError (dwErrCode=0x0) [0259.125] GetLastError () returned 0x0 [0259.125] SetLastError (dwErrCode=0x0) [0259.125] GetLastError () returned 0x0 [0259.125] SetLastError (dwErrCode=0x0) [0259.126] GetLastError () returned 0x0 [0259.126] SetLastError (dwErrCode=0x0) [0259.126] SysReAllocStringLen (in: pbstr=0x7ffb98*=0x0, psz="api-ms-win-core-synch-l1-2-0", len=0x1c | out: pbstr=0x7ffb98*="api-ms-win-core-synch-l1-2-0") returned 1 [0259.126] CharLowerBuffW (in: lpsz="api-ms-win-core-synch-l1-2-0", cchLength=0x1c | out: lpsz="api-ms-win-core-synch-l1-2-0") returned 0x1c [0259.126] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0259.126] GetLastError () returned 0x0 [0259.127] SetLastError (dwErrCode=0x0) [0259.127] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4d6c7c50 [0259.127] GetLastError () returned 0x0 [0259.127] SetLastError (dwErrCode=0x0) [0259.127] GetLastError () returned 0x0 [0259.127] SetLastError (dwErrCode=0x0) [0259.127] GetLastError () returned 0x0 [0259.127] SetLastError (dwErrCode=0x0) [0259.127] GetLastError () returned 0x0 [0259.127] SetLastError (dwErrCode=0x0) [0259.127] SysReAllocStringLen (in: pbstr=0x7ffb98*=0x0, psz="api-ms-win-core-fibers-l1-1-1", len=0x1d | out: pbstr=0x7ffb98*="api-ms-win-core-fibers-l1-1-1") returned 1 [0259.128] CharLowerBuffW (in: lpsz="api-ms-win-core-fibers-l1-1-1", cchLength=0x1d | out: lpsz="api-ms-win-core-fibers-l1-1-1") returned 0x1d [0259.128] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0259.128] GetLastError () returned 0x0 [0259.128] SetLastError (dwErrCode=0x0) [0259.128] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsAlloc") returned 0x7ffd4d6d7e50 [0259.128] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsSetValue") returned 0x7ffd4d6c3cb0 [0259.129] GetLastError () returned 0x0 [0259.129] SetLastError (dwErrCode=0x0) [0259.129] GetLastError () returned 0x0 [0259.129] SetLastError (dwErrCode=0x0) [0259.129] GetLastError () returned 0x0 [0259.129] SetLastError (dwErrCode=0x0) [0259.129] GetLastError () returned 0x0 [0259.129] SetLastError (dwErrCode=0x0) [0259.129] SysReAllocStringLen (in: pbstr=0x7ffb98*=0x0, psz="api-ms-win-core-synch-l1-2-0", len=0x1c | out: pbstr=0x7ffb98*="api-ms-win-core-synch-l1-2-0") returned 1 [0259.129] CharLowerBuffW (in: lpsz="api-ms-win-core-synch-l1-2-0", cchLength=0x1c | out: lpsz="api-ms-win-core-synch-l1-2-0") returned 0x1c [0259.129] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0259.130] GetLastError () returned 0x0 [0259.130] SetLastError (dwErrCode=0x0) [0259.130] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4d6c7c50 [0259.130] GetProcessHeap () returned 0x8f0000 [0259.130] GetLastError () returned 0x0 [0259.130] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x3c8) returned 0x28bc9c0 [0259.131] SetLastError (dwErrCode=0x0) [0259.131] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x1200) returned 0x28bcd90 [0259.133] GetStartupInfoW (in: lpStartupInfo=0x7ffc90 | out: lpStartupInfo=0x7ffc90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) [0259.133] GetStdHandle (nStdHandle=0xfffffff6) returned 0x20 [0259.133] GetFileType (hFile=0x20) returned 0x2 [0259.133] GetStdHandle (nStdHandle=0xfffffff5) returned 0x24 [0259.133] GetFileType (hFile=0x24) returned 0x2 [0259.133] GetStdHandle (nStdHandle=0xfffffff4) returned 0x28 [0259.133] GetFileType (hFile=0x28) returned 0x2 [0259.133] GetACP () returned 0x4e4 [0259.133] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x228) returned 0x28bdfa0 [0259.133] IsValidCodePage (CodePage=0x4e4) returned 1 [0259.133] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x7ffa30 | out: lpCPInfo=0x7ffa30) returned 1 [0259.133] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x7ff2d0 | out: lpCPInfo=0x7ff2d0) returned 1 [0259.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x7ff2f0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0259.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x7ff2f0, cbMultiByte=256, lpWideCharStr=0x7ff020, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0259.133] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpCharType=0x7ff5f0 | out: lpCharType=0x7ff5f0) returned 1 [0259.133] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x7ff2f0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0259.134] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x7ff2f0, cbMultiByte=256, lpWideCharStr=0x7fefc0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0259.134] GetLastError () returned 0x0 [0259.134] SetLastError (dwErrCode=0x0) [0259.134] GetLastError () returned 0x0 [0259.134] SetLastError (dwErrCode=0x0) [0259.134] GetLastError () returned 0x0 [0259.134] SetLastError (dwErrCode=0x0) [0259.134] GetLastError () returned 0x0 [0259.134] SetLastError (dwErrCode=0x0) [0259.134] SysReAllocStringLen (in: pbstr=0x7fedb8*=0x0, psz="api-ms-win-core-localization-l1-2-1", len=0x23 | out: pbstr=0x7fedb8*="api-ms-win-core-localization-l1-2-1") returned 1 [0259.134] CharLowerBuffW (in: lpsz="api-ms-win-core-localization-l1-2-1", cchLength=0x23 | out: lpsz="api-ms-win-core-localization-l1-2-1") returned 0x23 [0259.134] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0259.147] GetLastError () returned 0x0 [0259.147] SetLastError (dwErrCode=0x0) [0259.147] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="LCMapStringEx") returned 0x7ffd4d685350 [0259.147] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0259.147] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x7fedb0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0259.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x7ff3f0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x97\x02", lpUsedDefaultChar=0x0) returned 256 [0259.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x7ff2f0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0259.148] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x7ff2f0, cbMultiByte=256, lpWideCharStr=0x7fefc0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0259.148] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0259.148] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x7fedb0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0259.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x7ff4f0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0259.148] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x100) returned 0x907630 [0259.148] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7ffab0, nSize=0x105 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe")) returned 0x32 [0259.148] GetLastError () returned 0x0 [0259.148] SetLastError (dwErrCode=0x0) [0259.148] GetLastError () returned 0x0 [0259.149] SetLastError (dwErrCode=0x0) [0259.149] GetLastError () returned 0x0 [0259.149] SetLastError (dwErrCode=0x0) [0259.149] GetLastError () returned 0x0 [0259.149] SetLastError (dwErrCode=0x0) [0259.149] SysReAllocStringLen (in: pbstr=0x7ff8b8*=0x0, psz="kernel32", len=0x8 | out: pbstr=0x7ff8b8*="kernel32") returned 1 [0259.149] CharLowerBuffW (in: lpsz="kernel32", cchLength=0x8 | out: lpsz="kernel32") returned 0x8 [0259.149] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x7ffd4e1c0000 [0259.149] GetLastError () returned 0x0 [0259.149] SetLastError (dwErrCode=0x0) [0259.149] GetLastError () returned 0x0 [0259.150] SetLastError (dwErrCode=0x0) [0259.150] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="AreFileApisANSI") returned 0x7ffd4e1e4820 [0259.150] GetLastError () returned 0x0 [0259.150] SetLastError (dwErrCode=0x0) [0259.150] AreFileApisANSI () returned 1 [0259.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0259.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", cchWideChar=-1, lpMultiByteStr=0x7ff67cd0d5c0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe", lpUsedDefaultChar=0x0) returned 51 [0259.150] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x43) returned 0xae33f0 [0259.150] RtlInitializeSListHead (in: ListHead=0x7ff67cd0d1b0 | out: ListHead=0x7ff67cd0d1b0) [0259.150] GetLastError () returned 0x0 [0259.150] SetLastError (dwErrCode=0x0) [0259.150] GetEnvironmentStringsW () returned 0x28be5f0* [0259.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1254, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1254 [0259.150] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x4e6) returned 0x250b160 [0259.150] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1254, lpMultiByteStr=0x250b160, cbMultiByte=1254, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1254 [0259.150] FreeEnvironmentStringsW (penv=0x28be5f0) returned 1 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x118) returned 0x919580 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x1f) returned 0x28beac0 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x2e) returned 0x28b2130 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x31) returned 0x28b2730 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x3c) returned 0xae3b20 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x31) returned 0x28b2df0 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x14) returned 0x250b9c0 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x24) returned 0x28beb80 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0xd) returned 0x250b9a0 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x1d) returned 0x28beaf0 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x31) returned 0x28b2a70 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x15) returned 0x250ba20 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x17) returned 0x250bb20 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0xe) returned 0x250b8e0 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x69) returned 0xae4a20 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x3e) returned 0xae3e40 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x1d) returned 0x28bea60 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x48) returned 0xae35d0 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x12) returned 0x250bb00 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x18) returned 0x250bce0 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x1b) returned 0x28bea00 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x1e) returned 0x28beb20 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x29) returned 0x28b2070 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x1e) returned 0x28be910 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x6b) returned 0xae4d20 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x17) returned 0x250b740 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0xf) returned 0x250bb80 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x16) returned 0x250b780 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x2a) returned 0x28b2ab0 [0259.151] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x29) returned 0x28b1ff0 [0259.152] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x12) returned 0x250ba40 [0259.152] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x21) returned 0x28be730 [0259.152] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x16) returned 0x250bae0 [0259.152] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x22) returned 0x28beb50 [0259.152] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x12) returned 0x250bd00 [0259.152] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250b160 | out: hHeap=0x8f0000) returned 1 [0259.152] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x1000) returned 0x250be60 [0259.152] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff67c4b61ac) returned 0x0 [0259.153] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x20) returned 0x28bec70 [0259.153] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x30) returned 0x28b2030 [0259.154] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x20) returned 0x28be820 [0259.154] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x30) returned 0x28b2c70 [0259.154] FreeConsole () returned 1 [0259.467] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x7ff570 | out: TokenHandle=0x7ff570*=0x28) returned 1 [0259.467] GetTokenInformation (in: TokenHandle=0x28, TokenInformationClass=0x14, TokenInformation=0x7ff568, TokenInformationLength=0x4, ReturnLength=0x7ff564 | out: TokenInformation=0x7ff568, ReturnLength=0x7ff564) returned 1 [0259.467] CloseHandle (hObject=0x28) returned 1 [0259.467] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender", ulOptions=0x0, samDesired=0x20006, phkResult=0x7ff578 | out: phkResult=0x7ff578*=0x28) returned 0x0 [0259.468] RegSetValueExA (in: hKey=0x28, lpValueName="DisableAntiSpyware", Reserved=0x0, dwType=0x4, lpData=0x7ff5a8*=0x1, cbData=0x4 | out: lpData=0x7ff5a8*=0x1) returned 0x0 [0259.468] RegCloseKey (hKey=0x28) returned 0x0 [0259.468] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x7ff558, dwRevision=0x1 | out: pSecurityDescriptor=0x7ff558) returned 1 [0259.468] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x7ff558, bDaclPresent=1, pDacl=0x0, bDaclDefaulted=0 | out: pSecurityDescriptor=0x7ff558) returned 1 [0259.468] RegCreateKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x7ff540, phkResult=0x7ff538, lpdwDisposition=0x7ff534 | out: phkResult=0x7ff538*=0x28, lpdwDisposition=0x7ff534*=0x1) returned 0x0 [0259.475] RegCloseKey (hKey=0x28) returned 0x0 [0259.476] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", ulOptions=0x0, samDesired=0x20006, phkResult=0x7ff578 | out: phkResult=0x7ff578*=0x28) returned 0x0 [0259.476] RegSetValueExA (in: hKey=0x28, lpValueName="DisableBehaviorMonitoring", Reserved=0x0, dwType=0x4, lpData=0x7ff5a8*=0x1, cbData=0x4 | out: lpData=0x7ff5a8*=0x1) returned 0x0 [0259.477] RegCloseKey (hKey=0x28) returned 0x0 [0259.477] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", ulOptions=0x0, samDesired=0x20006, phkResult=0x7ff578 | out: phkResult=0x7ff578*=0x28) returned 0x0 [0259.477] RegSetValueExA (in: hKey=0x28, lpValueName="DisableOnAccessProtection", Reserved=0x0, dwType=0x4, lpData=0x7ff5a8*=0x1, cbData=0x4 | out: lpData=0x7ff5a8*=0x1) returned 0x0 [0259.477] RegCloseKey (hKey=0x28) returned 0x0 [0259.477] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", ulOptions=0x0, samDesired=0x20006, phkResult=0x7ff578 | out: phkResult=0x7ff578*=0x28) returned 0x0 [0259.477] RegSetValueExA (in: hKey=0x28, lpValueName="DisableScanOnRealtimeEnable", Reserved=0x0, dwType=0x4, lpData=0x7ff5a8*=0x1, cbData=0x4 | out: lpData=0x7ff5a8*=0x1) returned 0x0 [0259.478] RegCloseKey (hKey=0x28) returned 0x0 [0259.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x30) returned 0x28b2770 [0259.478] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x47) returned 0xae3ee0 [0259.478] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28b2770 | out: hHeap=0x8f0000) returned 1 [0259.479] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x250b860 [0259.479] GetLastError () returned 0x0 [0259.479] SetLastError (dwErrCode=0x0) [0259.479] GetLastError () returned 0x0 [0259.479] SetLastError (dwErrCode=0x0) [0259.479] GetLastError () returned 0x0 [0259.479] SetLastError (dwErrCode=0x0) [0259.479] GetLastError () returned 0x0 [0259.479] SetLastError (dwErrCode=0x0) [0259.479] SysReAllocStringLen (in: pbstr=0x7ff108*=0x0, psz="api-ms-win-core-string-l1-1-0", len=0x1d | out: pbstr=0x7ff108*="api-ms-win-core-string-l1-1-0") returned 1 [0259.479] CharLowerBuffW (in: lpsz="api-ms-win-core-string-l1-1-0", cchLength=0x1d | out: lpsz="api-ms-win-core-string-l1-1-0") returned 0x1d [0259.479] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0259.480] GetLastError () returned 0x0 [0259.480] SetLastError (dwErrCode=0x0) [0259.480] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="CompareStringEx") returned 0x7ffd4d684040 [0259.480] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="EnumSystemLocalesEx") returned 0x7ffd4d6e2bd0 [0259.480] GetLastError () returned 0x0 [0259.481] SetLastError (dwErrCode=0x0) [0259.481] GetLastError () returned 0x0 [0259.481] SetLastError (dwErrCode=0x0) [0259.481] GetLastError () returned 0x0 [0259.481] SetLastError (dwErrCode=0x0) [0259.481] GetLastError () returned 0x0 [0259.481] SetLastError (dwErrCode=0x0) [0259.481] SysReAllocStringLen (in: pbstr=0x7ff108*=0x0, psz="api-ms-win-core-datetime-l1-1-1", len=0x1f | out: pbstr=0x7ff108*="api-ms-win-core-datetime-l1-1-1") returned 1 [0259.481] CharLowerBuffW (in: lpsz="api-ms-win-core-datetime-l1-1-1", cchLength=0x1f | out: lpsz="api-ms-win-core-datetime-l1-1-1") returned 0x1f [0259.481] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0259.481] GetLastError () returned 0x0 [0259.481] SetLastError (dwErrCode=0x0) [0259.482] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="GetDateFormatEx") returned 0x7ffd4d6d1230 [0259.482] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="GetLocaleInfoEx") returned 0x7ffd4d680710 [0259.482] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="GetTimeFormatEx") returned 0x7ffd4d6d87b0 [0259.482] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="GetUserDefaultLocaleName") returned 0x7ffd4d6a37a0 [0259.482] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="IsValidLocaleName") returned 0x7ffd4d69a6f0 [0259.486] GetLastError () returned 0x0 [0259.486] SetLastError (dwErrCode=0x0) [0259.486] GetLastError () returned 0x0 [0259.486] SetLastError (dwErrCode=0x0) [0259.486] GetLastError () returned 0x0 [0259.486] SetLastError (dwErrCode=0x0) [0259.486] GetLastError () returned 0x0 [0259.486] SetLastError (dwErrCode=0x0) [0259.486] SysReAllocStringLen (in: pbstr=0x7ff108*=0x0, psz="api-ms-win-core-localization-obsolete-l1-2-0", len=0x2c | out: pbstr=0x7ff108*="api-ms-win-core-localization-obsolete-l1-2-0") returned 1 [0259.486] CharLowerBuffW (in: lpsz="api-ms-win-core-localization-obsolete-l1-2-0", cchLength=0x2c | out: lpsz="api-ms-win-core-localization-obsolete-l1-2-0") returned 0x2c [0259.486] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0259.487] GetLastError () returned 0x0 [0259.487] SetLastError (dwErrCode=0x0) [0259.487] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="LCIDToLocaleName") returned 0x7ffd4d6ce2c0 [0259.487] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="LocaleNameToLCID") returned 0x7ffd4d67e330 [0259.487] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x38) returned 0x28b2e30 [0259.487] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x2) returned 0x25093e0 [0259.487] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x25093e0 | out: hHeap=0x8f0000) returned 1 [0259.487] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x2) returned 0x25093e0 [0259.488] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x30) returned 0x28b2b30 [0259.488] GetLastError () returned 0x0 [0259.488] SetLastError (dwErrCode=0x0) [0259.488] GetLastError () returned 0x0 [0259.488] SetLastError (dwErrCode=0x0) [0259.488] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x158) returned 0x28bee00 [0259.488] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6a6) returned 0x250de80 [0259.489] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250de80 | out: hHeap=0x8f0000) returned 1 [0259.489] GetLastError () returned 0x0 [0259.489] SetLastError (dwErrCode=0x0) [0259.489] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6) returned 0xae62f0 [0259.489] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x2) returned 0xae6320 [0259.489] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x4) returned 0xae61e0 [0259.489] GetLastError () returned 0x0 [0259.489] SetLastError (dwErrCode=0x0) [0259.489] GetLastError () returned 0x0 [0259.489] SetLastError (dwErrCode=0x0) [0259.489] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x158) returned 0xae6a80 [0259.490] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6a6) returned 0x250de80 [0259.490] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250de80 | out: hHeap=0x8f0000) returned 1 [0259.490] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae62f0 | out: hHeap=0x8f0000) returned 1 [0259.491] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28bee00 | out: hHeap=0x8f0000) returned 1 [0259.491] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae61e0 | out: hHeap=0x8f0000) returned 1 [0259.491] GetLastError () returned 0x0 [0259.491] SetLastError (dwErrCode=0x0) [0259.491] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6) returned 0xae6250 [0259.491] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x2) returned 0xae6330 [0259.491] GetLastError () returned 0x0 [0259.491] SetLastError (dwErrCode=0x0) [0259.491] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x200) returned 0x250de80 [0259.491] GetLastError () returned 0x0 [0259.491] SetLastError (dwErrCode=0x0) [0259.492] GetLastError () returned 0x0 [0259.492] SetLastError (dwErrCode=0x0) [0259.492] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x4) returned 0xae61e0 [0259.492] GetLastError () returned 0x0 [0259.492] SetLastError (dwErrCode=0x0) [0259.492] GetLastError () returned 0x0 [0259.492] SetLastError (dwErrCode=0x0) [0259.492] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x158) returned 0x28bee00 [0259.492] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6a6) returned 0x250e090 [0259.493] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250e090 | out: hHeap=0x8f0000) returned 1 [0259.493] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6250 | out: hHeap=0x8f0000) returned 1 [0259.493] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6a80 | out: hHeap=0x8f0000) returned 1 [0259.493] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae61e0 | out: hHeap=0x8f0000) returned 1 [0259.493] GetLastError () returned 0x0 [0259.493] SetLastError (dwErrCode=0x0) [0259.493] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6) returned 0xae6250 [0259.493] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6330 | out: hHeap=0x8f0000) returned 1 [0259.493] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6320 | out: hHeap=0x8f0000) returned 1 [0259.494] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x250b6c0 [0259.494] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x250baa0 [0259.494] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x58) returned 0x24d1560 [0259.494] AreFileApisANSI () returned 1 [0259.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0xae3ee0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0259.494] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x78) returned 0xae4fa0 [0259.494] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0xae3ee0, cbMultiByte=-1, lpWideCharStr=0xae4fa0, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 60 [0259.494] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x7ff100, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0259.495] GetLastError () returned 0x2 [0259.495] GetLastError () returned 0x2 [0259.495] SetLastError (dwErrCode=0x2) [0259.495] GetLastError () returned 0x2 [0259.495] SetLastError (dwErrCode=0x2) [0259.495] GetLastError () returned 0x2 [0259.495] SetLastError (dwErrCode=0x2) [0259.496] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae4fa0 | out: hHeap=0x8f0000) returned 1 [0259.496] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250baa0 | out: hHeap=0x8f0000) returned 1 [0259.496] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250b860 | out: hHeap=0x8f0000) returned 1 [0259.496] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x30) returned 0x28b2b70 [0259.497] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x47) returned 0xae3620 [0259.497] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28b2b70 | out: hHeap=0x8f0000) returned 1 [0259.497] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x7ff570 | out: TokenHandle=0x7ff570*=0x28) returned 1 [0259.497] GetTokenInformation (in: TokenHandle=0x28, TokenInformationClass=0x14, TokenInformation=0x7ff568, TokenInformationLength=0x4, ReturnLength=0x7ff564 | out: TokenInformation=0x7ff568, ReturnLength=0x7ff564) returned 1 [0259.497] CloseHandle (hObject=0x28) returned 1 [0259.497] lstrlenA (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 59 [0259.497] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20006, phkResult=0x7ff578 | out: phkResult=0x7ff578*=0x28) returned 0x0 [0259.497] RegSetValueExA (in: hKey=0x28, lpValueName="RegHost", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", cbData=0x3b | out: lpData="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 0x0 [0259.498] RegCloseKey (hKey=0x28) returned 0x0 [0259.498] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40) returned 0xae3bc0 [0259.498] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x250b7e0 [0259.498] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x250b7a0 [0259.499] AreFileApisANSI () returned 1 [0259.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0xae3bc0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0259.499] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x66) returned 0x2509670 [0259.499] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0xae3bc0, cbMultiByte=-1, lpWideCharStr=0x2509670, cchWideChar=51 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe") returned 51 [0259.499] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x7ff260, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0259.499] GetFileType (hFile=0x28) returned 0x1 [0259.500] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x2509670 | out: hHeap=0x8f0000) returned 1 [0259.500] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x250ba00 [0259.500] GetLastError () returned 0x0 [0259.500] SetLastError (dwErrCode=0x0) [0259.500] GetLastError () returned 0x0 [0259.500] SetLastError (dwErrCode=0x0) [0259.501] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x158) returned 0xae6a80 [0259.501] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6a6) returned 0x250e090 [0259.501] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250e090 | out: hHeap=0x8f0000) returned 1 [0259.501] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6250 | out: hHeap=0x8f0000) returned 1 [0259.501] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28bee00 | out: hHeap=0x8f0000) returned 1 [0259.501] GetLastError () returned 0x0 [0259.501] SetLastError (dwErrCode=0x0) [0259.501] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6) returned 0xae6200 [0259.502] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x2) returned 0xae6280 [0259.502] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x4) returned 0xae6250 [0259.502] GetLastError () returned 0x0 [0259.502] SetLastError (dwErrCode=0x0) [0259.502] GetLastError () returned 0x0 [0259.502] SetLastError (dwErrCode=0x0) [0259.502] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x158) returned 0x28bee00 [0259.502] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6a6) returned 0x250e090 [0259.502] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250e090 | out: hHeap=0x8f0000) returned 1 [0259.503] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6200 | out: hHeap=0x8f0000) returned 1 [0259.503] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6a80 | out: hHeap=0x8f0000) returned 1 [0259.503] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6250 | out: hHeap=0x8f0000) returned 1 [0259.503] GetLastError () returned 0x0 [0259.503] SetLastError (dwErrCode=0x0) [0259.503] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6) returned 0xae6250 [0259.503] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x2) returned 0xae6310 [0259.503] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x4) returned 0xae6260 [0259.503] GetLastError () returned 0x0 [0259.503] SetLastError (dwErrCode=0x0) [0259.503] GetLastError () returned 0x0 [0259.503] SetLastError (dwErrCode=0x0) [0259.504] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x158) returned 0xae6a80 [0259.504] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6a6) returned 0x250e090 [0259.504] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250e090 | out: hHeap=0x8f0000) returned 1 [0259.504] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6250 | out: hHeap=0x8f0000) returned 1 [0259.504] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28bee00 | out: hHeap=0x8f0000) returned 1 [0259.505] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6260 | out: hHeap=0x8f0000) returned 1 [0259.505] GetLastError () returned 0x0 [0259.505] SetLastError (dwErrCode=0x0) [0259.505] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x6) returned 0xae6260 [0259.505] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6310 | out: hHeap=0x8f0000) returned 1 [0259.505] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6280 | out: hHeap=0x8f0000) returned 1 [0259.505] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x250b8a0 [0259.505] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x250bb40 [0259.505] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x250bbc0 [0259.506] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x58) returned 0x24d20a0 [0259.506] AreFileApisANSI () returned 1 [0259.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0xae3ee0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0259.506] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x78) returned 0xae4720 [0259.506] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0xae3ee0, cbMultiByte=-1, lpWideCharStr=0xae4720, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 60 [0259.506] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x7ff260, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24 [0259.517] GetFileType (hFile=0x24) returned 0x1 [0259.517] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae4720 | out: hHeap=0x8f0000) returned 1 [0259.517] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x250be00 [0259.518] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x10) returned 0x250bd60 [0259.518] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x58) returned 0x24d15c0 [0259.518] AreFileApisANSI () returned 1 [0259.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0xae3bc0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 51 [0259.518] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x66) returned 0x2509750 [0259.518] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0xae3bc0, cbMultiByte=-1, lpWideCharStr=0x2509750, cchWideChar=51 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe") returned 51 [0259.518] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x7ff110, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x20 [0259.823] GetFileType (hFile=0x20) returned 0x1 [0259.823] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x2509750 | out: hHeap=0x8f0000) returned 1 [0259.823] SetFilePointerEx (in: hFile=0x20, liDistanceToMove=0x0, lpNewFilePointer=0x7ff270, dwMoveMethod=0x2 | out: lpNewFilePointer=0x7ff270*=8483840) returned 1 [0259.824] SetFilePointerEx (in: hFile=0x20, liDistanceToMove=0x0, lpNewFilePointer=0x7ff1d0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x7ff1d0*=8483840) returned 1 [0259.824] CloseHandle (hObject=0x20) returned 1 [0259.824] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250bd60 | out: hHeap=0x8f0000) returned 1 [0259.825] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250be00 | out: hHeap=0x8f0000) returned 1 [0259.825] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x817400) returned 0x359e040 [0259.862] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x1000) returned 0xae6f00 [0259.863] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.864] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.864] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.864] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.865] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.865] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.865] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.865] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.866] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.866] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.866] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.866] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.867] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.867] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.867] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.867] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.868] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.868] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.868] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.868] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.869] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.869] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.869] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.870] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.870] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.870] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.871] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.871] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.871] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.871] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.872] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.872] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.872] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.872] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.873] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.873] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.873] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.873] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.874] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.874] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.874] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.875] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.875] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.876] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.876] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.876] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.877] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.877] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.877] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.877] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.878] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.878] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.878] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.878] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.879] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.879] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.879] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.879] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.880] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.880] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.880] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.881] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.881] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.881] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.881] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.882] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.883] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.883] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.883] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.883] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.883] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.884] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.884] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.884] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.884] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.885] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.885] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.885] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.886] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.886] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.886] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.887] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.887] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.888] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.888] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.889] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.889] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.889] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.890] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.890] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.890] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.890] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.891] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.891] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.891] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.892] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.892] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.892] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.892] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.893] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.893] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.893] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.894] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.894] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.894] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.894] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.895] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.895] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.895] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.895] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.896] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.896] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.896] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.896] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.897] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.897] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.897] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.898] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.898] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.898] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.899] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.899] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.899] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.899] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.900] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.900] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.901] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.901] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.901] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.902] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.903] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.903] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.903] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.904] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.904] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.904] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.904] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.905] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.905] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.905] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.905] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.906] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.906] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.906] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.907] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.907] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.908] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.908] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.908] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.908] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.909] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.909] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.909] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.909] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.910] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.910] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.911] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.911] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.911] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.911] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.912] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.912] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.912] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.913] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.913] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.913] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.913] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.914] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.914] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.914] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.914] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.915] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.915] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.915] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.915] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.916] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.916] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.916] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.916] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.917] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.917] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.917] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.917] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.918] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.918] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.919] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.919] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.919] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.919] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.920] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.920] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.920] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.920] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.922] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.922] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.922] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.923] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.923] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.923] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.924] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.924] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.924] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.924] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.925] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.925] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.941] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.941] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.942] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.942] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.942] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.943] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.943] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.943] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.944] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.944] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.944] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.945] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.945] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.945] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.946] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.946] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.946] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.947] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.947] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.948] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.948] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.948] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.953] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.954] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.956] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.956] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.957] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.957] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.957] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.957] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.958] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.958] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.958] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.958] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.959] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.959] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.959] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.959] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.960] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.960] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.960] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.960] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.960] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0259.960] ReadFile (in: hFile=0x28, lpBuffer=0xae6f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x7ff348, lpOverlapped=0x0 | out: lpBuffer=0xae6f00*, lpNumberOfBytesRead=0x7ff348*=0x1000, lpOverlapped=0x0) returned 1 [0261.164] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x8, Size=0x1000) returned 0xae6f00 [0261.165] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsGetValue") returned 0x7ffd4d6b3780 [0261.165] SetLastError (dwErrCode=0x0) [0261.166] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x20) returned 0x28bebb0 [0261.166] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x30) returned 0x28b2830 [0261.167] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28bebb0 | out: hHeap=0x8f0000) returned 1 [0261.167] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x30) returned 0x28b2cf0 [0261.167] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x50) returned 0x24d2160 [0261.168] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28b2830 | out: hHeap=0x8f0000) returned 1 [0261.168] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28b2cf0 | out: hHeap=0x8f0000) returned 1 [0261.168] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x40) returned 0xae3f80 [0261.168] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x80) returned 0x250d8e0 [0261.168] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x24d2160 | out: hHeap=0x8f0000) returned 1 [0261.169] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae3f80 | out: hHeap=0x8f0000) returned 1 [0261.169] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0xbf) returned 0x28bee00 [0261.169] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250d8e0 | out: hHeap=0x8f0000) returned 1 [0261.169] RtlAllocateHeap (HeapHandle=0x8f0000, Flags=0x0, Size=0x20) returned 0x28be940 [0261.170] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28be940 | out: hHeap=0x8f0000) returned 1 [0261.170] CreateProcessA (in: lpApplicationName="C:\\Windows\\explorer.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x7ff510*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x7ff4e0 | out: lpCommandLine=0x0, lpProcessInformation=0x7ff4e0*(hProcess=0x28, hThread=0x24, dwProcessId=0xf0, dwThreadId=0x388)) returned 1 [0262.485] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x1000, flProtect=0x4) returned 0x8c0000 [0262.486] GetThreadContext (in: hThread=0x24, lpContext=0x8c0000 | out: lpContext=0x8c0000*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x10000b, MxCsr=0x1f80, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x7ff7aac6e090, Rdx=0x319000, Rbx=0x0, Rsp=0xcffd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7ffd5052c230, FltSave.ControlWord=0x27f, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x1f80, FltSave.MxCsr_Mask=0xffff, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x27f, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0262.493] VirtualAllocEx (hProcess=0x28, lpAddress=0x140000000, dwSize=0x22000, flAllocationType=0x3000, flProtect=0x40) returned 0x140000000 [0262.494] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x140000000, lpBuffer=0x7ff67c4e8000*, nSize=0x400, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c4e8000*, lpNumberOfBytesWritten=0x0) returned 1 [0262.497] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x140001000, lpBuffer=0x7ff67c4e8400*, nSize=0xf400, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c4e8400*, lpNumberOfBytesWritten=0x0) returned 1 [0262.501] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x319010, lpBuffer=0x7ff67c4e8138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c4e8138*, lpNumberOfBytesWritten=0x0) returned 1 [0262.502] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x140011000, lpBuffer=0x7ff67c4f7800*, nSize=0x9c00, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c4f7800*, lpNumberOfBytesWritten=0x0) returned 1 [0262.506] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x319010, lpBuffer=0x7ff67c4e8138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c4e8138*, lpNumberOfBytesWritten=0x0) returned 1 [0262.506] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x14001b000, lpBuffer=0x7ff67c501400*, nSize=0xc00, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c501400*, lpNumberOfBytesWritten=0x0) returned 1 [0262.509] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x319010, lpBuffer=0x7ff67c4e8138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c4e8138*, lpNumberOfBytesWritten=0x0) returned 1 [0262.509] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x14001d000, lpBuffer=0x7ff67c502000*, nSize=0x1200, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c502000*, lpNumberOfBytesWritten=0x0) returned 1 [0262.512] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x319010, lpBuffer=0x7ff67c4e8138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c4e8138*, lpNumberOfBytesWritten=0x0) returned 1 [0262.512] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x14001f000, lpBuffer=0x7ff67c503200*, nSize=0x200, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c503200*, lpNumberOfBytesWritten=0x0) returned 1 [0262.515] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x319010, lpBuffer=0x7ff67c4e8138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c4e8138*, lpNumberOfBytesWritten=0x0) returned 1 [0262.515] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x140020000, lpBuffer=0x7ff67c503400*, nSize=0x200, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c503400*, lpNumberOfBytesWritten=0x0) returned 1 [0262.517] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x319010, lpBuffer=0x7ff67c4e8138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c4e8138*, lpNumberOfBytesWritten=0x0) returned 1 [0262.518] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x140021000, lpBuffer=0x7ff67c503600*, nSize=0x800, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c503600*, lpNumberOfBytesWritten=0x0) returned 1 [0262.520] WriteProcessMemory (in: hProcess=0x28, lpBaseAddress=0x319010, lpBuffer=0x7ff67c4e8138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c4e8138*, lpNumberOfBytesWritten=0x0) returned 1 [0262.521] SetThreadContext (hThread=0x24, lpContext=0x8c0000*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x10000b, MxCsr=0x1f80, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x140001c18, Rdx=0x319000, Rbx=0x0, Rsp=0xcffd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7ffd5052c230, FltSave.ControlWord=0x27f, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x1f80, FltSave.MxCsr_Mask=0xffff, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x27f, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0262.522] ResumeThread (hThread=0x24) returned 0x1 [0262.522] WaitForSingleObject (hHandle=0x28, dwMilliseconds=0x0) returned 0x102 [0262.522] SetPriorityClass (hProcess=0x28, dwPriorityClass=0x40) returned 1 [0262.522] CreateProcessA (in: lpApplicationName="C:\\Windows\\bfsvc.exe", lpCommandLine="C:\\Windows\\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0xa6ceE57d9638dA506ff99899c6C018292Ef4826C -coin etc -worker EasyMiner_Bot -mi 14", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x7ff510*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x7ff4e0 | out: lpCommandLine="C:\\Windows\\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0xa6ceE57d9638dA506ff99899c6C018292Ef4826C -coin etc -worker EasyMiner_Bot -mi 14", lpProcessInformation=0x7ff4e0*(hProcess=0x20, hThread=0x18, dwProcessId=0x908, dwThreadId=0xfe4)) returned 1 [0262.750] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x1000, flProtect=0x4) returned 0x8d0000 [0262.750] GetThreadContext (in: hThread=0x18, lpContext=0x8d0000 | out: lpContext=0x8d0000*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x10000b, MxCsr=0x1f80, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x7ff7a55b8c30, Rdx=0x24a000, Rbx=0x0, Rsp=0xcffd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7ffd5052c230, FltSave.ControlWord=0x27f, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x1f80, FltSave.MxCsr_Mask=0xffff, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x27f, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0262.751] VirtualAllocEx (hProcess=0x20, lpAddress=0x140000000, dwSize=0x815000, flAllocationType=0x3000, flProtect=0x40) returned 0x140000000 [0262.755] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x140000000, lpBuffer=0x7ff67c503e00*, nSize=0x400, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c503e00*, lpNumberOfBytesWritten=0x0) returned 1 [0262.755] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x140001000, lpBuffer=0x7ff67c504200*, nSize=0x422a00, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c504200*, lpNumberOfBytesWritten=0x0) returned 1 [0262.894] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x24a010, lpBuffer=0x7ff67c503f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c503f70*, lpNumberOfBytesWritten=0x0) returned 1 [0262.896] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x140424000, lpBuffer=0x7ff67c926c00*, nSize=0x35c400, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c926c00*, lpNumberOfBytesWritten=0x0) returned 1 [0263.018] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x24a010, lpBuffer=0x7ff67c503f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c503f70*, lpNumberOfBytesWritten=0x0) returned 1 [0263.020] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x140781000, lpBuffer=0x7ff67cc83000*, nSize=0x56a00, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67cc83000*, lpNumberOfBytesWritten=0x0) returned 1 [0263.032] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x24a010, lpBuffer=0x7ff67c503f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c503f70*, lpNumberOfBytesWritten=0x0) returned 1 [0263.034] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x1407e1000, lpBuffer=0x7ff67ccd9a00*, nSize=0x28600, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67ccd9a00*, lpNumberOfBytesWritten=0x0) returned 1 [0263.040] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x24a010, lpBuffer=0x7ff67c503f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c503f70*, lpNumberOfBytesWritten=0x0) returned 1 [0263.042] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x14080a000, lpBuffer=0x7ff67cd02000*, nSize=0x200, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67cd02000*, lpNumberOfBytesWritten=0x0) returned 1 [0263.043] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x24a010, lpBuffer=0x7ff67c503f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c503f70*, lpNumberOfBytesWritten=0x0) returned 1 [0263.044] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x14080b000, lpBuffer=0x7ff67cd02200*, nSize=0x1000, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67cd02200*, lpNumberOfBytesWritten=0x0) returned 1 [0263.045] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x24a010, lpBuffer=0x7ff67c503f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c503f70*, lpNumberOfBytesWritten=0x0) returned 1 [0263.048] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x14080c000, lpBuffer=0x7ff67cd03200*, nSize=0x200, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67cd03200*, lpNumberOfBytesWritten=0x0) returned 1 [0263.049] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x24a010, lpBuffer=0x7ff67c503f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c503f70*, lpNumberOfBytesWritten=0x0) returned 1 [0263.051] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x14080d000, lpBuffer=0x7ff67cd03400*, nSize=0x8000, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67cd03400*, lpNumberOfBytesWritten=0x0) returned 1 [0263.053] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x24a010, lpBuffer=0x7ff67c503f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff67c503f70*, lpNumberOfBytesWritten=0x0) returned 1 [0263.054] SetThreadContext (hThread=0x18, lpContext=0x8d0000*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x10000b, MxCsr=0x1f80, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x1403a756c, Rdx=0x24a000, Rbx=0x0, Rsp=0xcffd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7ffd5052c230, FltSave.ControlWord=0x27f, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x1f80, FltSave.MxCsr_Mask=0xffff, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x27f, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0263.054] ResumeThread (hThread=0x18) returned 0x1 [0263.054] WaitForSingleObject (hHandle=0x20, dwMilliseconds=0x0) returned 0x102 [0263.055] SetPriorityClass (hProcess=0x20, dwPriorityClass=0x40) returned 1 [0263.055] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28bee00 | out: hHeap=0x8f0000) returned 1 [0263.056] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae3ee0 | out: hHeap=0x8f0000) returned 1 [0263.056] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28b2c70 | out: hHeap=0x8f0000) returned 1 [0263.057] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28be820 | out: hHeap=0x8f0000) returned 1 [0263.057] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28b2030 | out: hHeap=0x8f0000) returned 1 [0263.057] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28bec70 | out: hHeap=0x8f0000) returned 1 [0263.057] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250ba00 | out: hHeap=0x8f0000) returned 1 [0263.058] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250b8a0 | out: hHeap=0x8f0000) returned 1 [0263.058] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250de80 | out: hHeap=0x8f0000) returned 1 [0263.058] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28b2b30 | out: hHeap=0x8f0000) returned 1 [0263.058] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250b6c0 | out: hHeap=0x8f0000) returned 1 [0263.059] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x25093e0 | out: hHeap=0x8f0000) returned 1 [0263.059] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28b2e30 | out: hHeap=0x8f0000) returned 1 [0263.060] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x907630 | out: hHeap=0x8f0000) returned 1 [0263.061] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x24d1560 | out: hHeap=0x8f0000) returned 1 [0263.061] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x24d20a0 | out: hHeap=0x8f0000) returned 1 [0263.062] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x24d15c0 | out: hHeap=0x8f0000) returned 1 [0263.062] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x250be60 | out: hHeap=0x8f0000) returned 1 [0263.062] GetLastError () returned 0x0 [0263.062] SetLastError (dwErrCode=0x0) [0263.062] GetLastError () returned 0x0 [0263.062] SetLastError (dwErrCode=0x0) [0263.063] GetLastError () returned 0x0 [0263.063] SetLastError (dwErrCode=0x0) [0263.063] GetLastError () returned 0x0 [0263.063] SetLastError (dwErrCode=0x0) [0263.063] SysReAllocStringLen (in: pbstr=0x7ffb38*=0x0, psz="api-ms-win-appmodel-runtime-l1-1-2", len=0x22 | out: pbstr=0x7ffb38*="api-ms-win-appmodel-runtime-l1-1-2") returned 1 [0263.063] CharLowerBuffW (in: lpsz="api-ms-win-appmodel-runtime-l1-1-2", cchLength=0x22 | out: lpsz="api-ms-win-appmodel-runtime-l1-1-2") returned 0x22 [0263.063] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x7ffd4cb70000 [0263.063] GetLastError () returned 0x0 [0263.063] SetLastError (dwErrCode=0x0) [0263.064] GetProcAddress (hModule=0x7ffd4cb70000, lpProcName="AppPolicyGetProcessTerminationMethod") returned 0x0 [0263.064] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x7ffd18 | out: phModule=0x7ffd18) returned 0 [0263.064] ExitProcess (uExitCode=0x0) [0263.065] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6260 | out: hHeap=0x8f0000) returned 1 [0263.065] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0xae6a80 | out: hHeap=0x8f0000) returned 1 [0263.065] HeapFree (in: hHeap=0x8f0000, dwFlags=0x0, lpMem=0x28bc9c0 | out: hHeap=0x8f0000) returned 1 Thread: id = 128 os_tid = 0x43c Thread: id = 129 os_tid = 0x4ec [0258.265] GetTickCount () returned 0xb83e90 [0258.265] Sleep (dwMilliseconds=0x3e8) [0259.791] Sleep (dwMilliseconds=0x3e8) [0260.919] Sleep (dwMilliseconds=0x3e8) [0262.484] Sleep (dwMilliseconds=0x3e8) Thread: id = 130 os_tid = 0xf1c [0259.135] GetLastError () returned 0x57 [0259.135] GetLastError () returned 0x0 [0259.135] LocalAlloc (uFlags=0x40, uBytes=0x12c9) returned 0x2509e80 [0259.136] SetLastError (dwErrCode=0x0) [0259.136] GetLastError () returned 0x0 [0259.136] SetLastError (dwErrCode=0x0) [0259.136] GetLastError () returned 0x0 [0259.136] SetLastError (dwErrCode=0x0) [0259.137] GetLastError () returned 0x0 [0259.137] SetLastError (dwErrCode=0x0) [0259.137] GetLastError () returned 0x0 [0259.137] SetLastError (dwErrCode=0x0) [0259.137] GetLastError () returned 0x0 [0259.137] SetLastError (dwErrCode=0x0) [0259.137] GetLastError () returned 0x0 [0259.137] SetLastError (dwErrCode=0x0) [0259.137] GetLastError () returned 0x0 [0259.137] SetLastError (dwErrCode=0x0) [0259.137] GetLastError () returned 0x0 [0259.137] SetLastError (dwErrCode=0x0) [0259.137] GetLastError () returned 0x0 [0259.137] SetLastError (dwErrCode=0x0) [0259.137] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff67c4a0000 [0259.138] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff67c4a0000 [0259.138] GetLastError () returned 0x0 [0259.138] SetLastError (dwErrCode=0x0) [0259.138] GetLastError () returned 0x0 [0259.138] SetLastError (dwErrCode=0x0) [0259.138] GetLastError () returned 0x0 [0259.138] SetLastError (dwErrCode=0x0) [0259.138] GetCurrentThreadId () returned 0xf1c [0259.138] GetLastError () returned 0x0 [0259.138] SetLastError (dwErrCode=0x0) [0259.138] SetLastError (dwErrCode=0x57) [0259.138] GetLastError () returned 0x57 [0259.138] SetLastError (dwErrCode=0x57) [0259.138] GetLastError () returned 0x57 [0259.138] SetLastError (dwErrCode=0x57) [0259.138] GetLocalTime (in: lpSystemTime=0x358fdd0 | out: lpSystemTime=0x358fdd0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2a, wSecond=0x2f, wMilliseconds=0x3df)) [0259.139] GetTickCount () returned 0xb841ec [0259.139] Sleep (dwMilliseconds=0x3e8) [0260.236] GetLocalTime (in: lpSystemTime=0x358fdd0 | out: lpSystemTime=0x358fdd0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2a, wSecond=0x31, wMilliseconds=0x58)) [0260.236] GetTickCount () returned 0xb84641 [0260.236] Sleep (dwMilliseconds=0x3e8) [0262.484] GetLocalTime (in: lpSystemTime=0x358fdd0 | out: lpSystemTime=0x358fdd0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2a, wSecond=0x33, wMilliseconds=0x150)) [0262.484] GetTickCount () returned 0xb84f0b [0262.484] Sleep (dwMilliseconds=0x3e8) Process: id = "7" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x74456000" os_pid = "0x1174" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x115c" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3772 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3773 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3774 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3775 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 3776 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 3777 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 3778 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 3779 start_va = 0x7ff7625c0000 end_va = 0x7ff7625d0fff monitored = 0 entry_point = 0x7ff7625c16b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 3780 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 3781 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 3782 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 3783 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 3784 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 3785 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 3786 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 3787 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 3788 start_va = 0x190000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 3789 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 3790 start_va = 0x1d0000 end_va = 0x1d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 3791 start_va = 0x7ffd44e60000 end_va = 0x7ffd44eb8fff monitored = 0 entry_point = 0x7ffd44e6fbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 3792 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 3793 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 3794 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 3795 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 3796 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 3797 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 3798 start_va = 0x1f0000 end_va = 0x1f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 3799 start_va = 0x7ffd50380000 end_va = 0x7ffd504c2fff monitored = 0 entry_point = 0x7ffd503a8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 3800 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 3801 start_va = 0x7ffd4e2e0000 end_va = 0x7ffd4e31afff monitored = 0 entry_point = 0x7ffd4e2e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 3802 start_va = 0x7ffd4db80000 end_va = 0x7ffd4dc40fff monitored = 0 entry_point = 0x7ffd4dba0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 3803 start_va = 0x7ffd4b010000 end_va = 0x7ffd4b195fff monitored = 0 entry_point = 0x7ffd4b05d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 3804 start_va = 0x4c0000 end_va = 0x647fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 3805 start_va = 0x650000 end_va = 0x7d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 3806 start_va = 0x7e0000 end_va = 0x1bdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007e0000" filename = "" Region: id = 3807 start_va = 0x1be0000 end_va = 0x1be0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001be0000" filename = "" Region: id = 3808 start_va = 0x1bf0000 end_va = 0x1bf0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bf0000" filename = "" Region: id = 3809 start_va = 0x1c00000 end_va = 0x1c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 3810 start_va = 0x1c00000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 3811 start_va = 0x1c60000 end_va = 0x1c6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c60000" filename = "" Region: id = 3812 start_va = 0x7ffd4eb30000 end_va = 0x7ffd5008efff monitored = 0 entry_point = 0x7ffd4ec911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 3813 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 3814 start_va = 0x7ffd4cce0000 end_va = 0x7ffd4d323fff monitored = 0 entry_point = 0x7ffd4cea64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 3815 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 3816 start_va = 0x7ffd500f0000 end_va = 0x7ffd50141fff monitored = 0 entry_point = 0x7ffd500ff530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 3817 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 3818 start_va = 0x7ffd4d5b0000 end_va = 0x7ffd4d664fff monitored = 0 entry_point = 0x7ffd4d5f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 3819 start_va = 0x7ffd4cb10000 end_va = 0x7ffd4cb5afff monitored = 0 entry_point = 0x7ffd4cb135f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 3820 start_va = 0x7ffd4caf0000 end_va = 0x7ffd4cb03fff monitored = 0 entry_point = 0x7ffd4caf52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 3821 start_va = 0x7ffd4b470000 end_va = 0x7ffd4b505fff monitored = 0 entry_point = 0x7ffd4b495570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 3822 start_va = 0x1c70000 end_va = 0x1e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c70000" filename = "" Region: id = 3824 start_va = 0x1e70000 end_va = 0x21a6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 3825 start_va = 0x21b0000 end_va = 0x23c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 3826 start_va = 0x23d0000 end_va = 0x25ebfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 3827 start_va = 0x1c70000 end_va = 0x1d81fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c70000" filename = "" Region: id = 3828 start_va = 0x1e60000 end_va = 0x1e6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 3829 start_va = 0x25f0000 end_va = 0x2805fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025f0000" filename = "" Region: id = 3830 start_va = 0x2810000 end_va = 0x291bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002810000" filename = "" Region: id = 3831 start_va = 0x1d90000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d90000" filename = "" Region: id = 3832 start_va = 0x7ffd4e320000 end_va = 0x7ffd4e479fff monitored = 0 entry_point = 0x7ffd4e3638e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 3833 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3834 start_va = 0x2920000 end_va = 0x29dbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002920000" filename = "" Region: id = 3835 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 3836 start_va = 0x7ffd4a370000 end_va = 0x7ffd4a391fff monitored = 0 entry_point = 0x7ffd4a371a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 3837 start_va = 0x7ffd4b200000 end_va = 0x7ffd4b212fff monitored = 0 entry_point = 0x7ffd4b202760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 3838 start_va = 0x7ffd4c900000 end_va = 0x7ffd4c955fff monitored = 0 entry_point = 0x7ffd4c910bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 3839 start_va = 0x60000 end_va = 0x66fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 3840 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 3841 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 3842 start_va = 0x1c40000 end_va = 0x1c41fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c40000" filename = "" Region: id = 3843 start_va = 0x1c50000 end_va = 0x1c50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001c50000" filename = "" Region: id = 3844 start_va = 0x1dd0000 end_va = 0x1dd4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 3845 start_va = 0x1de0000 end_va = 0x1de0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 3846 start_va = 0x1df0000 end_va = 0x1df1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001df0000" filename = "" Region: id = 3847 start_va = 0x29e0000 end_va = 0x2bd5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000029e0000" filename = "" Region: id = 3848 start_va = 0x7ffd43ba0000 end_va = 0x7ffd43e13fff monitored = 0 entry_point = 0x7ffd43c10400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 3849 start_va = 0x1e00000 end_va = 0x1e00fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 3850 start_va = 0x1e10000 end_va = 0x1e11fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e10000" filename = "" Region: id = 3851 start_va = 0x2be0000 end_va = 0x2cbcfff monitored = 0 entry_point = 0x2c3e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 3852 start_va = 0x1e00000 end_va = 0x1e00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e00000" filename = "" Region: id = 3853 start_va = 0x2be0000 end_va = 0x2cdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002be0000" filename = "" Region: id = 3854 start_va = 0x2ce0000 end_va = 0x2edefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002ce0000" filename = "" Thread: id = 124 os_tid = 0x118c Thread: id = 125 os_tid = 0x1190 Thread: id = 126 os_tid = 0x11a8 Thread: id = 127 os_tid = 0x11ac Process: id = "8" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x28e18000" os_pid = "0xf0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x115c" cmd_line = "\"C:\\Windows\\explorer.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 3995 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 3996 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3997 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 3998 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 3999 start_va = 0xe0000 end_va = 0xe1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4000 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 4001 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4002 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4003 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 4004 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 4005 start_va = 0x7ff7aabd0000 end_va = 0x7ff7ab017fff monitored = 0 entry_point = 0x7ff7aac6e090 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe") Region: id = 4006 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4008 start_va = 0x140000000 end_va = 0x140021fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000140000000" filename = "" Region: id = 4023 start_va = 0x100000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 4024 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4025 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4026 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4027 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 4034 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4035 start_va = 0x7ffd4a880000 end_va = 0x7ffd4a8f8fff monitored = 0 entry_point = 0x7ffd4a89fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4036 start_va = 0x7df5ffe40000 end_va = 0x7df5ffebdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4037 start_va = 0x7ffd4eb30000 end_va = 0x7ffd5008efff monitored = 0 entry_point = 0x7ffd4ec911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 4038 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4039 start_va = 0x4c0000 end_va = 0x5bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4040 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4041 start_va = 0x7ffd4cce0000 end_va = 0x7ffd4d323fff monitored = 0 entry_point = 0x7ffd4cea64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 4042 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4059 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4060 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4061 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4062 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4063 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4064 start_va = 0x7ffd500f0000 end_va = 0x7ffd50141fff monitored = 0 entry_point = 0x7ffd500ff530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4065 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4066 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4067 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4068 start_va = 0x7ffd4d5b0000 end_va = 0x7ffd4d664fff monitored = 0 entry_point = 0x7ffd4d5f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 4069 start_va = 0x7ffd4cb10000 end_va = 0x7ffd4cb5afff monitored = 0 entry_point = 0x7ffd4cb135f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4086 start_va = 0x7ffd4caf0000 end_va = 0x7ffd4cb03fff monitored = 0 entry_point = 0x7ffd4caf52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4087 start_va = 0x5c0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 4088 start_va = 0x5c0000 end_va = 0x5c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 4089 start_va = 0x6b0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006b0000" filename = "" Region: id = 4090 start_va = 0x5d0000 end_va = 0x608fff monitored = 0 entry_point = 0x5d12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4091 start_va = 0x6c0000 end_va = 0x847fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Region: id = 4092 start_va = 0x7ffd4e2e0000 end_va = 0x7ffd4e31afff monitored = 0 entry_point = 0x7ffd4e2e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4093 start_va = 0x850000 end_va = 0x9d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000850000" filename = "" Region: id = 4094 start_va = 0x9e0000 end_va = 0x1ddffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 4095 start_va = 0x5d0000 end_va = 0x5d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 4096 start_va = 0x5e0000 end_va = 0x5e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 4097 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4098 start_va = 0x5f0000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4099 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 4100 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4101 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4102 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4103 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4104 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4105 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4106 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4107 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4108 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4109 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4110 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4111 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4112 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4113 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4114 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4115 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4116 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4117 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4118 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4119 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4120 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4121 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4122 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4123 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4124 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4125 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4126 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4127 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4128 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4129 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4130 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4131 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4132 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4133 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4134 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4135 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4136 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4137 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4138 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4139 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4140 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4141 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4142 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4143 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4144 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4145 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4146 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4147 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4148 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4149 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4150 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4151 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4152 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4153 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4154 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4155 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4156 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4157 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4158 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4159 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4160 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4161 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4162 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4163 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4164 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4165 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4166 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4167 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4168 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4169 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4170 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4171 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4172 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4173 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4174 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4175 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4176 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4177 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4178 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4179 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4180 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4181 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4182 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4183 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4184 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4185 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4186 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4187 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4188 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4189 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4190 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4191 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4192 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4193 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4194 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4195 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4196 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4197 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4198 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4199 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4200 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4201 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4202 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4203 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4204 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4205 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4206 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4207 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4208 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4209 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4210 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4211 start_va = 0x5f0000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4212 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 4213 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4214 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4215 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4216 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4217 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4218 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4219 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4220 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4221 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4222 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4223 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4224 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4225 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4226 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4227 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4228 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4229 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4230 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4231 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4232 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4233 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4234 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4235 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4236 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4237 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4238 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4239 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4240 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4241 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4242 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4243 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4244 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4245 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4246 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4247 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4248 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4249 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4250 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4251 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4252 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4253 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4254 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4255 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4256 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4257 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4258 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4259 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4260 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4261 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4262 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4263 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4264 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4265 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4266 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4267 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4268 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4269 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4270 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4271 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4272 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4273 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4274 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4275 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4276 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4277 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4278 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4279 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4280 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4281 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4282 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4283 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4284 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4285 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4286 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4287 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4288 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4289 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4290 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4291 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4292 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4293 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4294 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4295 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4296 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4297 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4298 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4299 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4300 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4301 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4302 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4303 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4304 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4305 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4306 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4307 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4308 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4309 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4310 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4311 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4312 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4313 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4314 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4315 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4316 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4317 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4318 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4319 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4320 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4321 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4322 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4323 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4324 start_va = 0x5f0000 end_va = 0x60ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4325 start_va = 0x610000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 4326 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4327 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4328 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4329 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4330 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4331 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4332 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4333 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4334 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4335 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4336 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4337 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4338 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4339 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4340 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4341 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4342 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4343 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4344 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4345 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4346 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4347 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4348 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4349 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4350 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4351 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4352 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4353 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4354 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4355 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4356 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4357 start_va = 0x5f0000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4419 start_va = 0x5f0000 end_va = 0x5f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 4420 start_va = 0x1de0000 end_va = 0x2116fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4421 start_va = 0x7ffd4b470000 end_va = 0x7ffd4b505fff monitored = 0 entry_point = 0x7ffd4b495570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4422 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 4423 start_va = 0x7ffd50380000 end_va = 0x7ffd504c2fff monitored = 0 entry_point = 0x7ffd503a8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4424 start_va = 0x7ffd4b010000 end_va = 0x7ffd4b195fff monitored = 0 entry_point = 0x7ffd4b05d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 4425 start_va = 0x7ffd4db80000 end_va = 0x7ffd4dc40fff monitored = 0 entry_point = 0x7ffd4dba0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4426 start_va = 0x600000 end_va = 0x600fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000600000" filename = "" Region: id = 4427 start_va = 0x7ffd50150000 end_va = 0x7ffd501f6fff monitored = 0 entry_point = 0x7ffd5015b4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 4428 start_va = 0x610000 end_va = 0x610fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 4429 start_va = 0x620000 end_va = 0x623fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 4430 start_va = 0x630000 end_va = 0x674fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 4431 start_va = 0x680000 end_va = 0x683fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 4432 start_va = 0x690000 end_va = 0x691fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000690000" filename = "" Region: id = 4433 start_va = 0x2120000 end_va = 0x21adfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 4434 start_va = 0x21b0000 end_va = 0x21b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021b0000" filename = "" Region: id = 4435 start_va = 0x21c0000 end_va = 0x25bafff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000021c0000" filename = "" Region: id = 4436 start_va = 0x25d0000 end_va = 0x25e2fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db") Region: id = 4437 start_va = 0x25f0000 end_va = 0x25f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025f0000" filename = "" Region: id = 4438 start_va = 0x2600000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 4439 start_va = 0x2700000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 4440 start_va = 0x2800000 end_va = 0x287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002800000" filename = "" Region: id = 4441 start_va = 0x7ffd41100000 end_va = 0x7ffd412b7fff monitored = 0 entry_point = 0x7ffd4116e630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\System32\\urlmon.dll" (normalized: "c:\\windows\\system32\\urlmon.dll") Region: id = 4442 start_va = 0x7ffd47080000 end_va = 0x7ffd47401fff monitored = 0 entry_point = 0x7ffd470d1220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 4443 start_va = 0x7ffd4c770000 end_va = 0x7ffd4c79cfff monitored = 0 entry_point = 0x7ffd4c789d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Thread: id = 131 os_tid = 0x388 [0265.722] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0265.723] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4d6c7c50 [0265.724] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0265.725] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsAlloc") returned 0x7ffd4d6d7e50 [0265.725] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsSetValue") returned 0x7ffd4d6c3cb0 [0265.734] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0265.734] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4d6c7c50 [0265.734] GetProcessHeap () returned 0x100000 [0265.734] GetLastError () returned 0x36b7 [0265.735] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x3c8) returned 0x116a00 [0265.735] SetLastError (dwErrCode=0x36b7) [0265.736] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x1200) returned 0x116dd0 [0265.738] GetStartupInfoW (in: lpStartupInfo=0xcfe10 | out: lpStartupInfo=0xcfe10*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\explorer.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) [0265.738] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0265.738] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0265.738] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0265.738] GetCommandLineA () returned="\"C:\\Windows\\explorer.exe\"" [0265.738] GetCommandLineW () returned="\"C:\\Windows\\explorer.exe\"" [0265.739] GetACP () returned 0x4e4 [0265.739] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x0, Size=0x228) returned 0x10dc40 [0265.740] IsValidCodePage (CodePage=0x4e4) returned 1 [0265.740] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xcfbb0 | out: lpCPInfo=0xcfbb0) returned 1 [0265.740] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xcf450 | out: lpCPInfo=0xcf450) returned 1 [0265.740] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf470, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0265.740] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf470, cbMultiByte=256, lpWideCharStr=0xcf1a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x01䲯") returned 256 [0265.740] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x01䲯", cchSrc=256, lpCharType=0xcf770 | out: lpCharType=0xcf770) returned 1 [0265.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf470, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0265.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf470, cbMultiByte=256, lpWideCharStr=0xcf140, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0265.741] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0265.741] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="LCMapStringEx") returned 0x7ffd4d685350 [0265.741] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0265.741] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xcef30, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0265.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0xcf570, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0265.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf470, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0265.741] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf470, cbMultiByte=256, lpWideCharStr=0xcf140, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0265.741] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0265.741] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xcef30, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0265.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0xcf670, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0265.741] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x0, Size=0x100) returned 0x114270 [0265.742] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xcfc30, nSize=0x105 | out: lpFilename="C:\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe")) returned 0x17 [0265.742] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x7ffd4e1c0000 [0265.742] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="AreFileApisANSI") returned 0x7ffd4e1e4820 [0265.742] AreFileApisANSI () returned 1 [0265.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\explorer.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0265.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\explorer.exe", cchWideChar=-1, lpMultiByteStr=0x14001c2a0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\explorer.exe", lpUsedDefaultChar=0x0) returned 24 [0265.742] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x28) returned 0x1105c0 [0265.742] RtlInitializeSListHead (in: ListHead=0x14001c0e0 | out: ListHead=0x14001c0e0) [0265.742] GetLastError () returned 0x0 [0265.742] SetLastError (dwErrCode=0x0) [0265.742] GetEnvironmentStringsW () returned 0x117fe0* [0265.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1254, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1254 [0265.742] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x0, Size=0x4e6) returned 0x1189c0 [0265.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1254, lpMultiByteStr=0x1189c0, cbMultiByte=1254, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1254 [0265.742] FreeEnvironmentStringsW (penv=0x117fe0) returned 1 [0265.742] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x118) returned 0x10ee30 [0265.742] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x1f) returned 0x110680 [0265.742] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x2e) returned 0x109e20 [0265.742] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x31) returned 0x1097d0 [0265.742] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x3c) returned 0x116310 [0265.742] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x31) returned 0x109810 [0265.742] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x14) returned 0x1069c0 [0265.742] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x24) returned 0x10ffc0 [0265.742] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0xd) returned 0x109e60 [0265.742] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x1d) returned 0x1106b0 [0265.743] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x31) returned 0x109850 [0265.743] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x15) returned 0x106f20 [0265.743] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x17) returned 0x106f40 [0265.743] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0xe) returned 0x106f60 [0265.743] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x69) returned 0x1071b0 [0265.743] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x3e) returned 0x1160e0 [0265.743] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x1d) returned 0x10ff90 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x48) returned 0x1164f0 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x12) returned 0x107230 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x18) returned 0x107250 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x1b) returned 0x110470 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x1e) returned 0x1101d0 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x29) returned 0x106f80 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x1e) returned 0x110170 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x6b) returned 0x106a10 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x17) returned 0x106fc0 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0xf) returned 0x106a90 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x16) returned 0x106ab0 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x2a) returned 0x118270 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x29) returned 0x1183f0 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x12) returned 0x109b70 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x21) returned 0x110200 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x16) returned 0x119100 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x22) returned 0x110230 [0265.744] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x12) returned 0x119260 [0265.744] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x1189c0 | out: hHeap=0x100000) returned 1 [0265.745] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x8, Size=0x1000) returned 0x1192c0 [0265.745] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x14000245c) returned 0x0 [0265.745] GetStartupInfoW (in: lpStartupInfo=0xcfea0 | out: lpStartupInfo=0xcfea0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\explorer.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0265.745] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x0, Size=0x30) returned 0x1182b0 [0265.745] RtlAllocateHeap (HeapHandle=0x100000, Flags=0x0, Size=0x47) returned 0x116720 [0265.746] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x1182b0 | out: hHeap=0x100000) returned 1 [0265.746] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x8 [0265.788] Process32First (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0265.788] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0265.789] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0265.809] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.810] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0265.811] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0265.811] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0265.812] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0265.813] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0265.813] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.814] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.881] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0265.882] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.883] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.884] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.885] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.886] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.887] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.887] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.888] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0265.889] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0265.890] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x604, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0265.891] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.892] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0265.966] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0265.967] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0265.968] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0265.968] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0265.969] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0265.969] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0265.970] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.971] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0265.971] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0265.972] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0265.973] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0265.973] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0265.974] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0265.975] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0265.987] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0265.988] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1040, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="wind.exe")) returned 1 [0265.988] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="rest.exe")) returned 1 [0265.989] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="eventtimemember.exe")) returned 1 [0265.990] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1068, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="fly herself occur.exe")) returned 1 [0265.990] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0265.991] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1080, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell film.exe")) returned 1 [0265.992] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x108c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="alone.exe")) returned 1 [0265.992] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="project.exe")) returned 1 [0265.993] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="simple-company.exe")) returned 1 [0265.993] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="understand.exe")) returned 1 [0265.994] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="despite.exe")) returned 1 [0265.996] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="first hot son.exe")) returned 1 [0265.997] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="energy-war.exe")) returned 1 [0265.997] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle_dead.exe")) returned 1 [0265.998] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="conference-may.exe")) returned 1 [0265.999] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle-book.exe")) returned 1 [0266.000] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x110c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="song_role_treat.exe")) returned 1 [0266.000] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1118, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime.exe")) returned 1 [0266.001] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="sure.exe")) returned 1 [0266.002] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="enjoy.exe")) returned 1 [0266.003] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="what-scientist-win.exe")) returned 1 [0266.005] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="subject.exe")) returned 1 [0266.006] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0266.007] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x116c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0266.008] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x117c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0266.009] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0266.010] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0266.011] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0266.013] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0266.014] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0266.015] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0266.041] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0266.064] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0266.070] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0266.071] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0266.072] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0266.073] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0266.075] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x121c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0266.076] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0266.077] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1238, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0266.079] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0266.080] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0266.081] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1260, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0266.082] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0266.083] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0266.085] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0266.086] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0266.087] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0266.088] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0266.090] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0266.091] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0266.092] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0266.093] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0266.094] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0266.095] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0266.096] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0266.101] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0266.102] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0266.103] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0266.104] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0266.105] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0266.119] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0266.132] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0266.141] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0266.157] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x137c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0266.158] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1034, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x394, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0266.159] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x107c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0266.160] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x115c, pcPriClassBase=4, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.161] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x115c, pcPriClassBase=4, dwFlags=0x0, szExeFile="bfsvc.exe")) returned 1 [0266.162] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x908, pcPriClassBase=4, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0266.163] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x908, pcPriClassBase=4, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0266.164] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x14c [0266.175] Process32First (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.175] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.176] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.177] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.178] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.179] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.180] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.181] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.182] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.183] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.183] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.184] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0266.185] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.214] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.228] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.229] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.230] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.231] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.232] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.233] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0266.234] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0266.234] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x604, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.235] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.236] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0266.237] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0266.238] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0266.238] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0266.239] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0266.240] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0266.241] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0266.242] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.243] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0266.245] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0266.246] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0266.247] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0266.247] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.248] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0266.249] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0266.250] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0266.251] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1040, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="wind.exe")) returned 1 [0266.253] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="rest.exe")) returned 1 [0266.254] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1050, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="eventtimemember.exe")) returned 1 [0266.254] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1068, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="fly herself occur.exe")) returned 1 [0266.255] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1070, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0266.256] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1080, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="tell film.exe")) returned 1 [0266.257] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x108c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="alone.exe")) returned 1 [0266.258] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="project.exe")) returned 1 [0266.259] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="simple-company.exe")) returned 1 [0266.260] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="understand.exe")) returned 1 [0266.260] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="despite.exe")) returned 1 [0266.282] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="first hot son.exe")) returned 1 [0266.300] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="energy-war.exe")) returned 1 [0266.302] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle_dead.exe")) returned 1 [0266.304] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="conference-may.exe")) returned 1 [0266.305] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="middle-book.exe")) returned 1 [0266.306] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x110c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="song_role_treat.exe")) returned 1 [0266.307] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1118, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="crime.exe")) returned 1 [0266.308] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="sure.exe")) returned 1 [0266.309] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="enjoy.exe")) returned 1 [0266.310] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="what-scientist-win.exe")) returned 1 [0266.312] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="subject.exe")) returned 1 [0266.313] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0266.315] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x116c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0266.316] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x117c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0266.317] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0266.319] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0266.320] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0266.321] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0266.322] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0266.324] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0266.325] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0266.326] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0266.328] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0266.329] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x11fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0266.330] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0266.331] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0266.332] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x121c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0266.334] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0266.339] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1238, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0266.363] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0266.382] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0266.383] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1260, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0266.384] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0266.385] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0266.386] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x127c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0266.387] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0266.388] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x128c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0266.389] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0266.391] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0266.392] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0266.393] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0266.394] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0266.395] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0266.396] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0266.398] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0266.399] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0266.400] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0266.401] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0266.402] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0266.403] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0266.404] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0266.406] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0266.407] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0266.408] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x137c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0266.409] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1034, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x394, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0266.410] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x107c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0266.411] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x115c, pcPriClassBase=4, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.415] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x115c, pcPriClassBase=4, dwFlags=0x0, szExeFile="bfsvc.exe")) returned 1 [0266.442] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x908, pcPriClassBase=4, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0266.455] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x908, pcPriClassBase=4, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0266.457] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x150 [0266.467] Process32First (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0266.471] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0266.492] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0266.493] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.494] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0266.494] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0266.495] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0266.496] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0266.497] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0266.498] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.499] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.500] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0266.501] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.502] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.502] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.503] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.504] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.505] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.506] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.515] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0266.525] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0266.533] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x604, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0266.534] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.535] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0266.536] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0266.536] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0266.538] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0266.539] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0266.540] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0266.540] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0266.541] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xcc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0266.542] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0274.638] ExitProcess (uExitCode=0x1) [0274.639] HeapFree (in: hHeap=0x100000, dwFlags=0x0, lpMem=0x116a00 | out: hHeap=0x100000) returned 1 Thread: id = 134 os_tid = 0xe04 Thread: id = 139 os_tid = 0x588 Thread: id = 140 os_tid = 0x748 Thread: id = 141 os_tid = 0xd5c Process: id = "9" image_name = "bfsvc.exe" filename = "c:\\windows\\bfsvc.exe" page_root = "0x48034000" os_pid = "0x908" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "6" os_parent_pid = "0x115c" cmd_line = "C:\\Windows\\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0xa6ceE57d9638dA506ff99899c6C018292Ef4826C -coin etc -worker EasyMiner_Bot -mi 14" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4009 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4010 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4011 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4012 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4013 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4014 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 4015 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4016 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4017 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 4018 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 4019 start_va = 0x7ff7a55b0000 end_va = 0x7ff7a55c3fff monitored = 0 entry_point = 0x7ff7a55b8c30 region_type = mapped_file name = "bfsvc.exe" filename = "\\Windows\\bfsvc.exe" (normalized: "c:\\windows\\bfsvc.exe") Region: id = 4020 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4022 start_va = 0x140000000 end_va = 0x140814fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000140000000" filename = "" Region: id = 4028 start_va = 0x4e0000 end_va = 0x5dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 4029 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4030 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4031 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4032 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 4033 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4384 start_va = 0x7ffd4e960000 end_va = 0x7ffd4e967fff monitored = 0 entry_point = 0x7ffd4e9610b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 4385 start_va = 0x5e0000 end_va = 0x15dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 4386 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4387 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4388 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4389 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4390 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4391 start_va = 0x7ffd4e270000 end_va = 0x7ffd4e2dafff monitored = 0 entry_point = 0x7ffd4e2890c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 4392 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4393 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4394 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4395 start_va = 0x7ffd50380000 end_va = 0x7ffd504c2fff monitored = 0 entry_point = 0x7ffd503a8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4396 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4397 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4398 start_va = 0x7ffd4cc80000 end_va = 0x7ffd4ccd4fff monitored = 0 entry_point = 0x7ffd4cc97970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 4399 start_va = 0x7ffd4cb60000 end_va = 0x7ffd4cb6ffff monitored = 0 entry_point = 0x7ffd4cb656e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 4400 start_va = 0x7ffd4d350000 end_va = 0x7ffd4d516fff monitored = 0 entry_point = 0x7ffd4d3adb80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 4401 start_va = 0x7ffd4c3c0000 end_va = 0x7ffd4c41bfff monitored = 0 entry_point = 0x7ffd4c3d6f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 4402 start_va = 0x400000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4403 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4404 start_va = 0x400000 end_va = 0x438fff monitored = 0 entry_point = 0x4012f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4405 start_va = 0x450000 end_va = 0x45ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 4406 start_va = 0x15e0000 end_va = 0x1767fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000015e0000" filename = "" Region: id = 4407 start_va = 0x7ffd4e2e0000 end_va = 0x7ffd4e31afff monitored = 0 entry_point = 0x7ffd4e2e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4408 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 4409 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4410 start_va = 0x1770000 end_va = 0x18f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001770000" filename = "" Region: id = 4411 start_va = 0x1900000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001900000" filename = "" Region: id = 4412 start_va = 0x2d00000 end_va = 0x2dbffff monitored = 0 entry_point = 0x2d20da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4413 start_va = 0x2d00000 end_va = 0x2edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d00000" filename = "" Region: id = 4414 start_va = 0x7ffd3ed50000 end_va = 0x7ffd3ed5bfff monitored = 0 entry_point = 0x7ffd3ed535c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 4415 start_va = 0x7ffd4c770000 end_va = 0x7ffd4c79cfff monitored = 0 entry_point = 0x7ffd4c789d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4416 start_va = 0x7ffd4c590000 end_va = 0x7ffd4c59afff monitored = 0 entry_point = 0x7ffd4c5919a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 4417 start_va = 0x460000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 4418 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Thread: id = 132 os_tid = 0xfe4 [0268.159] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0268.159] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4d6c7c50 [0268.159] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0268.159] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsAlloc") returned 0x7ffd4d6d7e50 [0268.159] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsSetValue") returned 0x7ffd4d6c3cb0 [0268.160] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0268.160] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4d6c7c50 [0268.160] GetProcessHeap () returned 0x4e0000 [0268.160] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0268.160] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsAlloc") returned 0x7ffd4d6d7e50 [0268.160] GetLastError () returned 0x0 [0268.160] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsGetValue") returned 0x7ffd4d6b3780 [0268.160] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x3c8) returned 0x4eb140 [0268.160] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsSetValue") returned 0x7ffd4d6c3cb0 [0268.161] SetLastError (dwErrCode=0x0) [0268.161] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1000) returned 0x4efd90 [0268.162] GetStartupInfoW (in: lpStartupInfo=0xcfe10 | out: lpStartupInfo=0xcfe10*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\bfsvc.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) [0268.162] GetStdHandle (nStdHandle=0xfffffff6) returned 0x20 [0268.162] GetFileType (hFile=0x20) returned 0x2 [0268.162] GetStdHandle (nStdHandle=0xfffffff5) returned 0x24 [0268.162] GetFileType (hFile=0x24) returned 0x2 [0268.162] GetStdHandle (nStdHandle=0xfffffff4) returned 0x28 [0268.162] GetFileType (hFile=0x28) returned 0x2 [0268.163] GetCommandLineA () returned="C:\\Windows\\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0xa6ceE57d9638dA506ff99899c6C018292Ef4826C -coin etc -worker EasyMiner_Bot -mi 14" [0268.163] GetCommandLineW () returned="C:\\Windows\\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0xa6ceE57d9638dA506ff99899c6C018292Ef4826C -coin etc -worker EasyMiner_Bot -mi 14" [0268.163] GetLastError () returned 0x0 [0268.163] SetLastError (dwErrCode=0x0) [0268.163] GetLastError () returned 0x0 [0268.163] SetLastError (dwErrCode=0x0) [0268.163] GetACP () returned 0x4e4 [0268.163] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x228) returned 0x4f0da0 [0268.163] IsValidCodePage (CodePage=0x4e4) returned 1 [0268.163] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xcfde0 | out: lpCPInfo=0xcfde0) returned 1 [0268.163] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xcf680 | out: lpCPInfo=0xcf680) returned 1 [0268.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf6a0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0268.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf6a0, cbMultiByte=256, lpWideCharStr=0xcf3d0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ菰N") returned 256 [0268.163] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ菰N", cchSrc=256, lpCharType=0xcf9a0 | out: lpCharType=0xcf9a0) returned 1 [0268.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf6a0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0268.163] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf6a0, cbMultiByte=256, lpWideCharStr=0xcf370, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0268.163] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0268.163] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="LCMapStringEx") returned 0x7ffd4d685350 [0268.163] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0268.164] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xcf160, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0268.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0xcf7a0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿH", lpUsedDefaultChar=0x0) returned 256 [0268.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf6a0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0268.164] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf6a0, cbMultiByte=256, lpWideCharStr=0xcf370, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0268.164] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0268.164] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xcf160, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0268.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0xcf8a0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0268.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x100) returned 0x4eece0 [0268.164] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x1407dfb80, nSize=0x104 | out: lpFilename="C:\\Windows\\bfsvc.exe" (normalized: "c:\\windows\\bfsvc.exe")) returned 0x14 [0268.164] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x11e) returned 0x4e88b0 [0268.164] RtlInitializeSListHead (in: ListHead=0x1407def90 | out: ListHead=0x1407def90) [0268.164] GetLastError () returned 0x0 [0268.164] SetLastError (dwErrCode=0x0) [0268.164] GetEnvironmentStringsW () returned 0x4f0fd0* [0268.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1254, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1254 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4e6) returned 0x4f19b0 [0268.165] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1254, lpMultiByteStr=0x4f19b0, cbMultiByte=1254, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1254 [0268.165] FreeEnvironmentStringsW (penv=0x4f0fd0) returned 1 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x118) returned 0x4eaa80 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1f) returned 0x4eb970 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2e) returned 0x4e89e0 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x31) returned 0x4e2660 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x3c) returned 0x4e9830 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x31) returned 0x4eb510 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x4e26a0 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4ebaf0 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xd) returned 0x4e8a20 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1d) returned 0x4ebca0 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x31) returned 0x4eb550 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x15) returned 0x4eb590 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x17) returned 0x4ebe70 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x4e45b0 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x69) returned 0x4e45d0 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x3e) returned 0x4e9a10 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1d) returned 0x4eb700 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x4e98d0 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4e5220 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x18) returned 0x4e5240 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1b) returned 0x4eb9a0 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4eba00 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x29) returned 0x4e5260 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4eba30 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x6b) returned 0x4e4e00 [0268.165] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x17) returned 0x4e4e80 [0268.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xf) returned 0x4e4ea0 [0268.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4e52a0 [0268.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2a) returned 0x4e4a30 [0268.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x29) returned 0x4f1420 [0268.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4e52c0 [0268.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x21) returned 0x4ebcd0 [0268.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x4e4a70 [0268.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x22) returned 0x4eb760 [0268.166] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x4e4a90 [0268.166] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f19b0 | out: hHeap=0x4e0000) returned 1 [0268.166] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0268.166] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FlsAlloc") returned 0x7ffd4e1e6cd0 [0268.166] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FlsFree") returned 0x7ffd4e1e7660 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FlsGetValue") returned 0x7ffd4e1dd6e0 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FlsSetValue") returned 0x7ffd4e1e3ae0 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4e1ed760 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="InitOnceExecuteOnce") returned 0x7ffd4d6c3d20 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateEventExW") returned 0x7ffd4e1ed6c0 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateSemaphoreW") returned 0x7ffd4e1ed730 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateSemaphoreExW") returned 0x7ffd4e1ed720 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateThreadpoolTimer") returned 0x7ffd4e1e4d00 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetThreadpoolTimer") returned 0x7ffd504dae40 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x7ffd504da650 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CloseThreadpoolTimer") returned 0x7ffd504da3f0 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateThreadpoolWait") returned 0x7ffd4e1e8c50 [0268.167] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetThreadpoolWait") returned 0x7ffd504d9120 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CloseThreadpoolWait") returned 0x7ffd504d77e0 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FlushProcessWriteBuffers") returned 0x7ffd505768b0 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x7ffd5054fea0 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentProcessorNumber") returned 0x7ffd50574930 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateSymbolicLinkW") returned 0x7ffd4e205b60 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentPackageId") returned 0x7ffd4d6c8d40 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetTickCount64") returned 0x7ffd4e1dd6f0 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetFileInformationByHandleEx") returned 0x7ffd4e1ea030 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetFileInformationByHandle") returned 0x7ffd4e1edc50 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x7ffd4e1edd20 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="InitializeConditionVariable") returned 0x7ffd505421f0 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WakeConditionVariable") returned 0x7ffd505380f0 [0268.168] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WakeAllConditionVariable") returned 0x7ffd5052bd20 [0268.169] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SleepConditionVariableCS") returned 0x7ffd4d68bb10 [0268.169] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="InitializeSRWLock") returned 0x7ffd505421f0 [0268.169] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="AcquireSRWLockExclusive") returned 0x7ffd504fd760 [0268.169] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TryAcquireSRWLockExclusive") returned 0x7ffd504d4df0 [0268.169] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ReleaseSRWLockExclusive") returned 0x7ffd504f3790 [0268.169] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SleepConditionVariableSRW") returned 0x7ffd4d6d6d30 [0268.169] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateThreadpoolWork") returned 0x7ffd4e1e72c0 [0268.169] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SubmitThreadpoolWork") returned 0x7ffd504fe420 [0268.169] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CloseThreadpoolWork") returned 0x7ffd504da7b0 [0268.169] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CompareStringEx") returned 0x7ffd4e1ddd30 [0268.169] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetLocaleInfoEx") returned 0x7ffd4e1e4e60 [0268.170] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LCMapStringEx") returned 0x7ffd4e1dd560 [0268.170] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0268.170] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="InitializeConditionVariable") returned 0x7ffd505421f0 [0268.170] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SleepConditionVariableCS") returned 0x7ffd4d68bb10 [0268.170] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WakeAllConditionVariable") returned 0x7ffd5052bd20 [0268.170] RtlInitializeConditionVariable () returned 0x7ffd5052bd20 [0268.170] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1000) returned 0x4f17e0 [0268.170] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1403a7cb0) returned 0x0 [0268.171] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x2ed0000 [0268.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f2f00 [0268.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x38) returned 0x4f1720 [0268.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2) returned 0x4e4ab0 [0268.172] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e4ab0 | out: hHeap=0x4e0000) returned 1 [0268.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2) returned 0x4e4ab0 [0268.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f2e40 [0268.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1760 [0268.173] GetLastError () returned 0x0 [0268.173] SetLastError (dwErrCode=0x0) [0268.173] GetLastError () returned 0x0 [0268.173] SetLastError (dwErrCode=0x0) [0268.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x158) returned 0x4e7920 [0268.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6a6) returned 0x4f3080 [0268.173] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f3080 | out: hHeap=0x4e0000) returned 1 [0268.174] GetLastError () returned 0x0 [0268.174] SetLastError (dwErrCode=0x0) [0268.174] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x4e4ad0 [0268.174] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2) returned 0x4e7a80 [0268.174] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4) returned 0x4e7aa0 [0268.174] GetLastError () returned 0x0 [0268.174] SetLastError (dwErrCode=0x0) [0268.174] GetLastError () returned 0x0 [0268.174] SetLastError (dwErrCode=0x0) [0268.174] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x158) returned 0x4e9f40 [0268.174] GetLastError () returned 0x0 [0268.174] SetLastError (dwErrCode=0x0) [0268.174] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6a6) returned 0x4f3080 [0268.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f3080 | out: hHeap=0x4e0000) returned 1 [0268.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e4ad0 | out: hHeap=0x4e0000) returned 1 [0268.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e7920 | out: hHeap=0x4e0000) returned 1 [0268.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e7aa0 | out: hHeap=0x4e0000) returned 1 [0268.175] GetLastError () returned 0x0 [0268.175] SetLastError (dwErrCode=0x0) [0268.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x4e4ad0 [0268.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2) returned 0x4e7aa0 [0268.176] GetLastError () returned 0x0 [0268.176] SetLastError (dwErrCode=0x0) [0268.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x200) returned 0x4e9b90 [0268.176] GetLastError () returned 0x0 [0268.176] SetLastError (dwErrCode=0x0) [0268.176] GetLastError () returned 0x0 [0268.176] SetLastError (dwErrCode=0x0) [0268.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4) returned 0x4e7ac0 [0268.176] GetLastError () returned 0x0 [0268.176] SetLastError (dwErrCode=0x0) [0268.176] GetLastError () returned 0x0 [0268.176] SetLastError (dwErrCode=0x0) [0268.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x158) returned 0x4e7920 [0268.176] GetLastError () returned 0x0 [0268.177] SetLastError (dwErrCode=0x0) [0268.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6a6) returned 0x4f3080 [0268.177] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f3080 | out: hHeap=0x4e0000) returned 1 [0268.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e4ad0 | out: hHeap=0x4e0000) returned 1 [0268.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e9f40 | out: hHeap=0x4e0000) returned 1 [0268.179] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e7ac0 | out: hHeap=0x4e0000) returned 1 [0268.179] GetLastError () returned 0x0 [0268.179] SetLastError (dwErrCode=0x0) [0268.179] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x4e4ad0 [0268.179] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e7aa0 | out: hHeap=0x4e0000) returned 1 [0268.179] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e7a80 | out: hHeap=0x4e0000) returned 1 [0268.179] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f3020 [0268.179] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f2ec0 [0268.179] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x4f2f20 [0268.180] GetCurrentThread () returned 0xfffffffffffffffe [0268.180] GetThreadTimes (in: hThread=0xfffffffffffffffe, lpCreationTime=0xcfec8, lpExitTime=0xcfec0, lpKernelTime=0xcfec0, lpUserTime=0xcfec0 | out: lpCreationTime=0xcfec8, lpExitTime=0xcfec0, lpKernelTime=0xcfec0, lpUserTime=0xcfec0) returned 1 [0268.180] RtlInitializeSListHead (in: ListHead=0x1407df600 | out: ListHead=0x1407df600) [0268.180] RtlAllocateHeap (HeapHandle=0x2ed0000, Flags=0x1, Size=0x68) returned 0x2ed0830 [0268.181] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0268.181] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0268.181] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0268.181] WSAStartup (in: wVersionRequired=0x2, lpWSAData=0xcfd30 | out: lpWSAData=0xcfd30) returned 0 [0268.203] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0268.203] RtlInitializeConditionVariable () returned 0x7ffd505421f0 [0268.203] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xd0) returned 0x4e4cc0 [0268.242] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2da0 [0268.242] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4e9da0 [0268.242] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4e4690 [0268.242] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f3040 [0268.242] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2d20 [0268.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2ee0 [0268.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2cc0 [0268.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2e60 [0268.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2ea0 [0268.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2f40 [0268.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2f60 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2d60 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2f80 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2fa0 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2ce0 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2fc0 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2d00 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2fe0 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2d40 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2e00 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2d80 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2dc0 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2e80 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f3000 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2de0 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f2e20 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7ea0 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7ec0 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7be0 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7880 [0268.332] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7de0 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7860 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7aa0 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7ce0 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7b40 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7bc0 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7e00 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7d80 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f79c0 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7ee0 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f78a0 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7a80 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7e20 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7c00 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7900 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7760 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7940 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f78c0 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f77e0 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7960 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7920 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7800 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7dc0 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7ac0 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f79e0 [0268.333] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7ae0 [0268.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7c80 [0268.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f77a0 [0268.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7e40 [0268.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7780 [0268.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7d20 [0268.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f77c0 [0268.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7980 [0268.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7e60 [0268.384] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e4690, Size=0x100) returned 0x4e3b90 [0268.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7e80 [0268.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7820 [0268.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7a40 [0268.384] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7da0 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7ca0 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7a60 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7cc0 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f79a0 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7b00 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7d40 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7b20 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7b60 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7840 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f78e0 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7d00 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7a00 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7a20 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7b80 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7ba0 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7d60 [0268.385] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7c20 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7c40 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7c60 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8690 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8090 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f84b0 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8510 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8590 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8630 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8430 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f81b0 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8230 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8250 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f86f0 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8130 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8170 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f86d0 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8270 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8570 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f82f0 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8450 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f86b0 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f82d0 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7f70 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7f90 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8410 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f84d0 [0268.386] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8470 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8210 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8150 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8190 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8490 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8550 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f81d0 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f80b0 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8370 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8650 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f84f0 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f82b0 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8530 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7fb0 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8030 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7fd0 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8670 [0268.387] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e3b90, Size=0x200) returned 0x4f8730 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8350 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f85b0 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f81f0 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f85d0 [0268.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f85b0 | out: hHeap=0x4e0000) returned 1 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4eb790 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4eb850 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8310 [0268.387] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8310 | out: hHeap=0x4e0000) returned 1 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4e4690 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4e4210 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f85f0 [0268.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f83f0 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8310 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8050 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8610 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f7ff0 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8390 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8110 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8290 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f85b0 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8010 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8330 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f83b0 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8070 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f83d0 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f80d0 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f80f0 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f89b0 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8e50 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8fb0 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9010 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8fd0 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8c30 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8c70 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8ad0 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8f50 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8c90 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8e70 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8bd0 [0268.388] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8ff0 [0268.388] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e4210, Size=0x100) returned 0x4e3b90 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8f10 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8f70 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8c10 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8dd0 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9030 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f90f0 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9070 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8e90 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8a70 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8d10 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8b30 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8f90 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8af0 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8b70 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8d30 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8b90 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8ab0 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8d90 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8eb0 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8bf0 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8b10 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9050 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8bb0 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8c50 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9110 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8b50 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8990 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8ed0 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8ef0 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f89d0 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9090 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8cb0 [0268.389] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e3b90, Size=0x200) returned 0x4f9150 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f89f0 [0268.389] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8d50 [0268.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f90b0 [0268.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8cd0 [0268.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8d70 [0268.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8cf0 [0268.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8db0 [0268.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8df0 [0268.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8e10 [0268.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f90d0 [0268.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8e30 [0268.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8f30 [0268.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8a10 [0268.390] GetLastError () returned 0x0 [0268.390] SetLastError (dwErrCode=0x0) [0268.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x86) returned 0x4e4210 [0268.390] GetLastError () returned 0x0 [0268.390] SetLastError (dwErrCode=0x0) [0268.390] GetLastError () returned 0x0 [0268.390] SetLastError (dwErrCode=0x0) [0268.390] GetLastError () returned 0x0 [0268.390] SetLastError (dwErrCode=0x0) [0268.390] GetLastError () returned 0x0 [0268.390] SetLastError (dwErrCode=0x0) [0268.390] GetLastError () returned 0x0 [0268.390] SetLastError (dwErrCode=0x0) [0268.390] GetLastError () returned 0x0 [0268.390] SetLastError (dwErrCode=0x0) [0268.390] GetLastError () returned 0x0 [0268.390] SetLastError (dwErrCode=0x0) [0268.390] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.391] SetLastError (dwErrCode=0x0) [0268.391] GetLastError () returned 0x0 [0268.392] SetLastError (dwErrCode=0x0) [0268.392] GetLastError () returned 0x0 [0268.392] SetLastError (dwErrCode=0x0) [0268.392] GetLastError () returned 0x0 [0268.392] SetLastError (dwErrCode=0x0) [0268.392] GetLastError () returned 0x0 [0268.394] SetLastError (dwErrCode=0x0) [0268.394] GetLastError () returned 0x0 [0268.394] SetLastError (dwErrCode=0x0) [0268.394] GetLastError () returned 0x0 [0268.394] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.395] GetLastError () returned 0x0 [0268.395] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.396] SetLastError (dwErrCode=0x0) [0268.396] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.397] SetLastError (dwErrCode=0x0) [0268.397] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.398] SetLastError (dwErrCode=0x0) [0268.398] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.399] SetLastError (dwErrCode=0x0) [0268.399] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.400] SetLastError (dwErrCode=0x0) [0268.400] GetLastError () returned 0x0 [0268.401] SetLastError (dwErrCode=0x0) [0268.401] GetLastError () returned 0x0 [0268.401] SetLastError (dwErrCode=0x0) [0268.401] GetLastError () returned 0x0 [0268.401] SetLastError (dwErrCode=0x0) [0268.401] GetLastError () returned 0x0 [0268.401] SetLastError (dwErrCode=0x0) [0268.401] GetLastError () returned 0x0 [0268.401] SetLastError (dwErrCode=0x0) [0268.401] GetLastError () returned 0x0 [0268.401] SetLastError (dwErrCode=0x0) [0268.401] GetLastError () returned 0x0 [0268.401] SetLastError (dwErrCode=0x0) [0268.401] GetLastError () returned 0x0 [0268.401] SetLastError (dwErrCode=0x0) [0268.401] GetLastError () returned 0x0 [0268.401] SetLastError (dwErrCode=0x0) [0268.401] GetLastError () returned 0x0 [0268.401] SetLastError (dwErrCode=0x0) [0268.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8a30 [0268.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8a50 [0268.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f8a90 [0268.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9950 [0268.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f99d0 [0268.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9850 [0268.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9410 [0268.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f97d0 [0268.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9870 [0268.401] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9530 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9430 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9a10 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9890 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9730 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9450 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9510 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9470 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9750 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9490 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9a70 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f96b0 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9610 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9a90 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9770 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9af0 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f98f0 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9b10 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9b30 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f94b0 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f94f0 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9ad0 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9ab0 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f97f0 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f94d0 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f95f0 [0268.402] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x4f9630 [0268.406] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0268.406] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0268.407] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0268.407] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4eece0) returned 0x100 [0268.407] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4eece0, Size=0x200) returned 0x4f8730 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f14a0 [0268.408] RtlInitializeConditionVariable () returned 0x7ffd505421f0 [0268.408] RtlInitializeConditionVariable () returned 0x7ffd505421f0 [0268.408] RtlInitializeConditionVariable () returned 0x7ffd505421f0 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4e3e70 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4ec060 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4e5090 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4e5110 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4e3b90 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4e3c10 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4e9f40 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4e9fc0 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4ea040 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4f9150 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4f91d0 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4f9250 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x4f92d0 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x504190 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x504790 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x504310 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x503b90 [0268.408] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x504590 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x503f90 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x504390 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x4ff2b0 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x4ff370 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x4ff430 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x4ff4f0 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x4ff5b0 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x4ff670 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x4ff730 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x504850 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x504910 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x5049d0 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x504a90 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x504b50 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x504c10 [0268.409] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x504cd0 [0268.409] RtlInitializeConditionVariable () returned 0x7ffd505421f0 [0268.410] RtlInitializeConditionVariable () returned 0x7ffd505421f0 [0268.410] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4f8730) returned 0x200 [0268.410] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4f8730, Size=0x400) returned 0x504d90 [0268.410] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x96027) returned 0x51b8c0 [0268.423] CreateSemaphoreA (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=2147483647, lpName=0x0) returned 0x10c [0268.423] CreateSemaphoreA (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=2147483647, lpName=0x0) returned 0x110 [0268.423] CreateSemaphoreA (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=2147483647, lpName=0x0) returned 0x114 [0268.423] RtlInitializeConditionVariable () returned 0x7ffd505421f0 [0268.423] RtlInitializeConditionVariable () returned 0x7ffd505421f0 [0268.424] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x2, Condition=0x1) returned 0x8000000000000008 [0268.424] VerSetConditionMask (ConditionMask=0x8000000000000008, TypeMask=0x1, Condition=0x3) returned 0x800000000000000b [0268.424] VerSetConditionMask (ConditionMask=0x800000000000000b, TypeMask=0x20, Condition=0x3) returned 0x800000000001800b [0268.424] VerSetConditionMask (ConditionMask=0x800000000001800b, TypeMask=0x10, Condition=0x3) returned 0x800000000001b00b [0268.424] VerSetConditionMask (ConditionMask=0x800000000001b00b, TypeMask=0x8, Condition=0x1) returned 0x800000000001b20b [0268.424] VerifyVersionInfoA (in: lpVersionInformation=0xcfda0, dwTypeMask=0x3b, dwlConditionMask=0x800000000001b20b | out: lpVersionInformation=0xcfda0) returned 0 [0268.424] GetModuleHandleA (lpModuleName="kernel32") returned 0x7ffd4e1c0000 [0268.424] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryExA") returned 0x7ffd4e1e6b80 [0268.424] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="AddDllDirectory") returned 0x7ffd4d6e8030 [0268.424] LoadLibraryExA (lpLibFileName="secur32.dll", hFile=0x0, dwFlags=0x800) returned 0x7ffd3ed50000 [0268.428] GetProcAddress (hModule=0x7ffd3ed50000, lpProcName="InitSecurityInterfaceA") returned 0x7ffd4c77cc60 [0268.637] InitSecurityInterfaceA () returned 0x7ffd4c797240 [0268.637] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0xcfcd0 | out: lpWSAData=0xcfcd0) returned 0 [0268.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fed00 [0268.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4f8730 [0268.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fefd0 [0268.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x4f87c0 [0268.639] GetModuleHandleW (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0268.639] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="RtlEqualUnicodeString") returned 0x7ffd504e4de0 [0268.639] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0268.639] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateHardLinkW") returned 0x7ffd4e1ec860 [0268.639] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0268.640] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateSymbolicLinkW") returned 0x7ffd4e205b60 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x4e9b00 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x4e93d0 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x4e9100 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x4e9420 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x5b1a00 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x4e9470 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x5b1940 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x5b3530 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b2f40 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x5b2950 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fed60 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x5b33a0 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x5b1a60 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x5b2c20 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x5b1f40 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x5b35d0 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x5b21e0 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x5b2f90 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1020 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x5b38a0 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1620 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x5b2ef0 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff0c0 [0268.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x5b2fe0 [0268.641] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4feb50 [0268.641] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x48) returned 0x5b2a40 [0268.641] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4febb0 [0268.641] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0268.641] RtlPcToFileHeader (in: PcValue=0x14077d7a8, BaseOfImage=0xcfdf0 | out: BaseOfImage=0xcfdf0*=0x140000000) returned 0x140000000 [0268.641] RtlInitializeConditionVariable () returned 0x7ffd505421f0 [0268.641] LoadLibraryExW (lpLibFileName="api-ms-win-security-systemfunctions-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4e480000 [0268.641] GetProcAddress (hModule=0x7ffd4e480000, lpProcName="SystemFunction036") returned 0x7ffd4c591a10 [0268.644] SystemFunction036 (in: RandomBuffer=0xcfe90, RandomBufferLength=0x4 | out: RandomBuffer=0xcfe90) returned 1 [0268.644] SetErrorMode (uMode=0x3) returned 0x0 [0268.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff120 [0268.645] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff120 | out: hHeap=0x4e0000) returned 1 [0268.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0268.645] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0268.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4febe0 [0268.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x5187a0 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x118) returned 0x4ea4e0 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1f) returned 0x4fef10 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2e) returned 0x4f11a0 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x31) returned 0x4f15e0 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x3c) returned 0x5b3030 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x31) returned 0x4f14e0 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x14) returned 0x5183c0 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x24) returned 0x4fec10 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xd) returned 0x518740 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1d) returned 0x4fec40 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x31) returned 0x4f12a0 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x15) returned 0x518600 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x17) returned 0x518880 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xe) returned 0x518900 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x69) returned 0x504690 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x3e) returned 0x5b33f0 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1d) returned 0x4feee0 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x5b30d0 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x518300 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x18) returned 0x518760 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1b) returned 0x4fef40 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4fefa0 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x29) returned 0x4f13e0 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4ff000 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x6b) returned 0x503a90 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x17) returned 0x518580 [0268.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xf) returned 0x5186a0 [0268.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x5183e0 [0268.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2a) returned 0x4f11e0 [0268.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x29) returned 0x4f16e0 [0268.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x518340 [0268.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x21) returned 0x4ff120 [0268.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x518920 [0268.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x22) returned 0x4fef70 [0268.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x12) returned 0x518140 [0268.647] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4ea4e0) returned 0x118 [0268.647] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4ea4e0, Size=0x120) returned 0x5b3a50 [0268.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x17) returned 0x518660 [0268.647] SetEnvironmentVariableA (lpName="GPU_FORCE_64BIT_PTR", lpValue="0") returned 1 [0268.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518660 | out: hHeap=0x4e0000) returned 1 [0268.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4febe0 | out: hHeap=0x4e0000) returned 1 [0268.648] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4febe0 [0268.648] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x518460 [0268.648] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x5b3a50) returned 0x120 [0268.649] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x5b3a50, Size=0x128) returned 0x4e0860 [0268.649] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x17) returned 0x518160 [0268.649] SetEnvironmentVariableA (lpName="GPU_MAX_HEAP_SIZE", lpValue="100") returned 1 [0268.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518160 | out: hHeap=0x4e0000) returned 1 [0268.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4febe0 | out: hHeap=0x4e0000) returned 1 [0268.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fedc0 [0268.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x17) returned 0x518520 [0268.650] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4e0860) returned 0x128 [0268.650] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0860, Size=0x130) returned 0x4e0860 [0268.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x18) returned 0x518480 [0268.650] SetEnvironmentVariableA (lpName="GPU_USE_SYNC_OBJECTS", lpValue="1") returned 1 [0268.650] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518480 | out: hHeap=0x4e0000) returned 1 [0268.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fedc0 | out: hHeap=0x4e0000) returned 1 [0268.651] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fedc0 [0268.651] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1a) returned 0x4ff150 [0268.651] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4e0860) returned 0x130 [0268.651] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0860, Size=0x138) returned 0x4e0860 [0268.651] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1b) returned 0x4ff1e0 [0268.651] SetEnvironmentVariableA (lpName="GPU_MAX_ALLOC_PERCENT", lpValue="100") returned 1 [0268.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff1e0 | out: hHeap=0x4e0000) returned 1 [0268.652] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fedc0 | out: hHeap=0x4e0000) returned 1 [0268.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff1e0 [0268.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1d) returned 0x4febe0 [0268.652] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4e0860) returned 0x138 [0268.652] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0860, Size=0x140) returned 0x4e0860 [0268.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1e) returned 0x4fedc0 [0268.652] SetEnvironmentVariableA (lpName="GPU_SINGLE_ALLOC_PERCENT", lpValue="100") returned 1 [0268.652] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fedc0 | out: hHeap=0x4e0000) returned 1 [0268.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff1e0 | out: hHeap=0x4e0000) returned 1 [0268.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fedc0 [0268.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x15) returned 0x5187c0 [0268.653] RtlSizeHeap (HeapHandle=0x4e0000, Flags=0x0, MemoryPointer=0x4e0860) returned 0x140 [0268.653] RtlReAllocateHeap (Heap=0x4e0000, Flags=0x0, Ptr=0x4e0860, Size=0x148) returned 0x4e0860 [0268.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x16) returned 0x518620 [0268.653] SetEnvironmentVariableA (lpName="CUDA_CACHE_DISABLE", lpValue="1") returned 1 [0268.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518620 | out: hHeap=0x4e0000) returned 1 [0268.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fedc0 | out: hHeap=0x4e0000) returned 1 [0268.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fedc0 [0268.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0268.654] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fedc0 | out: hHeap=0x4e0000) returned 1 [0268.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f10a0 [0268.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0268.655] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fedc0 [0268.655] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1520 [0268.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fedc0 | out: hHeap=0x4e0000) returned 1 [0268.656] GetLastError () returned 0x47e [0268.656] SetLastError (dwErrCode=0x47e) [0268.656] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.658] GetLastError () returned 0x47e [0268.658] SetLastError (dwErrCode=0x47e) [0268.658] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.659] GetLastError () returned 0x47e [0268.659] SetLastError (dwErrCode=0x47e) [0268.659] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.661] GetLastError () returned 0x47e [0268.661] SetLastError (dwErrCode=0x47e) [0268.661] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.662] GetLastError () returned 0x47e [0268.662] SetLastError (dwErrCode=0x47e) [0268.662] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.665] GetLastError () returned 0x47e [0268.665] SetLastError (dwErrCode=0x47e) [0268.665] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.665] GetLastError () returned 0x47e [0268.665] SetLastError (dwErrCode=0x47e) [0268.665] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.666] GetLastError () returned 0x47e [0268.666] SetLastError (dwErrCode=0x47e) [0268.666] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.666] GetLastError () returned 0x47e [0268.666] SetLastError (dwErrCode=0x47e) [0268.666] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.667] GetLastError () returned 0x47e [0268.667] SetLastError (dwErrCode=0x47e) [0268.667] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.668] GetLastError () returned 0x47e [0268.668] SetLastError (dwErrCode=0x47e) [0268.668] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.668] GetLastError () returned 0x47e [0268.668] SetLastError (dwErrCode=0x47e) [0268.668] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.669] GetLastError () returned 0x47e [0268.669] SetLastError (dwErrCode=0x47e) [0268.669] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.669] GetLastError () returned 0x47e [0268.670] SetLastError (dwErrCode=0x47e) [0268.670] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.670] GetLastError () returned 0x47e [0268.670] SetLastError (dwErrCode=0x47e) [0268.670] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.671] GetLastError () returned 0x47e [0268.671] SetLastError (dwErrCode=0x47e) [0268.671] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.671] GetLastError () returned 0x47e [0268.671] SetLastError (dwErrCode=0x47e) [0268.671] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.672] GetLastError () returned 0x47e [0268.672] SetLastError (dwErrCode=0x47e) [0268.672] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.672] GetLastError () returned 0x47e [0268.673] SetLastError (dwErrCode=0x47e) [0268.673] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.673] GetLastError () returned 0x47e [0268.673] SetLastError (dwErrCode=0x47e) [0268.673] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.674] GetLastError () returned 0x47e [0268.674] SetLastError (dwErrCode=0x47e) [0268.674] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.674] GetLastError () returned 0x47e [0268.674] SetLastError (dwErrCode=0x47e) [0268.674] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.675] GetLastError () returned 0x47e [0268.675] SetLastError (dwErrCode=0x47e) [0268.675] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.676] GetLastError () returned 0x47e [0268.676] SetLastError (dwErrCode=0x47e) [0268.676] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.676] GetLastError () returned 0x47e [0268.676] SetLastError (dwErrCode=0x47e) [0268.676] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.677] GetLastError () returned 0x47e [0268.677] SetLastError (dwErrCode=0x47e) [0268.677] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.677] GetLastError () returned 0x47e [0268.678] SetLastError (dwErrCode=0x47e) [0268.678] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.678] GetLastError () returned 0x47e [0268.678] SetLastError (dwErrCode=0x47e) [0268.678] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.679] GetLastError () returned 0x47e [0268.679] SetLastError (dwErrCode=0x47e) [0268.679] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.679] GetLastError () returned 0x47e [0268.679] SetLastError (dwErrCode=0x47e) [0268.679] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.680] GetLastError () returned 0x47e [0268.680] SetLastError (dwErrCode=0x47e) [0268.680] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.681] GetLastError () returned 0x47e [0268.681] SetLastError (dwErrCode=0x47e) [0268.681] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.681] GetLastError () returned 0x47e [0268.681] SetLastError (dwErrCode=0x47e) [0268.681] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.682] GetLastError () returned 0x47e [0268.682] SetLastError (dwErrCode=0x47e) [0268.682] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.682] GetLastError () returned 0x47e [0268.682] SetLastError (dwErrCode=0x47e) [0268.682] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.683] GetLastError () returned 0x47e [0268.683] SetLastError (dwErrCode=0x47e) [0268.683] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.684] GetLastError () returned 0x47e [0268.684] SetLastError (dwErrCode=0x47e) [0268.684] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.749] GetLastError () returned 0x47e [0268.770] SetLastError (dwErrCode=0x47e) [0268.770] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0268.904] GetLastError () returned 0x47e [0268.924] SetLastError (dwErrCode=0x47e) [0268.925] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.017] GetLastError () returned 0x47e [0269.018] SetLastError (dwErrCode=0x47e) [0269.018] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.022] GetLastError () returned 0x47e [0269.022] SetLastError (dwErrCode=0x47e) [0269.022] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.027] GetLastError () returned 0x47e [0269.029] SetLastError (dwErrCode=0x47e) [0269.029] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.109] GetLastError () returned 0x47e [0269.111] SetLastError (dwErrCode=0x47e) [0269.111] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.121] GetLastError () returned 0x47e [0269.121] SetLastError (dwErrCode=0x47e) [0269.122] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.123] GetLastError () returned 0x47e [0269.123] SetLastError (dwErrCode=0x47e) [0269.123] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.123] GetLastError () returned 0x47e [0269.123] SetLastError (dwErrCode=0x47e) [0269.124] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.129] GetLastError () returned 0x47e [0269.131] SetLastError (dwErrCode=0x47e) [0269.134] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.135] GetLastError () returned 0x47e [0269.135] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsGetValue") returned 0x7ffd4d6b3780 [0269.135] SetLastError (dwErrCode=0x47e) [0269.136] GetLastError () returned 0x47e [0269.136] SetLastError (dwErrCode=0x47e) [0269.136] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x2, lpOverlapped=0x0) returned 1 [0269.136] GetLastError () returned 0x47e [0269.136] SetLastError (dwErrCode=0x47e) [0269.137] GetLastError () returned 0x47e [0269.137] SetLastError (dwErrCode=0x47e) [0269.137] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1520 | out: hHeap=0x4e0000) returned 1 [0269.137] GetLastError () returned 0x47e [0269.137] SetLastError (dwErrCode=0x47e) [0269.137] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.138] GetLastError () returned 0x47e [0269.138] SetLastError (dwErrCode=0x47e) [0269.138] GetLastError () returned 0x47e [0269.138] SetLastError (dwErrCode=0x47e) [0269.138] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.139] GetLastError () returned 0x47e [0269.139] SetLastError (dwErrCode=0x47e) [0269.139] GetLastError () returned 0x47e [0269.139] SetLastError (dwErrCode=0x47e) [0269.139] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.140] GetLastError () returned 0x47e [0269.140] SetLastError (dwErrCode=0x47e) [0269.140] GetLastError () returned 0x47e [0269.140] SetLastError (dwErrCode=0x47e) [0269.140] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.141] GetLastError () returned 0x47e [0269.141] SetLastError (dwErrCode=0x47e) [0269.141] GetLastError () returned 0x47e [0269.141] SetLastError (dwErrCode=0x47e) [0269.141] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.142] GetLastError () returned 0x47e [0269.142] SetLastError (dwErrCode=0x47e) [0269.142] GetLastError () returned 0x47e [0269.142] SetLastError (dwErrCode=0x47e) [0269.142] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.143] GetLastError () returned 0x47e [0269.143] SetLastError (dwErrCode=0x47e) [0269.143] GetLastError () returned 0x47e [0269.143] SetLastError (dwErrCode=0x47e) [0269.143] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.143] GetLastError () returned 0x47e [0269.143] SetLastError (dwErrCode=0x47e) [0269.144] GetLastError () returned 0x47e [0269.144] SetLastError (dwErrCode=0x47e) [0269.144] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.144] GetLastError () returned 0x47e [0269.144] SetLastError (dwErrCode=0x47e) [0269.144] GetLastError () returned 0x47e [0269.144] SetLastError (dwErrCode=0x47e) [0269.145] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.148] GetLastError () returned 0x47e [0269.148] SetLastError (dwErrCode=0x47e) [0269.148] GetLastError () returned 0x47e [0269.148] SetLastError (dwErrCode=0x47e) [0269.148] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.149] GetLastError () returned 0x47e [0269.149] SetLastError (dwErrCode=0x47e) [0269.149] GetLastError () returned 0x47e [0269.149] SetLastError (dwErrCode=0x47e) [0269.149] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.150] GetLastError () returned 0x47e [0269.150] SetLastError (dwErrCode=0x47e) [0269.150] GetLastError () returned 0x47e [0269.151] SetLastError (dwErrCode=0x47e) [0269.151] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.151] GetLastError () returned 0x47e [0269.151] SetLastError (dwErrCode=0x47e) [0269.152] GetLastError () returned 0x47e [0269.152] SetLastError (dwErrCode=0x47e) [0269.152] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.152] GetLastError () returned 0x47e [0269.152] SetLastError (dwErrCode=0x47e) [0269.152] GetLastError () returned 0x47e [0269.152] SetLastError (dwErrCode=0x47e) [0269.153] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.153] GetLastError () returned 0x47e [0269.153] SetLastError (dwErrCode=0x47e) [0269.153] GetLastError () returned 0x47e [0269.153] SetLastError (dwErrCode=0x47e) [0269.153] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.154] GetLastError () returned 0x47e [0269.154] SetLastError (dwErrCode=0x47e) [0269.154] GetLastError () returned 0x47e [0269.154] SetLastError (dwErrCode=0x47e) [0269.154] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.155] GetLastError () returned 0x47e [0269.155] SetLastError (dwErrCode=0x47e) [0269.155] GetLastError () returned 0x47e [0269.155] SetLastError (dwErrCode=0x47e) [0269.155] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.155] GetLastError () returned 0x47e [0269.155] SetLastError (dwErrCode=0x47e) [0269.156] GetLastError () returned 0x47e [0269.156] SetLastError (dwErrCode=0x47e) [0269.156] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.156] GetLastError () returned 0x47e [0269.156] SetLastError (dwErrCode=0x47e) [0269.156] GetLastError () returned 0x47e [0269.156] SetLastError (dwErrCode=0x47e) [0269.156] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.157] GetLastError () returned 0x47e [0269.157] SetLastError (dwErrCode=0x47e) [0269.157] GetLastError () returned 0x47e [0269.157] SetLastError (dwErrCode=0x47e) [0269.157] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.157] GetLastError () returned 0x47e [0269.157] SetLastError (dwErrCode=0x47e) [0269.158] GetLastError () returned 0x47e [0269.158] SetLastError (dwErrCode=0x47e) [0269.158] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.158] GetLastError () returned 0x47e [0269.158] SetLastError (dwErrCode=0x47e) [0269.158] GetLastError () returned 0x47e [0269.158] SetLastError (dwErrCode=0x47e) [0269.158] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.159] GetLastError () returned 0x47e [0269.159] SetLastError (dwErrCode=0x47e) [0269.159] GetLastError () returned 0x47e [0269.159] SetLastError (dwErrCode=0x47e) [0269.159] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.160] GetLastError () returned 0x47e [0269.160] SetLastError (dwErrCode=0x47e) [0269.160] GetLastError () returned 0x47e [0269.160] SetLastError (dwErrCode=0x47e) [0269.160] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.160] GetLastError () returned 0x47e [0269.160] SetLastError (dwErrCode=0x47e) [0269.161] GetLastError () returned 0x47e [0269.161] SetLastError (dwErrCode=0x47e) [0269.161] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.161] GetLastError () returned 0x47e [0269.161] SetLastError (dwErrCode=0x47e) [0269.161] GetLastError () returned 0x47e [0269.161] SetLastError (dwErrCode=0x47e) [0269.161] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.162] GetLastError () returned 0x47e [0269.162] SetLastError (dwErrCode=0x47e) [0269.162] GetLastError () returned 0x47e [0269.162] SetLastError (dwErrCode=0x47e) [0269.162] WriteFile (in: hFile=0x24, lpBuffer=0xcd970*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0xcd960, lpOverlapped=0x0 | out: lpBuffer=0xcd970*, lpNumberOfBytesWritten=0xcd960*=0x1, lpOverlapped=0x0) returned 1 [0269.163] GetLastError () returned 0x47e [0269.163] SetLastError (dwErrCode=0x47e) [0269.163] GetLastError () returned 0x47e [0269.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff1e0 [0269.172] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b2a90 [0269.172] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff1e0 | out: hHeap=0x4e0000) returned 1 [0269.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4ea0c0 [0269.173] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2a90 | out: hHeap=0x4e0000) returned 1 [0269.173] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x80) returned 0x5057b0 [0269.174] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ea0c0 | out: hHeap=0x4e0000) returned 1 [0269.174] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xc0) returned 0x4f8850 [0269.174] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5057b0 | out: hHeap=0x4e0000) returned 1 [0269.175] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff1e0 [0269.175] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fee20 [0269.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fee20 | out: hHeap=0x4e0000) returned 1 [0269.175] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fedc0 [0269.175] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fedc0 | out: hHeap=0x4e0000) returned 1 [0269.175] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fedc0 [0269.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fedc0 | out: hHeap=0x4e0000) returned 1 [0269.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fedc0 [0269.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fedc0 | out: hHeap=0x4e0000) returned 1 [0269.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fedc0 [0269.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff1e0 | out: hHeap=0x4e0000) returned 1 [0269.176] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x120) returned 0x4e09c0 [0269.176] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8850 | out: hHeap=0x4e0000) returned 1 [0269.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f12e0 [0269.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1060 [0269.177] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1060 | out: hHeap=0x4e0000) returned 1 [0269.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0269.177] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0269.177] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1060 [0269.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1060 | out: hHeap=0x4e0000) returned 1 [0269.178] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f15a0 [0269.178] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f15a0 | out: hHeap=0x4e0000) returned 1 [0269.178] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1060 [0269.179] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f12e0 | out: hHeap=0x4e0000) returned 1 [0269.179] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1a0) returned 0x4e0af0 [0269.179] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e09c0 | out: hHeap=0x4e0000) returned 1 [0269.180] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x260) returned 0x4e0ca0 [0269.181] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0af0 | out: hHeap=0x4e0000) returned 1 [0269.181] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4fee20 [0269.181] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff1e0 [0269.181] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b2c70 [0269.181] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fee20 | out: hHeap=0x4e0000) returned 1 [0269.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff1e0 | out: hHeap=0x4e0000) returned 1 [0269.182] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f10e0 [0269.182] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x70) returned 0x504710 [0269.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2c70 | out: hHeap=0x4e0000) returned 1 [0269.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f10e0 | out: hHeap=0x4e0000) returned 1 [0269.182] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xa7) returned 0x4f8850 [0269.182] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504710 | out: hHeap=0x4e0000) returned 1 [0269.182] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28) returned 0x4fee20 [0269.183] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x52f7) returned 0x5b4550 [0269.183] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x4f70c0 [0269.184] LoadLibraryExW (lpLibFileName="api-ms-win-core-sysinfo-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0269.184] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x7ffd4d6c7640 [0269.184] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0xcf010 | out: lpSystemTimeAsFileTime=0xcf010) [0269.184] GetLastError () returned 0x47e [0269.184] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff1e0 [0269.185] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff1e0 | out: hHeap=0x4e0000) returned 1 [0269.185] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff1e0 [0269.185] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff1e0 | out: hHeap=0x4e0000) returned 1 [0269.186] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff1e0 [0269.186] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff1e0 | out: hHeap=0x4e0000) returned 1 [0269.186] GetLastError () returned 0x47e [0269.186] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff1e0 [0269.187] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff1e0 | out: hHeap=0x4e0000) returned 1 [0269.187] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff1e0 [0269.188] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff1e0 | out: hHeap=0x4e0000) returned 1 [0269.188] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff1e0 [0269.189] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff1e0 | out: hHeap=0x4e0000) returned 1 [0269.190] GetLastError () returned 0x47e [0269.190] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x4ff1e0 [0269.190] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0xb0) returned 0x4e09c0 [0269.190] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0269.190] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9930 [0269.191] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0269.193] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff1e0 | out: hHeap=0x4e0000) returned 1 [0269.193] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1120 [0269.193] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f12e0 [0269.194] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1120 | out: hHeap=0x4e0000) returned 1 [0269.195] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0269.196] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0269.196] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a80 [0269.196] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a80 | out: hHeap=0x4e0000) returned 1 [0269.197] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c60 [0269.198] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c60 | out: hHeap=0x4e0000) returned 1 [0269.198] GetLastError () returned 0x47e [0269.198] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x4) returned 0x4f71a0 [0269.198] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x5b2540 [0269.198] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x78) returned 0x503910 [0269.198] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x5b2120 [0269.199] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2540 | out: hHeap=0x4e0000) returned 1 [0269.199] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f71a0 | out: hHeap=0x4e0000) returned 1 [0269.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x518480 [0269.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b31c0 [0269.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28) returned 0x5b9d20 [0269.199] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0269.199] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0269.199] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="NtSetInformationThread") returned 0x7ffd50574ee0 [0269.200] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0269.200] GetCurrentThread () returned 0xfffffffffffffffe [0269.200] NtSetInformationThread (ThreadHandle=0xfffffffffffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0269.200] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0269.200] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b31c0 | out: hHeap=0x4e0000) returned 1 [0269.200] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518480 | out: hHeap=0x4e0000) returned 1 [0269.200] GetCurrentDirectoryW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x29 [0269.201] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x52) returned 0x5b2600 [0269.201] GetCurrentDirectoryW (in: nBufferLength=0x29, lpBuffer=0x5b2600 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp") returned 0x28 [0269.201] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4ea0c0 [0269.201] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2600 | out: hHeap=0x4e0000) returned 1 [0269.202] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x38) returned 0x4f1520 [0269.202] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x18) returned 0x518180 [0269.202] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4ec0e0 [0269.202] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x5057b0 [0269.202] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\*", lpFindFileData=0xce490 | out: lpFindFileData=0xce490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xb12b8d, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b1e20 [0269.204] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0269.204] RtlEqualUnicodeString (String1=0xce3a0, String2=".exe", CaseInsensitive=1) returned 0 [0269.204] RtlEqualUnicodeString (String1=0xce3a0, String2=".com", CaseInsensitive=1) returned 0 [0269.204] RtlEqualUnicodeString (String1=0xce3a0, String2=".bat", CaseInsensitive=1) returned 0 [0269.204] RtlEqualUnicodeString (String1=0xce3a0, String2=".cmd", CaseInsensitive=1) returned 0 [0269.204] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5057b0 | out: hHeap=0x4e0000) returned 1 [0269.204] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ec0e0 | out: hHeap=0x4e0000) returned 1 [0269.204] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4ec0e0 [0269.205] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x5057b0 [0269.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ec0e0 | out: hHeap=0x4e0000) returned 1 [0269.205] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x60) returned 0x4ec0e0 [0269.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5057b0 | out: hHeap=0x4e0000) returned 1 [0269.205] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce300 | out: lpFindFileData=0xce300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xb12b8d, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x403a6da5, cFileName="..", cAlternateFileName="")) returned 1 [0269.206] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0269.206] RtlEqualUnicodeString (String1=0xce230, String2=".exe", CaseInsensitive=1) returned 0 [0269.206] RtlEqualUnicodeString (String1=0xce230, String2=".com", CaseInsensitive=1) returned 0 [0269.206] RtlEqualUnicodeString (String1=0xce230, String2=".bat", CaseInsensitive=1) returned 0 [0269.206] RtlEqualUnicodeString (String1=0xce230, String2=".cmd", CaseInsensitive=1) returned 0 [0269.206] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce300 | out: lpFindFileData=0xce300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb638b340, ftCreationTime.dwHighDateTime=0x1d7e68f, ftLastAccessTime.dwLowDateTime=0x5327b4b0, ftLastAccessTime.dwHighDateTime=0x1d7e750, ftLastWriteTime.dwLowDateTime=0x5327b4b0, ftLastWriteTime.dwHighDateTime=0x1d7e750, nFileSizeHigh=0x0, nFileSizeLow=0x11383, dwReserved0=0x0, dwReserved1=0x403a6da5, cFileName="07A8E gA XPTpUH6q.docx", cAlternateFileName="07A8EG~1.DOC")) returned 1 [0269.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0269.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0269.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0269.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0269.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f10e0 [0269.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0269.206] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f10e0 | out: hHeap=0x4e0000) returned 1 [0269.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1560 [0269.206] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0269.207] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1560 | out: hHeap=0x4e0000) returned 1 [0269.207] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0269.207] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0269.207] RtlEqualUnicodeString (String1=".docx", String2=".exe", CaseInsensitive=1) returned 0 [0269.207] RtlEqualUnicodeString (String1=".docx", String2=".com", CaseInsensitive=1) returned 0 [0269.207] RtlEqualUnicodeString (String1=".docx", String2=".bat", CaseInsensitive=1) returned 0 [0269.207] RtlEqualUnicodeString (String1=".docx", String2=".cmd", CaseInsensitive=1) returned 0 [0269.207] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0269.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f10e0 [0269.208] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8e) returned 0x5057b0 [0269.208] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ec0e0 | out: hHeap=0x4e0000) returned 1 [0269.208] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f10e0 | out: hHeap=0x4e0000) returned 1 [0269.208] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0269.208] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\07A8E gA XPTpUH6q.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\07a8e ga xptpuh6q.docx")) returned 0x20 [0269.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0269.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0269.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0269.209] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0269.209] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0269.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1560 [0269.209] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f15a0 [0269.210] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1560 | out: hHeap=0x4e0000) returned 1 [0269.210] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f15a0 | out: hHeap=0x4e0000) returned 1 [0269.210] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0269.210] RtlEqualUnicodeString (String1=".docx", String2=".exe", CaseInsensitive=1) returned 0 [0269.210] RtlEqualUnicodeString (String1=".docx", String2=".com", CaseInsensitive=1) returned 0 [0269.210] RtlEqualUnicodeString (String1=".docx", String2=".bat", CaseInsensitive=1) returned 0 [0269.210] RtlEqualUnicodeString (String1=".docx", String2=".cmd", CaseInsensitive=1) returned 0 [0269.211] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\07A8E gA XPTpUH6q.docx" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\07a8e ga xptpuh6q.docx")) returned 0x20 [0269.211] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f10e0 [0269.211] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1120 [0269.211] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f13a0 [0269.211] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1120 | out: hHeap=0x4e0000) returned 1 [0269.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f13a0 | out: hHeap=0x4e0000) returned 1 [0269.212] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1120 [0269.212] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0269.212] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1120 | out: hHeap=0x4e0000) returned 1 [0269.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0269.213] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f10e0 | out: hHeap=0x4e0000) returned 1 [0269.213] RtlEqualUnicodeString (String1=".docx", String2=".exe", CaseInsensitive=1) returned 0 [0269.213] RtlEqualUnicodeString (String1=".docx", String2=".com", CaseInsensitive=1) returned 0 [0269.213] RtlEqualUnicodeString (String1=".docx", String2=".bat", CaseInsensitive=1) returned 0 [0269.214] RtlEqualUnicodeString (String1=".docx", String2=".cmd", CaseInsensitive=1) returned 0 [0269.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0269.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b36c0 [0269.214] GetLastError () returned 0x47e [0269.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x158) returned 0x4e0a80 [0269.214] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6a6) returned 0x5bb070 [0269.214] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bb070 | out: hHeap=0x4e0000) returned 1 [0269.214] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e4ad0 | out: hHeap=0x4e0000) returned 1 [0269.215] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e7920 | out: hHeap=0x4e0000) returned 1 [0269.215] GetLastError () returned 0x47e [0269.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x4f7190 [0269.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2) returned 0x4f7130 [0269.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4) returned 0x4f71b0 [0269.215] GetLastError () returned 0x47e [0269.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x158) returned 0x4e7920 [0269.215] GetLastError () returned 0x47e [0269.215] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6a6) returned 0x5bb070 [0269.215] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bb070 | out: hHeap=0x4e0000) returned 1 [0269.216] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7190 | out: hHeap=0x4e0000) returned 1 [0269.216] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0a80 | out: hHeap=0x4e0000) returned 1 [0269.216] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f71b0 | out: hHeap=0x4e0000) returned 1 [0269.216] GetLastError () returned 0x47e [0269.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x4f71d0 [0269.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2) returned 0x4f7200 [0269.216] GetLastError () returned 0x47e [0269.216] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4) returned 0x4f7220 [0269.216] GetLastError () returned 0x47e [0269.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x158) returned 0x4e0a80 [0269.217] GetLastError () returned 0x47e [0269.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6a6) returned 0x5bb070 [0269.217] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bb070 | out: hHeap=0x4e0000) returned 1 [0269.217] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f71d0 | out: hHeap=0x4e0000) returned 1 [0269.217] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e7920 | out: hHeap=0x4e0000) returned 1 [0269.217] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7220 | out: hHeap=0x4e0000) returned 1 [0269.217] GetLastError () returned 0x47e [0269.217] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x4f7220 [0269.218] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7200 | out: hHeap=0x4e0000) returned 1 [0269.218] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7130 | out: hHeap=0x4e0000) returned 1 [0269.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x38) returned 0x4f10e0 [0269.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2) returned 0x4f7230 [0269.218] GetLastError () returned 0x47e [0269.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x158) returned 0x4e7920 [0269.218] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6a6) returned 0x5bb070 [0269.218] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bb070 | out: hHeap=0x4e0000) returned 1 [0269.218] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7220 | out: hHeap=0x4e0000) returned 1 [0269.218] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0a80 | out: hHeap=0x4e0000) returned 1 [0269.219] GetLastError () returned 0x47e [0269.219] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x4f71f0 [0269.219] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2) returned 0x4f7140 [0269.219] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x4) returned 0x4f7110 [0269.219] GetLastError () returned 0x47e [0269.219] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x158) returned 0x4e0a80 [0269.219] GetLastError () returned 0x47e [0269.219] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6a6) returned 0x5bb070 [0269.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bb070 | out: hHeap=0x4e0000) returned 1 [0269.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f71f0 | out: hHeap=0x4e0000) returned 1 [0269.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e7920 | out: hHeap=0x4e0000) returned 1 [0269.220] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7110 | out: hHeap=0x4e0000) returned 1 [0269.220] GetLastError () returned 0x47e [0269.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x6) returned 0x4f7150 [0269.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x2) returned 0x4f71a0 [0269.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1120 [0269.220] GetLastError () returned 0x47e [0269.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x200) returned 0x5bc560 [0269.221] GetLastError () returned 0x47e [0269.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x140) returned 0x4e7920 [0269.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x5185a0 [0269.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x5181e0 [0269.221] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1560 [0269.221] GetLastError () returned 0x47e [0269.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1) returned 0x4f71b0 [0269.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x6) returned 0x4f70f0 [0269.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x5) returned 0x4f70a0 [0269.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x5186c0 [0269.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9cf0 [0269.222] GetLastError () returned 0x47e [0269.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x518400 [0269.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x518620 [0269.222] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x5182a0 [0269.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x78) returned 0x503e10 [0269.223] GetLastError () returned 0x47e [0269.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1) returned 0x4f71c0 [0269.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1) returned 0x4f7100 [0269.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1) returned 0x4f7130 [0269.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2) returned 0x4f7220 [0269.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x78) returned 0x504290 [0269.223] GetLastError () returned 0x47e [0269.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1) returned 0x4f7120 [0269.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1) returned 0x4f7160 [0269.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x1) returned 0x4f7200 [0269.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x2) returned 0x4f71f0 [0269.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x58) returned 0x5b24e0 [0269.223] GetLastError () returned 0x47e [0269.223] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x56) returned 0x5b1be0 [0269.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x56) returned 0x5b2060 [0269.224] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b1be0 | out: hHeap=0x4e0000) returned 1 [0269.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x56) returned 0x5b25a0 [0269.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x87) returned 0x4e0be0 [0269.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x87) returned 0x4e0f10 [0269.224] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0be0 | out: hHeap=0x4e0000) returned 1 [0269.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x87) returned 0x4e0be0 [0269.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0xd) returned 0x518480 [0269.224] GetLastError () returned 0x47e [0269.227] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0269.227] AreFileApisANSI () returned 1 [0269.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="07A8E gA XPTpUH6q.docx", cchWideChar=22, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="07A8E gA XPTpUH6q.docx", lpUsedDefaultChar=0x0) returned 22 [0269.227] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98a0 [0269.228] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d80 [0269.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98a0 | out: hHeap=0x4e0000) returned 1 [0269.229] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0269.230] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d80 | out: hHeap=0x4e0000) returned 1 [0269.230] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2160d0a0, ftCreationTime.dwHighDateTime=0x1d7df36, ftLastAccessTime.dwLowDateTime=0x11f3ad50, ftLastAccessTime.dwHighDateTime=0x1d7e129, ftLastWriteTime.dwLowDateTime=0x11f3ad50, ftLastWriteTime.dwHighDateTime=0x1d7e129, nFileSizeHigh=0x0, nFileSizeLow=0x1716, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="2sr840Dgzq3V.bmp", cAlternateFileName="2SR840~1.BMP")) returned 1 [0269.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0269.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0269.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0269.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0269.230] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0269.230] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0269.231] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0269.231] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0269.231] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0269.231] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0269.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0269.232] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0269.232] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0269.232] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0269.232] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0269.232] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0269.233] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0269.233] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0269.233] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.233] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\2sr840Dgzq3V.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\2sr840dgzq3v.bmp")) returned 0x20 [0269.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0269.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0269.234] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0269.234] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.235] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0269.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.235] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0269.236] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0269.236] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0269.236] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0269.236] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0269.236] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0269.236] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\2sr840Dgzq3V.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\2sr840dgzq3v.bmp")) returned 0x20 [0269.236] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0269.236] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0269.236] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.236] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0269.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.237] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.237] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0269.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0269.237] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0269.237] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0269.237] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0269.237] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0269.237] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0269.237] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0269.238] AreFileApisANSI () returned 1 [0269.238] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="2sr840Dgzq3V.bmp", cchWideChar=16, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2sr840Dgzq3V.bmp", lpUsedDefaultChar=0x0) returned 16 [0269.238] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0269.238] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c00 [0269.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0269.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0269.239] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c00 | out: hHeap=0x4e0000) returned 1 [0269.239] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4954dd50, ftCreationTime.dwHighDateTime=0x1d7da7b, ftLastAccessTime.dwLowDateTime=0x4f660d10, ftLastAccessTime.dwHighDateTime=0x1d7e253, ftLastWriteTime.dwLowDateTime=0x4f660d10, ftLastWriteTime.dwHighDateTime=0x1d7e253, nFileSizeHigh=0x0, nFileSizeLow=0xcb30, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="3z31Zds.gif", cAlternateFileName="")) returned 1 [0269.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0269.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0269.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99c0 [0269.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a80 [0269.239] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c30 [0269.240] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a80 | out: hHeap=0x4e0000) returned 1 [0269.240] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c30 | out: hHeap=0x4e0000) returned 1 [0269.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0269.240] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99f0 [0269.240] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0269.240] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99f0 | out: hHeap=0x4e0000) returned 1 [0269.240] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99c0 | out: hHeap=0x4e0000) returned 1 [0269.240] RtlEqualUnicodeString (String1=".gif", String2=".exe", CaseInsensitive=1) returned 0 [0269.240] RtlEqualUnicodeString (String1=".gif", String2=".com", CaseInsensitive=1) returned 0 [0269.240] RtlEqualUnicodeString (String1=".gif", String2=".bat", CaseInsensitive=1) returned 0 [0269.240] RtlEqualUnicodeString (String1=".gif", String2=".cmd", CaseInsensitive=1) returned 0 [0269.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0269.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c90 [0269.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c90 | out: hHeap=0x4e0000) returned 1 [0269.241] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0269.241] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\3z31Zds.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\3z31zds.gif")) returned 0x20 [0269.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0269.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0269.241] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0269.242] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0269.242] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0269.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a80 [0269.243] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b10 [0269.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a80 | out: hHeap=0x4e0000) returned 1 [0269.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b10 | out: hHeap=0x4e0000) returned 1 [0269.243] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0269.243] RtlEqualUnicodeString (String1=".gif", String2=".exe", CaseInsensitive=1) returned 0 [0269.243] RtlEqualUnicodeString (String1=".gif", String2=".com", CaseInsensitive=1) returned 0 [0269.243] RtlEqualUnicodeString (String1=".gif", String2=".bat", CaseInsensitive=1) returned 0 [0269.243] RtlEqualUnicodeString (String1=".gif", String2=".cmd", CaseInsensitive=1) returned 0 [0269.243] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\3z31Zds.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\3z31zds.gif")) returned 0x20 [0269.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99f0 [0269.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98a0 [0269.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0269.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98a0 | out: hHeap=0x4e0000) returned 1 [0269.244] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0269.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0269.244] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ff0 [0269.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0269.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ff0 | out: hHeap=0x4e0000) returned 1 [0269.245] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99f0 | out: hHeap=0x4e0000) returned 1 [0269.245] RtlEqualUnicodeString (String1=".gif", String2=".exe", CaseInsensitive=1) returned 0 [0269.245] RtlEqualUnicodeString (String1=".gif", String2=".com", CaseInsensitive=1) returned 0 [0269.245] RtlEqualUnicodeString (String1=".gif", String2=".bat", CaseInsensitive=1) returned 0 [0269.245] RtlEqualUnicodeString (String1=".gif", String2=".cmd", CaseInsensitive=1) returned 0 [0269.245] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0269.245] AreFileApisANSI () returned 1 [0269.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="3z31Zds.gif", cchWideChar=11, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3z31Zds.gif", lpUsedDefaultChar=0x0) returned 11 [0269.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0269.246] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea7a9f00, ftCreationTime.dwHighDateTime=0x1d7d998, ftLastAccessTime.dwLowDateTime=0x57f1e520, ftLastAccessTime.dwHighDateTime=0x1d7ddc7, ftLastWriteTime.dwLowDateTime=0x57f1e520, ftLastWriteTime.dwHighDateTime=0x1d7ddc7, nFileSizeHigh=0x0, nFileSizeLow=0x168aa, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="7Mla2TjakLT.rtf", cAlternateFileName="7MLA2T~1.RTF")) returned 1 [0269.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b70 [0269.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5ba020 [0269.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9bd0 [0269.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ed0 [0269.246] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0269.246] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ed0 | out: hHeap=0x4e0000) returned 1 [0269.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0269.247] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c00 [0269.247] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0269.247] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c00 | out: hHeap=0x4e0000) returned 1 [0269.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0269.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9bd0 | out: hHeap=0x4e0000) returned 1 [0269.248] RtlEqualUnicodeString (String1=".rtf", String2=".exe", CaseInsensitive=1) returned 0 [0269.248] RtlEqualUnicodeString (String1=".rtf", String2=".com", CaseInsensitive=1) returned 0 [0269.248] RtlEqualUnicodeString (String1=".rtf", String2=".bat", CaseInsensitive=1) returned 0 [0269.248] RtlEqualUnicodeString (String1=".rtf", String2=".cmd", CaseInsensitive=1) returned 0 [0269.248] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5ba020 | out: hHeap=0x4e0000) returned 1 [0269.248] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b40 [0269.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b40 | out: hHeap=0x4e0000) returned 1 [0269.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b70 | out: hHeap=0x4e0000) returned 1 [0269.249] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\7Mla2TjakLT.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\7mla2tjaklt.rtf")) returned 0x20 [0269.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0269.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0269.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0269.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0269.249] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0269.249] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0269.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0269.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0269.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0269.250] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0269.250] RtlEqualUnicodeString (String1=".rtf", String2=".exe", CaseInsensitive=1) returned 0 [0269.250] RtlEqualUnicodeString (String1=".rtf", String2=".com", CaseInsensitive=1) returned 0 [0269.250] RtlEqualUnicodeString (String1=".rtf", String2=".bat", CaseInsensitive=1) returned 0 [0269.250] RtlEqualUnicodeString (String1=".rtf", String2=".cmd", CaseInsensitive=1) returned 0 [0269.250] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\7Mla2TjakLT.rtf" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\7mla2tjaklt.rtf")) returned 0x20 [0269.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0269.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0269.250] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0269.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0269.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0269.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c30 [0269.251] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0269.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c30 | out: hHeap=0x4e0000) returned 1 [0269.251] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0269.252] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0269.252] RtlEqualUnicodeString (String1=".rtf", String2=".exe", CaseInsensitive=1) returned 0 [0269.252] RtlEqualUnicodeString (String1=".rtf", String2=".com", CaseInsensitive=1) returned 0 [0269.252] RtlEqualUnicodeString (String1=".rtf", String2=".bat", CaseInsensitive=1) returned 0 [0269.252] RtlEqualUnicodeString (String1=".rtf", String2=".cmd", CaseInsensitive=1) returned 0 [0269.252] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98a0 [0269.252] AreFileApisANSI () returned 1 [0269.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="7Mla2TjakLT.rtf", cchWideChar=15, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7Mla2TjakLT.rtf", lpUsedDefaultChar=0x0) returned 15 [0269.253] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98a0 | out: hHeap=0x4e0000) returned 1 [0269.253] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5adbb900, ftCreationTime.dwHighDateTime=0x1d7e335, ftLastAccessTime.dwLowDateTime=0xf3e2c980, ftLastAccessTime.dwHighDateTime=0x1d7e674, ftLastWriteTime.dwLowDateTime=0xf3e2c980, ftLastWriteTime.dwHighDateTime=0x1d7e674, nFileSizeHigh=0x0, nFileSizeLow=0x9429, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="960NsfJkE0.bmp", cAlternateFileName="960NSF~1.BMP")) returned 1 [0269.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0269.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ea0 [0269.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d50 [0269.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9900 [0269.253] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9cc0 [0269.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9900 | out: hHeap=0x4e0000) returned 1 [0269.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9cc0 | out: hHeap=0x4e0000) returned 1 [0269.254] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d80 [0269.254] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0269.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d80 | out: hHeap=0x4e0000) returned 1 [0269.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0269.254] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d50 | out: hHeap=0x4e0000) returned 1 [0269.255] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0269.255] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0269.255] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0269.255] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0269.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ea0 | out: hHeap=0x4e0000) returned 1 [0269.255] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9900 [0269.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9900 | out: hHeap=0x4e0000) returned 1 [0269.255] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0269.255] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\960NsfJkE0.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\960nsfjke0.bmp")) returned 0x20 [0269.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d50 [0269.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c30 [0269.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0269.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c30 | out: hHeap=0x4e0000) returned 1 [0269.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0269.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0269.256] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9900 [0269.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0269.256] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9900 | out: hHeap=0x4e0000) returned 1 [0269.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d50 | out: hHeap=0x4e0000) returned 1 [0269.257] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0269.257] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0269.257] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0269.257] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0269.257] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\960NsfJkE0.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\960nsfjke0.bmp")) returned 0x20 [0269.257] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0269.257] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0269.257] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0269.257] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0269.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0269.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0269.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0269.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0269.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0269.258] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0269.258] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0269.258] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0269.258] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0269.258] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0269.258] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c60 [0269.258] AreFileApisANSI () returned 1 [0269.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="960NsfJkE0.bmp", cchWideChar=14, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="960NsfJkE0.bmp", lpUsedDefaultChar=0x0) returned 14 [0269.259] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c60 | out: hHeap=0x4e0000) returned 1 [0269.259] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5d3d70, ftCreationTime.dwHighDateTime=0x1d7de32, ftLastAccessTime.dwLowDateTime=0xc2626950, ftLastAccessTime.dwHighDateTime=0x1d7e305, ftLastWriteTime.dwLowDateTime=0xc2626950, ftLastWriteTime.dwHighDateTime=0x1d7e305, nFileSizeHigh=0x0, nFileSizeLow=0x7432, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="9r8pRiczDN0.gif", cAlternateFileName="9R8PRI~1.GIF")) returned 1 [0269.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ff0 [0269.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0269.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5ba020 [0269.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98a0 [0269.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0269.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98a0 | out: hHeap=0x4e0000) returned 1 [0269.260] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0269.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99c0 [0269.260] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9fc0 [0269.261] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99c0 | out: hHeap=0x4e0000) returned 1 [0269.261] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9fc0 | out: hHeap=0x4e0000) returned 1 [0269.261] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5ba020 | out: hHeap=0x4e0000) returned 1 [0269.261] RtlEqualUnicodeString (String1=".gif", String2=".exe", CaseInsensitive=1) returned 0 [0269.261] RtlEqualUnicodeString (String1=".gif", String2=".com", CaseInsensitive=1) returned 0 [0269.261] RtlEqualUnicodeString (String1=".gif", String2=".bat", CaseInsensitive=1) returned 0 [0269.261] RtlEqualUnicodeString (String1=".gif", String2=".cmd", CaseInsensitive=1) returned 0 [0269.261] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0269.262] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f90 [0269.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f90 | out: hHeap=0x4e0000) returned 1 [0269.262] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ff0 | out: hHeap=0x4e0000) returned 1 [0269.262] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\9r8pRiczDN0.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\9r8priczdn0.gif")) returned 0x20 [0269.262] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9cc0 [0269.262] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0269.262] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0269.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0269.263] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0269.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b10 [0269.263] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d50 [0269.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b10 | out: hHeap=0x4e0000) returned 1 [0269.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d50 | out: hHeap=0x4e0000) returned 1 [0269.264] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9cc0 | out: hHeap=0x4e0000) returned 1 [0269.264] RtlEqualUnicodeString (String1=".gif", String2=".exe", CaseInsensitive=1) returned 0 [0269.264] RtlEqualUnicodeString (String1=".gif", String2=".com", CaseInsensitive=1) returned 0 [0269.264] RtlEqualUnicodeString (String1=".gif", String2=".bat", CaseInsensitive=1) returned 0 [0269.264] RtlEqualUnicodeString (String1=".gif", String2=".cmd", CaseInsensitive=1) returned 0 [0269.264] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\9r8pRiczDN0.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\9r8priczdn0.gif")) returned 0x20 [0269.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0269.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0269.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0269.265] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0269.265] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0269.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5ba020 [0269.265] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98d0 [0269.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5ba020 | out: hHeap=0x4e0000) returned 1 [0269.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98d0 | out: hHeap=0x4e0000) returned 1 [0269.266] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0269.266] RtlEqualUnicodeString (String1=".gif", String2=".exe", CaseInsensitive=1) returned 0 [0269.266] RtlEqualUnicodeString (String1=".gif", String2=".com", CaseInsensitive=1) returned 0 [0269.266] RtlEqualUnicodeString (String1=".gif", String2=".bat", CaseInsensitive=1) returned 0 [0269.266] RtlEqualUnicodeString (String1=".gif", String2=".cmd", CaseInsensitive=1) returned 0 [0269.266] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e10 [0269.266] AreFileApisANSI () returned 1 [0269.267] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="9r8pRiczDN0.gif", cchWideChar=15, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="9r8pRiczDN0.gif", lpUsedDefaultChar=0x0) returned 15 [0269.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e10 | out: hHeap=0x4e0000) returned 1 [0269.268] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0842e80, ftCreationTime.dwHighDateTime=0x1d7d8b4, ftLastAccessTime.dwLowDateTime=0x8d076740, ftLastAccessTime.dwHighDateTime=0x1d7e64a, ftLastWriteTime.dwLowDateTime=0x8d076740, ftLastWriteTime.dwHighDateTime=0x1d7e64a, nFileSizeHigh=0x0, nFileSizeLow=0x16b6, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="a95WAC.avi", cAlternateFileName="")) returned 1 [0269.268] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0269.268] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0269.268] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98d0 [0269.268] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0269.268] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0269.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0269.268] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0269.269] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a80 [0269.269] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c60 [0269.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a80 | out: hHeap=0x4e0000) returned 1 [0269.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c60 | out: hHeap=0x4e0000) returned 1 [0269.269] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98d0 | out: hHeap=0x4e0000) returned 1 [0269.269] RtlEqualUnicodeString (String1=".avi", String2=".exe", CaseInsensitive=1) returned 0 [0269.269] RtlEqualUnicodeString (String1=".avi", String2=".com", CaseInsensitive=1) returned 0 [0269.269] RtlEqualUnicodeString (String1=".avi", String2=".bat", CaseInsensitive=1) returned 0 [0269.269] RtlEqualUnicodeString (String1=".avi", String2=".cmd", CaseInsensitive=1) returned 0 [0269.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0269.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0269.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0269.270] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0269.270] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\a95WAC.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\a95wac.avi")) returned 0x20 [0269.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9900 [0269.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c30 [0269.270] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0269.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c30 | out: hHeap=0x4e0000) returned 1 [0269.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0269.271] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9cc0 [0269.271] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0269.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9cc0 | out: hHeap=0x4e0000) returned 1 [0269.271] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0269.272] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9900 | out: hHeap=0x4e0000) returned 1 [0269.272] RtlEqualUnicodeString (String1=".avi", String2=".exe", CaseInsensitive=1) returned 0 [0269.272] RtlEqualUnicodeString (String1=".avi", String2=".com", CaseInsensitive=1) returned 0 [0269.272] RtlEqualUnicodeString (String1=".avi", String2=".bat", CaseInsensitive=1) returned 0 [0269.272] RtlEqualUnicodeString (String1=".avi", String2=".cmd", CaseInsensitive=1) returned 0 [0269.272] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\a95WAC.avi" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\a95wac.avi")) returned 0x20 [0269.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c30 [0269.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ed0 [0269.272] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0269.272] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ed0 | out: hHeap=0x4e0000) returned 1 [0269.273] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0269.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98d0 [0269.273] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0269.273] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98d0 | out: hHeap=0x4e0000) returned 1 [0269.273] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0269.274] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c30 | out: hHeap=0x4e0000) returned 1 [0269.274] RtlEqualUnicodeString (String1=".avi", String2=".exe", CaseInsensitive=1) returned 0 [0269.274] RtlEqualUnicodeString (String1=".avi", String2=".com", CaseInsensitive=1) returned 0 [0269.274] RtlEqualUnicodeString (String1=".avi", String2=".bat", CaseInsensitive=1) returned 0 [0269.274] RtlEqualUnicodeString (String1=".avi", String2=".cmd", CaseInsensitive=1) returned 0 [0269.274] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0269.275] AreFileApisANSI () returned 1 [0269.275] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="a95WAC.avi", cchWideChar=10, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="a95WAC.avi", lpUsedDefaultChar=0x0) returned 10 [0269.276] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0269.276] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c3cdb0, ftCreationTime.dwHighDateTime=0x1d7d8f0, ftLastAccessTime.dwLowDateTime=0xfda6ece0, ftLastAccessTime.dwHighDateTime=0x1d7d908, ftLastWriteTime.dwLowDateTime=0xfda6ece0, ftLastWriteTime.dwHighDateTime=0x1d7d908, nFileSizeHigh=0x0, nFileSizeLow=0x4885, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="b dI7t.pptx", cAlternateFileName="BDI7T~1.PPT")) returned 1 [0269.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0269.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0269.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9bd0 [0269.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f00 [0269.276] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0269.276] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f00 | out: hHeap=0x4e0000) returned 1 [0269.276] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0269.277] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99c0 [0269.277] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0269.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99c0 | out: hHeap=0x4e0000) returned 1 [0269.277] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0269.278] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9bd0 | out: hHeap=0x4e0000) returned 1 [0269.278] RtlEqualUnicodeString (String1=".pptx", String2=".exe", CaseInsensitive=1) returned 0 [0269.278] RtlEqualUnicodeString (String1=".pptx", String2=".com", CaseInsensitive=1) returned 0 [0269.278] RtlEqualUnicodeString (String1=".pptx", String2=".bat", CaseInsensitive=1) returned 0 [0269.278] RtlEqualUnicodeString (String1=".pptx", String2=".cmd", CaseInsensitive=1) returned 0 [0269.278] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0269.278] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0269.278] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0269.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0269.279] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\b dI7t.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\b di7t.pptx")) returned 0x20 [0269.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e10 [0269.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c90 [0269.279] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0269.279] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c90 | out: hHeap=0x4e0000) returned 1 [0269.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0269.280] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0269.280] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ed0 [0269.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0269.280] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ed0 | out: hHeap=0x4e0000) returned 1 [0269.281] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e10 | out: hHeap=0x4e0000) returned 1 [0269.281] RtlEqualUnicodeString (String1=".pptx", String2=".exe", CaseInsensitive=1) returned 0 [0269.281] RtlEqualUnicodeString (String1=".pptx", String2=".com", CaseInsensitive=1) returned 0 [0269.281] RtlEqualUnicodeString (String1=".pptx", String2=".bat", CaseInsensitive=1) returned 0 [0269.281] RtlEqualUnicodeString (String1=".pptx", String2=".cmd", CaseInsensitive=1) returned 0 [0269.281] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\b dI7t.pptx" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\b di7t.pptx")) returned 0x20 [0269.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ff0 [0269.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0269.281] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9bd0 [0269.281] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0269.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9bd0 | out: hHeap=0x4e0000) returned 1 [0269.282] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0269.282] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0269.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0269.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0269.282] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ff0 | out: hHeap=0x4e0000) returned 1 [0269.283] RtlEqualUnicodeString (String1=".pptx", String2=".exe", CaseInsensitive=1) returned 0 [0269.283] RtlEqualUnicodeString (String1=".pptx", String2=".com", CaseInsensitive=1) returned 0 [0269.283] RtlEqualUnicodeString (String1=".pptx", String2=".bat", CaseInsensitive=1) returned 0 [0269.283] RtlEqualUnicodeString (String1=".pptx", String2=".cmd", CaseInsensitive=1) returned 0 [0269.283] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0269.283] AreFileApisANSI () returned 1 [0269.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="b dI7t.pptx", cchWideChar=11, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b dI7t.pptx", lpUsedDefaultChar=0x0) returned 11 [0269.284] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0269.285] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a6fd90, ftCreationTime.dwHighDateTime=0x1d7e3a3, ftLastAccessTime.dwLowDateTime=0x12ad4f60, ftLastAccessTime.dwHighDateTime=0x1d7e455, ftLastWriteTime.dwLowDateTime=0x12ad4f60, ftLastWriteTime.dwHighDateTime=0x1d7e455, nFileSizeHigh=0x0, nFileSizeLow=0x3915, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="bNcEV.wav", cAlternateFileName="")) returned 1 [0269.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0269.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0269.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0269.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f90 [0269.285] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9fc0 [0269.285] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f90 | out: hHeap=0x4e0000) returned 1 [0269.286] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9fc0 | out: hHeap=0x4e0000) returned 1 [0269.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f90 [0269.286] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ff0 [0269.286] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f90 | out: hHeap=0x4e0000) returned 1 [0269.286] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ff0 | out: hHeap=0x4e0000) returned 1 [0269.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0269.287] RtlEqualUnicodeString (String1=".wav", String2=".exe", CaseInsensitive=1) returned 0 [0269.287] RtlEqualUnicodeString (String1=".wav", String2=".com", CaseInsensitive=1) returned 0 [0269.287] RtlEqualUnicodeString (String1=".wav", String2=".bat", CaseInsensitive=1) returned 0 [0269.287] RtlEqualUnicodeString (String1=".wav", String2=".cmd", CaseInsensitive=1) returned 0 [0269.287] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0269.287] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f00 [0269.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f00 | out: hHeap=0x4e0000) returned 1 [0269.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0269.288] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\bNcEV.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\bncev.wav")) returned 0x20 [0269.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0269.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c00 [0269.288] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0269.288] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c00 | out: hHeap=0x4e0000) returned 1 [0269.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0269.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98a0 [0269.289] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0269.289] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98a0 | out: hHeap=0x4e0000) returned 1 [0269.290] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0269.290] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0269.290] RtlEqualUnicodeString (String1=".wav", String2=".exe", CaseInsensitive=1) returned 0 [0269.290] RtlEqualUnicodeString (String1=".wav", String2=".com", CaseInsensitive=1) returned 0 [0269.290] RtlEqualUnicodeString (String1=".wav", String2=".bat", CaseInsensitive=1) returned 0 [0269.290] RtlEqualUnicodeString (String1=".wav", String2=".cmd", CaseInsensitive=1) returned 0 [0269.290] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\bNcEV.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\bncev.wav")) returned 0x20 [0269.291] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0269.291] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c90 [0269.291] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0269.291] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c90 | out: hHeap=0x4e0000) returned 1 [0269.292] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0269.292] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9cc0 [0269.292] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d80 [0269.292] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9cc0 | out: hHeap=0x4e0000) returned 1 [0269.292] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d80 | out: hHeap=0x4e0000) returned 1 [0269.293] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0269.293] RtlEqualUnicodeString (String1=".wav", String2=".exe", CaseInsensitive=1) returned 0 [0269.293] RtlEqualUnicodeString (String1=".wav", String2=".com", CaseInsensitive=1) returned 0 [0269.293] RtlEqualUnicodeString (String1=".wav", String2=".bat", CaseInsensitive=1) returned 0 [0269.293] RtlEqualUnicodeString (String1=".wav", String2=".cmd", CaseInsensitive=1) returned 0 [0269.293] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0269.294] AreFileApisANSI () returned 1 [0269.294] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="bNcEV.wav", cchWideChar=9, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bNcEV.wav", lpUsedDefaultChar=0x0) returned 9 [0269.295] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0269.296] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb12b8d, ftCreationTime.dwHighDateTime=0x1d7fc90, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0x46500cf, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x817400, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="build.exe", cAlternateFileName="")) returned 1 [0269.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9900 [0269.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0269.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0269.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a80 [0269.296] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d50 [0269.297] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a80 | out: hHeap=0x4e0000) returned 1 [0269.297] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d50 | out: hHeap=0x4e0000) returned 1 [0269.297] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99f0 [0269.297] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b40 [0269.298] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99f0 | out: hHeap=0x4e0000) returned 1 [0269.299] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b40 | out: hHeap=0x4e0000) returned 1 [0269.300] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0269.300] RtlEqualUnicodeString (String1=".exe", String2=".exe", CaseInsensitive=1) returned 1 [0269.300] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0269.300] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d80 [0269.300] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d80 | out: hHeap=0x4e0000) returned 1 [0269.300] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9900 | out: hHeap=0x4e0000) returned 1 [0269.300] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe")) returned 0x20 [0269.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0269.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9fc0 [0269.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d80 [0269.301] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9fc0 | out: hHeap=0x4e0000) returned 1 [0269.301] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d80 | out: hHeap=0x4e0000) returned 1 [0269.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b40 [0269.301] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c00 [0269.301] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b40 | out: hHeap=0x4e0000) returned 1 [0269.302] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c00 | out: hHeap=0x4e0000) returned 1 [0269.302] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0269.302] RtlEqualUnicodeString (String1=".exe", String2=".exe", CaseInsensitive=1) returned 1 [0269.302] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\build.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\build.exe")) returned 0x20 [0269.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ed0 [0269.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0269.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99c0 [0269.302] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0269.302] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99c0 | out: hHeap=0x4e0000) returned 1 [0269.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c00 [0269.302] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ea0 [0269.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c00 | out: hHeap=0x4e0000) returned 1 [0269.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ea0 | out: hHeap=0x4e0000) returned 1 [0269.303] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ed0 | out: hHeap=0x4e0000) returned 1 [0269.303] RtlEqualUnicodeString (String1=".exe", String2=".exe", CaseInsensitive=1) returned 1 [0269.303] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b40 [0269.303] AreFileApisANSI () returned 1 [0269.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="build.exe", cchWideChar=9, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="build.exe", lpUsedDefaultChar=0x0) returned 9 [0269.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b40 | out: hHeap=0x4e0000) returned 1 [0269.304] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0c2b70, ftCreationTime.dwHighDateTime=0x1d7e25d, ftLastAccessTime.dwLowDateTime=0x9afc9100, ftLastAccessTime.dwHighDateTime=0x1d7e3dd, ftLastWriteTime.dwLowDateTime=0x9afc9100, ftLastWriteTime.dwHighDateTime=0x1d7e3dd, nFileSizeHigh=0x0, nFileSizeLow=0x1bf7, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="dZjGE7ohnSMV0P16.wav", cAlternateFileName="DZJGE7~1.WAV")) returned 1 [0269.304] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0269.304] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0269.304] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0269.304] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0269.304] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.304] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0269.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.305] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0269.305] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0269.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.305] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0269.305] RtlEqualUnicodeString (String1=".wav", String2=".exe", CaseInsensitive=1) returned 0 [0269.305] RtlEqualUnicodeString (String1=".wav", String2=".com", CaseInsensitive=1) returned 0 [0269.305] RtlEqualUnicodeString (String1=".wav", String2=".bat", CaseInsensitive=1) returned 0 [0269.305] RtlEqualUnicodeString (String1=".wav", String2=".cmd", CaseInsensitive=1) returned 0 [0269.306] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0269.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.306] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.306] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0269.306] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\dZjGE7ohnSMV0P16.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\dzjge7ohnsmv0p16.wav")) returned 0x20 [0269.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0269.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0269.306] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.306] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0269.307] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0269.308] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0269.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.309] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0269.309] RtlEqualUnicodeString (String1=".wav", String2=".exe", CaseInsensitive=1) returned 0 [0269.309] RtlEqualUnicodeString (String1=".wav", String2=".com", CaseInsensitive=1) returned 0 [0269.309] RtlEqualUnicodeString (String1=".wav", String2=".bat", CaseInsensitive=1) returned 0 [0269.309] RtlEqualUnicodeString (String1=".wav", String2=".cmd", CaseInsensitive=1) returned 0 [0269.309] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\dZjGE7ohnSMV0P16.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\dzjge7ohnsmv0p16.wav")) returned 0x20 [0269.310] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0269.310] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1360 [0269.310] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.310] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1360 | out: hHeap=0x4e0000) returned 1 [0269.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.311] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0269.311] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0269.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.311] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0269.311] RtlEqualUnicodeString (String1=".wav", String2=".exe", CaseInsensitive=1) returned 0 [0269.312] RtlEqualUnicodeString (String1=".wav", String2=".com", CaseInsensitive=1) returned 0 [0269.312] RtlEqualUnicodeString (String1=".wav", String2=".bat", CaseInsensitive=1) returned 0 [0269.312] RtlEqualUnicodeString (String1=".wav", String2=".cmd", CaseInsensitive=1) returned 0 [0269.312] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0269.312] AreFileApisANSI () returned 1 [0269.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="dZjGE7ohnSMV0P16.wav", cchWideChar=20, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dZjGE7ohnSMV0P16.wav", lpUsedDefaultChar=0x0) returned 20 [0269.312] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d50 [0269.313] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9fc0 [0269.313] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d50 | out: hHeap=0x4e0000) returned 1 [0269.313] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0269.314] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9fc0 | out: hHeap=0x4e0000) returned 1 [0269.314] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43a5d830, ftCreationTime.dwHighDateTime=0x1d7e2b1, ftLastAccessTime.dwLowDateTime=0xe356e3d0, ftLastAccessTime.dwHighDateTime=0x1d7e345, ftLastWriteTime.dwLowDateTime=0xe356e3d0, ftLastWriteTime.dwHighDateTime=0x1d7e345, nFileSizeHigh=0x0, nFileSizeLow=0x50cb, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="F0yKB9SQcTesgyb.mp3", cAlternateFileName="F0YKB9~1.MP3")) returned 1 [0269.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0269.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1360 [0269.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0269.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.314] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0269.314] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.314] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0269.315] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.315] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0269.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0269.315] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0269.315] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0269.315] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0269.315] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0269.315] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0269.316] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1360 | out: hHeap=0x4e0000) returned 1 [0269.316] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1360 [0269.317] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1360 | out: hHeap=0x4e0000) returned 1 [0269.317] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0269.318] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\F0yKB9SQcTesgyb.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\f0ykb9sqctesgyb.mp3")) returned 0x20 [0269.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0269.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0269.318] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.318] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0269.319] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1360 [0269.320] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0269.320] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1360 | out: hHeap=0x4e0000) returned 1 [0269.321] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0269.321] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0269.321] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0269.321] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0269.321] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0269.321] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0269.322] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\F0yKB9SQcTesgyb.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\f0ykb9sqctesgyb.mp3")) returned 0x20 [0269.322] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0269.322] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.322] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0269.322] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.323] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0269.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0269.323] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0269.323] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0269.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0269.324] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0269.324] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0269.324] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0269.324] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0269.324] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0269.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0269.324] AreFileApisANSI () returned 1 [0269.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="F0yKB9SQcTesgyb.mp3", cchWideChar=19, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="F0yKB9SQcTesgyb.mp3", lpUsedDefaultChar=0x0) returned 19 [0269.324] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b40 [0269.325] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0269.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b40 | out: hHeap=0x4e0000) returned 1 [0269.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0269.326] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0269.326] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6be86d90, ftCreationTime.dwHighDateTime=0x1d7e49a, ftLastAccessTime.dwLowDateTime=0x834a7600, ftLastAccessTime.dwHighDateTime=0x1d7e764, ftLastWriteTime.dwLowDateTime=0x834a7600, ftLastWriteTime.dwHighDateTime=0x1d7e764, nFileSizeHigh=0x0, nFileSizeLow=0xe65a, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="fNqhTG9Xak 1Etlj7H5v.ots", cAlternateFileName="FNQHTG~1.OTS")) returned 1 [0269.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b3080 [0269.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b2e00 [0269.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b29a0 [0269.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b2d10 [0269.326] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b3440 [0269.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2d10 | out: hHeap=0x4e0000) returned 1 [0269.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b3440 | out: hHeap=0x4e0000) returned 1 [0269.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b2a90 [0269.327] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b2c70 [0269.327] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2a90 | out: hHeap=0x4e0000) returned 1 [0269.328] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2c70 | out: hHeap=0x4e0000) returned 1 [0269.374] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b29a0 | out: hHeap=0x4e0000) returned 1 [0269.377] RtlEqualUnicodeString (String1=".ots", String2=".exe", CaseInsensitive=1) returned 0 [0269.378] RtlEqualUnicodeString (String1=".ots", String2=".com", CaseInsensitive=1) returned 0 [0269.378] RtlEqualUnicodeString (String1=".ots", String2=".bat", CaseInsensitive=1) returned 0 [0269.379] RtlEqualUnicodeString (String1=".ots", String2=".cmd", CaseInsensitive=1) returned 0 [0269.381] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2e00 | out: hHeap=0x4e0000) returned 1 [0269.387] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b3120 [0269.391] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b3120 | out: hHeap=0x4e0000) returned 1 [0269.396] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b3080 | out: hHeap=0x4e0000) returned 1 [0269.398] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\fNqhTG9Xak 1Etlj7H5v.ots" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\fnqhtg9xak 1etlj7h5v.ots")) returned 0x20 [0269.483] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b3620 [0269.486] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b31c0 [0269.487] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b3080 [0269.488] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b31c0 | out: hHeap=0x4e0000) returned 1 [0269.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b3080 | out: hHeap=0x4e0000) returned 1 [0269.712] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b3850 [0269.727] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b29a0 [0269.738] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b3850 | out: hHeap=0x4e0000) returned 1 [0269.740] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b29a0 | out: hHeap=0x4e0000) returned 1 [0269.750] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b3620 | out: hHeap=0x4e0000) returned 1 [0269.772] RtlEqualUnicodeString (String1=".ots", String2=".exe", CaseInsensitive=1) returned 0 [0269.793] RtlEqualUnicodeString (String1=".ots", String2=".com", CaseInsensitive=1) returned 0 [0269.793] RtlEqualUnicodeString (String1=".ots", String2=".bat", CaseInsensitive=1) returned 0 [0269.793] RtlEqualUnicodeString (String1=".ots", String2=".cmd", CaseInsensitive=1) returned 0 [0269.793] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\fNqhTG9Xak 1Etlj7H5v.ots" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\fnqhtg9xak 1etlj7h5v.ots")) returned 0x20 [0269.842] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b3620 [0269.867] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b3080 [0269.879] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b3490 [0269.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b3080 | out: hHeap=0x4e0000) returned 1 [0269.951] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b3490 | out: hHeap=0x4e0000) returned 1 [0269.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b3080 [0269.982] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b3800 [0270.027] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b3080 | out: hHeap=0x4e0000) returned 1 [0270.057] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b3800 | out: hHeap=0x4e0000) returned 1 [0270.060] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b3620 | out: hHeap=0x4e0000) returned 1 [0270.071] RtlEqualUnicodeString (String1=".ots", String2=".exe", CaseInsensitive=1) returned 0 [0270.084] RtlEqualUnicodeString (String1=".ots", String2=".com", CaseInsensitive=1) returned 0 [0270.094] RtlEqualUnicodeString (String1=".ots", String2=".bat", CaseInsensitive=1) returned 0 [0270.098] RtlEqualUnicodeString (String1=".ots", String2=".cmd", CaseInsensitive=1) returned 0 [0270.108] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b2a90 [0270.131] AreFileApisANSI () returned 1 [0270.131] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="fNqhTG9Xak 1Etlj7H5v.ots", cchWideChar=24, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fNqhTG9Xak 1Etlj7H5v.ots", lpUsedDefaultChar=0x0) returned 24 [0270.131] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98d0 [0270.170] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0270.203] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98d0 | out: hHeap=0x4e0000) returned 1 [0270.204] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2a90 | out: hHeap=0x4e0000) returned 1 [0270.205] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0270.211] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650633a0, ftCreationTime.dwHighDateTime=0x1d7e11f, ftLastAccessTime.dwLowDateTime=0x32f360c0, ftLastAccessTime.dwHighDateTime=0x1d7e5ae, ftLastWriteTime.dwLowDateTime=0x32f360c0, ftLastWriteTime.dwHighDateTime=0x1d7e5ae, nFileSizeHigh=0x0, nFileSizeLow=0x16ce, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="fv8otpMka Wg.m4a", cAlternateFileName="FV8OTP~1.M4A")) returned 1 [0270.220] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.224] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.225] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.225] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.227] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.229] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.230] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.230] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.236] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.238] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.315] RtlEqualUnicodeString (String1=".m4a", String2=".exe", CaseInsensitive=1) returned 0 [0270.324] RtlEqualUnicodeString (String1=".m4a", String2=".com", CaseInsensitive=1) returned 0 [0270.345] RtlEqualUnicodeString (String1=".m4a", String2=".bat", CaseInsensitive=1) returned 0 [0270.360] RtlEqualUnicodeString (String1=".m4a", String2=".cmd", CaseInsensitive=1) returned 0 [0270.390] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.390] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.398] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.401] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.499] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\fv8otpMka Wg.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\fv8otpmka wg.m4a")) returned 0x20 [0270.499] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.499] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.499] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.500] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.500] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.500] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.501] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.501] RtlEqualUnicodeString (String1=".m4a", String2=".exe", CaseInsensitive=1) returned 0 [0270.501] RtlEqualUnicodeString (String1=".m4a", String2=".com", CaseInsensitive=1) returned 0 [0270.501] RtlEqualUnicodeString (String1=".m4a", String2=".bat", CaseInsensitive=1) returned 0 [0270.501] RtlEqualUnicodeString (String1=".m4a", String2=".cmd", CaseInsensitive=1) returned 0 [0270.501] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\fv8otpMka Wg.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\fv8otpmka wg.m4a")) returned 0x20 [0270.501] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.501] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.501] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.502] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.502] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.502] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.503] RtlEqualUnicodeString (String1=".m4a", String2=".exe", CaseInsensitive=1) returned 0 [0270.503] RtlEqualUnicodeString (String1=".m4a", String2=".com", CaseInsensitive=1) returned 0 [0270.503] RtlEqualUnicodeString (String1=".m4a", String2=".bat", CaseInsensitive=1) returned 0 [0270.503] RtlEqualUnicodeString (String1=".m4a", String2=".cmd", CaseInsensitive=1) returned 0 [0270.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.503] AreFileApisANSI () returned 1 [0270.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="fv8otpMka Wg.m4a", cchWideChar=16, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fv8otpMka Wg.m4a", lpUsedDefaultChar=0x0) returned 16 [0270.503] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0270.504] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ea0 [0270.504] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0270.505] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.505] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ea0 | out: hHeap=0x4e0000) returned 1 [0270.505] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb4e9da1b, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xb4e9ee2c, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb4e9ee2c, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="gen_py", cAlternateFileName="")) returned 1 [0270.505] RtlEqualUnicodeString (String1=0xce350, String2=".exe", CaseInsensitive=1) returned 0 [0270.505] RtlEqualUnicodeString (String1=0xce350, String2=".com", CaseInsensitive=1) returned 0 [0270.505] RtlEqualUnicodeString (String1=0xce350, String2=".bat", CaseInsensitive=1) returned 0 [0270.505] RtlEqualUnicodeString (String1=0xce350, String2=".cmd", CaseInsensitive=1) returned 0 [0270.505] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\gen_py" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\gen_py")) returned 0x10 [0270.506] RtlEqualUnicodeString (String1=0xce730, String2=".exe", CaseInsensitive=1) returned 0 [0270.506] RtlEqualUnicodeString (String1=0xce730, String2=".com", CaseInsensitive=1) returned 0 [0270.506] RtlEqualUnicodeString (String1=0xce730, String2=".bat", CaseInsensitive=1) returned 0 [0270.506] RtlEqualUnicodeString (String1=0xce730, String2=".cmd", CaseInsensitive=1) returned 0 [0270.506] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\gen_py" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\gen_py")) returned 0x10 [0270.506] RtlEqualUnicodeString (String1=0xce730, String2=".exe", CaseInsensitive=1) returned 0 [0270.506] RtlEqualUnicodeString (String1=0xce730, String2=".com", CaseInsensitive=1) returned 0 [0270.506] RtlEqualUnicodeString (String1=0xce730, String2=".bat", CaseInsensitive=1) returned 0 [0270.506] RtlEqualUnicodeString (String1=0xce730, String2=".cmd", CaseInsensitive=1) returned 0 [0270.506] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb648af0, ftCreationTime.dwHighDateTime=0x1d7df0a, ftLastAccessTime.dwLowDateTime=0xc0765460, ftLastAccessTime.dwHighDateTime=0x1d7e01e, ftLastWriteTime.dwLowDateTime=0xc0765460, ftLastWriteTime.dwHighDateTime=0x1d7e01e, nFileSizeHigh=0x0, nFileSizeLow=0x136ff, dwReserved0=0x740061, dwReserved1=0x5c0061, cFileName="H-wcra.bmp", cAlternateFileName="")) returned 1 [0270.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b10 [0270.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0270.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0270.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ff0 [0270.506] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f90 [0270.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ff0 | out: hHeap=0x4e0000) returned 1 [0270.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f90 | out: hHeap=0x4e0000) returned 1 [0270.507] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0270.507] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0270.507] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0270.508] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0270.508] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0270.508] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0270.508] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0270.508] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0270.508] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0270.508] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0270.509] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c00 [0270.509] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c00 | out: hHeap=0x4e0000) returned 1 [0270.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b10 | out: hHeap=0x4e0000) returned 1 [0270.510] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\H-wcra.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\h-wcra.bmp")) returned 0x20 [0270.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0270.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99c0 [0270.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a80 [0270.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99c0 | out: hHeap=0x4e0000) returned 1 [0270.510] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a80 | out: hHeap=0x4e0000) returned 1 [0270.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c30 [0270.510] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0270.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c30 | out: hHeap=0x4e0000) returned 1 [0270.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0270.511] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0270.511] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0270.511] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0270.511] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0270.511] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0270.511] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\H-wcra.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\h-wcra.bmp")) returned 0x20 [0270.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c90 [0270.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0270.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0270.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0270.512] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0270.512] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0270.513] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0270.513] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0270.513] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0270.513] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c90 | out: hHeap=0x4e0000) returned 1 [0270.513] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0270.513] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0270.513] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0270.513] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0270.514] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a80 [0270.514] AreFileApisANSI () returned 1 [0270.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="H-wcra.bmp", cchWideChar=10, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="H-wcra.bmp", lpUsedDefaultChar=0x0) returned 10 [0270.515] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a80 | out: hHeap=0x4e0000) returned 1 [0270.515] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19efcce0, ftCreationTime.dwHighDateTime=0x1d7e40e, ftLastAccessTime.dwLowDateTime=0x6cecee60, ftLastAccessTime.dwHighDateTime=0x1d7e520, ftLastWriteTime.dwLowDateTime=0x6cecee60, ftLastWriteTime.dwHighDateTime=0x1d7e520, nFileSizeHigh=0x0, nFileSizeLow=0x155ae, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="I-2nm5-X4q.wav", cAlternateFileName="I-2NM5~1.WAV")) returned 1 [0270.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0270.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5ba020 [0270.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99f0 [0270.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98a0 [0270.515] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0270.515] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98a0 | out: hHeap=0x4e0000) returned 1 [0270.516] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0270.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0270.516] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ff0 [0270.516] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0270.516] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ff0 | out: hHeap=0x4e0000) returned 1 [0270.516] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99f0 | out: hHeap=0x4e0000) returned 1 [0270.516] RtlEqualUnicodeString (String1=".wav", String2=".exe", CaseInsensitive=1) returned 0 [0270.517] RtlEqualUnicodeString (String1=".wav", String2=".com", CaseInsensitive=1) returned 0 [0270.517] RtlEqualUnicodeString (String1=".wav", String2=".bat", CaseInsensitive=1) returned 0 [0270.517] RtlEqualUnicodeString (String1=".wav", String2=".cmd", CaseInsensitive=1) returned 0 [0270.517] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5ba020 | out: hHeap=0x4e0000) returned 1 [0270.517] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0270.517] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0270.518] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0270.518] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\I-2nm5-X4q.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\i-2nm5-x4q.wav")) returned 0x20 [0270.518] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5ba020 [0270.518] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9bd0 [0270.518] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ed0 [0270.518] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9bd0 | out: hHeap=0x4e0000) returned 1 [0270.519] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ed0 | out: hHeap=0x4e0000) returned 1 [0270.519] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0270.519] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c00 [0270.519] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0270.519] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c00 | out: hHeap=0x4e0000) returned 1 [0270.519] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5ba020 | out: hHeap=0x4e0000) returned 1 [0270.519] RtlEqualUnicodeString (String1=".wav", String2=".exe", CaseInsensitive=1) returned 0 [0270.520] RtlEqualUnicodeString (String1=".wav", String2=".com", CaseInsensitive=1) returned 0 [0270.520] RtlEqualUnicodeString (String1=".wav", String2=".bat", CaseInsensitive=1) returned 0 [0270.520] RtlEqualUnicodeString (String1=".wav", String2=".cmd", CaseInsensitive=1) returned 0 [0270.520] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\I-2nm5-X4q.wav" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\i-2nm5-x4q.wav")) returned 0x20 [0270.520] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b40 [0270.520] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0270.520] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0270.521] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0270.521] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0270.521] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0270.521] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0270.521] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0270.521] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0270.522] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b40 | out: hHeap=0x4e0000) returned 1 [0270.522] RtlEqualUnicodeString (String1=".wav", String2=".exe", CaseInsensitive=1) returned 0 [0270.522] RtlEqualUnicodeString (String1=".wav", String2=".com", CaseInsensitive=1) returned 0 [0270.522] RtlEqualUnicodeString (String1=".wav", String2=".bat", CaseInsensitive=1) returned 0 [0270.522] RtlEqualUnicodeString (String1=".wav", String2=".cmd", CaseInsensitive=1) returned 0 [0270.522] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0270.522] AreFileApisANSI () returned 1 [0270.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="I-2nm5-X4q.wav", cchWideChar=14, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="I-2nm5-X4q.wav", lpUsedDefaultChar=0x0) returned 14 [0270.523] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0270.523] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83072100, ftCreationTime.dwHighDateTime=0x1d7de88, ftLastAccessTime.dwLowDateTime=0xe47d8690, ftLastAccessTime.dwHighDateTime=0x1d7e031, ftLastWriteTime.dwLowDateTime=0xe47d8690, ftLastWriteTime.dwHighDateTime=0x1d7e031, nFileSizeHigh=0x0, nFileSizeLow=0x2007, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="I8X2TxPpjjqAS3.mkv", cAlternateFileName="I8X2TX~1.MKV")) returned 1 [0270.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.523] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.523] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.524] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.524] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.524] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.524] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.524] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.524] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.524] RtlEqualUnicodeString (String1=".mkv", String2=".exe", CaseInsensitive=1) returned 0 [0270.524] RtlEqualUnicodeString (String1=".mkv", String2=".com", CaseInsensitive=1) returned 0 [0270.525] RtlEqualUnicodeString (String1=".mkv", String2=".bat", CaseInsensitive=1) returned 0 [0270.525] RtlEqualUnicodeString (String1=".mkv", String2=".cmd", CaseInsensitive=1) returned 0 [0270.525] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.525] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.525] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.529] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.529] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\I8X2TxPpjjqAS3.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\i8x2txppjjqas3.mkv")) returned 0x20 [0270.529] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.529] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.529] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.529] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.529] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.529] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.529] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.530] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.530] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.530] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.530] RtlEqualUnicodeString (String1=".mkv", String2=".exe", CaseInsensitive=1) returned 0 [0270.530] RtlEqualUnicodeString (String1=".mkv", String2=".com", CaseInsensitive=1) returned 0 [0270.530] RtlEqualUnicodeString (String1=".mkv", String2=".bat", CaseInsensitive=1) returned 0 [0270.531] RtlEqualUnicodeString (String1=".mkv", String2=".cmd", CaseInsensitive=1) returned 0 [0270.531] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\I8X2TxPpjjqAS3.mkv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\i8x2txppjjqas3.mkv")) returned 0x20 [0270.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.531] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.531] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.531] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.589] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.589] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.589] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.590] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.590] RtlEqualUnicodeString (String1=".mkv", String2=".exe", CaseInsensitive=1) returned 0 [0270.590] RtlEqualUnicodeString (String1=".mkv", String2=".com", CaseInsensitive=1) returned 0 [0270.590] RtlEqualUnicodeString (String1=".mkv", String2=".bat", CaseInsensitive=1) returned 0 [0270.590] RtlEqualUnicodeString (String1=".mkv", String2=".cmd", CaseInsensitive=1) returned 0 [0270.590] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.590] AreFileApisANSI () returned 1 [0270.590] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="I8X2TxPpjjqAS3.mkv", cchWideChar=18, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="I8X2TxPpjjqAS3.mkv", lpUsedDefaultChar=0x0) returned 18 [0270.590] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9900 [0270.591] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c00 [0270.591] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9900 | out: hHeap=0x4e0000) returned 1 [0270.592] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.592] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c00 | out: hHeap=0x4e0000) returned 1 [0270.592] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab330d90, ftCreationTime.dwHighDateTime=0x1d7de62, ftLastAccessTime.dwLowDateTime=0x766a6110, ftLastAccessTime.dwHighDateTime=0x1d7dee1, ftLastWriteTime.dwLowDateTime=0x766a6110, ftLastWriteTime.dwHighDateTime=0x1d7dee1, nFileSizeHigh=0x0, nFileSizeLow=0x10090, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="IoeGM.ots", cAlternateFileName="")) returned 1 [0270.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0270.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0270.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0270.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0270.592] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f90 [0270.592] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0270.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f90 | out: hHeap=0x4e0000) returned 1 [0270.593] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c60 [0270.593] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ff0 [0270.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c60 | out: hHeap=0x4e0000) returned 1 [0270.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ff0 | out: hHeap=0x4e0000) returned 1 [0270.593] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0270.594] RtlEqualUnicodeString (String1=".ots", String2=".exe", CaseInsensitive=1) returned 0 [0270.594] RtlEqualUnicodeString (String1=".ots", String2=".com", CaseInsensitive=1) returned 0 [0270.594] RtlEqualUnicodeString (String1=".ots", String2=".bat", CaseInsensitive=1) returned 0 [0270.594] RtlEqualUnicodeString (String1=".ots", String2=".cmd", CaseInsensitive=1) returned 0 [0270.594] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0270.594] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0270.594] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0270.595] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0270.595] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\IoeGM.ots" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\ioegm.ots")) returned 0x20 [0270.595] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5ba020 [0270.595] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0270.595] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99c0 [0270.595] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0270.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99c0 | out: hHeap=0x4e0000) returned 1 [0270.596] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9fc0 [0270.596] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f90 [0270.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9fc0 | out: hHeap=0x4e0000) returned 1 [0270.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f90 | out: hHeap=0x4e0000) returned 1 [0270.596] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5ba020 | out: hHeap=0x4e0000) returned 1 [0270.597] RtlEqualUnicodeString (String1=".ots", String2=".exe", CaseInsensitive=1) returned 0 [0270.597] RtlEqualUnicodeString (String1=".ots", String2=".com", CaseInsensitive=1) returned 0 [0270.597] RtlEqualUnicodeString (String1=".ots", String2=".bat", CaseInsensitive=1) returned 0 [0270.597] RtlEqualUnicodeString (String1=".ots", String2=".cmd", CaseInsensitive=1) returned 0 [0270.597] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\IoeGM.ots" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\ioegm.ots")) returned 0x20 [0270.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0270.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0270.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b10 [0270.597] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0270.597] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b10 | out: hHeap=0x4e0000) returned 1 [0270.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d50 [0270.597] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0270.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d50 | out: hHeap=0x4e0000) returned 1 [0270.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0270.598] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0270.598] RtlEqualUnicodeString (String1=".ots", String2=".exe", CaseInsensitive=1) returned 0 [0270.598] RtlEqualUnicodeString (String1=".ots", String2=".com", CaseInsensitive=1) returned 0 [0270.598] RtlEqualUnicodeString (String1=".ots", String2=".bat", CaseInsensitive=1) returned 0 [0270.598] RtlEqualUnicodeString (String1=".ots", String2=".cmd", CaseInsensitive=1) returned 0 [0270.598] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0270.599] AreFileApisANSI () returned 1 [0270.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="IoeGM.ots", cchWideChar=9, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IoeGM.ots", lpUsedDefaultChar=0x0) returned 9 [0270.599] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0270.599] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf85963d0, ftCreationTime.dwHighDateTime=0x1d7e25e, ftLastAccessTime.dwLowDateTime=0x7e547330, ftLastAccessTime.dwHighDateTime=0x1d7e57f, ftLastWriteTime.dwLowDateTime=0x7e547330, ftLastWriteTime.dwHighDateTime=0x1d7e57f, nFileSizeHigh=0x0, nFileSizeLow=0x6a6e, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="kC aUQz.mp3", cAlternateFileName="KCAUQZ~1.MP3")) returned 1 [0270.599] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0270.599] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5ba020 [0270.599] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98d0 [0270.600] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e10 [0270.600] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0270.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e10 | out: hHeap=0x4e0000) returned 1 [0270.600] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0270.600] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0270.600] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9900 [0270.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0270.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9900 | out: hHeap=0x4e0000) returned 1 [0270.601] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98d0 | out: hHeap=0x4e0000) returned 1 [0270.601] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0270.601] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0270.601] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0270.601] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0270.602] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5ba020 | out: hHeap=0x4e0000) returned 1 [0270.602] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0270.602] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0270.603] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0270.604] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\kC aUQz.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\kc auqz.mp3")) returned 0x20 [0270.604] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a80 [0270.604] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c60 [0270.604] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0270.605] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c60 | out: hHeap=0x4e0000) returned 1 [0270.605] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0270.605] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0270.605] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9900 [0270.605] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0270.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9900 | out: hHeap=0x4e0000) returned 1 [0270.606] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a80 | out: hHeap=0x4e0000) returned 1 [0270.606] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0270.606] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0270.606] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0270.606] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0270.606] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\kC aUQz.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\kc auqz.mp3")) returned 0x20 [0270.606] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0270.606] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9cc0 [0270.606] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0270.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9cc0 | out: hHeap=0x4e0000) returned 1 [0270.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0270.607] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0270.607] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c30 [0270.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0270.607] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c30 | out: hHeap=0x4e0000) returned 1 [0270.608] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0270.608] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0270.608] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0270.608] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0270.608] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0270.608] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ed0 [0270.608] AreFileApisANSI () returned 1 [0270.608] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="kC aUQz.mp3", cchWideChar=11, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kC aUQz.mp3", lpUsedDefaultChar=0x0) returned 11 [0270.609] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ed0 | out: hHeap=0x4e0000) returned 1 [0270.609] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc330eb4, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xbc330eb4, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xbc330eb4, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="KnoB88.tmp", cAlternateFileName="")) returned 1 [0270.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0270.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98d0 [0270.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0270.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0270.609] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0270.610] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0270.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0270.613] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0270.613] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9bd0 [0270.613] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0270.614] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9bd0 | out: hHeap=0x4e0000) returned 1 [0270.614] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0270.614] RtlEqualUnicodeString (String1=".tmp", String2=".exe", CaseInsensitive=1) returned 0 [0270.614] RtlEqualUnicodeString (String1=".tmp", String2=".com", CaseInsensitive=1) returned 0 [0270.614] RtlEqualUnicodeString (String1=".tmp", String2=".bat", CaseInsensitive=1) returned 0 [0270.614] RtlEqualUnicodeString (String1=".tmp", String2=".cmd", CaseInsensitive=1) returned 0 [0270.614] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98d0 | out: hHeap=0x4e0000) returned 1 [0270.614] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f00 [0270.615] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f00 | out: hHeap=0x4e0000) returned 1 [0270.615] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0270.615] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\KnoB88.tmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\knob88.tmp")) returned 0x20 [0270.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99c0 [0270.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0270.615] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0270.616] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0270.616] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0270.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9bd0 [0270.616] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e10 [0270.616] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9bd0 | out: hHeap=0x4e0000) returned 1 [0270.617] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e10 | out: hHeap=0x4e0000) returned 1 [0270.617] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99c0 | out: hHeap=0x4e0000) returned 1 [0270.617] RtlEqualUnicodeString (String1=".tmp", String2=".exe", CaseInsensitive=1) returned 0 [0270.617] RtlEqualUnicodeString (String1=".tmp", String2=".com", CaseInsensitive=1) returned 0 [0270.617] RtlEqualUnicodeString (String1=".tmp", String2=".bat", CaseInsensitive=1) returned 0 [0270.617] RtlEqualUnicodeString (String1=".tmp", String2=".cmd", CaseInsensitive=1) returned 0 [0270.617] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\KnoB88.tmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\knob88.tmp")) returned 0x20 [0270.617] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0270.617] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0270.618] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ed0 [0270.618] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0270.618] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ed0 | out: hHeap=0x4e0000) returned 1 [0270.618] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b10 [0270.618] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ff0 [0270.618] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b10 | out: hHeap=0x4e0000) returned 1 [0270.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ff0 | out: hHeap=0x4e0000) returned 1 [0270.619] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0270.619] RtlEqualUnicodeString (String1=".tmp", String2=".exe", CaseInsensitive=1) returned 0 [0270.619] RtlEqualUnicodeString (String1=".tmp", String2=".com", CaseInsensitive=1) returned 0 [0270.619] RtlEqualUnicodeString (String1=".tmp", String2=".bat", CaseInsensitive=1) returned 0 [0270.619] RtlEqualUnicodeString (String1=".tmp", String2=".cmd", CaseInsensitive=1) returned 0 [0270.619] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0270.619] AreFileApisANSI () returned 1 [0270.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="KnoB88.tmp", cchWideChar=10, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KnoB88.tmp", lpUsedDefaultChar=0x0) returned 10 [0270.620] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0270.620] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa95363c0, ftCreationTime.dwHighDateTime=0x1d7e3d6, ftLastAccessTime.dwLowDateTime=0xac9655e0, ftLastAccessTime.dwHighDateTime=0x1d7e75c, ftLastWriteTime.dwLowDateTime=0xac9655e0, ftLastWriteTime.dwHighDateTime=0x1d7e75c, nFileSizeHigh=0x0, nFileSizeLow=0x5e6, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="Kzlu2xjDYc.mp3", cAlternateFileName="KZLU2X~1.MP3")) returned 1 [0270.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9bd0 [0270.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0270.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0270.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0270.620] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0270.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0270.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0270.621] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0270.621] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f90 [0270.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0270.621] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f90 | out: hHeap=0x4e0000) returned 1 [0270.622] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0270.622] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0270.622] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0270.622] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0270.622] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0270.622] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0270.622] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0270.622] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0270.623] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9bd0 | out: hHeap=0x4e0000) returned 1 [0270.623] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\Kzlu2xjDYc.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\kzlu2xjdyc.mp3")) returned 0x20 [0270.623] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0270.623] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ff0 [0270.623] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f00 [0270.623] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ff0 | out: hHeap=0x4e0000) returned 1 [0270.623] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f00 | out: hHeap=0x4e0000) returned 1 [0270.623] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0270.624] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0270.624] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0270.624] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0270.624] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0270.624] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0270.624] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0270.624] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0270.625] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0270.625] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\Kzlu2xjDYc.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\kzlu2xjdyc.mp3")) returned 0x20 [0270.625] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0270.625] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98a0 [0270.625] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0270.625] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98a0 | out: hHeap=0x4e0000) returned 1 [0270.625] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0270.626] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5ba020 [0270.626] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0270.626] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5ba020 | out: hHeap=0x4e0000) returned 1 [0270.626] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0270.626] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0270.626] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0270.626] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0270.626] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0270.626] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0270.627] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c90 [0270.627] AreFileApisANSI () returned 1 [0270.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="Kzlu2xjDYc.mp3", cchWideChar=14, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Kzlu2xjDYc.mp3", lpUsedDefaultChar=0x0) returned 14 [0270.628] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c90 | out: hHeap=0x4e0000) returned 1 [0270.628] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb69f7b9a, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xb69f7b9a, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb69f7b9a, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="Low", cAlternateFileName="")) returned 1 [0270.628] RtlEqualUnicodeString (String1=0xce350, String2=".exe", CaseInsensitive=1) returned 0 [0270.628] RtlEqualUnicodeString (String1=0xce350, String2=".com", CaseInsensitive=1) returned 0 [0270.628] RtlEqualUnicodeString (String1=0xce350, String2=".bat", CaseInsensitive=1) returned 0 [0270.628] RtlEqualUnicodeString (String1=0xce350, String2=".cmd", CaseInsensitive=1) returned 0 [0270.628] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\Low" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\low")) returned 0x2010 [0270.628] RtlEqualUnicodeString (String1=0xce730, String2=".exe", CaseInsensitive=1) returned 0 [0270.628] RtlEqualUnicodeString (String1=0xce730, String2=".com", CaseInsensitive=1) returned 0 [0270.628] RtlEqualUnicodeString (String1=0xce730, String2=".bat", CaseInsensitive=1) returned 0 [0270.628] RtlEqualUnicodeString (String1=0xce730, String2=".cmd", CaseInsensitive=1) returned 0 [0270.628] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\Low" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\low")) returned 0x2010 [0270.629] RtlEqualUnicodeString (String1=0xce730, String2=".exe", CaseInsensitive=1) returned 0 [0270.629] RtlEqualUnicodeString (String1=0xce730, String2=".com", CaseInsensitive=1) returned 0 [0270.629] RtlEqualUnicodeString (String1=0xce730, String2=".bat", CaseInsensitive=1) returned 0 [0270.629] RtlEqualUnicodeString (String1=0xce730, String2=".cmd", CaseInsensitive=1) returned 0 [0270.629] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2715b750, ftCreationTime.dwHighDateTime=0x1d7e4e4, ftLastAccessTime.dwLowDateTime=0xca1c39b0, ftLastAccessTime.dwHighDateTime=0x1d7e52f, ftLastWriteTime.dwLowDateTime=0xca1c39b0, ftLastWriteTime.dwHighDateTime=0x1d7e52f, nFileSizeHigh=0x0, nFileSizeLow=0xa6cd, dwReserved0=0x740061, dwReserved1=0x5c0061, cFileName="ltfBgcZqVqf_y.png", cAlternateFileName="LTFBGC~1.PNG")) returned 1 [0270.629] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.629] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.629] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.629] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.629] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.629] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.630] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.630] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.630] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.630] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.630] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.631] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.631] RtlEqualUnicodeString (String1=".png", String2=".exe", CaseInsensitive=1) returned 0 [0270.631] RtlEqualUnicodeString (String1=".png", String2=".com", CaseInsensitive=1) returned 0 [0270.631] RtlEqualUnicodeString (String1=".png", String2=".bat", CaseInsensitive=1) returned 0 [0270.631] RtlEqualUnicodeString (String1=".png", String2=".cmd", CaseInsensitive=1) returned 0 [0270.631] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.631] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.632] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.632] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\ltfBgcZqVqf_y.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\ltfbgczqvqf_y.png")) returned 0x20 [0270.632] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.632] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.632] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.633] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.633] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1360 [0270.633] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.634] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1360 | out: hHeap=0x4e0000) returned 1 [0270.634] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.634] RtlEqualUnicodeString (String1=".png", String2=".exe", CaseInsensitive=1) returned 0 [0270.634] RtlEqualUnicodeString (String1=".png", String2=".com", CaseInsensitive=1) returned 0 [0270.634] RtlEqualUnicodeString (String1=".png", String2=".bat", CaseInsensitive=1) returned 0 [0270.634] RtlEqualUnicodeString (String1=".png", String2=".cmd", CaseInsensitive=1) returned 0 [0270.634] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\ltfBgcZqVqf_y.png" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\ltfbgczqvqf_y.png")) returned 0x20 [0270.634] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.634] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.634] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.635] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.636] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.636] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.636] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.637] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.637] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.637] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.637] RtlEqualUnicodeString (String1=".png", String2=".exe", CaseInsensitive=1) returned 0 [0270.637] RtlEqualUnicodeString (String1=".png", String2=".com", CaseInsensitive=1) returned 0 [0270.638] RtlEqualUnicodeString (String1=".png", String2=".bat", CaseInsensitive=1) returned 0 [0270.638] RtlEqualUnicodeString (String1=".png", String2=".cmd", CaseInsensitive=1) returned 0 [0270.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.638] AreFileApisANSI () returned 1 [0270.638] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="ltfBgcZqVqf_y.png", cchWideChar=17, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ltfBgcZqVqf_y.png", lpUsedDefaultChar=0x0) returned 17 [0270.638] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ed0 [0270.639] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0270.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ed0 | out: hHeap=0x4e0000) returned 1 [0270.640] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.640] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0270.640] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9f4860, ftCreationTime.dwHighDateTime=0x1d7e253, ftLastAccessTime.dwLowDateTime=0xfd9a6a90, ftLastAccessTime.dwHighDateTime=0x1d7e50d, ftLastWriteTime.dwLowDateTime=0xfd9a6a90, ftLastWriteTime.dwHighDateTime=0x1d7e50d, nFileSizeHigh=0x0, nFileSizeLow=0x17950, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="Nj5Ecq5SeR8t.mp3", cAlternateFileName="NJ5ECQ~1.MP3")) returned 1 [0270.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.640] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.640] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.641] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.641] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.641] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.641] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.641] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.642] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0270.642] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0270.642] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0270.642] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0270.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.642] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.643] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.644] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.644] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\Nj5Ecq5SeR8t.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\nj5ecq5ser8t.mp3")) returned 0x20 [0270.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.644] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.645] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.645] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.645] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.645] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.646] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.646] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.646] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0270.646] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0270.646] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0270.646] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0270.646] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\Nj5Ecq5SeR8t.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\nj5ecq5ser8t.mp3")) returned 0x20 [0270.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.646] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.647] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1360 [0270.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.647] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1360 | out: hHeap=0x4e0000) returned 1 [0270.648] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.648] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0270.648] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0270.648] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0270.648] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0270.648] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1360 [0270.648] AreFileApisANSI () returned 1 [0270.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="Nj5Ecq5SeR8t.mp3", cchWideChar=16, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nj5Ecq5SeR8t.mp3", lpUsedDefaultChar=0x0) returned 16 [0270.648] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ff0 [0270.649] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0270.649] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ff0 | out: hHeap=0x4e0000) returned 1 [0270.650] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1360 | out: hHeap=0x4e0000) returned 1 [0270.650] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0270.650] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d4e00, ftCreationTime.dwHighDateTime=0x1d7dd40, ftLastAccessTime.dwLowDateTime=0x8ef18d30, ftLastAccessTime.dwHighDateTime=0x1d7e39b, ftLastWriteTime.dwLowDateTime=0x8ef18d30, ftLastWriteTime.dwHighDateTime=0x1d7e39b, nFileSizeHigh=0x0, nFileSizeLow=0xba9b, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="nZtaga69 KA6WZPDv.flv", cAlternateFileName="NZTAGA~1.FLV")) returned 1 [0270.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.650] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.650] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.651] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.651] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.651] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.651] RtlEqualUnicodeString (String1=".flv", String2=".exe", CaseInsensitive=1) returned 0 [0270.651] RtlEqualUnicodeString (String1=".flv", String2=".com", CaseInsensitive=1) returned 0 [0270.651] RtlEqualUnicodeString (String1=".flv", String2=".bat", CaseInsensitive=1) returned 0 [0270.651] RtlEqualUnicodeString (String1=".flv", String2=".cmd", CaseInsensitive=1) returned 0 [0270.652] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.652] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.652] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.652] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.652] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\nZtaga69 KA6WZPDv.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\nztaga69 ka6wzpdv.flv")) returned 0x20 [0270.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1360 [0270.653] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.653] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1360 | out: hHeap=0x4e0000) returned 1 [0270.654] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.654] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.654] RtlEqualUnicodeString (String1=".flv", String2=".exe", CaseInsensitive=1) returned 0 [0270.654] RtlEqualUnicodeString (String1=".flv", String2=".com", CaseInsensitive=1) returned 0 [0270.654] RtlEqualUnicodeString (String1=".flv", String2=".bat", CaseInsensitive=1) returned 0 [0270.654] RtlEqualUnicodeString (String1=".flv", String2=".cmd", CaseInsensitive=1) returned 0 [0270.654] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\nZtaga69 KA6WZPDv.flv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\nztaga69 ka6wzpdv.flv")) returned 0x20 [0270.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.654] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.654] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.655] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.655] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.655] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.656] RtlEqualUnicodeString (String1=".flv", String2=".exe", CaseInsensitive=1) returned 0 [0270.656] RtlEqualUnicodeString (String1=".flv", String2=".com", CaseInsensitive=1) returned 0 [0270.656] RtlEqualUnicodeString (String1=".flv", String2=".bat", CaseInsensitive=1) returned 0 [0270.656] RtlEqualUnicodeString (String1=".flv", String2=".cmd", CaseInsensitive=1) returned 0 [0270.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.656] AreFileApisANSI () returned 1 [0270.656] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="nZtaga69 KA6WZPDv.flv", cchWideChar=21, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nZtaga69 KA6WZPDv.flv", lpUsedDefaultChar=0x0) returned 21 [0270.656] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0270.657] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0270.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0270.658] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.659] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0270.659] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91578da0, ftCreationTime.dwHighDateTime=0x1d7dd2d, ftLastAccessTime.dwLowDateTime=0xfcbec1a0, ftLastAccessTime.dwHighDateTime=0x1d7e38e, ftLastWriteTime.dwLowDateTime=0xfcbec1a0, ftLastWriteTime.dwHighDateTime=0x1d7e38e, nFileSizeHigh=0x0, nFileSizeLow=0xdfa9, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="pNar6q-oOp1.bmp", cAlternateFileName="PNAR6Q~1.BMP")) returned 1 [0270.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0270.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0270.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b40 [0270.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0270.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0270.659] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0270.659] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0270.659] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0270.660] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ff0 [0270.660] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0270.660] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ff0 | out: hHeap=0x4e0000) returned 1 [0270.660] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b40 | out: hHeap=0x4e0000) returned 1 [0270.660] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0270.660] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0270.660] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0270.660] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0270.661] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0270.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a80 [0270.661] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a80 | out: hHeap=0x4e0000) returned 1 [0270.661] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0270.661] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\pNar6q-oOp1.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pnar6q-oop1.bmp")) returned 0x20 [0270.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d80 [0270.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9900 [0270.661] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99c0 [0270.662] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9900 | out: hHeap=0x4e0000) returned 1 [0270.662] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99c0 | out: hHeap=0x4e0000) returned 1 [0270.662] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b70 [0270.662] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ea0 [0270.662] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b70 | out: hHeap=0x4e0000) returned 1 [0270.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ea0 | out: hHeap=0x4e0000) returned 1 [0270.664] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d80 | out: hHeap=0x4e0000) returned 1 [0270.664] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0270.664] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0270.664] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0270.664] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0270.664] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\pNar6q-oOp1.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\pnar6q-oop1.bmp")) returned 0x20 [0270.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9cc0 [0270.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b70 [0270.665] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9fc0 [0270.665] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b70 | out: hHeap=0x4e0000) returned 1 [0270.666] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9fc0 | out: hHeap=0x4e0000) returned 1 [0270.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ff0 [0270.666] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ea0 [0270.666] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ff0 | out: hHeap=0x4e0000) returned 1 [0270.666] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ea0 | out: hHeap=0x4e0000) returned 1 [0270.667] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9cc0 | out: hHeap=0x4e0000) returned 1 [0270.667] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0270.667] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0270.667] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0270.667] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0270.667] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b40 [0270.667] AreFileApisANSI () returned 1 [0270.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="pNar6q-oOp1.bmp", cchWideChar=15, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pNar6q-oOp1.bmp", lpUsedDefaultChar=0x0) returned 15 [0270.668] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b40 | out: hHeap=0x4e0000) returned 1 [0270.669] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a1e70, ftCreationTime.dwHighDateTime=0x1d7de04, ftLastAccessTime.dwLowDateTime=0x359c1070, ftLastAccessTime.dwHighDateTime=0x1d7e4db, ftLastWriteTime.dwLowDateTime=0x359c1070, ftLastWriteTime.dwHighDateTime=0x1d7e4db, nFileSizeHigh=0x0, nFileSizeLow=0xe859, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="Sdy83DydyPsPS_PB_.doc", cAlternateFileName="SDY83D~1.DOC")) returned 1 [0270.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.669] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.669] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.670] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.670] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.670] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.671] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.729] RtlEqualUnicodeString (String1=".doc", String2=".exe", CaseInsensitive=1) returned 0 [0270.733] RtlEqualUnicodeString (String1=".doc", String2=".com", CaseInsensitive=1) returned 0 [0270.733] RtlEqualUnicodeString (String1=".doc", String2=".bat", CaseInsensitive=1) returned 0 [0270.733] RtlEqualUnicodeString (String1=".doc", String2=".cmd", CaseInsensitive=1) returned 0 [0270.734] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.734] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.734] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.734] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.735] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\Sdy83DydyPsPS_PB_.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\sdy83dydypsps_pb_.doc")) returned 0x20 [0270.735] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.735] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.735] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.735] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.735] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.735] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.736] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.736] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.736] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.737] RtlEqualUnicodeString (String1=".doc", String2=".exe", CaseInsensitive=1) returned 0 [0270.737] RtlEqualUnicodeString (String1=".doc", String2=".com", CaseInsensitive=1) returned 0 [0270.737] RtlEqualUnicodeString (String1=".doc", String2=".bat", CaseInsensitive=1) returned 0 [0270.737] RtlEqualUnicodeString (String1=".doc", String2=".cmd", CaseInsensitive=1) returned 0 [0270.737] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\Sdy83DydyPsPS_PB_.doc" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\sdy83dydypsps_pb_.doc")) returned 0x20 [0270.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.737] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.738] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.738] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.738] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.738] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.739] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.739] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.739] RtlEqualUnicodeString (String1=".doc", String2=".exe", CaseInsensitive=1) returned 0 [0270.739] RtlEqualUnicodeString (String1=".doc", String2=".com", CaseInsensitive=1) returned 0 [0270.739] RtlEqualUnicodeString (String1=".doc", String2=".bat", CaseInsensitive=1) returned 0 [0270.739] RtlEqualUnicodeString (String1=".doc", String2=".cmd", CaseInsensitive=1) returned 0 [0270.739] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.739] AreFileApisANSI () returned 1 [0270.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="Sdy83DydyPsPS_PB_.doc", cchWideChar=21, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sdy83DydyPsPS_PB_.doc", lpUsedDefaultChar=0x0) returned 21 [0270.739] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99f0 [0270.740] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0270.740] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99f0 | out: hHeap=0x4e0000) returned 1 [0270.740] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.741] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0270.741] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fa4730, ftCreationTime.dwHighDateTime=0x1d7d806, ftLastAccessTime.dwLowDateTime=0x584117c0, ftLastAccessTime.dwHighDateTime=0x1d7e052, ftLastWriteTime.dwLowDateTime=0x584117c0, ftLastWriteTime.dwHighDateTime=0x1d7e052, nFileSizeHigh=0x0, nFileSizeLow=0x13c8, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="UIfpAwOH_o8OFjt3.mp3", cAlternateFileName="UIFPAW~1.MP3")) returned 1 [0270.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.741] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.741] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.741] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.742] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.742] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.742] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.742] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.743] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.743] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0270.743] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0270.743] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0270.743] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0270.743] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.743] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.743] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.744] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.744] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\UIfpAwOH_o8OFjt3.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\uifpawoh_o8ofjt3.mp3")) returned 0x20 [0270.744] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.744] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.744] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.744] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0270.744] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0270.744] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0270.744] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0270.744] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\UIfpAwOH_o8OFjt3.mp3" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\uifpawoh_o8ofjt3.mp3")) returned 0x20 [0270.744] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.744] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.744] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.744] RtlEqualUnicodeString (String1=".mp3", String2=".exe", CaseInsensitive=1) returned 0 [0270.744] RtlEqualUnicodeString (String1=".mp3", String2=".com", CaseInsensitive=1) returned 0 [0270.744] RtlEqualUnicodeString (String1=".mp3", String2=".bat", CaseInsensitive=1) returned 0 [0270.744] RtlEqualUnicodeString (String1=".mp3", String2=".cmd", CaseInsensitive=1) returned 0 [0270.744] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.744] AreFileApisANSI () returned 1 [0270.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="UIfpAwOH_o8OFjt3.mp3", cchWideChar=20, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UIfpAwOH_o8OFjt3.mp3", lpUsedDefaultChar=0x0) returned 20 [0270.745] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0270.746] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b99c0 [0270.746] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0270.746] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.746] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99c0 | out: hHeap=0x4e0000) returned 1 [0270.746] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12b443b0, ftCreationTime.dwHighDateTime=0x1d7dad2, ftLastAccessTime.dwLowDateTime=0x68020450, ftLastAccessTime.dwHighDateTime=0x1d7def7, ftLastWriteTime.dwLowDateTime=0x68020450, ftLastWriteTime.dwHighDateTime=0x1d7def7, nFileSizeHigh=0x0, nFileSizeLow=0x7535, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="wXMLRlSp5zrw_qj72WX.csv", cAlternateFileName="WXMLRL~1.CSV")) returned 1 [0270.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1360 [0270.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.747] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.747] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.747] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.747] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.748] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.748] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1360 | out: hHeap=0x4e0000) returned 1 [0270.748] RtlEqualUnicodeString (String1=".csv", String2=".exe", CaseInsensitive=1) returned 0 [0270.748] RtlEqualUnicodeString (String1=".csv", String2=".com", CaseInsensitive=1) returned 0 [0270.748] RtlEqualUnicodeString (String1=".csv", String2=".bat", CaseInsensitive=1) returned 0 [0270.748] RtlEqualUnicodeString (String1=".csv", String2=".cmd", CaseInsensitive=1) returned 0 [0270.748] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.748] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.749] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.749] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.749] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\wXMLRlSp5zrw_qj72WX.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\wxmlrlsp5zrw_qj72wx.csv")) returned 0x20 [0270.749] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.749] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.749] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.749] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.749] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.749] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.749] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.750] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.750] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.750] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.755] RtlEqualUnicodeString (String1=".csv", String2=".exe", CaseInsensitive=1) returned 0 [0270.755] RtlEqualUnicodeString (String1=".csv", String2=".com", CaseInsensitive=1) returned 0 [0270.755] RtlEqualUnicodeString (String1=".csv", String2=".bat", CaseInsensitive=1) returned 0 [0270.755] RtlEqualUnicodeString (String1=".csv", String2=".cmd", CaseInsensitive=1) returned 0 [0270.755] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\wXMLRlSp5zrw_qj72WX.csv" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\wxmlrlsp5zrw_qj72wx.csv")) returned 0x20 [0270.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.755] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.756] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.756] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.756] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.756] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.756] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.757] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.757] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.757] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.757] RtlEqualUnicodeString (String1=".csv", String2=".exe", CaseInsensitive=1) returned 0 [0270.757] RtlEqualUnicodeString (String1=".csv", String2=".com", CaseInsensitive=1) returned 0 [0270.757] RtlEqualUnicodeString (String1=".csv", String2=".bat", CaseInsensitive=1) returned 0 [0270.757] RtlEqualUnicodeString (String1=".csv", String2=".cmd", CaseInsensitive=1) returned 0 [0270.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.757] AreFileApisANSI () returned 1 [0270.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="wXMLRlSp5zrw_qj72WX.csv", cchWideChar=23, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wXMLRlSp5zrw_qj72WX.csv", lpUsedDefaultChar=0x0) returned 23 [0270.757] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c00 [0270.758] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b70 [0270.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c00 | out: hHeap=0x4e0000) returned 1 [0270.759] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.760] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b70 | out: hHeap=0x4e0000) returned 1 [0270.760] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d3a8f0, ftCreationTime.dwHighDateTime=0x1d7dae8, ftLastAccessTime.dwLowDateTime=0x3b945b20, ftLastAccessTime.dwHighDateTime=0x1d7e68b, ftLastWriteTime.dwLowDateTime=0x3b945b20, ftLastWriteTime.dwHighDateTime=0x1d7e68b, nFileSizeHigh=0x0, nFileSizeLow=0x16094, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="yP4F9.bmp", cAlternateFileName="")) returned 1 [0270.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b40 [0270.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0270.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0270.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0270.760] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ba0 [0270.760] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0270.761] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ba0 | out: hHeap=0x4e0000) returned 1 [0270.761] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d20 [0270.761] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e70 [0270.761] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d20 | out: hHeap=0x4e0000) returned 1 [0270.761] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e70 | out: hHeap=0x4e0000) returned 1 [0270.761] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0270.761] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0270.761] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0270.761] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0270.761] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0270.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0270.762] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9de0 [0270.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9de0 | out: hHeap=0x4e0000) returned 1 [0270.762] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b40 | out: hHeap=0x4e0000) returned 1 [0270.762] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\yP4F9.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\yp4f9.bmp")) returned 0x20 [0270.762] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c30 [0270.762] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9db0 [0270.762] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98a0 [0270.763] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0270.763] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98a0 | out: hHeap=0x4e0000) returned 1 [0270.763] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f60 [0270.763] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ea0 [0270.763] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f60 | out: hHeap=0x4e0000) returned 1 [0270.763] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ea0 | out: hHeap=0x4e0000) returned 1 [0270.764] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c30 | out: hHeap=0x4e0000) returned 1 [0270.764] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0270.764] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0270.764] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0270.764] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0270.764] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\yP4F9.bmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\yp4f9.bmp")) returned 0x20 [0270.764] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9900 [0270.764] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9cc0 [0270.764] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d50 [0270.764] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9cc0 | out: hHeap=0x4e0000) returned 1 [0270.764] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d50 | out: hHeap=0x4e0000) returned 1 [0270.765] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9a50 [0270.766] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9960 [0270.766] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a50 | out: hHeap=0x4e0000) returned 1 [0270.766] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9960 | out: hHeap=0x4e0000) returned 1 [0270.766] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9900 | out: hHeap=0x4e0000) returned 1 [0270.766] RtlEqualUnicodeString (String1=".bmp", String2=".exe", CaseInsensitive=1) returned 0 [0270.767] RtlEqualUnicodeString (String1=".bmp", String2=".com", CaseInsensitive=1) returned 0 [0270.767] RtlEqualUnicodeString (String1=".bmp", String2=".bat", CaseInsensitive=1) returned 0 [0270.767] RtlEqualUnicodeString (String1=".bmp", String2=".cmd", CaseInsensitive=1) returned 0 [0270.767] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f00 [0270.767] AreFileApisANSI () returned 1 [0270.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="yP4F9.bmp", cchWideChar=9, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yP4F9.bmp", lpUsedDefaultChar=0x0) returned 9 [0270.768] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f00 | out: hHeap=0x4e0000) returned 1 [0270.768] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3529fb0, ftCreationTime.dwHighDateTime=0x1d7d8ac, ftLastAccessTime.dwLowDateTime=0x4870f1e0, ftLastAccessTime.dwHighDateTime=0x1d7e20e, ftLastWriteTime.dwLowDateTime=0x4870f1e0, ftLastWriteTime.dwHighDateTime=0x1d7e20e, nFileSizeHigh=0x0, nFileSizeLow=0x1183c, dwReserved0=0x0, dwReserved1=0x504f08f9, cFileName="_MqYlmgEvKDoR.gif", cAlternateFileName="_MQYLM~1.GIF")) returned 1 [0270.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.768] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.769] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.769] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.769] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.769] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.770] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.770] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.771] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.771] RtlEqualUnicodeString (String1=".gif", String2=".exe", CaseInsensitive=1) returned 0 [0270.771] RtlEqualUnicodeString (String1=".gif", String2=".com", CaseInsensitive=1) returned 0 [0270.771] RtlEqualUnicodeString (String1=".gif", String2=".bat", CaseInsensitive=1) returned 0 [0270.771] RtlEqualUnicodeString (String1=".gif", String2=".cmd", CaseInsensitive=1) returned 0 [0270.771] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.771] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.772] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.772] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.772] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\_MqYlmgEvKDoR.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\_mqylmgevkdor.gif")) returned 0x20 [0270.772] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.772] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.773] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.773] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.773] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.774] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.774] RtlEqualUnicodeString (String1=".gif", String2=".exe", CaseInsensitive=1) returned 0 [0270.774] RtlEqualUnicodeString (String1=".gif", String2=".com", CaseInsensitive=1) returned 0 [0270.774] RtlEqualUnicodeString (String1=".gif", String2=".bat", CaseInsensitive=1) returned 0 [0270.774] RtlEqualUnicodeString (String1=".gif", String2=".cmd", CaseInsensitive=1) returned 0 [0270.774] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\_MqYlmgEvKDoR.gif" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\_mqylmgevkdor.gif")) returned 0x20 [0270.775] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.775] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.775] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.775] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.776] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.776] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.776] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.776] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.777] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.777] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.777] RtlEqualUnicodeString (String1=".gif", String2=".exe", CaseInsensitive=1) returned 0 [0270.777] RtlEqualUnicodeString (String1=".gif", String2=".com", CaseInsensitive=1) returned 0 [0270.777] RtlEqualUnicodeString (String1=".gif", String2=".bat", CaseInsensitive=1) returned 0 [0270.777] RtlEqualUnicodeString (String1=".gif", String2=".cmd", CaseInsensitive=1) returned 0 [0270.777] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.777] AreFileApisANSI () returned 1 [0270.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="_MqYlmgEvKDoR.gif", cchWideChar=17, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_MqYlmgEvKDoR.gif", lpUsedDefaultChar=0x0) returned 17 [0270.778] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f90 [0270.779] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9cc0 [0270.779] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f90 | out: hHeap=0x4e0000) returned 1 [0270.780] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.780] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9cc0 | out: hHeap=0x4e0000) returned 1 [0270.780] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa7d1900, ftCreationTime.dwHighDateTime=0x1d7e591, ftLastAccessTime.dwLowDateTime=0xf40cfb10, ftLastAccessTime.dwHighDateTime=0x1d7e6a6, ftLastWriteTime.dwLowDateTime=0xf40cfb10, ftLastWriteTime.dwHighDateTime=0x1d7e6a6, nFileSizeHigh=0x0, nFileSizeLow=0xff31, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="_qlnLp46kQ1zTXWm.m4a", cAlternateFileName="_QLNLP~1.M4A")) returned 1 [0270.780] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.780] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.780] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.780] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.780] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.781] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.781] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.781] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.782] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.782] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.782] RtlEqualUnicodeString (String1=".m4a", String2=".exe", CaseInsensitive=1) returned 0 [0270.782] RtlEqualUnicodeString (String1=".m4a", String2=".com", CaseInsensitive=1) returned 0 [0270.782] RtlEqualUnicodeString (String1=".m4a", String2=".bat", CaseInsensitive=1) returned 0 [0270.782] RtlEqualUnicodeString (String1=".m4a", String2=".cmd", CaseInsensitive=1) returned 0 [0270.783] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.783] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.783] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.783] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.783] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\_qlnLp46kQ1zTXWm.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\_qlnlp46kq1ztxwm.m4a")) returned 0x20 [0270.783] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.783] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.783] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.784] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.784] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.784] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.785] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.785] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.785] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.785] RtlEqualUnicodeString (String1=".m4a", String2=".exe", CaseInsensitive=1) returned 0 [0270.785] RtlEqualUnicodeString (String1=".m4a", String2=".com", CaseInsensitive=1) returned 0 [0270.785] RtlEqualUnicodeString (String1=".m4a", String2=".bat", CaseInsensitive=1) returned 0 [0270.785] RtlEqualUnicodeString (String1=".m4a", String2=".cmd", CaseInsensitive=1) returned 0 [0270.785] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\_qlnLp46kQ1zTXWm.m4a" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\_qlnlp46kq1ztxwm.m4a")) returned 0x20 [0270.785] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1360 [0270.785] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.786] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.786] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.786] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.786] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.787] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.787] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1360 | out: hHeap=0x4e0000) returned 1 [0270.787] RtlEqualUnicodeString (String1=".m4a", String2=".exe", CaseInsensitive=1) returned 0 [0270.787] RtlEqualUnicodeString (String1=".m4a", String2=".com", CaseInsensitive=1) returned 0 [0270.787] RtlEqualUnicodeString (String1=".m4a", String2=".bat", CaseInsensitive=1) returned 0 [0270.787] RtlEqualUnicodeString (String1=".m4a", String2=".cmd", CaseInsensitive=1) returned 0 [0270.787] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.787] AreFileApisANSI () returned 1 [0270.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="_qlnLp46kQ1zTXWm.m4a", cchWideChar=20, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="_qlnLp46kQ1zTXWm.m4a", lpUsedDefaultChar=0x0) returned 20 [0270.787] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9900 [0270.788] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c30 [0270.789] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9900 | out: hHeap=0x4e0000) returned 1 [0270.789] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.789] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c30 | out: hHeap=0x4e0000) returned 1 [0270.789] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb7a143fe, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xb7a143fe, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb7a143fe, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="~DFD54D056689FA94D6.TMP", cAlternateFileName="~DFD54~1.TMP")) returned 1 [0270.790] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.790] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.790] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.790] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.790] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.790] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.790] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.791] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.791] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.791] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.791] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.791] RtlEqualUnicodeString (String1=".TMP", String2=".exe", CaseInsensitive=1) returned 0 [0270.791] RtlEqualUnicodeString (String1=".TMP", String2=".com", CaseInsensitive=1) returned 0 [0270.791] RtlEqualUnicodeString (String1=".TMP", String2=".bat", CaseInsensitive=1) returned 0 [0270.792] RtlEqualUnicodeString (String1=".TMP", String2=".cmd", CaseInsensitive=1) returned 0 [0270.792] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.792] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.792] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.792] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.792] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\~DFD54D056689FA94D6.TMP" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\~dfd54d056689fa94d6.tmp")) returned 0x120 [0270.792] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.792] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.792] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.793] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.793] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.793] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.793] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.793] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.793] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.793] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.793] RtlEqualUnicodeString (String1=".TMP", String2=".exe", CaseInsensitive=1) returned 0 [0270.794] RtlEqualUnicodeString (String1=".TMP", String2=".com", CaseInsensitive=1) returned 0 [0270.794] RtlEqualUnicodeString (String1=".TMP", String2=".bat", CaseInsensitive=1) returned 0 [0270.794] RtlEqualUnicodeString (String1=".TMP", String2=".cmd", CaseInsensitive=1) returned 0 [0270.794] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\~DFD54D056689FA94D6.TMP" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\~dfd54d056689fa94d6.tmp")) returned 0x120 [0270.794] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.794] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.794] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.794] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.794] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.794] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.794] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1360 [0270.794] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.795] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1360 | out: hHeap=0x4e0000) returned 1 [0270.795] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.795] RtlEqualUnicodeString (String1=".TMP", String2=".exe", CaseInsensitive=1) returned 0 [0270.795] RtlEqualUnicodeString (String1=".TMP", String2=".com", CaseInsensitive=1) returned 0 [0270.795] RtlEqualUnicodeString (String1=".TMP", String2=".bat", CaseInsensitive=1) returned 0 [0270.795] RtlEqualUnicodeString (String1=".TMP", String2=".cmd", CaseInsensitive=1) returned 0 [0270.795] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.795] AreFileApisANSI () returned 1 [0270.795] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="~DFD54D056689FA94D6.TMP", cchWideChar=23, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~DFD54D056689FA94D6.TMP", lpUsedDefaultChar=0x0) returned 23 [0270.795] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9e10 [0270.796] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c90 [0270.797] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e10 | out: hHeap=0x4e0000) returned 1 [0270.797] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.797] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c90 | out: hHeap=0x4e0000) returned 1 [0270.798] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xb6b2ef4d, ftCreationTime.dwHighDateTime=0x1d7e78c, ftLastAccessTime.dwLowDateTime=0xb6b2ef4d, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb6b2ef4d, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="~DFDA4D730673A5F8D5.TMP", cAlternateFileName="~DFDA4~1.TMP")) returned 1 [0270.798] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.798] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.798] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.798] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.798] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.798] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.798] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.801] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1320 [0270.801] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.801] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1320 | out: hHeap=0x4e0000) returned 1 [0270.801] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.802] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.802] RtlEqualUnicodeString (String1=".TMP", String2=".exe", CaseInsensitive=1) returned 0 [0270.802] RtlEqualUnicodeString (String1=".TMP", String2=".com", CaseInsensitive=1) returned 0 [0270.802] RtlEqualUnicodeString (String1=".TMP", String2=".bat", CaseInsensitive=1) returned 0 [0270.802] RtlEqualUnicodeString (String1=".TMP", String2=".cmd", CaseInsensitive=1) returned 0 [0270.802] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.802] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.803] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.803] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.803] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\~DFDA4D730673A5F8D5.TMP" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\~dfda4d730673a5f8d5.tmp")) returned 0x120 [0270.803] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1660 [0270.803] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.803] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f16a0 [0270.803] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.804] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f16a0 | out: hHeap=0x4e0000) returned 1 [0270.804] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.804] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.804] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.804] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.805] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1660 | out: hHeap=0x4e0000) returned 1 [0270.805] RtlEqualUnicodeString (String1=".TMP", String2=".exe", CaseInsensitive=1) returned 0 [0270.805] RtlEqualUnicodeString (String1=".TMP", String2=".com", CaseInsensitive=1) returned 0 [0270.805] RtlEqualUnicodeString (String1=".TMP", String2=".bat", CaseInsensitive=1) returned 0 [0270.805] RtlEqualUnicodeString (String1=".TMP", String2=".cmd", CaseInsensitive=1) returned 0 [0270.805] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\~DFDA4D730673A5F8D5.TMP" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\~dfda4d730673a5f8d5.tmp")) returned 0x120 [0270.805] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1160 [0270.805] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.805] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.805] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.806] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.806] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1220 [0270.806] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1260 [0270.806] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1220 | out: hHeap=0x4e0000) returned 1 [0270.806] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1260 | out: hHeap=0x4e0000) returned 1 [0270.807] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1160 | out: hHeap=0x4e0000) returned 1 [0270.807] RtlEqualUnicodeString (String1=".TMP", String2=".exe", CaseInsensitive=1) returned 0 [0270.807] RtlEqualUnicodeString (String1=".TMP", String2=".com", CaseInsensitive=1) returned 0 [0270.807] RtlEqualUnicodeString (String1=".TMP", String2=".bat", CaseInsensitive=1) returned 0 [0270.807] RtlEqualUnicodeString (String1=".TMP", String2=".cmd", CaseInsensitive=1) returned 0 [0270.807] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x30) returned 0x4f1460 [0270.807] AreFileApisANSI () returned 1 [0270.807] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="~DFDA4D730673A5F8D5.TMP", cchWideChar=23, lpMultiByteStr=0xce6d0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="~DFDA4D730673A5F8D5.TMP", lpUsedDefaultChar=0x0) returned 23 [0270.807] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0270.808] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9c00 [0270.809] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0270.810] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1460 | out: hHeap=0x4e0000) returned 1 [0270.810] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9c00 | out: hHeap=0x4e0000) returned 1 [0270.810] FindNextFileW (in: hFindFile=0x5b1e20, lpFindFileData=0xce420 | out: lpFindFileData=0xce420*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x1f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x17, dwReserved0=0x0, dwReserved1=0x403e5684, cFileName="\x01", cAlternateFileName="\x01")) returned 0 [0270.810] GetLastError () returned 0x12 [0270.810] FindClose (in: hFindFile=0x5b1e20 | out: hFindFile=0x5b1e20) returned 1 [0270.861] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5057b0 | out: hHeap=0x4e0000) returned 1 [0270.861] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1520 | out: hHeap=0x4e0000) returned 1 [0270.861] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518180 | out: hHeap=0x4e0000) returned 1 [0270.861] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ea0c0 | out: hHeap=0x4e0000) returned 1 [0270.861] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0xcec60 | out: lpSystemTimeAsFileTime=0xcec60) [0270.862] GetLastError () returned 0x12 [0270.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcefd8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0270.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x1c) returned 0x5b98a0 [0270.862] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xcefd8, cbMultiByte=-1, lpWideCharStr=0x5b98a0, cchWideChar=14 | out: lpWideCharStr="%Y%m%d_%H%M%S") returned 14 [0270.862] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x78) returned 0x504610 [0270.862] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="20211229_125959", cchWideChar=-1, lpMultiByteStr=0x1407d7f88, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="20211229_125959", lpUsedDefaultChar=0x0) returned 16 [0270.863] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504610 | out: hHeap=0x4e0000) returned 1 [0270.863] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98a0 | out: hHeap=0x4e0000) returned 1 [0270.863] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5ba020 [0270.863] GetStdHandle (nStdHandle=0xfffffff5) returned 0x24 [0270.863] GetStdHandle (nStdHandle=0xfffffff6) returned 0x20 [0270.863] GetConsoleMode (in: hConsoleHandle=0x20, lpMode=0xceab0 | out: lpMode=0xceab0) returned 1 [0270.864] SetConsoleMode (hConsoleHandle=0x20, dwMode=0x1a7) returned 1 [0270.868] GetSystemTimePreciseAsFileTime (in: lpSystemTimeAsFileTime=0xceab0 | out: lpSystemTimeAsFileTime=0xceab0) [0270.868] QueryPerformanceFrequency (in: lpFrequency=0xceab0 | out: lpFrequency=0xceab0*=100000000) returned 1 [0270.868] QueryPerformanceCounter (in: lpPerformanceCount=0xceab0 | out: lpPerformanceCount=0xceab0*=1219107826207) returned 1 [0270.868] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x8) returned 0x5bef50 [0270.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x48) returned 0x5b31c0 [0270.869] RtlInitializeConditionVariable () returned 0x7ffd505421f0 [0270.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x50) returned 0x5b1ac0 [0270.869] RtlInitializeConditionVariable () returned 0x7ffd505421f0 [0270.869] GetCurrentThreadId () returned 0xfe4 [0270.869] GetCurrentThreadId () returned 0xfe4 [0270.869] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x28) returned 0x5b9cc0 [0270.869] GetModuleHandleExW (in: dwFlags=0x4, lpModuleName=0x140034e40, phModule=0x5b9cd8 | out: phModule=0x5b9cd8*=0x140000000) returned 1 [0270.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1403dda2c, lpParameter=0x5b9cc0, dwCreationFlags=0x0, lpThreadId=0xcea00 | out: lpThreadId=0xcea00*=0xa60) returned 0x120 [0270.870] SleepConditionVariableSRW (in: ConditionVariable=0x5b31c8, SRWLock=0x5b1ad0, dwMilliseconds=0xffffffff, Flags=0x0 | out: ConditionVariable=0x5b31c8, SRWLock=0x5b1ad0) returned 1 [0270.876] GetCurrentThreadId () returned 0xfe4 [0270.877] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b1ac0 | out: hHeap=0x4e0000) returned 1 [0270.877] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b31c0 | out: hHeap=0x4e0000) returned 1 [0270.877] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0270.878] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5ba020 | out: hHeap=0x4e0000) returned 1 [0270.878] QueryPerformanceFrequency (in: lpFrequency=0xce880 | out: lpFrequency=0xce880*=100000000) returned 1 [0270.878] QueryPerformanceCounter (in: lpPerformanceCount=0xce880 | out: lpPerformanceCount=0xce880*=1219108762270) returned 1 [0270.878] GetCurrentThreadId () returned 0xfe4 [0270.878] GetCurrentThreadId () returned 0xfe4 [0270.878] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0270.878] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0270.878] QueryPerformanceFrequency (in: lpFrequency=0xce8d0 | out: lpFrequency=0xce8d0*=100000000) returned 1 [0270.878] QueryPerformanceCounter (in: lpPerformanceCount=0xce8d0 | out: lpPerformanceCount=0xce8d0*=1219108797429) returned 1 [0270.878] GetCurrentThreadId () returned 0xfe4 [0270.878] GetCurrentThreadId () returned 0xfe4 [0270.878] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0270.878] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d80 [0270.879] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x518320 [0270.879] SetLastError (dwErrCode=0x0) [0270.879] GetSystemDirectoryW (in: lpBuffer=0x0, uSize=0x0 | out: lpBuffer=0x0) returned 0x14 [0270.879] LocalAlloc (uFlags=0x40, uBytes=0x3e) returned 0x5b2a90 [0270.879] GetSystemDirectoryW (in: lpBuffer=0x5b2a90, uSize=0x14 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0270.879] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\nvcuda.dll", hFile=0x0, dwFlags=0x0) returned 0x0 [0270.880] LocalFree (hMem=0x5b2a90) returned 0x0 [0270.880] LocalFree (hMem=0x518320) returned 0x0 [0270.880] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b98d0 [0270.880] QueryPerformanceFrequency (in: lpFrequency=0xc8b20 | out: lpFrequency=0xc8b20*=100000000) returned 1 [0270.880] QueryPerformanceCounter (in: lpPerformanceCount=0xc8b20 | out: lpPerformanceCount=0xc8b20*=1219108982146) returned 1 [0270.880] GetCurrentThreadId () returned 0xfe4 [0270.880] GetCurrentThreadId () returned 0xfe4 [0270.880] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0270.880] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b98d0 | out: hHeap=0x4e0000) returned 1 [0270.881] InitOnceExecuteOnce (in: InitOnce=0x1407da4f0, InitFn=0x14027a7f0, Parameter=0x0, Context=0x0 | out: InitOnce=0x1407da4f0, Parameter=0x0, Context=0x0) returned 0 [0270.881] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9900 [0270.881] StringFromGUID2 (in: rguid=0x1406bac68*(Data1=0x4d36e968, Data2=0xe325, Data3=0x11ce, Data4=([0]=0xbf, [1]=0xc1, [2]=0x8, [3]=0x0, [4]=0x2b, [5]=0xe1, [6]=0x3, [7]=0x18)), lpsz=0xc95c0, cchMax=39 | out: lpsz="{4D36E968-E325-11CE-BFC1-08002BE10318}") returned 39 [0270.881] CM_Get_Device_ID_List_SizeW (in: pulLen=0xc9598, pszFilter="{4D36E968-E325-11CE-BFC1-08002BE10318}", ulFlags=0x300 | out: pulLen=0xc9598) returned 0x0 [0270.882] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x7c) returned 0x4e0f10 [0270.882] CM_Get_Device_ID_ListW (in: pszFilter="{4D36E968-E325-11CE-BFC1-08002BE10318}", Buffer=0x4e0f10, BufferLen=0x3e, ulFlags=0x300 | out: Buffer="PCI\\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\\3&2411e6fe&0&08") returned 0x0 [0270.882] CM_Locate_DevNodeW (in: pdnDevInst=0xc9594, pDeviceID=0x4e0f10, ulFlags=0x0 | out: pdnDevInst=0xc9594) returned 0x0 [0270.882] CM_Get_DevNode_Status (in: pulStatus=0xc959c, pulProblemNumber=0xc95a0, dnDevInst=0x1, ulFlags=0x0 | out: pulStatus=0xc959c, pulProblemNumber=0xc95a0) returned 0x0 [0270.883] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b40 [0270.883] CM_Open_DevNode_Key (in: dnDevNode=0x1, samDesired=0x1, ulHardwareProfile=0x0, Disposition=0x1, phkDevice=0xc94c8, ulFlags=0x1 | out: phkDevice=0xc94c8) returned 0x0 [0270.883] RegQueryValueExA (in: hKey=0x124, lpValueName="OpenCLDriverName", lpReserved=0x0, lpType=0xc94c4, lpData=0x0, lpcbData=0xc94c0*=0x0 | out: lpType=0xc94c4*=0x0, lpData=0x0, lpcbData=0xc94c0*=0x0) returned 0x2 [0270.883] RegCloseKey (hKey=0x124) returned 0x0 [0270.884] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b40 | out: hHeap=0x4e0000) returned 1 [0270.884] CM_Get_Child (in: pdnDevInst=0xc9590, dnDevInst=0x1, ulFlags=0x0 | out: pdnDevInst=0xc9590) returned 0x0 [0270.884] CM_Get_Device_IDW (in: dnDevInst=0x2, Buffer=0xc9610, BufferLen=0x190, ulFlags=0x0 | out: Buffer="DISPLAY\\DEFAULT_MONITOR\\4&35AB2D93&0&UID0") returned 0x0 [0270.884] CM_Get_DevNode_PropertyW () returned 0x0 [0270.884] CM_Get_Sibling (in: pdnDevInst=0xc9590, dnDevInst=0x2, ulFlags=0x0 | out: pdnDevInst=0xc9590) returned 0xd [0270.884] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0f10 | out: hHeap=0x4e0000) returned 1 [0270.885] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Khronos\\OpenCL\\Vendors", ulOptions=0x0, samDesired=0x20019, phkResult=0xc9810 | out: phkResult=0xc9810*=0x0) returned 0x2 [0270.885] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9900 | out: hHeap=0x4e0000) returned 1 [0270.885] RtlPcToFileHeader (in: PcValue=0x14077d310, BaseOfImage=0xc9da0 | out: BaseOfImage=0xc9da0*=0x140000000) returned 0x140000000 [0270.885] RaiseException (dwExceptionCode=0xe06d7363, dwExceptionFlags=0x1, nNumberOfArguments=0x4, lpArguments=0xc9d60) [0270.886] GetLastError () returned 0x7e [0270.886] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0270.886] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b99c0 | out: hHeap=0x4e0000) returned 1 [0270.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x5b2240 [0270.886] QueryPerformanceFrequency (in: lpFrequency=0xc9d20 | out: lpFrequency=0xc9d20*=100000000) returned 1 [0270.886] QueryPerformanceCounter (in: lpPerformanceCount=0xc9d20 | out: lpPerformanceCount=0xc9d20*=1219109602573) returned 1 [0270.886] GetCurrentThreadId () returned 0xfe4 [0270.886] GetCurrentThreadId () returned 0xfe4 [0270.886] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0270.888] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2240 | out: hHeap=0x4e0000) returned 1 [0270.889] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d80 | out: hHeap=0x4e0000) returned 1 [0270.889] QueryPerformanceFrequency (in: lpFrequency=0xce880 | out: lpFrequency=0xce880*=100000000) returned 1 [0270.889] QueryPerformanceCounter (in: lpPerformanceCount=0xce880 | out: lpPerformanceCount=0xce880*=1219109853686) returned 1 [0270.889] GetCurrentThreadId () returned 0xfe4 [0270.889] GetCurrentThreadId () returned 0xfe4 [0270.889] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0270.889] GetCurrentThreadId () returned 0xfe4 [0270.889] GetCurrentThreadId () returned 0xfe4 [0270.889] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0270.889] GetCurrentThreadId () returned 0xfe4 [0270.889] WaitForSingleObjectEx (hHandle=0x120, dwMilliseconds=0xffffffff, bAlertable=0) returned 0x0 [0270.896] GetExitCodeThread (in: hThread=0x120, lpExitCode=0xcf000 | out: lpExitCode=0xcf000) returned 1 [0270.896] CloseHandle (hObject=0x120) returned 1 [0270.896] SetConsoleTextAttribute (hConsoleOutput=0x24, wAttributes=0x7) returned 1 [0270.896] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f70c0 | out: hHeap=0x4e0000) returned 1 [0270.897] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2120 | out: hHeap=0x4e0000) returned 1 [0270.897] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x503910 | out: hHeap=0x4e0000) returned 1 [0270.897] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b4550 | out: hHeap=0x4e0000) returned 1 [0270.898] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fee20 | out: hHeap=0x4e0000) returned 1 [0270.898] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f12e0 | out: hHeap=0x4e0000) returned 1 [0270.898] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9930 | out: hHeap=0x4e0000) returned 1 [0270.898] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e09c0 | out: hHeap=0x4e0000) returned 1 [0270.899] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8850 | out: hHeap=0x4e0000) returned 1 [0270.899] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fedc0 | out: hHeap=0x4e0000) returned 1 [0270.899] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1060 | out: hHeap=0x4e0000) returned 1 [0270.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0ca0 | out: hHeap=0x4e0000) returned 1 [0270.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f10a0 | out: hHeap=0x4e0000) returned 1 [0270.900] GetModuleHandleW (lpModuleName=0x0) returned 0x140000000 [0270.900] GetModuleHandleW (lpModuleName=0x0) returned 0x140000000 [0270.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b34e0 | out: hHeap=0x4e0000) returned 1 [0270.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bf080 | out: hHeap=0x4e0000) returned 1 [0270.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518660 | out: hHeap=0x4e0000) returned 1 [0270.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bd780 | out: hHeap=0x4e0000) returned 1 [0270.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ea720 | out: hHeap=0x4e0000) returned 1 [0270.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f30 | out: hHeap=0x4e0000) returned 1 [0270.900] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2420 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bf030 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bf050 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5befc0 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bee20 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x503e90 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bed50 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bee10 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5befb0 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5beeb0 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x503990 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518260 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5182e0 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518200 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ab0 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bee00 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518220 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518560 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f13a0 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5181c0 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5181a0 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bbf30 | out: hHeap=0x4e0000) returned 1 [0270.901] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e1010 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b36c0 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5be680 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5184c0 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bdfc0 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ea4e0 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9e40 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2840 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f71e0 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f70d0 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f71d0 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f70e0 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504010 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7110 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7090 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7180 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f70b0 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x503c10 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5188e0 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518540 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5188c0 | out: hHeap=0x4e0000) returned 1 [0270.902] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9a20 | out: hHeap=0x4e0000) returned 1 [0270.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7190 | out: hHeap=0x4e0000) returned 1 [0270.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518160 | out: hHeap=0x4e0000) returned 1 [0270.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518700 | out: hHeap=0x4e0000) returned 1 [0270.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f15a0 | out: hHeap=0x4e0000) returned 1 [0270.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518820 | out: hHeap=0x4e0000) returned 1 [0270.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518640 | out: hHeap=0x4e0000) returned 1 [0270.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bb2d0 | out: hHeap=0x4e0000) returned 1 [0270.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0fa0 | out: hHeap=0x4e0000) returned 1 [0270.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bd080 | out: hHeap=0x4e0000) returned 1 [0270.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5184a0 | out: hHeap=0x4e0000) returned 1 [0270.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b25a0 | out: hHeap=0x4e0000) returned 1 [0270.903] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e0be0 | out: hHeap=0x4e0000) returned 1 [0270.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518480 | out: hHeap=0x4e0000) returned 1 [0270.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b24e0 | out: hHeap=0x4e0000) returned 1 [0270.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7120 | out: hHeap=0x4e0000) returned 1 [0270.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7160 | out: hHeap=0x4e0000) returned 1 [0270.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7200 | out: hHeap=0x4e0000) returned 1 [0270.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f71f0 | out: hHeap=0x4e0000) returned 1 [0270.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504290 | out: hHeap=0x4e0000) returned 1 [0270.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f71c0 | out: hHeap=0x4e0000) returned 1 [0270.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7100 | out: hHeap=0x4e0000) returned 1 [0270.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7130 | out: hHeap=0x4e0000) returned 1 [0270.904] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f7220 | out: hHeap=0x4e0000) returned 1 [0270.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x503e10 | out: hHeap=0x4e0000) returned 1 [0270.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5182a0 | out: hHeap=0x4e0000) returned 1 [0270.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518620 | out: hHeap=0x4e0000) returned 1 [0270.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518400 | out: hHeap=0x4e0000) returned 1 [0270.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9cf0 | out: hHeap=0x4e0000) returned 1 [0270.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5186c0 | out: hHeap=0x4e0000) returned 1 [0270.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f71b0 | out: hHeap=0x4e0000) returned 1 [0270.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f70f0 | out: hHeap=0x4e0000) returned 1 [0270.905] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f70a0 | out: hHeap=0x4e0000) returned 1 [0270.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1560 | out: hHeap=0x4e0000) returned 1 [0270.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5181e0 | out: hHeap=0x4e0000) returned 1 [0270.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5185a0 | out: hHeap=0x4e0000) returned 1 [0270.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bc560 | out: hHeap=0x4e0000) returned 1 [0270.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1120 | out: hHeap=0x4e0000) returned 1 [0270.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e7920 | out: hHeap=0x4e0000) returned 1 [0270.906] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bef90 | out: hHeap=0x4e0000) returned 1 [0270.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f10e0 | out: hHeap=0x4e0000) returned 1 [0270.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1020 | out: hHeap=0x4e0000) returned 1 [0270.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2f90 | out: hHeap=0x4e0000) returned 1 [0270.907] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff0c0 | out: hHeap=0x4e0000) returned 1 [0270.908] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2ef0 | out: hHeap=0x4e0000) returned 1 [0270.908] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4febb0 | out: hHeap=0x4e0000) returned 1 [0270.908] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2a40 | out: hHeap=0x4e0000) returned 1 [0270.908] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4feb50 | out: hHeap=0x4e0000) returned 1 [0270.908] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2fe0 | out: hHeap=0x4e0000) returned 1 [0270.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1620 | out: hHeap=0x4e0000) returned 1 [0270.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b38a0 | out: hHeap=0x4e0000) returned 1 [0270.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e9100 | out: hHeap=0x4e0000) returned 1 [0270.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e93d0 | out: hHeap=0x4e0000) returned 1 [0270.909] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b1a00 | out: hHeap=0x4e0000) returned 1 [0270.910] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e9420 | out: hHeap=0x4e0000) returned 1 [0270.910] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b1940 | out: hHeap=0x4e0000) returned 1 [0270.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e9470 | out: hHeap=0x4e0000) returned 1 [0270.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fed60 | out: hHeap=0x4e0000) returned 1 [0270.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2950 | out: hHeap=0x4e0000) returned 1 [0270.924] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b1a60 | out: hHeap=0x4e0000) returned 1 [0270.925] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b33a0 | out: hHeap=0x4e0000) returned 1 [0270.925] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b1f40 | out: hHeap=0x4e0000) returned 1 [0270.925] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2c20 | out: hHeap=0x4e0000) returned 1 [0270.925] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b21e0 | out: hHeap=0x4e0000) returned 1 [0270.926] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b35d0 | out: hHeap=0x4e0000) returned 1 [0270.926] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2f40 | out: hHeap=0x4e0000) returned 1 [0270.926] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b3530 | out: hHeap=0x4e0000) returned 1 [0270.927] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e9b00 | out: hHeap=0x4e0000) returned 1 [0270.927] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f87c0 | out: hHeap=0x4e0000) returned 1 [0270.927] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fefd0 | out: hHeap=0x4e0000) returned 1 [0270.927] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8730 | out: hHeap=0x4e0000) returned 1 [0270.927] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fed00 | out: hHeap=0x4e0000) returned 1 [0270.927] FreeLibrary (hLibModule=0x7ffd3ed50000) returned 1 [0270.929] WSACleanup () returned 0 [0270.929] CloseHandle (hObject=0x114) returned 1 [0270.929] CloseHandle (hObject=0x10c) returned 1 [0270.929] CloseHandle (hObject=0x110) returned 1 [0270.935] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x51b8c0 | out: hHeap=0x4e0000) returned 1 [0270.935] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504cd0 | out: hHeap=0x4e0000) returned 1 [0270.935] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504c10 | out: hHeap=0x4e0000) returned 1 [0270.936] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504b50 | out: hHeap=0x4e0000) returned 1 [0270.936] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504a90 | out: hHeap=0x4e0000) returned 1 [0270.937] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5049d0 | out: hHeap=0x4e0000) returned 1 [0270.938] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504910 | out: hHeap=0x4e0000) returned 1 [0270.938] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504850 | out: hHeap=0x4e0000) returned 1 [0270.938] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff730 | out: hHeap=0x4e0000) returned 1 [0270.939] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff670 | out: hHeap=0x4e0000) returned 1 [0270.939] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff5b0 | out: hHeap=0x4e0000) returned 1 [0270.939] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff4f0 | out: hHeap=0x4e0000) returned 1 [0270.939] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff430 | out: hHeap=0x4e0000) returned 1 [0270.940] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff370 | out: hHeap=0x4e0000) returned 1 [0270.940] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ff2b0 | out: hHeap=0x4e0000) returned 1 [0270.940] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504390 | out: hHeap=0x4e0000) returned 1 [0270.940] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x503f90 | out: hHeap=0x4e0000) returned 1 [0270.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504590 | out: hHeap=0x4e0000) returned 1 [0270.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x503b90 | out: hHeap=0x4e0000) returned 1 [0270.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504310 | out: hHeap=0x4e0000) returned 1 [0270.941] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504790 | out: hHeap=0x4e0000) returned 1 [0270.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504190 | out: hHeap=0x4e0000) returned 1 [0270.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f92d0 | out: hHeap=0x4e0000) returned 1 [0270.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9250 | out: hHeap=0x4e0000) returned 1 [0270.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f91d0 | out: hHeap=0x4e0000) returned 1 [0270.942] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9150 | out: hHeap=0x4e0000) returned 1 [0270.943] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ea040 | out: hHeap=0x4e0000) returned 1 [0270.944] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e9fc0 | out: hHeap=0x4e0000) returned 1 [0270.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e9f40 | out: hHeap=0x4e0000) returned 1 [0270.945] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e3c10 | out: hHeap=0x4e0000) returned 1 [0270.946] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e3b90 | out: hHeap=0x4e0000) returned 1 [0270.946] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e5110 | out: hHeap=0x4e0000) returned 1 [0270.946] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e5090 | out: hHeap=0x4e0000) returned 1 [0270.947] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4ec060 | out: hHeap=0x4e0000) returned 1 [0270.947] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e3e70 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f14a0 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e8e60 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518240 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e90a0 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518500 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9770 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd220 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x500050 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x500ee0 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x501700 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x502be0 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x507f90 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5083d0 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x50a2a0 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x50c910 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x50d370 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fbbc0 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x503500 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5074c0 | out: hHeap=0x4e0000) returned 1 [0270.948] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5087d0 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5144f0 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa090 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd740 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd520 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd640 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fde70 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x502240 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x502e80 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x505bc0 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x50e530 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9010 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa050 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fb8e0 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fdb70 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x500230 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x501a20 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x503360 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x50e3f0 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8e70 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fa270 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fbec0 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc640 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x500ca0 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5034e0 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x506d40 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x508710 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x50afc0 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x50e330 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x50ec50 | out: hHeap=0x4e0000) returned 1 [0270.949] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x514f90 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f9410 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd4e0 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fca00 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5002f0 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5006f0 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x505a00 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x509e60 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x50e5b0 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x515810 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x515f10 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fbf60 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd000 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5019e0 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x503780 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x507580 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x508c30 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x508c70 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x50ae00 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x515870 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x515d30 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f8db0 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fc240 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fd1c0 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fcba0 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4fe1d0 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x501780 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x506300 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x508370 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x508ad0 | out: hHeap=0x4e0000) returned 1 [0270.950] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x508bd0 | out: hHeap=0x4e0000) returned 1 [0271.623] WSACleanup () returned 0 [0271.638] HeapFree (in: hHeap=0x2ed0000, dwFlags=0x1, lpMem=0x2ed0830 | out: hHeap=0x2ed0000) returned 1 [0271.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f2f20 | out: hHeap=0x4e0000) returned 1 [0271.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f2ec0 | out: hHeap=0x4e0000) returned 1 [0271.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f2e40 | out: hHeap=0x4e0000) returned 1 [0271.639] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e4ab0 | out: hHeap=0x4e0000) returned 1 [0271.640] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f1720 | out: hHeap=0x4e0000) returned 1 [0271.640] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f2f00 | out: hHeap=0x4e0000) returned 1 [0271.640] HeapDestroy (hHeap=0x2ed0000) returned 1 [0271.641] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x504d90 | out: hHeap=0x4e0000) returned 1 [0271.641] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4f17e0 | out: hHeap=0x4e0000) returned 1 [0271.641] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0xcfec8 | out: phModule=0xcfec8) returned 0 [0271.642] ExitProcess (uExitCode=0x8) [0271.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9db0 | out: hHeap=0x4e0000) returned 1 [0271.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e4210 | out: hHeap=0x4e0000) returned 1 [0271.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bee40 | out: hHeap=0x4e0000) returned 1 [0271.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4e1080 | out: hHeap=0x4e0000) returned 1 [0271.642] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x4eb140 | out: hHeap=0x4e0000) returned 1 Thread: id = 137 os_tid = 0xe4c Thread: id = 138 os_tid = 0xa60 [0270.871] GetLastError () returned 0x57 [0270.871] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x8, Size=0x3c8) returned 0x5bfa90 [0270.871] SetLastError (dwErrCode=0x57) [0270.871] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4cb70000 [0270.876] GetProcAddress (hModule=0x7ffd4cb70000, lpProcName="GetCurrentPackageId") returned 0x7ffd4cb72300 [0270.876] GetCurrentPackageId () returned 0x3d54 [0270.876] GetCurrentThreadId () returned 0xa60 [0270.876] GetCurrentThreadId () returned 0xa60 [0270.876] RtlWakeConditionVariable () returned 0x1 [0270.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x10) returned 0x518280 [0270.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x40) returned 0x5b2c70 [0270.886] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x28) returned 0x5b9fc0 [0270.887] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9f90 [0270.887] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0270.887] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="NtSetInformationThread") returned 0x7ffd50574ee0 [0270.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9f90 | out: hHeap=0x4e0000) returned 1 [0270.887] GetCurrentThread () returned 0xfffffffffffffffe [0270.887] NtSetInformationThread (ThreadHandle=0xfffffffffffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0270.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9fc0 | out: hHeap=0x4e0000) returned 1 [0270.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b2c70 | out: hHeap=0x4e0000) returned 1 [0270.887] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x518280 | out: hHeap=0x4e0000) returned 1 [0270.888] RtlWakeAllConditionVariable () returned 0x7ffd5052bd20 [0270.888] QueryPerformanceFrequency (in: lpFrequency=0x4dfa30 | out: lpFrequency=0x4dfa30*=100000000) returned 1 [0270.888] QueryPerformanceCounter (in: lpPerformanceCount=0x4dfa30 | out: lpPerformanceCount=0x4dfa30*=1219109755202) returned 1 [0270.888] GetCurrentThreadId () returned 0xa60 [0270.888] GetCurrentThreadId () returned 0xa60 [0270.888] SetConsoleTextAttribute (hConsoleOutput=0x24, wAttributes=0x7) returned 1 [0270.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9990 [0270.889] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9ae0 [0270.890] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9990 | out: hHeap=0x4e0000) returned 1 [0270.890] WriteFile (in: hFile=0x24, lpBuffer=0x5b9ae0*, nNumberOfBytesToWrite=0x15, lpNumberOfBytesWritten=0x4df720, lpOverlapped=0x0 | out: lpBuffer=0x5b9ae0*, lpNumberOfBytesWritten=0x4df720*=0x15, lpOverlapped=0x0) returned 1 [0270.890] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9ae0 | out: hHeap=0x4e0000) returned 1 [0270.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9b10 [0270.890] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x20) returned 0x5b9d50 [0270.891] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9b10 | out: hHeap=0x4e0000) returned 1 [0270.891] WriteFile (in: hFile=0x24, lpBuffer=0x5b9d50*, nNumberOfBytesToWrite=0x1a, lpNumberOfBytesWritten=0x4df720, lpOverlapped=0x0 | out: lpBuffer=0x5b9d50*, lpNumberOfBytesWritten=0x4df720*=0x1a, lpOverlapped=0x0) returned 1 [0270.891] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9d50 | out: hHeap=0x4e0000) returned 1 [0270.891] SetConsoleTextAttribute (hConsoleOutput=0x24, wAttributes=0xc) returned 1 [0270.892] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x5b1c40 [0270.892] RtlAllocateHeap (HeapHandle=0x4e0000, Flags=0x0, Size=0x50) returned 0x5b1d00 [0270.892] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b1c40 | out: hHeap=0x4e0000) returned 1 [0270.892] WriteFile (in: hFile=0x24, lpBuffer=0x5b1d00*, nNumberOfBytesToWrite=0x48, lpNumberOfBytesWritten=0x4df720, lpOverlapped=0x0 | out: lpBuffer=0x5b1d00*, lpNumberOfBytesWritten=0x4df720*=0x48, lpOverlapped=0x0) returned 1 [0270.893] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b1d00 | out: hHeap=0x4e0000) returned 1 [0270.893] GetCurrentThreadId () returned 0xa60 [0270.893] GetCurrentThreadId () returned 0xa60 [0270.893] GetCurrentThreadId () returned 0xa60 [0270.893] GetCurrentThreadId () returned 0xa60 [0270.893] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bef50 | out: hHeap=0x4e0000) returned 1 [0270.893] GetCurrentProcess () returned 0xffffffffffffffff [0270.893] GetCurrentThread () returned 0xfffffffffffffffe [0270.893] GetCurrentProcess () returned 0xffffffffffffffff [0270.893] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x4dfed0, dwDesiredAccess=0x2, bInheritHandle=1, dwOptions=0x0 | out: lpTargetHandle=0x4dfed0*=0x124) returned 1 [0270.894] CloseHandle (hObject=0x124) returned 1 [0270.894] GetCurrentThreadId () returned 0xa60 [0270.894] GetLastError () returned 0x57 [0270.894] SetLastError (dwErrCode=0x57) [0270.894] FreeLibraryAndExitThread (hLibModule=0x140000000, dwExitCode=0x0) [0270.894] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5b9cc0 | out: hHeap=0x4e0000) returned 1 [0270.895] HeapFree (in: hHeap=0x4e0000, dwFlags=0x0, lpMem=0x5bfa90 | out: hHeap=0x4e0000) returned 1 Process: id = "10" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x414ff000" os_pid = "0x78c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x908" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4043 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4044 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4045 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4046 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4047 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4048 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 4049 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 4050 start_va = 0x7ff7625c0000 end_va = 0x7ff7625d0fff monitored = 0 entry_point = 0x7ff7625c16b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 4051 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4052 start_va = 0x5f0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 4053 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4054 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4055 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4056 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 4057 start_va = 0x90000 end_va = 0x14dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4058 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4070 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 4071 start_va = 0x400000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4072 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4073 start_va = 0x7ffd44e60000 end_va = 0x7ffd44eb8fff monitored = 0 entry_point = 0x7ffd44e6fbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 4074 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4075 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4076 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4077 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4078 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4079 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4080 start_va = 0x1a0000 end_va = 0x1a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 4081 start_va = 0x7ffd50380000 end_va = 0x7ffd504c2fff monitored = 0 entry_point = 0x7ffd503a8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4082 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4083 start_va = 0x7ffd4e2e0000 end_va = 0x7ffd4e31afff monitored = 0 entry_point = 0x7ffd4e2e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4084 start_va = 0x7ffd4db80000 end_va = 0x7ffd4dc40fff monitored = 0 entry_point = 0x7ffd4dba0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4085 start_va = 0x7ffd4b010000 end_va = 0x7ffd4b195fff monitored = 0 entry_point = 0x7ffd4b05d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 4358 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 4359 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4360 start_va = 0x6f0000 end_va = 0x877fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006f0000" filename = "" Region: id = 4361 start_va = 0x880000 end_va = 0xa00fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000880000" filename = "" Region: id = 4362 start_va = 0xa10000 end_va = 0x1e0ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a10000" filename = "" Region: id = 4363 start_va = 0x1e10000 end_va = 0x1f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e10000" filename = "" Region: id = 4364 start_va = 0x400000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4365 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 4366 start_va = 0x7ffd4eb30000 end_va = 0x7ffd5008efff monitored = 0 entry_point = 0x7ffd4ec911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 4367 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4368 start_va = 0x7ffd4cce0000 end_va = 0x7ffd4d323fff monitored = 0 entry_point = 0x7ffd4cea64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 4369 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4370 start_va = 0x7ffd500f0000 end_va = 0x7ffd50141fff monitored = 0 entry_point = 0x7ffd500ff530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4371 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4372 start_va = 0x7ffd4d5b0000 end_va = 0x7ffd4d664fff monitored = 0 entry_point = 0x7ffd4d5f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 4373 start_va = 0x7ffd4cb10000 end_va = 0x7ffd4cb5afff monitored = 0 entry_point = 0x7ffd4cb135f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4374 start_va = 0x7ffd4caf0000 end_va = 0x7ffd4cb03fff monitored = 0 entry_point = 0x7ffd4caf52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4375 start_va = 0x7ffd4b470000 end_va = 0x7ffd4b505fff monitored = 0 entry_point = 0x7ffd4b495570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4376 start_va = 0x440000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 4378 start_va = 0x1f20000 end_va = 0x2256fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4379 start_va = 0x2260000 end_va = 0x2472fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002260000" filename = "" Region: id = 4380 start_va = 0x2480000 end_va = 0x2699fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002480000" filename = "" Region: id = 4381 start_va = 0x26a0000 end_va = 0x27b2fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000026a0000" filename = "" Region: id = 4382 start_va = 0x27c0000 end_va = 0x29dcfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027c0000" filename = "" Region: id = 4383 start_va = 0x29e0000 end_va = 0x2aecfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029e0000" filename = "" Thread: id = 133 os_tid = 0xf60 Thread: id = 135 os_tid = 0x254 Thread: id = 136 os_tid = 0xa98 Process: id = "11" image_name = "reghost.exe" filename = "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe" page_root = "0x2a8ad000" os_pid = "0x694" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xf0" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4444 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4445 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4446 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4447 start_va = 0x60000 end_va = 0x61fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 4448 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4449 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4450 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4451 start_va = 0x7ff5fffd0000 end_va = 0x7ff5ffff2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5fffd0000" filename = "" Region: id = 4452 start_va = 0x7ff771f50000 end_va = 0x7ff7735fdfff monitored = 1 entry_point = 0x7ff7735fc474 region_type = mapped_file name = "reghost.exe" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe") Region: id = 4453 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4454 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4455 start_va = 0x70000 end_va = 0x12dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4456 start_va = 0x710000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 4457 start_va = 0x7ff5ffed0000 end_va = 0x7ff5fffcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007ff5ffed0000" filename = "" Region: id = 4458 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4459 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4537 start_va = 0x7ffd4a880000 end_va = 0x7ffd4a8f8fff monitored = 0 entry_point = 0x7ffd4a89fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4538 start_va = 0x7ff5ffe50000 end_va = 0x7ff5ffecdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4539 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4540 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4541 start_va = 0x910000 end_va = 0xb0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000910000" filename = "" Region: id = 4542 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4543 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4544 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4545 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4546 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4547 start_va = 0x7ffd4db80000 end_va = 0x7ffd4dc40fff monitored = 0 entry_point = 0x7ffd4dba0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4548 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4549 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4550 start_va = 0x7ffd4eb30000 end_va = 0x7ffd5008efff monitored = 0 entry_point = 0x7ffd4ec911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 4551 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4552 start_va = 0x7ffd4cce0000 end_va = 0x7ffd4d323fff monitored = 0 entry_point = 0x7ffd4cea64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 4553 start_va = 0x7ffd500f0000 end_va = 0x7ffd50141fff monitored = 0 entry_point = 0x7ffd500ff530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4554 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4555 start_va = 0x7ffd4d5b0000 end_va = 0x7ffd4d664fff monitored = 0 entry_point = 0x7ffd4d5f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 4556 start_va = 0x7ffd4cb10000 end_va = 0x7ffd4cb5afff monitored = 0 entry_point = 0x7ffd4cb135f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4557 start_va = 0x7ffd4caf0000 end_va = 0x7ffd4cb03fff monitored = 0 entry_point = 0x7ffd4caf52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4558 start_va = 0x7ffd50380000 end_va = 0x7ffd504c2fff monitored = 0 entry_point = 0x7ffd503a8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4559 start_va = 0x7ffd41d70000 end_va = 0x7ffd41d79fff monitored = 0 entry_point = 0x7ffd41d71350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 4560 start_va = 0x130000 end_va = 0x168fff monitored = 0 entry_point = 0x1312f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4561 start_va = 0xb10000 end_va = 0xc97fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b10000" filename = "" Region: id = 4562 start_va = 0x7ffd4e2e0000 end_va = 0x7ffd4e31afff monitored = 0 entry_point = 0x7ffd4e2e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4563 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 4564 start_va = 0x140000 end_va = 0x140fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 4565 start_va = 0x600000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 4566 start_va = 0xca0000 end_va = 0xe20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ca0000" filename = "" Region: id = 4567 start_va = 0xe30000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000e30000" filename = "" Region: id = 4568 start_va = 0x150000 end_va = 0x156fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 4569 start_va = 0x600000 end_va = 0x6a5fff monitored = 0 entry_point = 0x6093e0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll") Region: id = 4570 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 4571 start_va = 0x7ffd40ab0000 end_va = 0x7ffd40b59fff monitored = 0 entry_point = 0x7ffd40ab93e0 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_396e892957c7fb25\\comctl32.dll") Region: id = 4572 start_va = 0x2230000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 4573 start_va = 0x7ffd4e960000 end_va = 0x7ffd4e967fff monitored = 0 entry_point = 0x7ffd4e9610b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 4574 start_va = 0x7ffd4b470000 end_va = 0x7ffd4b505fff monitored = 0 entry_point = 0x7ffd4b495570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4575 start_va = 0x2230000 end_va = 0x235ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 4576 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 4577 start_va = 0x23c0000 end_va = 0x2557fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 4578 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 4579 start_va = 0x7ff5ffaf0000 end_va = 0x7ff5ffec0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ff5ffaf0000" filename = "" Region: id = 4580 start_va = 0x2560000 end_va = 0x275ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 4581 start_va = 0x160000 end_va = 0x160fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 4582 start_va = 0x7ffd45f80000 end_va = 0x7ffd45f86fff monitored = 0 entry_point = 0x7ffd45f812f0 region_type = mapped_file name = "shfolder.dll" filename = "\\Windows\\System32\\shfolder.dll" (normalized: "c:\\windows\\system32\\shfolder.dll") Region: id = 4583 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 4584 start_va = 0x180000 end_va = 0x181fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 4585 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 4586 start_va = 0x1a0000 end_va = 0x1a1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "comctl32.dll.mui" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.10586.0_en-us_4f79d20e846e2d12\\comctl32.dll.mui" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.10586.0_en-us_4f79d20e846e2d12\\comctl32.dll.mui") Region: id = 4587 start_va = 0x7ffd31cc0000 end_va = 0x7ffd31cc6fff monitored = 0 entry_point = 0x7ffd31cc1220 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\System32\\msimg32.dll" (normalized: "c:\\windows\\system32\\msimg32.dll") Region: id = 4588 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 4589 start_va = 0x2230000 end_va = 0x22ebfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002230000" filename = "" Region: id = 4590 start_va = 0x2350000 end_va = 0x235ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 4591 start_va = 0x1b0000 end_va = 0x1b3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 4592 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4593 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 4594 start_va = 0x23c0000 end_va = 0x249cfff monitored = 0 entry_point = 0x241e0b0 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 4595 start_va = 0x24d0000 end_va = 0x2557fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 4596 start_va = 0x2760000 end_va = 0x2897fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002760000" filename = "" Region: id = 4597 start_va = 0x28a0000 end_va = 0x2bd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 4598 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 4599 start_va = 0x7ffd4c770000 end_va = 0x7ffd4c79cfff monitored = 0 entry_point = 0x7ffd4c789d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 4600 start_va = 0x2be0000 end_va = 0x33dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002be0000" filename = "" Region: id = 4601 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4602 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4603 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4604 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4605 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4606 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4607 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4608 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4609 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4610 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4611 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4612 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4613 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4614 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4615 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4616 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4617 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4618 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4619 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4620 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4621 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4622 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4623 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4624 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4625 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4626 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4627 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4628 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4629 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4630 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4631 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4632 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4633 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4634 start_va = 0x2be0000 end_va = 0x2ddffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002be0000" filename = "" Region: id = 4635 start_va = 0x2de0000 end_va = 0x35dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002de0000" filename = "" Region: id = 4636 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4637 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4638 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4639 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4640 start_va = 0x7ffd4e270000 end_va = 0x7ffd4e27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffd4e270000" filename = "" Region: id = 4641 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4642 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4643 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4644 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4645 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4646 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4647 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4648 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4649 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4650 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4651 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4652 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4653 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4654 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4655 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4657 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4658 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4659 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4660 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4661 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4662 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4663 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4664 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4665 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4666 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4667 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4668 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4669 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4670 start_va = 0x1f0000 end_va = 0x1f8fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4671 start_va = 0x2de0000 end_va = 0x32e8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 4672 start_va = 0x2de0000 end_va = 0x31dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 4673 start_va = 0x31e0000 end_va = 0x3a02fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031e0000" filename = "" Region: id = 4674 start_va = 0x7ff5ffa70000 end_va = 0x7ff5ffaedfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4687 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4701 start_va = 0x22f0000 end_va = 0x22f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022f0000" filename = "" Thread: id = 142 os_tid = 0x63c [0277.728] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0277.728] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetLastError") returned 0x7ffd4e1db710 [0277.728] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetLastError") returned 0x7ffd4e1db730 [0277.728] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetTickCount") returned 0x7ffd4e1db4c0 [0277.728] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ExitProcess") returned 0x7ffd4e1e4d80 [0277.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetStartupInfoA") returned 0x7ffd4e1e5d70 [0277.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetStdHandle") returned 0x7ffd4e1e3e80 [0277.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCommandLineA") returned 0x7ffd4e1e6d00 [0277.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentProcessId") returned 0x7ffd4e1db4a0 [0277.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentThreadId") returned 0x7ffd4e1db460 [0277.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentProcess") returned 0x7ffd4e1db7c0 [0277.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ReadProcessMemory") returned 0x7ffd4e1e3680 [0277.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetModuleFileNameA") returned 0x7ffd4e1e6e30 [0277.729] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetModuleHandleA") returned 0x7ffd4e1e4c90 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WriteFile") returned 0x7ffd4e1edcc0 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ReadFile") returned 0x7ffd4e1edbd0 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CloseHandle") returned 0x7ffd4e1ed650 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetFilePointer") returned 0x7ffd4e1edc60 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetFileSize") returned 0x7ffd4e1eda90 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetEndOfFile") returned 0x7ffd4e1edc20 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FreeLibrary") returned 0x7ffd4e1e4810 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetSystemInfo") returned 0x7ffd4e1e6720 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryA") returned 0x7ffd4e1e74d0 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetProcAddress") returned 0x7ffd4e1e0b80 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="DeleteFileW") returned 0x7ffd4e1ed8e0 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileW") returned 0x7ffd4e1ed8b0 [0277.730] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetFileAttributesW") returned 0x7ffd4e1eda70 [0277.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateDirectoryW") returned 0x7ffd4e1ed880 [0277.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RemoveDirectoryW") returned 0x7ffd4e1edc10 [0277.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetCurrentDirectoryW") returned 0x7ffd4e1ea310 [0277.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentDirectoryW") returned 0x7ffd4e1e6e90 [0277.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetFullPathNameW") returned 0x7ffd4e1edb00 [0277.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetEnvironmentVariableW") returned 0x7ffd4e1e7500 [0277.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetConsoleMode") returned 0x7ffd4e1edfa0 [0277.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetConsoleOutputCP") returned 0x7ffd4e1edfb0 [0277.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetOEMCP") returned 0x7ffd4e1ec840 [0277.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetProcessHeap") returned 0x7ffd4e1dd4f0 [0277.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="HeapAlloc") returned 0x7ffd504f52d0 [0277.731] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="HeapFree") returned 0x7ffd4e1db480 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TlsAlloc") returned 0x7ffd4e1e3ad0 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TlsFree") returned 0x7ffd4e1e3e40 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TlsGetValue") returned 0x7ffd4e1db450 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TlsSetValue") returned 0x7ffd4e1db7d0 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateThread") returned 0x7ffd4e1e16f0 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ExitThread") returned 0x7ffd5052c2a0 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LocalAlloc") returned 0x7ffd4e1ddd20 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LocalFree") returned 0x7ffd4e1ddd10 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Sleep") returned 0x7ffd4e1db7b0 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SuspendThread") returned 0x7ffd4e1e6730 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ResumeThread") returned 0x7ffd4e1e4e70 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TerminateThread") returned 0x7ffd4e1e7250 [0277.732] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WaitForSingleObject") returned 0x7ffd4e1ed840 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetThreadPriority") returned 0x7ffd4e1e45a0 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetThreadPriority") returned 0x7ffd4e1e45b0 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateEventA") returned 0x7ffd4e1ed6a0 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ResetEvent") returned 0x7ffd4e1ed7e0 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetEvent") returned 0x7ffd4e1ed7f0 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="InitializeCriticalSection") returned 0x7ffd5053ced0 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="DeleteCriticalSection") returned 0x7ffd505299d0 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="EnterCriticalSection") returned 0x7ffd504fe600 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LeaveCriticalSection") returned 0x7ffd504feb00 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="TryEnterCriticalSection") returned 0x7ffd50520d20 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RaiseException") returned 0x7ffd4e1e4d70 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="MultiByteToWideChar") returned 0x7ffd4e1dd500 [0277.733] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WideCharToMultiByte") returned 0x7ffd4e1db490 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetACP") returned 0x7ffd4e1dd720 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetConsoleCP") returned 0x7ffd4e1edf90 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RtlCaptureContext") returned 0x7ffd4e1ed410 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RtlLookupFunctionEntry") returned 0x7ffd4e1e6e60 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RtlVirtualUnwind") returned 0x7ffd4e1ea410 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RtlUnwindEx") returned 0x7ffd4e1e6ba0 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="AddVectoredExceptionHandler") returned 0x7ffd50542650 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="EnumResourceTypesA") returned 0x7ffd4e2031a0 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="EnumResourceNamesA") returned 0x7ffd4e203170 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="EnumResourceLanguagesA") returned 0x7ffd4e203110 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FindResourceA") returned 0x7ffd4e1cb6b0 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FindResourceExA") returned 0x7ffd4e1cb6d0 [0277.734] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadResource") returned 0x7ffd4e1e3e60 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SizeofResource") returned 0x7ffd4e1e4460 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LockResource") returned 0x7ffd4e1e4450 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FreeResource") returned 0x7ffd4e1e8ee0 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FormatMessageA") returned 0x7ffd4e1ea9c0 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileMappingA") returned 0x7ffd4e1e1810 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryExA") returned 0x7ffd4e1e6b80 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetEnvironmentVariableA") returned 0x7ffd4e1e3e50 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalAddAtomA") returned 0x7ffd4e1cb940 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WritePrivateProfileStringA") returned 0x7ffd4e1fff50 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetDriveTypeA") returned 0x7ffd4e1eda20 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetWindowsDirectoryA") returned 0x7ffd4e1eb190 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileA") returned 0x7ffd4e1ed8a0 [0277.735] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetVolumeInformationA") returned 0x7ffd4e1edb60 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetComputerNameA") returned 0x7ffd4e1e20c0 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetVersionExA") returned 0x7ffd4e1e7450 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CompareStringA") returned 0x7ffd4e1e6740 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetLocaleInfoA") returned 0x7ffd4e1e3700 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetDateFormatA") returned 0x7ffd4e1ea460 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="EnumCalendarInfoA") returned 0x7ffd4e217f10 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetEnvironmentStringsW") returned 0x7ffd4e1e6790 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FreeEnvironmentStringsW") returned 0x7ffd4e1e67a0 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FormatMessageW") returned 0x7ffd4e1e45c0 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileMappingW") returned 0x7ffd4e1e3af0 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetLogicalDriveStringsW") returned 0x7ffd4e1edb10 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryW") returned 0x7ffd4e1e50f0 [0277.736] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryExW") returned 0x7ffd4e1e0dd0 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetModuleFileNameW") returned 0x7ffd4e1e4840 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetModuleHandleW") returned 0x7ffd4e1e3d40 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCommandLineW") returned 0x7ffd4e1e6a00 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetPrivateProfileStringW") returned 0x7ffd4e1ce1d0 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WritePrivateProfileStringW") returned 0x7ffd4e1da430 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetSystemDirectoryW") returned 0x7ffd4e1e03c0 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetTempPathW") returned 0x7ffd4e1edb50 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetTempFileNameW") returned 0x7ffd4e1edb30 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetWindowsDirectoryW") returned 0x7ffd4e1e8ed0 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="QueryDosDeviceW") returned 0x7ffd4e1edbc0 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetFileAttributesW") returned 0x7ffd4e1edc40 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetFileAttributesExW") returned 0x7ffd4e1eda60 [0277.737] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetVolumeInformationW") returned 0x7ffd4e1edb80 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetComputerNameW") returned 0x7ffd4e1e2230 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FindFirstFileW") returned 0x7ffd4e1ed980 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FindNextFileW") returned 0x7ffd4e1ed9c0 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CompareStringW") returned 0x7ffd4e1e2ce0 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetLocaleInfoW") returned 0x7ffd4e1e72a0 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetVersion") returned 0x7ffd4e1e7550 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalAlloc") returned 0x7ffd4e1e0de0 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalReAlloc") returned 0x7ffd4e1dd7c0 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalSize") returned 0x7ffd4e1e02a0 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalLock") returned 0x7ffd4e1db590 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalUnlock") returned 0x7ffd4e1db4e0 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FlushInstructionCache") returned 0x7ffd4e1e0c70 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualAlloc") returned 0x7ffd4e1e28c0 [0277.738] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualAllocEx") returned 0x7ffd4e1ea400 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualFree") returned 0x7ffd4e1e32a0 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualProtect") returned 0x7ffd4e1e3a90 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualProtectEx") returned 0x7ffd4e206a60 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="HeapCreate") returned 0x7ffd4e1e72b0 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="HeapDestroy") returned 0x7ffd4e1e90c0 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="OpenProcess") returned 0x7ffd4e1deb80 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetExitCodeProcess") returned 0x7ffd4e1e3c20 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateRemoteThread") returned 0x7ffd4e205b10 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentThread") returned 0x7ffd4e1db7a0 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetExitCodeThread") returned 0x7ffd4e1e67b0 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetErrorMode") returned 0x7ffd4e1e3ac0 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="WriteProcessMemory") returned 0x7ffd4e1ea3f0 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetThreadContext") returned 0x7ffd4e1e6780 [0277.739] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GlobalDeleteAtom") returned 0x7ffd4e1cd180 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FlushFileBuffers") returned 0x7ffd4e1ed9d0 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="DeviceIoControl") returned 0x7ffd4e1db2d0 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FindClose") returned 0x7ffd4e1ed900 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetFileTime") returned 0x7ffd4e1edc80 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="MulDiv") returned 0x7ffd4e1edcf0 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetLocalTime") returned 0x7ffd4e1e4830 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetTimeZoneInformation") returned 0x7ffd4e1e3ab0 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SystemTimeToFileTime") returned 0x7ffd4e1e7290 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FileTimeToLocalFileTime") returned 0x7ffd4e1ed8f0 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FileTimeToDosDateTime") returned 0x7ffd4e1cd940 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="PeekNamedPipe") returned 0x7ffd4e206350 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="MapViewOfFile") returned 0x7ffd4e1e4860 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="UnmapViewOfFile") returned 0x7ffd4e1e4ce0 [0277.740] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualLock") returned 0x7ffd4e206a50 [0277.741] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="VirtualUnlock") returned 0x7ffd4e1e4330 [0277.741] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="MapViewOfFileEx") returned 0x7ffd4e1e1f30 [0277.741] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="IsBadReadPtr") returned 0x7ffd4e1db680 [0277.741] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="IsBadWritePtr") returned 0x7ffd4e204980 [0277.741] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="QueryPerformanceCounter") returned 0x7ffd4e1db720 [0277.741] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetThreadLocale") returned 0x7ffd4e1e0db0 [0277.741] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetThreadLocale") returned 0x7ffd4e1e0dc0 [0277.741] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetUserDefaultLCID") returned 0x7ffd4e1e3a70 [0277.741] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="PostQueuedCompletionStatus") returned 0x7ffd4e1e31f0 [0277.741] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetThreadContext") returned 0x7ffd4e1ec890 [0277.742] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RemoveVectoredExceptionHandler") returned 0x7ffd50551f70 [0277.742] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7ffd4e1ee800 [0277.742] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Process32FirstW") returned 0x7ffd4e1e6a40 [0277.742] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Process32NextW") returned 0x7ffd4e1e1040 [0277.742] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Process32Next") returned 0x7ffd4e2086c0 [0277.742] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Module32First") returned 0x7ffd4e208390 [0277.742] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Module32Next") returned 0x7ffd4e2084b0 [0277.742] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="DebugBreak") returned 0x7ffd4e205b90 [0277.742] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Thread32First") returned 0x7ffd4e1e8b30 [0277.742] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="Thread32Next") returned 0x7ffd4e1e0aa0 [0277.742] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x7ffd4db80000 [0277.742] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SysAllocStringLen") returned 0x7ffd4db8e5b0 [0277.742] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SysFreeString") returned 0x7ffd4db90ae0 [0277.743] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SysReAllocStringLen") returned 0x7ffd4db92880 [0277.743] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayCreate") returned 0x7ffd4db826b0 [0277.743] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayRedim") returned 0x7ffd4db93510 [0277.743] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayGetUBound") returned 0x7ffd4db98350 [0277.743] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayGetLBound") returned 0x7ffd4db98820 [0277.743] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayAccessData") returned 0x7ffd4db94be0 [0277.743] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayUnaccessData") returned 0x7ffd4db983c0 [0277.743] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayGetElement") returned 0x7ffd4db91bd0 [0277.744] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayPutElement") returned 0x7ffd4db91870 [0277.744] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="SafeArrayPtrOfIndex") returned 0x7ffd4db993c0 [0277.744] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="VariantChangeTypeEx") returned 0x7ffd4db8e680 [0277.744] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="VariantClear") returned 0x7ffd4dc0c230 [0277.744] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="VariantCopy") returned 0x7ffd4dc0c910 [0277.744] GetProcAddress (hModule=0x7ffd4db80000, lpProcName="VariantInit") returned 0x7ffd4dc0cbc0 [0277.744] GetModuleHandleA (lpModuleName="user32.dll") returned 0x7ffd4e9d0000 [0277.744] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="MessageBoxA") returned 0x7ffd4ea4e0a0 [0277.744] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharUpperBuffW") returned 0x7ffd4e9d19d0 [0277.744] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharLowerBuffW") returned 0x7ffd4e9ff5d0 [0277.744] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="PeekMessageA") returned 0x7ffd4e9ec540 [0277.744] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SendMessageA") returned 0x7ffd4e9e5eb0 [0277.744] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="PostMessageA") returned 0x7ffd4e9f7640 [0277.745] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="DefWindowProcA") returned 0x7ffd50574a30 [0277.745] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CallWindowProcA") returned 0x7ffd4ea01400 [0277.745] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="RegisterClassA") returned 0x7ffd4e9f38c0 [0277.745] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="UnregisterClassA") returned 0x7ffd4e9f3750 [0277.745] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetClassInfoA") returned 0x7ffd4e9f34f0 [0277.745] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CreateWindowExA") returned 0x7ffd4e9f8a40 [0277.745] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="RegisterClipboardFormatA") returned 0x7ffd4e9f3d50 [0277.745] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetClipboardFormatNameA") returned 0x7ffd4ea587f0 [0277.745] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharToOemA") returned 0x7ffd4e9f59d0 [0277.745] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharUpperA") returned 0x7ffd4e9f6af0 [0277.745] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharUpperBuffA") returned 0x7ffd4ea01460 [0277.745] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharLowerA") returned 0x7ffd4e9fa5f0 [0277.746] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CharLowerBuffA") returned 0x7ffd4ea59ab0 [0277.746] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetMenuItemInfoA") returned 0x7ffd4e9efd50 [0277.746] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetPropA") returned 0x7ffd4ea58d60 [0277.746] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetPropA") returned 0x7ffd4e9f3270 [0277.746] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="RemovePropA") returned 0x7ffd4ea58ab0 [0277.746] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="EnumPropsA") returned 0x7ffd4ea21590 [0277.746] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetWindowTextA") returned 0x7ffd4e9e5640 [0277.746] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetWindowLongA") returned 0x7ffd4e9df770 [0277.746] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetWindowLongA") returned 0x7ffd4e9e6fc0 [0277.746] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetClassLongPtrA") returned 0x7ffd4ea58c30 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="FindWindowA") returned 0x7ffd4ea587a0 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetClassNameA") returned 0x7ffd4ea002b0 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="LoadBitmapA") returned 0x7ffd4e9fe680 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="LoadCursorA") returned 0x7ffd4e9d5740 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="LoadIconA") returned 0x7ffd4e9faa30 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="LoadImageA") returned 0x7ffd4e9d5020 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SystemParametersInfoA") returned 0x7ffd4e9f2140 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="DispatchMessageW") returned 0x7ffd4e9e0ae0 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="PeekMessageW") returned 0x7ffd4e9ec670 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SendMessageW") returned 0x7ffd4e9e0560 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="DefWindowProcW") returned 0x7ffd50574a40 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CallWindowProcW") returned 0x7ffd4e9e09b0 [0277.747] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="RegisterClassW") returned 0x7ffd4e9da6a0 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="UnregisterClassW") returned 0x7ffd4e9dc510 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetClassInfoW") returned 0x7ffd4e9da410 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CreateWindowExW") returned 0x7ffd4e9db4e0 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="InsertMenuItemW") returned 0x7ffd4e9f0070 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetMenuItemInfoW") returned 0x7ffd4e9f0220 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetMenuItemInfoW") returned 0x7ffd4e9efce0 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="DrawTextW") returned 0x7ffd4e9edaf0 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="DrawStateW") returned 0x7ffd4e9f8720 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetWindowTextW") returned 0x7ffd4e9e59f0 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetWindowTextW") returned 0x7ffd4e9dde10 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetWindowTextLengthW") returned 0x7ffd4e9e5780 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="MessageBoxW") returned 0x7ffd4ea4e600 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetWindowLongPtrW") returned 0x7ffd4e9dfaf0 [0277.748] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetWindowLongPtrW") returned 0x7ffd4e9e5ac0 [0277.749] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x7ffd4e480000 [0277.749] GetModuleHandleA (lpModuleName="gdi32.dll") returned 0x7ffd4d8d0000 [0277.749] GetModuleHandleA (lpModuleName="version.dll") returned 0x7ffd41d70000 [0277.749] GetModuleHandleA (lpModuleName="shell32.dll") returned 0x7ffd4eb30000 [0277.750] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x7ffd50380000 [0277.750] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0277.750] GetModuleHandleA (lpModuleName="shlwapi.dll") returned 0x7ffd500f0000 [0277.750] GetModuleHandleA (lpModuleName="comctl32.dll") returned 0x0 [0277.756] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x7ffd40ab0000 [0277.764] GetModuleHandleA (lpModuleName="psapi.dll") returned 0x0 [0277.764] LoadLibraryA (lpLibFileName="psapi.dll") returned 0x7ffd4e960000 [0277.766] GetCurrentThreadId () returned 0x63c [0277.767] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff771f50000 [0277.767] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff771f50000 [0277.767] GetStartupInfoA (in: lpStartupInfo=0x7ff772b9f3f0 | out: lpStartupInfo=0x7ff772b9f3f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffffffffffff, hStdOutput=0xffffffffffffffff, hStdError=0xffffffffffffffff)) [0277.767] GetCurrentThreadId () returned 0x63c [0277.767] GetLastError () returned 0x7e [0277.767] LocalAlloc (uFlags=0x40, uBytes=0x12a2) returned 0x727b60 [0277.767] SetLastError (dwErrCode=0x7e) [0277.767] GetLastError () returned 0x7e [0277.767] SetLastError (dwErrCode=0x7e) [0277.767] GetLastError () returned 0x7e [0277.767] SetLastError (dwErrCode=0x7e) [0277.767] GetLastError () returned 0x7e [0277.767] SetLastError (dwErrCode=0x7e) [0277.767] GetLastError () returned 0x7e [0277.767] SetLastError (dwErrCode=0x7e) [0277.767] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.768] GetLastError () returned 0x7e [0277.768] SetLastError (dwErrCode=0x7e) [0277.769] GetLastError () returned 0x7e [0277.769] SetLastError (dwErrCode=0x7e) [0277.769] GetACP () returned 0x4e4 [0277.769] GetStdHandle (nStdHandle=0xfffffff6) returned 0x20 [0277.769] GetStdHandle (nStdHandle=0xfffffff5) returned 0x24 [0277.769] GetStdHandle (nStdHandle=0xfffffff4) returned 0x28 [0277.769] GetLastError () returned 0x7e [0277.769] SetLastError (dwErrCode=0x7e) [0277.769] GetConsoleCP () returned 0x1b5 [0277.770] GetLastError () returned 0x7e [0277.770] SetLastError (dwErrCode=0x7e) [0277.770] GetConsoleOutputCP () returned 0x1b5 [0277.770] GetLastError () returned 0x7e [0277.770] SetLastError (dwErrCode=0x7e) [0277.770] GetConsoleOutputCP () returned 0x1b5 [0277.771] GetLastError () returned 0x7e [0277.771] SetLastError (dwErrCode=0x7e) [0277.771] GetConsoleOutputCP () returned 0x1b5 [0277.771] GetLastError () returned 0x7e [0277.771] SetLastError (dwErrCode=0x7e) [0277.771] GetConsoleOutputCP () returned 0x1b5 [0277.771] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x5ffc28, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe")) returned 0x3b [0277.774] GetLastError () returned 0x0 [0277.775] SetLastError (dwErrCode=0x0) [0277.775] GetProcessHeap () returned 0x710000 [0277.775] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x728e10 [0277.776] GetLastError () returned 0x0 [0277.776] SetLastError (dwErrCode=0x0) [0277.776] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe\" " [0277.776] GetLastError () returned 0x0 [0277.776] SetLastError (dwErrCode=0x0) [0277.776] GetCurrentProcessId () returned 0x694 [0277.776] GetLastError () returned 0x0 [0277.776] SetLastError (dwErrCode=0x0) [0277.776] GetProcessHeap () returned 0x710000 [0277.776] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x730e20 [0277.777] GetLastError () returned 0x0 [0277.777] SetLastError (dwErrCode=0x0) [0277.777] GetUserDefaultLCID () returned 0x409 [0277.778] SetThreadLocale (Locale=0x409) returned 1 [0277.778] GetSystemMetrics (nIndex=42) returned 0 [0277.787] GetSystemMetrics (nIndex=74) returned 0 [0277.787] GetThreadLocale () returned 0x409 [0277.787] GetThreadLocale () returned 0x409 [0277.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Jan") returned 4 [0277.787] GetLastError () returned 0x0 [0277.787] SetLastError (dwErrCode=0x0) [0277.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x5ff990, cchData=256 | out: lpLCData="January") returned 8 [0277.787] GetLastError () returned 0x0 [0277.787] SetLastError (dwErrCode=0x0) [0277.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Feb") returned 4 [0277.787] GetLastError () returned 0x0 [0277.787] SetLastError (dwErrCode=0x0) [0277.787] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x5ff990, cchData=256 | out: lpLCData="February") returned 9 [0277.787] GetLastError () returned 0x0 [0277.788] SetLastError (dwErrCode=0x0) [0277.788] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Mar") returned 4 [0277.788] GetLastError () returned 0x0 [0277.788] SetLastError (dwErrCode=0x0) [0277.788] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x5ff990, cchData=256 | out: lpLCData="March") returned 6 [0277.788] GetLastError () returned 0x0 [0277.788] SetLastError (dwErrCode=0x0) [0277.788] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Apr") returned 4 [0277.788] GetLastError () returned 0x0 [0277.788] SetLastError (dwErrCode=0x0) [0277.788] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x5ff990, cchData=256 | out: lpLCData="April") returned 6 [0277.788] GetLastError () returned 0x0 [0277.788] SetLastError (dwErrCode=0x0) [0277.788] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x5ff990, cchData=256 | out: lpLCData="May") returned 4 [0277.788] GetLastError () returned 0x0 [0277.788] SetLastError (dwErrCode=0x0) [0277.788] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x5ff990, cchData=256 | out: lpLCData="May") returned 4 [0277.788] GetLastError () returned 0x0 [0277.788] SetLastError (dwErrCode=0x0) [0277.788] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Jun") returned 4 [0277.788] GetLastError () returned 0x0 [0277.788] SetLastError (dwErrCode=0x0) [0277.788] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x5ff990, cchData=256 | out: lpLCData="June") returned 5 [0277.788] GetLastError () returned 0x0 [0277.788] SetLastError (dwErrCode=0x0) [0277.788] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Jul") returned 4 [0277.789] GetLastError () returned 0x0 [0277.789] SetLastError (dwErrCode=0x0) [0277.789] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x5ff990, cchData=256 | out: lpLCData="July") returned 5 [0277.789] GetLastError () returned 0x0 [0277.789] SetLastError (dwErrCode=0x0) [0277.789] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Aug") returned 4 [0277.789] GetLastError () returned 0x0 [0277.789] SetLastError (dwErrCode=0x0) [0277.789] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x5ff990, cchData=256 | out: lpLCData="August") returned 7 [0277.789] GetLastError () returned 0x0 [0277.789] SetLastError (dwErrCode=0x0) [0277.789] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Sep") returned 4 [0277.789] GetLastError () returned 0x0 [0277.789] SetLastError (dwErrCode=0x0) [0277.789] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x5ff990, cchData=256 | out: lpLCData="September") returned 10 [0277.789] GetLastError () returned 0x0 [0277.789] SetLastError (dwErrCode=0x0) [0277.789] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Oct") returned 4 [0277.789] GetLastError () returned 0x0 [0277.789] SetLastError (dwErrCode=0x0) [0277.789] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x5ff990, cchData=256 | out: lpLCData="October") returned 8 [0277.789] GetLastError () returned 0x0 [0277.789] SetLastError (dwErrCode=0x0) [0277.789] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Nov") returned 4 [0277.789] GetLastError () returned 0x0 [0277.789] SetLastError (dwErrCode=0x0) [0277.789] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x5ff990, cchData=256 | out: lpLCData="November") returned 9 [0277.789] GetLastError () returned 0x0 [0277.790] SetLastError (dwErrCode=0x0) [0277.790] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Dec") returned 4 [0277.790] GetLastError () returned 0x0 [0277.790] SetLastError (dwErrCode=0x0) [0277.790] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x5ff990, cchData=256 | out: lpLCData="December") returned 9 [0277.790] GetLastError () returned 0x0 [0277.790] SetLastError (dwErrCode=0x0) [0277.790] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Sun") returned 4 [0277.790] GetLastError () returned 0x0 [0277.790] SetLastError (dwErrCode=0x0) [0277.790] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Sunday") returned 7 [0277.790] GetLastError () returned 0x0 [0277.790] SetLastError (dwErrCode=0x0) [0277.790] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Mon") returned 4 [0277.790] GetLastError () returned 0x0 [0277.790] SetLastError (dwErrCode=0x0) [0277.790] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Monday") returned 7 [0277.790] GetLastError () returned 0x0 [0277.790] SetLastError (dwErrCode=0x0) [0277.790] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Tue") returned 4 [0277.790] GetLastError () returned 0x0 [0277.790] SetLastError (dwErrCode=0x0) [0277.790] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Tuesday") returned 8 [0277.790] GetLastError () returned 0x0 [0277.790] SetLastError (dwErrCode=0x0) [0277.790] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Wed") returned 4 [0277.790] GetLastError () returned 0x0 [0277.791] SetLastError (dwErrCode=0x0) [0277.791] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Wednesday") returned 10 [0277.791] GetLastError () returned 0x0 [0277.791] SetLastError (dwErrCode=0x0) [0277.791] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Thu") returned 4 [0277.791] GetLastError () returned 0x0 [0277.791] SetLastError (dwErrCode=0x0) [0277.791] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Thursday") returned 9 [0277.791] GetLastError () returned 0x0 [0277.791] SetLastError (dwErrCode=0x0) [0277.791] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Fri") returned 4 [0277.791] GetLastError () returned 0x0 [0277.791] SetLastError (dwErrCode=0x0) [0277.791] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Friday") returned 7 [0277.791] GetLastError () returned 0x0 [0277.791] SetLastError (dwErrCode=0x0) [0277.791] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Sat") returned 4 [0277.791] GetLastError () returned 0x0 [0277.791] SetLastError (dwErrCode=0x0) [0277.791] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x5ff990, cchData=256 | out: lpLCData="Saturday") returned 9 [0277.791] GetLastError () returned 0x0 [0277.791] SetLastError (dwErrCode=0x0) [0277.791] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x5ffa90, cchData=4 | out: lpLCData="/") returned 2 [0277.791] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x5ff990, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0277.792] GetLastError () returned 0x0 [0277.792] SetLastError (dwErrCode=0x0) [0277.792] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x5ff990, cchData=256 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0277.792] GetLastError () returned 0x0 [0277.792] SetLastError (dwErrCode=0x0) [0277.792] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x5ffa90, cchData=4 | out: lpLCData=":") returned 2 [0277.792] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x5ff990, cchData=256 | out: lpLCData="AM") returned 3 [0277.792] GetLastError () returned 0x0 [0277.792] SetLastError (dwErrCode=0x0) [0277.792] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x5ff990, cchData=256 | out: lpLCData="PM") returned 3 [0277.792] GetLastError () returned 0x0 [0277.792] SetLastError (dwErrCode=0x0) [0277.792] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x5ff990, cchData=256 | out: lpLCData="0") returned 2 [0277.792] GetLastError () returned 0x0 [0277.792] SetLastError (dwErrCode=0x0) [0277.792] GetLastError () returned 0x0 [0277.792] SetLastError (dwErrCode=0x0) [0277.792] GetLastError () returned 0x0 [0277.792] SetLastError (dwErrCode=0x0) [0277.792] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x5ff990, cchData=256 | out: lpLCData="$") returned 2 [0277.792] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x5ff990, cchData=256 | out: lpLCData="0") returned 2 [0277.792] GetLastError () returned 0x0 [0277.792] SetLastError (dwErrCode=0x0) [0277.793] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x5ff990, cchData=256 | out: lpLCData="0") returned 2 [0277.793] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x5ffa90, cchData=4 | out: lpLCData=",") returned 2 [0277.793] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x5ffa90, cchData=4 | out: lpLCData=".") returned 2 [0277.793] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x5ff990, cchData=256 | out: lpLCData="2") returned 2 [0277.793] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x5ffa90, cchData=4 | out: lpLCData=",") returned 2 [0277.793] GetLastError () returned 0x0 [0277.793] SetLastError (dwErrCode=0x0) [0277.793] GetVersionExA (in: lpVersionInformation=0x5ffcd0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6d0065, dwMinorVersion=0x490065, dwBuildNumber=0x69006e, dwPlatformId=0x410074, szCSDVersion="p") | out: lpVersionInformation=0x5ffcd0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0277.793] GetModuleHandleA (lpModuleName="kernel32") returned 0x7ffd4e1c0000 [0277.793] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetDiskFreeSpaceExA") returned 0x7ffd4e1ed9f0 [0277.793] GetLastError () returned 0x0 [0277.793] SetLastError (dwErrCode=0x0) [0277.793] GetProcessHeap () returned 0x710000 [0277.793] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x73ae40 [0277.794] GetWindowsDirectoryA (in: lpBuffer=0x73ae98, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0277.794] HeapCreate (flOptions=0x0, dwInitialSize=0x88000, dwMaximumSize=0x88000) returned 0x24d0000 [0277.796] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x10000) returned 0x24d0720 [0277.796] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x10000) returned 0x24e0730 [0277.796] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x10000) returned 0x24f0740 [0277.796] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x10000) returned 0x2500750 [0277.797] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x10000) returned 0x2510760 [0277.797] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x10000) returned 0x2520770 [0277.797] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x10000) returned 0x2530780 [0277.797] RtlAllocateHeap (HeapHandle=0x24d0000, Flags=0x0, Size=0x10000) returned 0x2540790 [0277.797] GetLastError () returned 0x0 [0277.797] SetLastError (dwErrCode=0x0) [0277.797] GetLastError () returned 0x0 [0277.797] SetLastError (dwErrCode=0x0) [0277.797] GetProcessHeap () returned 0x710000 [0277.797] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40000) returned 0x742e50 [0277.801] GetLastError () returned 0x0 [0277.801] SetLastError (dwErrCode=0x0) [0277.801] GetLastError () returned 0x0 [0277.801] SetLastError (dwErrCode=0x0) [0277.801] GetLastError () returned 0x0 [0277.801] SetLastError (dwErrCode=0x0) [0277.801] GetLastError () returned 0x0 [0277.802] SetLastError (dwErrCode=0x0) [0277.802] GetProcessHeap () returned 0x710000 [0277.802] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x782e60 [0277.802] GetLastError () returned 0x0 [0277.802] SetLastError (dwErrCode=0x0) [0277.802] GetLastError () returned 0x0 [0277.802] SetLastError (dwErrCode=0x0) [0277.803] GetLastError () returned 0x0 [0277.803] SetLastError (dwErrCode=0x0) [0277.803] GetLastError () returned 0x0 [0277.803] SetLastError (dwErrCode=0x0) [0277.803] GetLastError () returned 0x0 [0277.803] SetLastError (dwErrCode=0x0) [0277.803] GetLastError () returned 0x0 [0277.803] SetLastError (dwErrCode=0x0) [0277.803] GetProcessHeap () returned 0x710000 [0277.803] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40000) returned 0x78ae70 [0277.808] GetLastError () returned 0x0 [0277.809] SetLastError (dwErrCode=0x0) [0277.809] GetLastError () returned 0x0 [0277.809] SetLastError (dwErrCode=0x0) [0277.809] GetLastError () returned 0x0 [0277.809] SetLastError (dwErrCode=0x0) [0277.809] GetLastError () returned 0x0 [0277.810] SetLastError (dwErrCode=0x0) [0277.810] GetLastError () returned 0x0 [0277.810] SetLastError (dwErrCode=0x0) [0277.810] GetLastError () returned 0x0 [0277.810] SetLastError (dwErrCode=0x0) [0277.810] GetLastError () returned 0x0 [0277.810] SetLastError (dwErrCode=0x0) [0277.811] GetLastError () returned 0x0 [0277.811] SetLastError (dwErrCode=0x0) [0277.811] GetLastError () returned 0x0 [0277.811] SetLastError (dwErrCode=0x0) [0277.811] GetLastError () returned 0x0 [0277.811] SetLastError (dwErrCode=0x0) [0277.811] GetLastError () returned 0x0 [0277.811] SetLastError (dwErrCode=0x0) [0277.811] GetLastError () returned 0x0 [0277.811] SetLastError (dwErrCode=0x0) [0277.811] GetLastError () returned 0x0 [0277.811] SetLastError (dwErrCode=0x0) [0277.811] GetLastError () returned 0x0 [0277.811] SetLastError (dwErrCode=0x0) [0277.812] GetLastError () returned 0x0 [0277.812] SetLastError (dwErrCode=0x0) [0277.812] GetLastError () returned 0x0 [0277.812] SetLastError (dwErrCode=0x0) [0277.812] GetLastError () returned 0x0 [0277.812] SetLastError (dwErrCode=0x0) [0277.812] GetLastError () returned 0x0 [0277.812] SetLastError (dwErrCode=0x0) [0277.812] GetProcessHeap () returned 0x710000 [0277.812] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x7cae80 [0277.813] GetLastError () returned 0x0 [0277.813] SetLastError (dwErrCode=0x0) [0277.813] GetProcessHeap () returned 0x710000 [0277.813] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40000) returned 0x7d2e90 [0277.815] GetLastError () returned 0x0 [0277.815] SetLastError (dwErrCode=0x0) [0277.815] GetLastError () returned 0x0 [0277.815] SetLastError (dwErrCode=0x0) [0277.815] GetLastError () returned 0x0 [0277.815] SetLastError (dwErrCode=0x0) [0277.815] GetLastError () returned 0x0 [0277.815] SetLastError (dwErrCode=0x0) [0277.815] GetLastError () returned 0x0 [0277.815] SetLastError (dwErrCode=0x0) [0277.815] GetLastError () returned 0x0 [0277.816] SetLastError (dwErrCode=0x0) [0277.816] GetLastError () returned 0x0 [0277.816] SetLastError (dwErrCode=0x0) [0277.816] GetLastError () returned 0x0 [0277.816] SetLastError (dwErrCode=0x0) [0277.816] GetLastError () returned 0x0 [0277.816] SetLastError (dwErrCode=0x0) [0277.816] GetLastError () returned 0x0 [0277.816] SetLastError (dwErrCode=0x0) [0277.817] GetLastError () returned 0x0 [0277.817] SetLastError (dwErrCode=0x0) [0277.817] GetLastError () returned 0x0 [0277.817] SetLastError (dwErrCode=0x0) [0277.817] GetLastError () returned 0x0 [0277.817] SetLastError (dwErrCode=0x0) [0277.817] GetLastError () returned 0x0 [0277.817] SetLastError (dwErrCode=0x0) [0277.817] GetLastError () returned 0x0 [0277.817] SetLastError (dwErrCode=0x0) [0277.817] GetLastError () returned 0x0 [0277.818] SetLastError (dwErrCode=0x0) [0277.818] GetLastError () returned 0x0 [0277.818] SetLastError (dwErrCode=0x0) [0277.818] GetLastError () returned 0x0 [0277.818] SetLastError (dwErrCode=0x0) [0277.818] GetLastError () returned 0x0 [0277.818] SetLastError (dwErrCode=0x0) [0277.818] GetLastError () returned 0x0 [0277.818] SetLastError (dwErrCode=0x0) [0277.819] GetLastError () returned 0x0 [0277.819] SetLastError (dwErrCode=0x0) [0277.819] GetLastError () returned 0x0 [0277.819] SetLastError (dwErrCode=0x0) [0277.819] GetLastError () returned 0x0 [0277.819] SetLastError (dwErrCode=0x0) [0277.819] GetLastError () returned 0x0 [0277.819] SetLastError (dwErrCode=0x0) [0277.819] GetLastError () returned 0x0 [0277.819] SetLastError (dwErrCode=0x0) [0277.819] GetLastError () returned 0x0 [0277.819] SetLastError (dwErrCode=0x0) [0277.820] GetLastError () returned 0x0 [0277.820] SetLastError (dwErrCode=0x0) [0277.820] GetLastError () returned 0x0 [0277.820] SetLastError (dwErrCode=0x0) [0277.820] GetLastError () returned 0x0 [0277.820] SetLastError (dwErrCode=0x0) [0277.820] GetLastError () returned 0x0 [0277.820] SetLastError (dwErrCode=0x0) [0277.820] GetLastError () returned 0x0 [0277.820] SetLastError (dwErrCode=0x0) [0277.821] GetLastError () returned 0x0 [0277.821] SetLastError (dwErrCode=0x0) [0277.821] GetLastError () returned 0x0 [0277.821] SetLastError (dwErrCode=0x0) [0277.821] GetLastError () returned 0x0 [0277.821] SetLastError (dwErrCode=0x0) [0277.821] GetLastError () returned 0x0 [0277.821] SetLastError (dwErrCode=0x0) [0277.821] GetLastError () returned 0x0 [0277.821] SetLastError (dwErrCode=0x0) [0277.821] GetLastError () returned 0x0 [0277.821] SetLastError (dwErrCode=0x0) [0277.822] GetLastError () returned 0x0 [0277.822] SetLastError (dwErrCode=0x0) [0277.822] GetLastError () returned 0x0 [0277.822] SetLastError (dwErrCode=0x0) [0277.822] GetLastError () returned 0x0 [0277.822] SetLastError (dwErrCode=0x0) [0277.822] GetLastError () returned 0x0 [0277.822] SetLastError (dwErrCode=0x0) [0277.822] GetLastError () returned 0x0 [0277.822] SetLastError (dwErrCode=0x0) [0277.822] GetLastError () returned 0x0 [0277.823] SetLastError (dwErrCode=0x0) [0277.823] GetLastError () returned 0x0 [0277.823] SetLastError (dwErrCode=0x0) [0277.823] GetLastError () returned 0x0 [0277.823] SetLastError (dwErrCode=0x0) [0277.823] GetLastError () returned 0x0 [0277.823] SetLastError (dwErrCode=0x0) [0277.823] GetLastError () returned 0x0 [0277.823] SetLastError (dwErrCode=0x0) [0277.823] GetLastError () returned 0x0 [0277.823] SetLastError (dwErrCode=0x0) [0277.824] GetLastError () returned 0x0 [0277.824] SetLastError (dwErrCode=0x0) [0277.824] GetLastError () returned 0x0 [0277.824] SetLastError (dwErrCode=0x0) [0277.824] GetLastError () returned 0x0 [0277.824] SetLastError (dwErrCode=0x0) [0277.824] GetLastError () returned 0x0 [0277.824] SetLastError (dwErrCode=0x0) [0277.824] GetLastError () returned 0x0 [0277.825] SetLastError (dwErrCode=0x0) [0277.826] GetLastError () returned 0x0 [0277.826] SetLastError (dwErrCode=0x0) [0277.826] GetLastError () returned 0x0 [0277.826] SetLastError (dwErrCode=0x0) [0277.826] GetLastError () returned 0x0 [0277.826] SetLastError (dwErrCode=0x0) [0277.826] GetLastError () returned 0x0 [0277.826] SetLastError (dwErrCode=0x0) [0277.827] GetLastError () returned 0x0 [0277.827] SetLastError (dwErrCode=0x0) [0277.827] GetLastError () returned 0x0 [0277.827] SetLastError (dwErrCode=0x0) [0277.827] GetLastError () returned 0x0 [0277.827] SetLastError (dwErrCode=0x0) [0277.827] GetLastError () returned 0x0 [0277.827] SetLastError (dwErrCode=0x0) [0277.827] GetLastError () returned 0x0 [0277.827] SetLastError (dwErrCode=0x0) [0277.828] GetLastError () returned 0x0 [0277.828] SetLastError (dwErrCode=0x0) [0277.828] GetLastError () returned 0x0 [0277.828] SetLastError (dwErrCode=0x0) [0277.828] GetLastError () returned 0x0 [0277.828] SetLastError (dwErrCode=0x0) [0277.828] GetLastError () returned 0x0 [0277.828] SetLastError (dwErrCode=0x0) [0277.828] GetLastError () returned 0x0 [0277.828] SetLastError (dwErrCode=0x0) [0277.828] GetLastError () returned 0x0 [0277.829] SetLastError (dwErrCode=0x0) [0277.829] GetLastError () returned 0x0 [0277.829] SetLastError (dwErrCode=0x0) [0277.829] GetLastError () returned 0x0 [0277.829] SetLastError (dwErrCode=0x0) [0277.829] GetLastError () returned 0x0 [0277.829] SetLastError (dwErrCode=0x0) [0277.829] GetLastError () returned 0x0 [0277.829] SetLastError (dwErrCode=0x0) [0277.829] GetLastError () returned 0x0 [0277.829] SetLastError (dwErrCode=0x0) [0277.829] GetLastError () returned 0x0 [0277.830] SetLastError (dwErrCode=0x0) [0277.830] GetProcessHeap () returned 0x710000 [0277.830] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40000) returned 0x812ea0 [0277.831] GetLastError () returned 0x0 [0277.831] SetLastError (dwErrCode=0x0) [0277.831] GetLastError () returned 0x0 [0277.831] SetLastError (dwErrCode=0x0) [0277.831] GetLastError () returned 0x0 [0277.831] SetLastError (dwErrCode=0x0) [0277.832] GetLastError () returned 0x0 [0277.832] SetLastError (dwErrCode=0x0) [0277.832] GetLastError () returned 0x0 [0277.832] SetLastError (dwErrCode=0x0) [0277.832] GetLastError () returned 0x0 [0277.832] SetLastError (dwErrCode=0x0) [0277.832] GetLastError () returned 0x0 [0277.832] SetLastError (dwErrCode=0x0) [0277.832] GetLastError () returned 0x0 [0277.832] SetLastError (dwErrCode=0x0) [0277.832] GetLastError () returned 0x0 [0277.832] SetLastError (dwErrCode=0x0) [0277.833] GetLastError () returned 0x0 [0277.833] SetLastError (dwErrCode=0x0) [0277.833] GetLastError () returned 0x0 [0277.833] SetLastError (dwErrCode=0x0) [0277.833] GetLastError () returned 0x0 [0277.833] SetLastError (dwErrCode=0x0) [0277.833] GetLastError () returned 0x0 [0277.833] SetLastError (dwErrCode=0x0) [0277.833] GetLastError () returned 0x0 [0277.833] SetLastError (dwErrCode=0x0) [0277.833] GetLastError () returned 0x0 [0277.834] SetLastError (dwErrCode=0x0) [0277.834] GetLastError () returned 0x0 [0277.834] SetLastError (dwErrCode=0x0) [0277.834] GetLastError () returned 0x0 [0277.834] SetLastError (dwErrCode=0x0) [0277.834] GetLastError () returned 0x0 [0277.834] SetLastError (dwErrCode=0x0) [0277.834] GetLastError () returned 0x0 [0277.834] SetLastError (dwErrCode=0x0) [0277.834] GetLastError () returned 0x0 [0277.834] SetLastError (dwErrCode=0x0) [0277.835] GetLastError () returned 0x0 [0277.835] SetLastError (dwErrCode=0x0) [0277.835] GetLastError () returned 0x0 [0277.835] SetLastError (dwErrCode=0x0) [0277.835] GetLastError () returned 0x0 [0277.835] SetLastError (dwErrCode=0x0) [0277.835] GetLastError () returned 0x0 [0277.835] SetLastError (dwErrCode=0x0) [0277.835] GetLastError () returned 0x0 [0277.835] SetLastError (dwErrCode=0x0) [0277.835] GetLastError () returned 0x0 [0277.835] SetLastError (dwErrCode=0x0) [0277.836] GetLastError () returned 0x0 [0277.836] SetLastError (dwErrCode=0x0) [0277.836] GetLastError () returned 0x0 [0277.836] SetLastError (dwErrCode=0x0) [0277.836] GetLastError () returned 0x0 [0277.836] SetLastError (dwErrCode=0x0) [0277.836] GetLastError () returned 0x0 [0277.836] SetLastError (dwErrCode=0x0) [0277.836] GetLastError () returned 0x0 [0277.836] SetLastError (dwErrCode=0x0) [0277.837] GetLastError () returned 0x0 [0277.837] SetLastError (dwErrCode=0x0) [0277.837] GetLastError () returned 0x0 [0277.837] SetLastError (dwErrCode=0x0) [0277.837] GetLastError () returned 0x0 [0277.837] SetLastError (dwErrCode=0x0) [0277.838] GetLastError () returned 0x0 [0277.838] SetLastError (dwErrCode=0x0) [0277.838] GetLastError () returned 0x0 [0277.838] SetLastError (dwErrCode=0x0) [0277.839] GetLastError () returned 0x0 [0277.839] SetLastError (dwErrCode=0x0) [0277.839] GetProcessHeap () returned 0x710000 [0277.839] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x852eb0 [0277.840] GetLastError () returned 0x0 [0277.840] SetLastError (dwErrCode=0x0) [0277.840] GetLastError () returned 0x0 [0277.840] SetLastError (dwErrCode=0x0) [0277.840] GetLastError () returned 0x0 [0277.840] SetLastError (dwErrCode=0x0) [0277.840] GetLastError () returned 0x0 [0277.840] SetLastError (dwErrCode=0x0) [0277.840] GetLastError () returned 0x0 [0277.840] SetLastError (dwErrCode=0x0) [0277.840] GetProcessHeap () returned 0x710000 [0277.841] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x85aec0 [0277.841] GetLastError () returned 0x0 [0277.841] SetLastError (dwErrCode=0x0) [0277.841] GetLastError () returned 0x0 [0277.841] SetLastError (dwErrCode=0x0) [0277.841] GetLastError () returned 0x0 [0277.842] SetLastError (dwErrCode=0x0) [0277.842] GetProcessHeap () returned 0x710000 [0277.842] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x862ed0 [0277.843] GetLastError () returned 0x0 [0277.843] SetLastError (dwErrCode=0x0) [0277.843] GetLastError () returned 0x0 [0277.843] SetLastError (dwErrCode=0x0) [0277.843] GetLastError () returned 0x0 [0277.843] SetLastError (dwErrCode=0x0) [0277.843] GetLastError () returned 0x0 [0277.843] SetLastError (dwErrCode=0x0) [0277.843] GetLastError () returned 0x0 [0277.843] SetLastError (dwErrCode=0x0) [0277.843] GetLastError () returned 0x0 [0277.843] SetLastError (dwErrCode=0x0) [0277.843] GetLastError () returned 0x0 [0277.844] SetLastError (dwErrCode=0x0) [0277.844] GetLastError () returned 0x0 [0277.844] SetLastError (dwErrCode=0x0) [0277.844] GetLastError () returned 0x0 [0277.844] SetLastError (dwErrCode=0x0) [0277.844] GetLastError () returned 0x0 [0277.844] SetLastError (dwErrCode=0x0) [0277.844] GetLastError () returned 0x0 [0277.844] SetLastError (dwErrCode=0x0) [0277.844] GetLastError () returned 0x0 [0277.844] SetLastError (dwErrCode=0x0) [0277.844] GetLastError () returned 0x0 [0277.844] SetLastError (dwErrCode=0x0) [0277.845] GetLastError () returned 0x0 [0277.845] SetLastError (dwErrCode=0x0) [0277.845] GetProcessHeap () returned 0x710000 [0277.845] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x86aee0 [0277.846] GetLastError () returned 0x0 [0277.846] SetLastError (dwErrCode=0x0) [0277.846] GetLastError () returned 0x0 [0277.846] SetLastError (dwErrCode=0x0) [0277.846] GetLastError () returned 0x0 [0277.846] SetLastError (dwErrCode=0x0) [0277.846] GetLastError () returned 0x0 [0277.847] SetLastError (dwErrCode=0x0) [0277.847] GetLastError () returned 0x0 [0277.847] SetLastError (dwErrCode=0x0) [0277.847] GetProcessHeap () returned 0x710000 [0277.847] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x872ef0 [0277.848] GetLastError () returned 0x0 [0277.848] SetLastError (dwErrCode=0x0) [0277.848] GetProcessHeap () returned 0x710000 [0277.848] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x87af00 [0277.849] GetLastError () returned 0x0 [0277.849] SetLastError (dwErrCode=0x0) [0277.849] GetLastError () returned 0x0 [0277.849] SetLastError (dwErrCode=0x0) [0277.850] GetLastError () returned 0x0 [0277.850] SetLastError (dwErrCode=0x0) [0277.850] GetLastError () returned 0x0 [0277.850] SetLastError (dwErrCode=0x0) [0277.850] GetLastError () returned 0x0 [0277.850] SetLastError (dwErrCode=0x0) [0277.850] GetLastError () returned 0x0 [0277.850] SetLastError (dwErrCode=0x0) [0277.850] GetLastError () returned 0x0 [0277.850] SetLastError (dwErrCode=0x0) [0277.851] GetLastError () returned 0x0 [0277.851] SetLastError (dwErrCode=0x0) [0277.851] GetLastError () returned 0x0 [0277.851] SetLastError (dwErrCode=0x0) [0277.851] GetLastError () returned 0x0 [0277.851] SetLastError (dwErrCode=0x0) [0277.851] GetLastError () returned 0x0 [0277.851] SetLastError (dwErrCode=0x0) [0277.851] GetLastError () returned 0x0 [0277.851] SetLastError (dwErrCode=0x0) [0277.851] GetLastError () returned 0x0 [0277.852] SetLastError (dwErrCode=0x0) [0277.852] GetLastError () returned 0x0 [0277.852] SetLastError (dwErrCode=0x0) [0277.852] GetLastError () returned 0x0 [0277.852] SetLastError (dwErrCode=0x0) [0277.852] GetLastError () returned 0x0 [0277.852] SetLastError (dwErrCode=0x0) [0277.852] GetLastError () returned 0x0 [0277.852] SetLastError (dwErrCode=0x0) [0277.852] GetLastError () returned 0x0 [0277.852] SetLastError (dwErrCode=0x0) [0277.853] GetLastError () returned 0x0 [0277.853] SetLastError (dwErrCode=0x0) [0277.853] GetLastError () returned 0x0 [0277.853] SetLastError (dwErrCode=0x0) [0277.853] GetLastError () returned 0x0 [0277.853] SetLastError (dwErrCode=0x0) [0277.853] GetLastError () returned 0x0 [0277.853] SetLastError (dwErrCode=0x0) [0277.853] GetLastError () returned 0x0 [0277.853] SetLastError (dwErrCode=0x0) [0277.853] GetLastError () returned 0x0 [0277.853] SetLastError (dwErrCode=0x0) [0277.853] GetLastError () returned 0x0 [0277.853] SetLastError (dwErrCode=0x0) [0277.853] GetLastError () returned 0x0 [0277.854] SetLastError (dwErrCode=0x0) [0277.854] GetProcessHeap () returned 0x710000 [0277.854] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40000) returned 0x882f10 [0277.855] GetLastError () returned 0x0 [0277.855] SetLastError (dwErrCode=0x0) [0277.855] GetLastError () returned 0x0 [0277.855] SetLastError (dwErrCode=0x0) [0277.855] GetLastError () returned 0x0 [0277.855] SetLastError (dwErrCode=0x0) [0277.855] GetLastError () returned 0x0 [0277.855] SetLastError (dwErrCode=0x0) [0277.856] GetLastError () returned 0x0 [0277.856] SetLastError (dwErrCode=0x0) [0277.856] GetLastError () returned 0x0 [0277.856] SetLastError (dwErrCode=0x0) [0277.856] GetLastError () returned 0x0 [0277.856] SetLastError (dwErrCode=0x0) [0277.856] GetLastError () returned 0x0 [0277.856] SetLastError (dwErrCode=0x0) [0277.856] GetLastError () returned 0x0 [0277.857] SetLastError (dwErrCode=0x0) [0277.857] GetLastError () returned 0x0 [0277.857] SetLastError (dwErrCode=0x0) [0277.857] GetLastError () returned 0x0 [0277.857] SetLastError (dwErrCode=0x0) [0277.857] GetLastError () returned 0x0 [0277.857] SetLastError (dwErrCode=0x0) [0277.857] GetLastError () returned 0x0 [0277.857] SetLastError (dwErrCode=0x0) [0277.857] GetLastError () returned 0x0 [0277.857] SetLastError (dwErrCode=0x0) [0277.857] GetLastError () returned 0x0 [0277.857] SetLastError (dwErrCode=0x0) [0277.858] GetLastError () returned 0x0 [0277.858] SetLastError (dwErrCode=0x0) [0277.858] GetLastError () returned 0x0 [0277.858] SetLastError (dwErrCode=0x0) [0277.858] GetLastError () returned 0x0 [0277.858] SetLastError (dwErrCode=0x0) [0277.858] GetLastError () returned 0x0 [0277.858] SetLastError (dwErrCode=0x0) [0277.858] GetLastError () returned 0x0 [0277.859] SetLastError (dwErrCode=0x0) [0277.859] GetLastError () returned 0x0 [0277.859] SetLastError (dwErrCode=0x0) [0277.859] GetLastError () returned 0x0 [0277.859] SetLastError (dwErrCode=0x0) [0277.859] GetLastError () returned 0x0 [0277.859] SetLastError (dwErrCode=0x0) [0277.859] GetLastError () returned 0x0 [0277.859] SetLastError (dwErrCode=0x0) [0277.859] GetLastError () returned 0x0 [0277.859] SetLastError (dwErrCode=0x0) [0277.859] GetProcessHeap () returned 0x710000 [0277.859] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x8c2f20 [0277.860] GetLastError () returned 0x0 [0277.860] SetLastError (dwErrCode=0x0) [0277.861] GetLastError () returned 0x0 [0277.861] SetLastError (dwErrCode=0x0) [0277.861] GetLastError () returned 0x0 [0277.861] SetLastError (dwErrCode=0x0) [0277.861] GetProcessHeap () returned 0x710000 [0277.861] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x8caf30 [0277.862] GetLastError () returned 0x0 [0277.862] SetLastError (dwErrCode=0x0) [0277.862] GetLastError () returned 0x0 [0277.862] SetLastError (dwErrCode=0x0) [0277.862] GetLastError () returned 0x0 [0277.862] SetLastError (dwErrCode=0x0) [0277.862] GetLastError () returned 0x0 [0277.863] SetLastError (dwErrCode=0x0) [0277.863] GetLastError () returned 0x0 [0277.863] SetLastError (dwErrCode=0x0) [0277.863] GetLastError () returned 0x0 [0277.863] SetLastError (dwErrCode=0x0) [0277.863] GetLastError () returned 0x0 [0277.863] SetLastError (dwErrCode=0x0) [0277.863] GetLastError () returned 0x0 [0277.863] SetLastError (dwErrCode=0x0) [0277.863] GetLastError () returned 0x0 [0277.863] SetLastError (dwErrCode=0x0) [0277.863] GetLastError () returned 0x0 [0277.863] SetLastError (dwErrCode=0x0) [0277.864] GetLastError () returned 0x0 [0277.864] SetLastError (dwErrCode=0x0) [0277.864] GetLastError () returned 0x0 [0277.864] SetLastError (dwErrCode=0x0) [0277.864] GetLastError () returned 0x0 [0277.864] SetLastError (dwErrCode=0x0) [0277.864] GetLastError () returned 0x0 [0277.864] SetLastError (dwErrCode=0x0) [0277.864] GetLastError () returned 0x0 [0277.864] SetLastError (dwErrCode=0x0) [0277.864] GetLastError () returned 0x0 [0277.864] SetLastError (dwErrCode=0x0) [0277.864] GetLastError () returned 0x0 [0277.865] SetLastError (dwErrCode=0x0) [0277.865] GetLastError () returned 0x0 [0277.865] SetLastError (dwErrCode=0x0) [0277.865] GetLastError () returned 0x0 [0277.865] SetLastError (dwErrCode=0x0) [0277.865] GetLastError () returned 0x0 [0277.865] SetLastError (dwErrCode=0x0) [0277.865] GetLastError () returned 0x0 [0277.865] SetLastError (dwErrCode=0x0) [0277.865] GetProcessHeap () returned 0x710000 [0277.865] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x8d2f40 [0277.866] GetLastError () returned 0x0 [0277.866] SetLastError (dwErrCode=0x0) [0277.867] GetLastError () returned 0x0 [0277.867] SetLastError (dwErrCode=0x0) [0277.867] GetLastError () returned 0x0 [0277.867] SetLastError (dwErrCode=0x0) [0277.867] GetLastError () returned 0x0 [0277.867] SetLastError (dwErrCode=0x0) [0277.869] GetProcessHeap () returned 0x710000 [0277.869] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40000) returned 0x600080 [0277.875] GetProcessHeap () returned 0x710000 [0277.875] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40000) returned 0x640090 [0277.882] GetProcessHeap () returned 0x710000 [0277.882] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40000) returned 0x6800a0 [0277.887] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0277.887] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="RtlAddFunctionTable") returned 0x7ffd5054df40 [0277.887] RtlAddFunctionTable (FunctionTable=0x7ff5ffaf0000, EntryCount=0x1, BaseAddress=0x7ff5ffaf0000, TargetGp=0x29b) returned 1 [0277.888] GetCurrentThreadId () returned 0x63c [0277.888] GetLastError () returned 0x0 [0277.888] SetLastError (dwErrCode=0x0) [0277.888] GetLastError () returned 0x0 [0277.888] SetLastError (dwErrCode=0x0) [0277.888] GetLastError () returned 0x0 [0277.888] SetLastError (dwErrCode=0x0) [0277.888] GetLastError () returned 0x0 [0277.888] SetLastError (dwErrCode=0x0) [0277.888] GetLastError () returned 0x0 [0277.888] SetLastError (dwErrCode=0x0) [0277.888] GetLastError () returned 0x0 [0277.888] SetLastError (dwErrCode=0x0) [0277.889] GetLastError () returned 0x0 [0277.929] SetLastError (dwErrCode=0x0) [0277.929] GetLastError () returned 0x0 [0277.929] SetLastError (dwErrCode=0x0) [0277.929] GetLastError () returned 0x0 [0277.929] SetLastError (dwErrCode=0x0) [0277.929] GetLastError () returned 0x0 [0277.929] SetLastError (dwErrCode=0x0) [0277.929] GetLastError () returned 0x0 [0277.930] SetLastError (dwErrCode=0x0) [0277.930] GetLastError () returned 0x0 [0277.930] SetLastError (dwErrCode=0x0) [0277.930] GetLastError () returned 0x0 [0277.930] GetLastError () returned 0x0 [0277.930] SetLastError (dwErrCode=0x0) [0277.930] SetLastError (dwErrCode=0x0) [0277.930] GetLastError () returned 0x0 [0277.930] SetLastError (dwErrCode=0x0) [0277.930] GetLastError () returned 0x0 [0277.930] SetLastError (dwErrCode=0x0) [0277.931] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff771f50000 [0277.931] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff771f50000 [0277.931] GetStartupInfoA (in: lpStartupInfo=0x7ff772b383b0 | out: lpStartupInfo=0x7ff772b383b0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffffffffffff, hStdOutput=0xffffffffffffffff, hStdError=0xffffffffffffffff)) [0277.931] GetCurrentThreadId () returned 0x63c [0277.931] GetLastError () returned 0x0 [0277.931] LocalAlloc (uFlags=0x40, uBytes=0x12c9) returned 0x6c00b0 [0277.931] SetLastError (dwErrCode=0x0) [0277.931] GetLastError () returned 0x0 [0277.931] SetLastError (dwErrCode=0x0) [0277.931] GetLastError () returned 0x0 [0277.931] SetLastError (dwErrCode=0x0) [0277.932] GetLastError () returned 0x0 [0277.932] SetLastError (dwErrCode=0x0) [0277.932] GetLastError () returned 0x0 [0277.932] SetLastError (dwErrCode=0x0) [0277.932] GetLastError () returned 0x0 [0277.932] SetLastError (dwErrCode=0x0) [0277.932] GetLastError () returned 0x0 [0277.932] SetLastError (dwErrCode=0x0) [0277.932] GetLastError () returned 0x0 [0277.932] SetLastError (dwErrCode=0x0) [0277.932] GetLastError () returned 0x0 [0277.932] SetLastError (dwErrCode=0x0) [0277.932] GetLastError () returned 0x0 [0277.932] SetLastError (dwErrCode=0x0) [0277.932] GetLastError () returned 0x0 [0277.933] SetLastError (dwErrCode=0x0) [0277.933] GetLastError () returned 0x0 [0277.933] SetLastError (dwErrCode=0x0) [0277.933] GetLastError () returned 0x0 [0277.933] SetLastError (dwErrCode=0x0) [0277.933] GetLastError () returned 0x0 [0277.933] SetLastError (dwErrCode=0x0) [0277.933] GetLastError () returned 0x0 [0277.933] SetLastError (dwErrCode=0x0) [0277.933] GetLastError () returned 0x0 [0277.933] SetLastError (dwErrCode=0x0) [0277.933] GetLastError () returned 0x0 [0277.933] SetLastError (dwErrCode=0x0) [0277.933] GetLastError () returned 0x0 [0277.933] SetLastError (dwErrCode=0x0) [0277.933] GetLastError () returned 0x0 [0277.933] SetLastError (dwErrCode=0x0) [0277.933] GetLastError () returned 0x0 [0277.933] SetLastError (dwErrCode=0x0) [0277.933] GetLastError () returned 0x0 [0277.933] SetLastError (dwErrCode=0x0) [0277.934] GetLastError () returned 0x0 [0277.934] SetLastError (dwErrCode=0x0) [0277.934] GetLastError () returned 0x0 [0277.934] SetLastError (dwErrCode=0x0) [0277.934] GetLastError () returned 0x0 [0277.934] SetLastError (dwErrCode=0x0) [0277.934] GetLastError () returned 0x0 [0277.934] SetLastError (dwErrCode=0x0) [0277.934] GetLastError () returned 0x0 [0277.934] SetLastError (dwErrCode=0x0) [0277.934] GetLastError () returned 0x0 [0277.934] SetLastError (dwErrCode=0x0) [0277.934] SysReAllocStringLen (in: pbstr=0x7ff7729f98f0*=0x0, psz="enigma_ide64.dll", len=0x10 | out: pbstr=0x7ff7729f98f0*="enigma_ide64.dll") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06df0*=0x0, psz="%DEFAULT FOLDER%", len=0x10 | out: pbstr=0x7ff772a06df0*="%DEFAULT FOLDER%") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06df8*=0x0, psz="%SYSTEM FOLDER%", len=0xf | out: pbstr=0x7ff772a06df8*="%SYSTEM FOLDER%") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06e00*=0x0, psz="%WINDOWS FOLDER%", len=0x10 | out: pbstr=0x7ff772a06e00*="%WINDOWS FOLDER%") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06e08*=0x0, psz="%My Documents FOLDER%", len=0x15 | out: pbstr=0x7ff772a06e08*="%My Documents FOLDER%") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06e10*=0x0, psz="%Program Files FOLDER%", len=0x16 | out: pbstr=0x7ff772a06e10*="%Program Files FOLDER%") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06e18*=0x0, psz="%Program Files, Common FOLDER%", len=0x1e | out: pbstr=0x7ff772a06e18*="%Program Files, Common FOLDER%") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06e20*=0x0, psz="%AllUsers, Documents FOLDER%", len=0x1c | out: pbstr=0x7ff772a06e20*="%AllUsers, Documents FOLDER%") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06e28*=0x0, psz="%My Pictures FOLDER%", len=0x14 | out: pbstr=0x7ff772a06e28*="%My Pictures FOLDER%") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06e30*=0x0, psz="%History FOLDER%", len=0x10 | out: pbstr=0x7ff772a06e30*="%History FOLDER%") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06e38*=0x0, psz="%Cookies FOLDER%", len=0x10 | out: pbstr=0x7ff772a06e38*="%Cookies FOLDER%") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06e40*=0x0, psz="%InternetCache FOLDER%", len=0x16 | out: pbstr=0x7ff772a06e40*="%InternetCache FOLDER%") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06e48*=0x0, psz="%ApplicationData FOLDER%", len=0x18 | out: pbstr=0x7ff772a06e48*="%ApplicationData FOLDER%") returned 1 [0277.935] SysReAllocStringLen (in: pbstr=0x7ff772a06e50*=0x0, psz="%Temp FOLDER%", len=0xd | out: pbstr=0x7ff772a06e50*="%Temp FOLDER%") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a06e58*=0x0, psz="%AllUsers, ApplicationData FOLDER%", len=0x22 | out: pbstr=0x7ff772a06e58*="%AllUsers, ApplicationData FOLDER%") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a06e60*=0x0, psz="%Local, ApplicationData FOLDER%", len=0x1f | out: pbstr=0x7ff772a06e60*="%Local, ApplicationData FOLDER%") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a06e68*=0x0, psz="%SYSTEM DRIVE%", len=0xe | out: pbstr=0x7ff772a06e68*="%SYSTEM DRIVE%") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a06e70*=0x0, psz="%UserProfile FOLDER%", len=0x14 | out: pbstr=0x7ff772a06e70*="%UserProfile FOLDER%") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a12a30*=0x0, psz="MICROSOFTEDGE", len=0xd | out: pbstr=0x7ff772a12a30*="MICROSOFTEDGE") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a2a600*=0x0, psz="LAZ_PIC_DIALOG_TEMPLATE", len=0x17 | out: pbstr=0x7ff772a2a600*="LAZ_PIC_DIALOG_TEMPLATE") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a07000*=0x0, psz="hh.exe", len=0x6 | out: pbstr=0x7ff772a07000*="hh.exe") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a07008*=0x0, psz="write.exe", len=0x9 | out: pbstr=0x7ff772a07008*="write.exe") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a07010*=0x0, psz="attrib.exe", len=0xa | out: pbstr=0x7ff772a07010*="attrib.exe") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a07018*=0x0, psz="chkdsk.exe", len=0xa | out: pbstr=0x7ff772a07018*="chkdsk.exe") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a07020*=0x0, psz="compact.exe", len=0xb | out: pbstr=0x7ff772a07020*="compact.exe") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a07028*=0x0, psz="find.exe", len=0x8 | out: pbstr=0x7ff772a07028*="find.exe") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a07030*=0x0, psz="help.exe", len=0x8 | out: pbstr=0x7ff772a07030*="help.exe") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a07038*=0x0, psz="winver.exe", len=0xa | out: pbstr=0x7ff772a07038*="winver.exe") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a07040*=0x0, psz="regsvr32.exe", len=0xc | out: pbstr=0x7ff772a07040*="regsvr32.exe") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a07048*=0x0, psz="replace.exe", len=0xb | out: pbstr=0x7ff772a07048*="replace.exe") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a07050*=0x0, psz="dllhost.exe", len=0xb | out: pbstr=0x7ff772a07050*="dllhost.exe") returned 1 [0277.936] SysReAllocStringLen (in: pbstr=0x7ff772a07058*=0x0, psz="ntvdm.exe", len=0x9 | out: pbstr=0x7ff772a07058*="ntvdm.exe") returned 1 [0277.937] SysReAllocStringLen (in: pbstr=0x7ff772a07060*=0x0, psz="tcpsvcs.exe", len=0xb | out: pbstr=0x7ff772a07060*="tcpsvcs.exe") returned 1 [0277.937] GetACP () returned 0x4e4 [0277.937] GetStdHandle (nStdHandle=0xfffffff6) returned 0x20 [0277.937] GetStdHandle (nStdHandle=0xfffffff5) returned 0x24 [0277.937] GetStdHandle (nStdHandle=0xfffffff4) returned 0x28 [0277.937] GetLastError () returned 0x0 [0277.937] SetLastError (dwErrCode=0x0) [0277.937] GetConsoleCP () returned 0x1b5 [0277.938] GetLastError () returned 0x0 [0277.938] SetLastError (dwErrCode=0x0) [0277.938] GetConsoleOutputCP () returned 0x1b5 [0277.938] GetLastError () returned 0x0 [0277.938] SetLastError (dwErrCode=0x0) [0277.938] GetConsoleOutputCP () returned 0x1b5 [0277.939] GetLastError () returned 0x0 [0277.939] SetLastError (dwErrCode=0x0) [0277.939] GetConsoleOutputCP () returned 0x1b5 [0277.940] GetLastError () returned 0x0 [0277.940] SetLastError (dwErrCode=0x0) [0277.940] GetConsoleOutputCP () returned 0x1b5 [0277.941] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x5ffc38, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe")) returned 0x3b [0277.941] GetLastError () returned 0x0 [0277.941] SetLastError (dwErrCode=0x0) [0277.941] GetProcessHeap () returned 0x710000 [0277.941] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x8daf50 [0277.942] GetLastError () returned 0x0 [0277.942] SetLastError (dwErrCode=0x0) [0277.942] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe\" " [0277.942] GetLastError () returned 0x0 [0277.942] SetLastError (dwErrCode=0x0) [0277.942] GetCurrentProcessId () returned 0x694 [0277.942] GetLastError () returned 0x0 [0277.942] SetLastError (dwErrCode=0x0) [0277.942] GetProcessHeap () returned 0x710000 [0277.942] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x8e2f60 [0277.943] GetLastError () returned 0x0 [0277.944] SetLastError (dwErrCode=0x0) [0277.944] GetUserDefaultLCID () returned 0x409 [0277.944] SetThreadLocale (Locale=0x409) returned 1 [0277.944] GetSystemMetrics (nIndex=42) returned 0 [0277.944] GetSystemMetrics (nIndex=74) returned 0 [0277.944] GetThreadLocale () returned 0x409 [0277.944] GetThreadLocale () returned 0x409 [0277.944] GetLocaleInfoA (in: Locale=0x409, LCType=0x44, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Jan") returned 4 [0277.944] GetLastError () returned 0x0 [0277.944] SetLastError (dwErrCode=0x0) [0277.944] GetLocaleInfoA (in: Locale=0x409, LCType=0x38, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="January") returned 8 [0277.944] GetLastError () returned 0x0 [0277.944] SetLastError (dwErrCode=0x0) [0277.944] GetLocaleInfoA (in: Locale=0x409, LCType=0x45, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Feb") returned 4 [0277.944] GetLastError () returned 0x0 [0277.944] SetLastError (dwErrCode=0x0) [0277.944] GetLocaleInfoA (in: Locale=0x409, LCType=0x39, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="February") returned 9 [0277.944] GetLastError () returned 0x0 [0277.944] SetLastError (dwErrCode=0x0) [0277.944] GetLocaleInfoA (in: Locale=0x409, LCType=0x46, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Mar") returned 4 [0277.944] GetLastError () returned 0x0 [0277.945] SetLastError (dwErrCode=0x0) [0277.945] GetLocaleInfoA (in: Locale=0x409, LCType=0x3a, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="March") returned 6 [0277.945] GetLastError () returned 0x0 [0277.945] SetLastError (dwErrCode=0x0) [0277.945] GetLocaleInfoA (in: Locale=0x409, LCType=0x47, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Apr") returned 4 [0277.945] GetLastError () returned 0x0 [0277.945] SetLastError (dwErrCode=0x0) [0277.945] GetLocaleInfoA (in: Locale=0x409, LCType=0x3b, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="April") returned 6 [0277.945] GetLastError () returned 0x0 [0277.945] SetLastError (dwErrCode=0x0) [0277.945] GetLocaleInfoA (in: Locale=0x409, LCType=0x48, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="May") returned 4 [0277.945] GetLastError () returned 0x0 [0277.945] SetLastError (dwErrCode=0x0) [0277.945] GetLocaleInfoA (in: Locale=0x409, LCType=0x3c, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="May") returned 4 [0277.945] GetLastError () returned 0x0 [0277.945] SetLastError (dwErrCode=0x0) [0277.945] GetLocaleInfoA (in: Locale=0x409, LCType=0x49, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Jun") returned 4 [0277.945] GetLastError () returned 0x0 [0277.945] SetLastError (dwErrCode=0x0) [0277.945] GetLocaleInfoA (in: Locale=0x409, LCType=0x3d, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="June") returned 5 [0277.945] GetLastError () returned 0x0 [0277.946] SetLastError (dwErrCode=0x0) [0277.946] GetLocaleInfoA (in: Locale=0x409, LCType=0x4a, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Jul") returned 4 [0277.946] GetLastError () returned 0x0 [0277.946] SetLastError (dwErrCode=0x0) [0277.946] GetLocaleInfoA (in: Locale=0x409, LCType=0x3e, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="July") returned 5 [0277.946] GetLastError () returned 0x0 [0277.946] SetLastError (dwErrCode=0x0) [0277.946] GetLocaleInfoA (in: Locale=0x409, LCType=0x4b, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Aug") returned 4 [0277.946] GetLastError () returned 0x0 [0277.946] SetLastError (dwErrCode=0x0) [0277.946] GetLocaleInfoA (in: Locale=0x409, LCType=0x3f, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="August") returned 7 [0277.946] GetLastError () returned 0x0 [0277.946] SetLastError (dwErrCode=0x0) [0277.946] GetLocaleInfoA (in: Locale=0x409, LCType=0x4c, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Sep") returned 4 [0277.946] GetLastError () returned 0x0 [0277.946] SetLastError (dwErrCode=0x0) [0277.946] GetLocaleInfoA (in: Locale=0x409, LCType=0x40, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="September") returned 10 [0277.946] GetLastError () returned 0x0 [0277.946] SetLastError (dwErrCode=0x0) [0277.946] GetLocaleInfoA (in: Locale=0x409, LCType=0x4d, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Oct") returned 4 [0277.946] GetLastError () returned 0x0 [0277.947] SetLastError (dwErrCode=0x0) [0277.947] GetLocaleInfoA (in: Locale=0x409, LCType=0x41, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="October") returned 8 [0277.947] GetLastError () returned 0x0 [0277.947] SetLastError (dwErrCode=0x0) [0277.947] GetLocaleInfoA (in: Locale=0x409, LCType=0x4e, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Nov") returned 4 [0277.947] GetLastError () returned 0x0 [0277.947] SetLastError (dwErrCode=0x0) [0277.947] GetLocaleInfoA (in: Locale=0x409, LCType=0x42, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="November") returned 9 [0277.947] GetLastError () returned 0x0 [0277.947] SetLastError (dwErrCode=0x0) [0277.947] GetLocaleInfoA (in: Locale=0x409, LCType=0x4f, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Dec") returned 4 [0277.947] GetLastError () returned 0x0 [0277.947] SetLastError (dwErrCode=0x0) [0277.947] GetLocaleInfoA (in: Locale=0x409, LCType=0x43, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="December") returned 9 [0277.947] GetLastError () returned 0x0 [0277.947] SetLastError (dwErrCode=0x0) [0277.947] GetLocaleInfoA (in: Locale=0x409, LCType=0x37, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Sun") returned 4 [0277.947] GetLastError () returned 0x0 [0277.947] SetLastError (dwErrCode=0x0) [0277.947] GetLocaleInfoA (in: Locale=0x409, LCType=0x30, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Sunday") returned 7 [0277.947] GetLastError () returned 0x0 [0277.948] SetLastError (dwErrCode=0x0) [0277.948] GetLocaleInfoA (in: Locale=0x409, LCType=0x31, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Mon") returned 4 [0277.948] GetLastError () returned 0x0 [0277.948] SetLastError (dwErrCode=0x0) [0277.948] GetLocaleInfoA (in: Locale=0x409, LCType=0x2a, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Monday") returned 7 [0277.948] GetLastError () returned 0x0 [0277.948] SetLastError (dwErrCode=0x0) [0277.948] GetLocaleInfoA (in: Locale=0x409, LCType=0x32, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Tue") returned 4 [0277.948] GetLastError () returned 0x0 [0277.948] SetLastError (dwErrCode=0x0) [0277.948] GetLocaleInfoA (in: Locale=0x409, LCType=0x2b, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Tuesday") returned 8 [0277.948] GetLastError () returned 0x0 [0277.948] SetLastError (dwErrCode=0x0) [0277.948] GetLocaleInfoA (in: Locale=0x409, LCType=0x33, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Wed") returned 4 [0277.948] GetLastError () returned 0x0 [0277.948] SetLastError (dwErrCode=0x0) [0277.948] GetLocaleInfoA (in: Locale=0x409, LCType=0x2c, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Wednesday") returned 10 [0277.948] GetLastError () returned 0x0 [0277.948] SetLastError (dwErrCode=0x0) [0277.948] GetLocaleInfoA (in: Locale=0x409, LCType=0x34, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Thu") returned 4 [0277.948] GetLastError () returned 0x0 [0277.948] SetLastError (dwErrCode=0x0) [0277.949] GetLocaleInfoA (in: Locale=0x409, LCType=0x2d, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Thursday") returned 9 [0277.949] GetLastError () returned 0x0 [0277.949] SetLastError (dwErrCode=0x0) [0277.949] GetLocaleInfoA (in: Locale=0x409, LCType=0x35, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Fri") returned 4 [0277.949] GetLastError () returned 0x0 [0277.949] SetLastError (dwErrCode=0x0) [0277.949] GetLocaleInfoA (in: Locale=0x409, LCType=0x2e, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Friday") returned 7 [0277.949] GetLastError () returned 0x0 [0277.949] SetLastError (dwErrCode=0x0) [0277.949] GetLocaleInfoA (in: Locale=0x409, LCType=0x36, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Sat") returned 4 [0277.949] GetLastError () returned 0x0 [0277.949] SetLastError (dwErrCode=0x0) [0277.949] GetLocaleInfoA (in: Locale=0x409, LCType=0x2f, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="Saturday") returned 9 [0277.949] GetLastError () returned 0x0 [0277.949] SetLastError (dwErrCode=0x0) [0277.950] GetLocaleInfoA (in: Locale=0x409, LCType=0x1d, lpLCData=0x5ffaa0, cchData=4 | out: lpLCData="/") returned 2 [0277.950] GetLocaleInfoA (in: Locale=0x409, LCType=0x1f, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0277.950] GetLastError () returned 0x0 [0277.950] SetLastError (dwErrCode=0x0) [0277.950] GetLocaleInfoA (in: Locale=0x409, LCType=0x20, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0277.950] GetLastError () returned 0x0 [0277.950] SetLastError (dwErrCode=0x0) [0277.950] GetLocaleInfoA (in: Locale=0x409, LCType=0x1e, lpLCData=0x5ffaa0, cchData=4 | out: lpLCData=":") returned 2 [0277.950] GetLocaleInfoA (in: Locale=0x409, LCType=0x28, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="AM") returned 3 [0277.950] GetLastError () returned 0x0 [0277.950] SetLastError (dwErrCode=0x0) [0277.950] GetLocaleInfoA (in: Locale=0x409, LCType=0x29, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="PM") returned 3 [0277.950] GetLastError () returned 0x0 [0277.950] SetLastError (dwErrCode=0x0) [0277.950] GetLocaleInfoA (in: Locale=0x409, LCType=0x25, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="0") returned 2 [0277.950] GetLastError () returned 0x0 [0277.950] SetLastError (dwErrCode=0x0) [0277.950] GetLastError () returned 0x0 [0277.951] SetLastError (dwErrCode=0x0) [0277.951] GetLastError () returned 0x0 [0277.951] SetLastError (dwErrCode=0x0) [0277.951] GetLocaleInfoA (in: Locale=0x409, LCType=0x14, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="$") returned 2 [0277.951] GetLocaleInfoA (in: Locale=0x409, LCType=0x1b, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="0") returned 2 [0277.951] GetLastError () returned 0x0 [0277.951] SetLastError (dwErrCode=0x0) [0277.951] GetLocaleInfoA (in: Locale=0x409, LCType=0x1c, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="0") returned 2 [0277.951] GetLocaleInfoA (in: Locale=0x409, LCType=0xf, lpLCData=0x5ffaa0, cchData=4 | out: lpLCData=",") returned 2 [0277.951] GetLocaleInfoA (in: Locale=0x409, LCType=0xe, lpLCData=0x5ffaa0, cchData=4 | out: lpLCData=".") returned 2 [0277.951] GetLocaleInfoA (in: Locale=0x409, LCType=0x19, lpLCData=0x5ff9a0, cchData=256 | out: lpLCData="2") returned 2 [0277.951] GetLocaleInfoA (in: Locale=0x409, LCType=0xc, lpLCData=0x5ffaa0, cchData=4 | out: lpLCData=",") returned 2 [0277.951] GetLastError () returned 0x0 [0277.951] SetLastError (dwErrCode=0x0) [0277.951] GetVersionExA (in: lpVersionInformation=0x5ffce0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x6e, dwBuildNumber=0x0, dwPlatformId=0x6, szCSDVersion="") | out: lpVersionInformation=0x5ffce0*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0277.951] GetModuleHandleA (lpModuleName="kernel32") returned 0x7ffd4e1c0000 [0277.952] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetDiskFreeSpaceExA") returned 0x7ffd4e1ed9f0 [0277.952] GetLastError () returned 0x0 [0277.952] SetLastError (dwErrCode=0x0) [0277.952] GetProcessHeap () returned 0x710000 [0277.952] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x8eaf70 [0277.953] GetWindowsDirectoryA (in: lpBuffer=0x8eafc8, uSize=0x104 | out: lpBuffer="C:\\Windows") returned 0xa [0277.953] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x170 [0277.953] GetCurrentThreadId () returned 0x63c [0277.953] GetLastError () returned 0x0 [0277.954] SetLastError (dwErrCode=0x0) [0277.954] GetLastError () returned 0x0 [0277.954] SetLastError (dwErrCode=0x0) [0277.954] GetLastError () returned 0x0 [0277.954] SetLastError (dwErrCode=0x0) [0277.954] GetProcessHeap () returned 0x710000 [0277.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x8f2f80 [0277.955] GetSystemInfo (in: lpSystemInfo=0x5ffd10 | out: lpSystemInfo=0x5ffd10*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0277.955] GetLastError () returned 0x0 [0277.955] SetLastError (dwErrCode=0x0) [0277.955] GetLastError () returned 0x0 [0277.955] SetLastError (dwErrCode=0x0) [0277.955] GetLastError () returned 0x0 [0277.956] SetLastError (dwErrCode=0x0) [0277.956] GetLastError () returned 0x0 [0277.956] SetLastError (dwErrCode=0x0) [0277.956] GetLastError () returned 0x0 [0277.956] SetLastError (dwErrCode=0x0) [0277.956] GetLastError () returned 0x0 [0277.956] SetLastError (dwErrCode=0x0) [0277.956] GetLastError () returned 0x0 [0277.956] SetLastError (dwErrCode=0x0) [0277.956] GetProcessHeap () returned 0x710000 [0277.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x8faf90 [0277.957] GetLastError () returned 0x0 [0277.957] SetLastError (dwErrCode=0x0) [0277.957] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x174 [0277.957] ResetEvent (hEvent=0x174) returned 1 [0277.957] GetLastError () returned 0x0 [0277.957] SetLastError (dwErrCode=0x0) [0277.957] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x178 [0277.957] GetLastError () returned 0x0 [0277.957] SetLastError (dwErrCode=0x0) [0277.958] GetLastError () returned 0x0 [0277.958] SetLastError (dwErrCode=0x0) [0277.958] GetLastError () returned 0x0 [0277.958] SetLastError (dwErrCode=0x0) [0277.958] GetLastError () returned 0x0 [0277.958] SetLastError (dwErrCode=0x0) [0277.958] GetLastError () returned 0x0 [0277.958] SetLastError (dwErrCode=0x0) [0277.958] GetLastError () returned 0x0 [0277.958] SetLastError (dwErrCode=0x0) [0277.958] GetLastError () returned 0x0 [0277.958] SetLastError (dwErrCode=0x0) [0277.958] GetLastError () returned 0x0 [0277.958] SetLastError (dwErrCode=0x0) [0277.958] GetProcessHeap () returned 0x710000 [0277.958] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x6c2bb0 [0277.959] GetLastError () returned 0x0 [0277.959] SetLastError (dwErrCode=0x0) [0277.959] GetLastError () returned 0x0 [0277.959] SetLastError (dwErrCode=0x0) [0277.960] GetProcessHeap () returned 0x710000 [0277.960] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40000) returned 0x2560080 [0277.961] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x7ffd50380000 [0277.961] GetProcAddress (hModule=0x7ffd50380000, lpProcName="CoCreateInstanceEx") returned 0x7ffd4dca82a0 [0277.962] GetProcAddress (hModule=0x7ffd50380000, lpProcName="CoInitializeEx") returned 0x7ffd4dcd2c50 [0277.962] GetProcAddress (hModule=0x7ffd50380000, lpProcName="CoAddRefServerProcess") returned 0x7ffd4dc9e660 [0277.962] GetProcAddress (hModule=0x7ffd50380000, lpProcName="CoReleaseServerProcess") returned 0x7ffd4dd33130 [0277.962] GetProcAddress (hModule=0x7ffd50380000, lpProcName="CoResumeClassObjects") returned 0x7ffd4dd3f990 [0277.962] GetProcAddress (hModule=0x7ffd50380000, lpProcName="CoSuspendClassObjects") returned 0x7ffd4dd3fe90 [0277.962] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0277.962] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x160000 [0277.963] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0277.963] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetProcAddress") returned 0x7ffd4e1e0b80 [0277.963] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwClose") returned 0x7ffd50574f20 [0277.963] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetInformationFile") returned 0x7ffd50575220 [0277.963] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryInformationFile") returned 0x7ffd50574f60 [0277.964] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwReadFile") returned 0x7ffd50574e00 [0277.964] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateFile") returned 0x7ffd505757e0 [0277.964] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenFile") returned 0x7ffd505753a0 [0277.964] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryAttributesFile") returned 0x7ffd505754e0 [0277.964] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateSection") returned 0x7ffd50575680 [0277.964] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwMapViewOfSection") returned 0x7ffd50575240 [0277.964] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQuerySection") returned 0x7ffd50575760 [0277.964] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnmapViewOfSection") returned 0x7ffd50575280 [0277.964] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryFullAttributesFile") returned 0x7ffd50577350 [0277.965] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwWriteFile") returned 0x7ffd50574e40 [0277.965] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryObject") returned 0x7ffd50574f40 [0277.965] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryDirectoryFile") returned 0x7ffd505753e0 [0277.965] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenSection") returned 0x7ffd50575420 [0277.965] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDuplicateObject") returned 0x7ffd505754c0 [0277.965] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryVolumeInformationFile") returned 0x7ffd50575660 [0277.965] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeleteFile") returned 0x7ffd505765d0 [0277.966] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwLockFile") returned 0x7ffd50576cb0 [0277.966] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnlockFile") returned 0x7ffd50578330 [0277.966] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwTerminateProcess") returned 0x7ffd505752c0 [0277.966] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenKey") returned 0x7ffd50574f80 [0277.966] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwEnumerateValueKey") returned 0x7ffd50574fa0 [0277.966] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryKey") returned 0x7ffd50575000 [0277.966] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryValueKey") returned 0x7ffd50575020 [0277.966] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateKey") returned 0x7ffd505750e0 [0277.966] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwEnumerateKey") returned 0x7ffd50575380 [0277.967] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetValueKey") returned 0x7ffd50575930 [0277.967] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeleteKey") returned 0x7ffd505765f0 [0277.967] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeleteValueKey") returned 0x7ffd50576650 [0277.967] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFlushKey") returned 0x7ffd50576890 [0277.967] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwLoadKey") returned 0x7ffd50576c50 [0277.967] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwLoadKey2") returned 0x7ffd50576c70 [0277.967] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwNotifyChangeKey") returned 0x7ffd50576e30 [0277.967] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryMultipleValueKey") returned 0x7ffd505774f0 [0277.967] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwReplaceKey") returned 0x7ffd505778d0 [0277.968] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwRestoreKey") returned 0x7ffd50577990 [0277.968] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSaveKey") returned 0x7ffd50577a70 [0277.968] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetInformationKey") returned 0x7ffd50577d10 [0277.968] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnloadKey") returned 0x7ffd505782d0 [0277.968] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwAccessCheck") returned 0x7ffd50574d40 [0277.968] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwExtendSection") returned 0x7ffd505767b0 [0277.968] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFlushBuffersFile") returned 0x7ffd505756a0 [0277.968] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFsControlFile") returned 0x7ffd50575460 [0277.968] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwNotifyChangeDirectoryFile") returned 0x7ffd50576e10 [0277.969] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQuerySecurityObject") returned 0x7ffd505775d0 [0277.969] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetSecurityObject") returned 0x7ffd50577ef0 [0277.969] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetVolumeInformationFile") returned 0x7ffd50578050 [0277.969] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenKeyEx") returned 0x7ffd50576f10 [0277.969] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateProcess") returned 0x7ffd505762f0 [0277.969] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateProcessEx") returned 0x7ffd505756e0 [0277.969] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateUserProcess") returned 0x7ffd50576490 [0277.969] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwResumeThread") returned 0x7ffd50575780 [0277.969] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateThread") returned 0x7ffd50575700 [0277.970] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryInformationProcess") returned 0x7ffd50575060 [0277.970] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryVirtualMemory") returned 0x7ffd505751a0 [0277.970] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeviceIoControlFile") returned 0x7ffd50574e20 [0277.970] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnmapViewOfSectionEx") returned 0x7ffd50578370 [0277.970] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryDirectoryFileEx") returned 0x0 [0277.970] VirtualFree (lpAddress=0x160000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0277.971] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0277.971] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwProtectVirtualMemory") returned 0x7ffd50575740 [0277.971] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0277.972] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwClose") returned 0x7ffd50574f20 [0277.972] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0277.972] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryInformationFile") returned 0x7ffd50574f60 [0277.972] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0277.972] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetInformationFile") returned 0x7ffd50575220 [0277.972] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0277.972] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFlushBuffersFile") returned 0x7ffd505756a0 [0277.972] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0277.973] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateFile") returned 0x7ffd505757e0 [0277.973] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0277.973] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwWriteFile") returned 0x7ffd50574e40 [0277.973] LoadLibraryA (lpLibFileName="SHFolder.dll") returned 0x7ffd45f80000 [0277.977] GetProcAddress (hModule=0x7ffd45f80000, lpProcName="SHGetFolderPathA") returned 0x7ffd45f81010 [0277.977] GetProcAddress (hModule=0x7ffd45f80000, lpProcName="SHGetFolderPathW") returned 0x7ffd45f819a0 [0277.977] GetTickCount () returned 0xb88b87 [0277.977] VirtualAlloc (lpAddress=0x0, dwSize=0x4, flAllocationType=0x1000, flProtect=0x1) returned 0x170000 [0277.977] GetTickCount () returned 0xb88b87 [0277.977] GetLastError () returned 0x7f [0277.978] SetLastError (dwErrCode=0x7f) [0277.981] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5ffb08, nSize=0x208 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe")) returned 0x3b [0277.981] GetLastError () returned 0x0 [0277.981] SetLastError (dwErrCode=0x0) [0277.981] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe\" " [0277.981] GetLastError () returned 0x0 [0277.981] SetLastError (dwErrCode=0x0) [0277.981] GetLastError () returned 0x0 [0277.981] SetLastError (dwErrCode=0x0) [0277.981] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0277.981] GetLastError () returned 0x0 [0277.981] SetLastError (dwErrCode=0x0) [0277.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", cchWideChar=59, lpMultiByteStr=0x8db188, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", lpUsedDefaultChar=0x0) returned 59 [0277.982] GetThreadLocale () returned 0x409 [0277.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Jan") returned 4 [0277.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jan", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.982] GetLastError () returned 0x0 [0277.982] SetLastError (dwErrCode=0x0) [0277.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jan", cchWideChar=3, lpMultiByteStr=0x8e3d38, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jan", lpUsedDefaultChar=0x0) returned 3 [0277.982] GetLastError () returned 0x0 [0277.982] SetLastError (dwErrCode=0x0) [0277.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x5ff988, cchData=512 | out: lpLCData="January") returned 8 [0277.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="January", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0277.982] GetLastError () returned 0x0 [0277.982] SetLastError (dwErrCode=0x0) [0277.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="January", cchWideChar=7, lpMultiByteStr=0x8e3038, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="January", lpUsedDefaultChar=0x0) returned 7 [0277.982] GetLastError () returned 0x0 [0277.982] SetLastError (dwErrCode=0x0) [0277.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Feb") returned 4 [0277.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Feb", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.982] GetLastError () returned 0x0 [0277.982] SetLastError (dwErrCode=0x0) [0277.982] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Feb", cchWideChar=3, lpMultiByteStr=0x8e3078, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Feb", lpUsedDefaultChar=0x0) returned 3 [0277.982] GetLastError () returned 0x0 [0277.983] SetLastError (dwErrCode=0x0) [0277.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x5ff988, cchData=512 | out: lpLCData="February") returned 9 [0277.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="February", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0277.983] GetLastError () returned 0x0 [0277.983] SetLastError (dwErrCode=0x0) [0277.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="February", cchWideChar=8, lpMultiByteStr=0x8e30b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="February", lpUsedDefaultChar=0x0) returned 8 [0277.983] GetLastError () returned 0x0 [0277.983] SetLastError (dwErrCode=0x0) [0277.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Mar") returned 4 [0277.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mar", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.983] GetLastError () returned 0x0 [0277.983] SetLastError (dwErrCode=0x0) [0277.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mar", cchWideChar=3, lpMultiByteStr=0x8e30f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mar", lpUsedDefaultChar=0x0) returned 3 [0277.983] GetLastError () returned 0x0 [0277.983] SetLastError (dwErrCode=0x0) [0277.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x5ff988, cchData=512 | out: lpLCData="March") returned 6 [0277.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="March", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0277.983] GetLastError () returned 0x0 [0277.983] SetLastError (dwErrCode=0x0) [0277.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="March", cchWideChar=5, lpMultiByteStr=0x8e3138, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="March", lpUsedDefaultChar=0x0) returned 5 [0277.983] GetLastError () returned 0x0 [0277.983] SetLastError (dwErrCode=0x0) [0277.983] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Apr") returned 4 [0277.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Apr", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.984] GetLastError () returned 0x0 [0277.984] SetLastError (dwErrCode=0x0) [0277.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Apr", cchWideChar=3, lpMultiByteStr=0x8e3178, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Apr", lpUsedDefaultChar=0x0) returned 3 [0277.984] GetLastError () returned 0x0 [0277.984] SetLastError (dwErrCode=0x0) [0277.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x5ff988, cchData=512 | out: lpLCData="April") returned 6 [0277.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="April", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0277.984] GetLastError () returned 0x0 [0277.984] SetLastError (dwErrCode=0x0) [0277.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="April", cchWideChar=5, lpMultiByteStr=0x8e31b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="April", lpUsedDefaultChar=0x0) returned 5 [0277.984] GetLastError () returned 0x0 [0277.984] SetLastError (dwErrCode=0x0) [0277.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x5ff988, cchData=512 | out: lpLCData="May") returned 4 [0277.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="May", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.984] GetLastError () returned 0x0 [0277.984] SetLastError (dwErrCode=0x0) [0277.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="May", cchWideChar=3, lpMultiByteStr=0x8e31f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 3 [0277.984] GetLastError () returned 0x0 [0277.984] SetLastError (dwErrCode=0x0) [0277.984] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x5ff988, cchData=512 | out: lpLCData="May") returned 4 [0277.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="May", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.984] GetLastError () returned 0x0 [0277.984] SetLastError (dwErrCode=0x0) [0277.984] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="May", cchWideChar=3, lpMultiByteStr=0x8e3238, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="May", lpUsedDefaultChar=0x0) returned 3 [0277.984] GetLastError () returned 0x0 [0277.985] SetLastError (dwErrCode=0x0) [0277.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Jun") returned 4 [0277.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jun", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.985] GetLastError () returned 0x0 [0277.985] SetLastError (dwErrCode=0x0) [0277.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jun", cchWideChar=3, lpMultiByteStr=0x8e3278, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jun", lpUsedDefaultChar=0x0) returned 3 [0277.985] GetLastError () returned 0x0 [0277.985] SetLastError (dwErrCode=0x0) [0277.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x5ff988, cchData=512 | out: lpLCData="June") returned 5 [0277.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="June", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0277.985] GetLastError () returned 0x0 [0277.985] SetLastError (dwErrCode=0x0) [0277.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="June", cchWideChar=4, lpMultiByteStr=0x8e32b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="June", lpUsedDefaultChar=0x0) returned 4 [0277.985] GetLastError () returned 0x0 [0277.985] SetLastError (dwErrCode=0x0) [0277.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Jul") returned 4 [0277.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jul", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.985] GetLastError () returned 0x0 [0277.985] SetLastError (dwErrCode=0x0) [0277.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Jul", cchWideChar=3, lpMultiByteStr=0x8e32f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Jul", lpUsedDefaultChar=0x0) returned 3 [0277.985] GetLastError () returned 0x0 [0277.985] SetLastError (dwErrCode=0x0) [0277.985] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x5ff988, cchData=512 | out: lpLCData="July") returned 5 [0277.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="July", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0277.985] GetLastError () returned 0x0 [0277.986] SetLastError (dwErrCode=0x0) [0277.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="July", cchWideChar=4, lpMultiByteStr=0x8e3338, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="July", lpUsedDefaultChar=0x0) returned 4 [0277.986] GetLastError () returned 0x0 [0277.986] SetLastError (dwErrCode=0x0) [0277.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Aug") returned 4 [0277.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Aug", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.986] GetLastError () returned 0x0 [0277.986] SetLastError (dwErrCode=0x0) [0277.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Aug", cchWideChar=3, lpMultiByteStr=0x8e3378, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Aug", lpUsedDefaultChar=0x0) returned 3 [0277.986] GetLastError () returned 0x0 [0277.986] SetLastError (dwErrCode=0x0) [0277.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x5ff988, cchData=512 | out: lpLCData="August") returned 7 [0277.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="August", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0277.986] GetLastError () returned 0x0 [0277.986] SetLastError (dwErrCode=0x0) [0277.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="August", cchWideChar=6, lpMultiByteStr=0x8e33b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="August", lpUsedDefaultChar=0x0) returned 6 [0277.986] GetLastError () returned 0x0 [0277.986] SetLastError (dwErrCode=0x0) [0277.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Sep") returned 4 [0277.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sep", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.986] GetLastError () returned 0x0 [0277.986] SetLastError (dwErrCode=0x0) [0277.986] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sep", cchWideChar=3, lpMultiByteStr=0x8e33f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sep", lpUsedDefaultChar=0x0) returned 3 [0277.986] GetLastError () returned 0x0 [0277.986] SetLastError (dwErrCode=0x0) [0277.986] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x5ff988, cchData=512 | out: lpLCData="September") returned 10 [0277.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="September", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0277.987] GetLastError () returned 0x0 [0277.987] SetLastError (dwErrCode=0x0) [0277.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="September", cchWideChar=9, lpMultiByteStr=0x8e3438, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="September", lpUsedDefaultChar=0x0) returned 9 [0277.987] GetLastError () returned 0x0 [0277.987] SetLastError (dwErrCode=0x0) [0277.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Oct") returned 4 [0277.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Oct", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.987] GetLastError () returned 0x0 [0277.987] SetLastError (dwErrCode=0x0) [0277.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Oct", cchWideChar=3, lpMultiByteStr=0x8e3478, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Oct", lpUsedDefaultChar=0x0) returned 3 [0277.987] GetLastError () returned 0x0 [0277.987] SetLastError (dwErrCode=0x0) [0277.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x5ff988, cchData=512 | out: lpLCData="October") returned 8 [0277.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="October", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0277.987] GetLastError () returned 0x0 [0277.987] SetLastError (dwErrCode=0x0) [0277.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="October", cchWideChar=7, lpMultiByteStr=0x8e34b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="October", lpUsedDefaultChar=0x0) returned 7 [0277.987] GetLastError () returned 0x0 [0277.987] SetLastError (dwErrCode=0x0) [0277.987] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Nov") returned 4 [0277.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nov", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.987] GetLastError () returned 0x0 [0277.987] SetLastError (dwErrCode=0x0) [0277.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Nov", cchWideChar=3, lpMultiByteStr=0x8e34f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nov", lpUsedDefaultChar=0x0) returned 3 [0277.988] GetLastError () returned 0x0 [0277.988] SetLastError (dwErrCode=0x0) [0277.988] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x5ff988, cchData=512 | out: lpLCData="November") returned 9 [0277.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="November", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0277.988] GetLastError () returned 0x0 [0277.988] SetLastError (dwErrCode=0x0) [0277.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="November", cchWideChar=8, lpMultiByteStr=0x8e3538, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="November", lpUsedDefaultChar=0x0) returned 8 [0277.988] GetLastError () returned 0x0 [0277.988] SetLastError (dwErrCode=0x0) [0277.988] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Dec") returned 4 [0277.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dec", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.988] GetLastError () returned 0x0 [0277.988] SetLastError (dwErrCode=0x0) [0277.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Dec", cchWideChar=3, lpMultiByteStr=0x8e3578, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dec", lpUsedDefaultChar=0x0) returned 3 [0277.988] GetLastError () returned 0x0 [0277.988] SetLastError (dwErrCode=0x0) [0277.988] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x5ff988, cchData=512 | out: lpLCData="December") returned 9 [0277.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="December", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0277.988] GetLastError () returned 0x0 [0277.988] SetLastError (dwErrCode=0x0) [0277.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="December", cchWideChar=8, lpMultiByteStr=0x8e35b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="December", lpUsedDefaultChar=0x0) returned 8 [0277.988] GetLastError () returned 0x0 [0277.988] SetLastError (dwErrCode=0x0) [0277.988] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Sun") returned 4 [0277.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sun", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.989] GetLastError () returned 0x0 [0277.989] SetLastError (dwErrCode=0x0) [0277.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sun", cchWideChar=3, lpMultiByteStr=0x8e35f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sun", lpUsedDefaultChar=0x0) returned 3 [0277.989] GetLastError () returned 0x0 [0277.989] SetLastError (dwErrCode=0x0) [0277.989] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Sunday") returned 7 [0277.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sunday", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0277.989] GetLastError () returned 0x0 [0277.989] SetLastError (dwErrCode=0x0) [0277.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sunday", cchWideChar=6, lpMultiByteStr=0x8e3638, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sunday", lpUsedDefaultChar=0x0) returned 6 [0277.989] GetLastError () returned 0x0 [0277.989] SetLastError (dwErrCode=0x0) [0277.989] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Mon") returned 4 [0277.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mon", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.989] GetLastError () returned 0x0 [0277.989] SetLastError (dwErrCode=0x0) [0277.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Mon", cchWideChar=3, lpMultiByteStr=0x8e3678, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Mon", lpUsedDefaultChar=0x0) returned 3 [0277.989] GetLastError () returned 0x0 [0277.989] SetLastError (dwErrCode=0x0) [0277.989] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Monday") returned 7 [0277.989] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Monday", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0277.990] GetLastError () returned 0x0 [0277.990] SetLastError (dwErrCode=0x0) [0277.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Monday", cchWideChar=6, lpMultiByteStr=0x8e36b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Monday", lpUsedDefaultChar=0x0) returned 6 [0277.990] GetLastError () returned 0x0 [0277.990] SetLastError (dwErrCode=0x0) [0277.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Tue") returned 4 [0277.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tue", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.990] GetLastError () returned 0x0 [0277.990] SetLastError (dwErrCode=0x0) [0277.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tue", cchWideChar=3, lpMultiByteStr=0x8e36f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tue", lpUsedDefaultChar=0x0) returned 3 [0277.990] GetLastError () returned 0x0 [0277.990] SetLastError (dwErrCode=0x0) [0277.990] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Tuesday") returned 8 [0277.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tuesday", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0277.990] GetLastError () returned 0x0 [0277.990] SetLastError (dwErrCode=0x0) [0277.990] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tuesday", cchWideChar=7, lpMultiByteStr=0x8e3738, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tuesday", lpUsedDefaultChar=0x0) returned 7 [0277.990] GetLastError () returned 0x0 [0277.991] SetLastError (dwErrCode=0x0) [0277.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Wed") returned 4 [0277.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wed", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.991] GetLastError () returned 0x0 [0277.991] SetLastError (dwErrCode=0x0) [0277.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wed", cchWideChar=3, lpMultiByteStr=0x8e3778, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wed", lpUsedDefaultChar=0x0) returned 3 [0277.991] GetLastError () returned 0x0 [0277.991] SetLastError (dwErrCode=0x0) [0277.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Wednesday") returned 10 [0277.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wednesday", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0277.991] GetLastError () returned 0x0 [0277.991] SetLastError (dwErrCode=0x0) [0277.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Wednesday", cchWideChar=9, lpMultiByteStr=0x8e37b8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wednesday", lpUsedDefaultChar=0x0) returned 9 [0277.991] GetLastError () returned 0x0 [0277.991] SetLastError (dwErrCode=0x0) [0277.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Thu") returned 4 [0277.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thu", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.991] GetLastError () returned 0x0 [0277.991] SetLastError (dwErrCode=0x0) [0277.991] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thu", cchWideChar=3, lpMultiByteStr=0x8e37f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thu", lpUsedDefaultChar=0x0) returned 3 [0277.991] GetLastError () returned 0x0 [0277.991] SetLastError (dwErrCode=0x0) [0277.991] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Thursday") returned 9 [0277.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thursday", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0277.992] GetLastError () returned 0x0 [0277.992] SetLastError (dwErrCode=0x0) [0277.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Thursday", cchWideChar=8, lpMultiByteStr=0x8e3838, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thursday", lpUsedDefaultChar=0x0) returned 8 [0277.992] GetLastError () returned 0x0 [0277.992] SetLastError (dwErrCode=0x0) [0277.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Fri") returned 4 [0277.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fri", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.992] GetLastError () returned 0x0 [0277.992] SetLastError (dwErrCode=0x0) [0277.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Fri", cchWideChar=3, lpMultiByteStr=0x8e3878, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fri", lpUsedDefaultChar=0x0) returned 3 [0277.992] GetLastError () returned 0x0 [0277.992] SetLastError (dwErrCode=0x0) [0277.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Friday") returned 7 [0277.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Friday", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0277.992] GetLastError () returned 0x0 [0277.992] SetLastError (dwErrCode=0x0) [0277.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Friday", cchWideChar=6, lpMultiByteStr=0x8e38b8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Friday", lpUsedDefaultChar=0x0) returned 6 [0277.992] GetLastError () returned 0x0 [0277.992] SetLastError (dwErrCode=0x0) [0277.992] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Sat") returned 4 [0277.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sat", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0277.992] GetLastError () returned 0x0 [0277.992] SetLastError (dwErrCode=0x0) [0277.992] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Sat", cchWideChar=3, lpMultiByteStr=0x8e38f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Sat", lpUsedDefaultChar=0x0) returned 3 [0277.992] GetLastError () returned 0x0 [0277.992] SetLastError (dwErrCode=0x0) [0277.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x5ff988, cchData=512 | out: lpLCData="Saturday") returned 9 [0277.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Saturday", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0277.993] GetLastError () returned 0x0 [0277.993] SetLastError (dwErrCode=0x0) [0277.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Saturday", cchWideChar=8, lpMultiByteStr=0x8e3938, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Saturday", lpUsedDefaultChar=0x0) returned 8 [0277.993] GetLastError () returned 0x0 [0277.993] SetLastError (dwErrCode=0x0) [0277.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x5ffb88, cchData=4 | out: lpLCData="/") returned 2 [0277.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/_", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0277.993] GetLastError () returned 0x0 [0277.993] SetLastError (dwErrCode=0x0) [0277.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="/_", cchWideChar=1, lpMultiByteStr=0x8e3978, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="/", lpUsedDefaultChar=0x0) returned 1 [0277.993] GetLastError () returned 0x0 [0277.993] SetLastError (dwErrCode=0x0) [0277.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x5ff988, cchData=512 | out: lpLCData="M/d/yyyy") returned 9 [0277.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M/d/yyyy", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0277.993] GetLastError () returned 0x0 [0277.993] SetLastError (dwErrCode=0x0) [0277.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="M/d/yyyy", cchWideChar=8, lpMultiByteStr=0x8e3978, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M/d/yyyy", lpUsedDefaultChar=0x0) returned 8 [0277.993] GetLastError () returned 0x0 [0277.993] SetLastError (dwErrCode=0x0) [0277.993] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x5ff988, cchData=512 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0277.993] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dddd, MMMM d, yyyy", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0277.994] GetLastError () returned 0x0 [0277.994] SetLastError (dwErrCode=0x0) [0277.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="dddd, MMMM d, yyyy", cchWideChar=18, lpMultiByteStr=0x8e39b8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dddd, MMMM d, yyyy", lpUsedDefaultChar=0x0) returned 18 [0277.994] GetLastError () returned 0x0 [0277.994] SetLastError (dwErrCode=0x0) [0277.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x5ffb88, cchData=4 | out: lpLCData=":") returned 2 [0277.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":_", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0277.994] GetLastError () returned 0x0 [0277.994] SetLastError (dwErrCode=0x0) [0277.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=":_", cchWideChar=1, lpMultiByteStr=0x8e39f8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=":", lpUsedDefaultChar=0x0) returned 1 [0277.994] GetLastError () returned 0x0 [0277.994] SetLastError (dwErrCode=0x0) [0277.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x5ff988, cchData=512 | out: lpLCData="AM") returned 3 [0277.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AM", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0277.994] GetLastError () returned 0x0 [0277.994] SetLastError (dwErrCode=0x0) [0277.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AM", cchWideChar=2, lpMultiByteStr=0x8e39f8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AM", lpUsedDefaultChar=0x0) returned 2 [0277.994] GetLastError () returned 0x0 [0277.994] SetLastError (dwErrCode=0x0) [0277.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x5ff988, cchData=512 | out: lpLCData="PM") returned 3 [0277.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PM", cchWideChar=2, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2 [0277.994] GetLastError () returned 0x0 [0277.994] SetLastError (dwErrCode=0x0) [0277.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PM", cchWideChar=2, lpMultiByteStr=0x8e3a38, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PM", lpUsedDefaultChar=0x0) returned 2 [0277.994] GetLastError () returned 0x0 [0277.994] SetLastError (dwErrCode=0x0) [0277.994] GetLocaleInfoW (in: Locale=0x409, LCType=0x25, lpLCData=0x5ff988, cchData=512 | out: lpLCData="0") returned 2 [0277.994] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0277.994] GetLastError () returned 0x0 [0277.995] SetLastError (dwErrCode=0x0) [0277.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x8e3a78, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0", lpUsedDefaultChar=0x0) returned 1 [0277.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x5ff988, cchData=512 | out: lpLCData="$") returned 2 [0277.995] GetLastError () returned 0x0 [0277.995] SetLastError (dwErrCode=0x0) [0277.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0277.995] GetLastError () returned 0x0 [0277.995] SetLastError (dwErrCode=0x0) [0277.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="$", cchWideChar=1, lpMultiByteStr=0x8e3a78, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="$", lpUsedDefaultChar=0x0) returned 1 [0277.995] GetLastError () returned 0x0 [0277.995] SetLastError (dwErrCode=0x0) [0277.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x1b, lpLCData=0x5ff988, cchData=512 | out: lpLCData="0") returned 2 [0277.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0277.995] GetLastError () returned 0x0 [0277.995] SetLastError (dwErrCode=0x0) [0277.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x8e3ab8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0", lpUsedDefaultChar=0x0) returned 1 [0277.995] GetLocaleInfoW (in: Locale=0x409, LCType=0x1c, lpLCData=0x5ff988, cchData=512 | out: lpLCData="0") returned 2 [0277.995] GetLastError () returned 0x0 [0277.995] SetLastError (dwErrCode=0x0) [0277.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0277.995] GetLastError () returned 0x0 [0277.995] SetLastError (dwErrCode=0x0) [0277.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x8e3ab8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0", lpUsedDefaultChar=0x0) returned 1 [0277.995] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x5ffb88, cchData=4 | out: lpLCData=",") returned 2 [0277.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",_", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0277.995] GetLastError () returned 0x0 [0277.996] SetLastError (dwErrCode=0x0) [0277.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",_", cchWideChar=1, lpMultiByteStr=0x8e3d78, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 1 [0277.996] GetLastError () returned 0x0 [0277.996] SetLastError (dwErrCode=0x0) [0277.996] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x5ffb88, cchData=4 | out: lpLCData=".") returned 2 [0277.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="._", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0277.996] GetLastError () returned 0x0 [0277.996] SetLastError (dwErrCode=0x0) [0277.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="._", cchWideChar=1, lpMultiByteStr=0x8e3d78, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".", lpUsedDefaultChar=0x0) returned 1 [0277.996] GetLastError () returned 0x0 [0277.996] SetLastError (dwErrCode=0x0) [0277.996] GetLocaleInfoW (in: Locale=0x409, LCType=0x19, lpLCData=0x5ff988, cchData=512 | out: lpLCData="2") returned 2 [0277.996] GetLastError () returned 0x0 [0277.996] SetLastError (dwErrCode=0x0) [0277.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0277.996] GetLastError () returned 0x0 [0277.996] SetLastError (dwErrCode=0x0) [0277.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x8e3ab8, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2", lpUsedDefaultChar=0x0) returned 1 [0277.996] GetLocaleInfoW (in: Locale=0x409, LCType=0xc, lpLCData=0x5ffb88, cchData=4 | out: lpLCData=",") returned 2 [0277.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",_", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0277.996] GetLastError () returned 0x0 [0277.996] SetLastError (dwErrCode=0x0) [0277.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr=",_", cchWideChar=1, lpMultiByteStr=0x8e3d78, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=",", lpUsedDefaultChar=0x0) returned 1 [0277.996] GetLastError () returned 0x0 [0277.996] SetLastError (dwErrCode=0x0) [0277.996] GetLastError () returned 0x0 [0277.997] SetLastError (dwErrCode=0x0) [0277.997] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x7ffd40ab0000 [0277.997] GetProcAddress (hModule=0x7ffd40ab0000, lpProcName="TaskDialogIndirect") returned 0x0 [0277.997] GetProcAddress (hModule=0x7ffd40ab0000, lpProcName="TaskDialog") returned 0x0 [0277.997] GetLastError () returned 0x7f [0277.997] SetLastError (dwErrCode=0x7f) [0277.997] GetLastError () returned 0x7f [0277.997] SetLastError (dwErrCode=0x7f) [0277.997] GetLastError () returned 0x7f [0277.997] SetLastError (dwErrCode=0x7f) [0277.997] GetLastError () returned 0x7f [0277.997] SetLastError (dwErrCode=0x7f) [0277.997] GetLastError () returned 0x7f [0278.001] SetLastError (dwErrCode=0x7f) [0278.001] GetLastError () returned 0x7f [0278.001] SetLastError (dwErrCode=0x7f) [0278.001] GetLastError () returned 0x7f [0278.001] SetLastError (dwErrCode=0x7f) [0278.001] GetModuleHandleA (lpModuleName="kernel32") returned 0x7ffd4e1c0000 [0278.002] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetDiskFreeSpaceExA") returned 0x7ffd4e1ed9f0 [0278.002] GetLastError () returned 0x7f [0278.002] SetLastError (dwErrCode=0x7f) [0278.002] GetLastError () returned 0x7f [0278.002] SetLastError (dwErrCode=0x7f) [0278.002] GetLastError () returned 0x7f [0278.002] SetLastError (dwErrCode=0x7f) [0278.002] GetLastError () returned 0x7f [0278.002] SetLastError (dwErrCode=0x7f) [0278.002] GetLastError () returned 0x7f [0278.002] SetLastError (dwErrCode=0x7f) [0278.002] GetLastError () returned 0x7f [0278.002] SetLastError (dwErrCode=0x7f) [0278.002] GetLastError () returned 0x7f [0278.002] SetLastError (dwErrCode=0x7f) [0278.002] GetLastError () returned 0x7f [0278.002] SetLastError (dwErrCode=0x7f) [0278.002] GetLastError () returned 0x7f [0278.002] SetLastError (dwErrCode=0x7f) [0278.002] GetLastError () returned 0x7f [0278.002] SetLastError (dwErrCode=0x7f) [0278.002] GetLastError () returned 0x7f [0278.003] SetLastError (dwErrCode=0x7f) [0278.003] GetLastError () returned 0x7f [0278.003] SetLastError (dwErrCode=0x7f) [0278.003] GetLastError () returned 0x7f [0278.003] SetLastError (dwErrCode=0x7f) [0278.003] GetLastError () returned 0x7f [0278.003] SetLastError (dwErrCode=0x7f) [0278.003] GetLastError () returned 0x7f [0278.003] SetLastError (dwErrCode=0x7f) [0278.003] GetLastError () returned 0x7f [0278.003] SetLastError (dwErrCode=0x7f) [0278.003] GetLastError () returned 0x7f [0278.003] SetLastError (dwErrCode=0x7f) [0278.003] GetLastError () returned 0x7f [0278.003] SetLastError (dwErrCode=0x7f) [0278.003] GetLastError () returned 0x7f [0278.003] SetLastError (dwErrCode=0x7f) [0278.003] GetLastError () returned 0x7f [0278.004] SetLastError (dwErrCode=0x7f) [0278.004] GetLastError () returned 0x7f [0278.004] SetLastError (dwErrCode=0x7f) [0278.004] GetLastError () returned 0x7f [0278.004] SetLastError (dwErrCode=0x7f) [0278.004] GetLastError () returned 0x7f [0278.004] SetLastError (dwErrCode=0x7f) [0278.004] GetLastError () returned 0x7f [0278.004] SetLastError (dwErrCode=0x7f) [0278.004] GetLastError () returned 0x7f [0278.004] SetLastError (dwErrCode=0x7f) [0278.004] GetLastError () returned 0x7f [0278.004] SetLastError (dwErrCode=0x7f) [0278.004] GetLastError () returned 0x7f [0278.004] SetLastError (dwErrCode=0x7f) [0278.004] GetLastError () returned 0x7f [0278.004] SetLastError (dwErrCode=0x7f) [0278.004] GetLastError () returned 0x7f [0278.004] SetLastError (dwErrCode=0x7f) [0278.004] GetLastError () returned 0x7f [0278.004] SetLastError (dwErrCode=0x7f) [0278.004] GetLastError () returned 0x7f [0278.005] SetLastError (dwErrCode=0x7f) [0278.005] GetLastError () returned 0x7f [0278.005] SetLastError (dwErrCode=0x7f) [0278.005] GetLastError () returned 0x7f [0278.005] SetLastError (dwErrCode=0x7f) [0278.005] GetLastError () returned 0x7f [0278.005] SetLastError (dwErrCode=0x7f) [0278.005] GetLastError () returned 0x7f [0278.005] SetLastError (dwErrCode=0x7f) [0278.005] GetLastError () returned 0x7f [0278.005] SetLastError (dwErrCode=0x7f) [0278.005] GetLastError () returned 0x7f [0278.005] SetLastError (dwErrCode=0x7f) [0278.005] GetLastError () returned 0x7f [0278.005] SetLastError (dwErrCode=0x7f) [0278.005] GetLastError () returned 0x7f [0278.005] SetLastError (dwErrCode=0x7f) [0278.005] GetLastError () returned 0x7f [0278.005] SetLastError (dwErrCode=0x7f) [0278.005] GetLastError () returned 0x7f [0278.005] SetLastError (dwErrCode=0x7f) [0278.005] GetLastError () returned 0x7f [0278.005] SetLastError (dwErrCode=0x7f) [0278.005] GetLastError () returned 0x7f [0278.006] SetLastError (dwErrCode=0x7f) [0278.006] GetLastError () returned 0x7f [0278.006] SetLastError (dwErrCode=0x7f) [0278.006] GetLastError () returned 0x7f [0278.006] SetLastError (dwErrCode=0x7f) [0278.006] GetLastError () returned 0x7f [0278.006] SetLastError (dwErrCode=0x7f) [0278.006] GetLastError () returned 0x7f [0278.006] SetLastError (dwErrCode=0x7f) [0278.006] GetLastError () returned 0x7f [0278.006] SetLastError (dwErrCode=0x7f) [0278.006] GetLastError () returned 0x7f [0278.006] SetLastError (dwErrCode=0x7f) [0278.006] GetLastError () returned 0x7f [0278.006] SetLastError (dwErrCode=0x7f) [0278.006] GetProcessHeap () returned 0x710000 [0278.006] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x6cabc0 [0278.007] GetLastError () returned 0x7f [0278.008] SetLastError (dwErrCode=0x7f) [0278.008] GetLastError () returned 0x7f [0278.008] SetLastError (dwErrCode=0x7f) [0278.008] GetLastError () returned 0x7f [0278.008] SetLastError (dwErrCode=0x7f) [0278.008] GetLastError () returned 0x7f [0278.008] SetLastError (dwErrCode=0x7f) [0278.008] GetLastError () returned 0x7f [0278.008] SetLastError (dwErrCode=0x7f) [0278.008] GetLastError () returned 0x7f [0278.008] SetLastError (dwErrCode=0x7f) [0278.008] GetLastError () returned 0x7f [0278.008] SetLastError (dwErrCode=0x7f) [0278.008] GetLastError () returned 0x7f [0278.008] SetLastError (dwErrCode=0x7f) [0278.008] GetLastError () returned 0x7f [0278.008] SetLastError (dwErrCode=0x7f) [0278.008] GetLastError () returned 0x7f [0278.008] SetLastError (dwErrCode=0x7f) [0278.008] GetLastError () returned 0x7f [0278.008] SetLastError (dwErrCode=0x7f) [0278.009] GetLastError () returned 0x7f [0278.009] SetLastError (dwErrCode=0x7f) [0278.009] GetLastError () returned 0x7f [0278.009] SetLastError (dwErrCode=0x7f) [0278.009] GetLastError () returned 0x7f [0278.009] SetLastError (dwErrCode=0x7f) [0278.009] GetLastError () returned 0x7f [0278.009] SetLastError (dwErrCode=0x7f) [0278.009] GetLastError () returned 0x7f [0278.009] SetLastError (dwErrCode=0x7f) [0278.009] GetLastError () returned 0x7f [0278.009] SetLastError (dwErrCode=0x7f) [0278.009] GetLastError () returned 0x7f [0278.009] SetLastError (dwErrCode=0x7f) [0278.010] GetLastError () returned 0x7f [0278.010] SetLastError (dwErrCode=0x7f) [0278.010] GetLastError () returned 0x7f [0278.010] SetLastError (dwErrCode=0x7f) [0278.010] GetLastError () returned 0x7f [0278.010] SetLastError (dwErrCode=0x7f) [0278.010] GetLastError () returned 0x7f [0278.010] SetLastError (dwErrCode=0x7f) [0278.010] GetLastError () returned 0x7f [0278.010] SetLastError (dwErrCode=0x7f) [0278.010] GetLastError () returned 0x7f [0278.010] SetLastError (dwErrCode=0x7f) [0278.010] GetLastError () returned 0x7f [0278.010] SetLastError (dwErrCode=0x7f) [0278.010] GetLastError () returned 0x7f [0278.010] SetLastError (dwErrCode=0x7f) [0278.010] GetLastError () returned 0x7f [0278.010] SetLastError (dwErrCode=0x7f) [0278.010] GetLastError () returned 0x7f [0278.010] SetLastError (dwErrCode=0x7f) [0278.010] GetLastError () returned 0x7f [0278.010] SetLastError (dwErrCode=0x7f) [0278.011] GetLastError () returned 0x7f [0278.011] SetLastError (dwErrCode=0x7f) [0278.011] GetLastError () returned 0x7f [0278.011] SetLastError (dwErrCode=0x7f) [0278.011] GetLastError () returned 0x7f [0278.011] SetLastError (dwErrCode=0x7f) [0278.011] GetLastError () returned 0x7f [0278.011] SetLastError (dwErrCode=0x7f) [0278.011] GetLastError () returned 0x7f [0278.011] SetLastError (dwErrCode=0x7f) [0278.011] GetLastError () returned 0x7f [0278.011] SetLastError (dwErrCode=0x7f) [0278.011] GetLastError () returned 0x7f [0278.011] SetLastError (dwErrCode=0x7f) [0278.011] GetLastError () returned 0x7f [0278.011] SetLastError (dwErrCode=0x7f) [0278.012] GetLastError () returned 0x7f [0278.012] SetLastError (dwErrCode=0x7f) [0278.012] GetLastError () returned 0x7f [0278.012] SetLastError (dwErrCode=0x7f) [0278.012] GetLastError () returned 0x7f [0278.012] SetLastError (dwErrCode=0x7f) [0278.012] GetLastError () returned 0x7f [0278.012] SetLastError (dwErrCode=0x7f) [0278.012] GetLastError () returned 0x7f [0278.012] SetLastError (dwErrCode=0x7f) [0278.013] GetLastError () returned 0x7f [0278.013] SetLastError (dwErrCode=0x7f) [0278.013] GetLastError () returned 0x7f [0278.013] SetLastError (dwErrCode=0x7f) [0278.013] GetLastError () returned 0x7f [0278.013] SetLastError (dwErrCode=0x7f) [0278.013] GetLastError () returned 0x7f [0278.013] SetLastError (dwErrCode=0x7f) [0278.013] GetLastError () returned 0x7f [0278.013] SetLastError (dwErrCode=0x7f) [0278.013] GetLastError () returned 0x7f [0278.013] SetLastError (dwErrCode=0x7f) [0278.013] GetLastError () returned 0x7f [0278.013] SetLastError (dwErrCode=0x7f) [0278.013] GetLastError () returned 0x7f [0278.013] SetLastError (dwErrCode=0x7f) [0278.013] GetLastError () returned 0x7f [0278.013] SetLastError (dwErrCode=0x7f) [0278.013] GetLastError () returned 0x7f [0278.013] SetLastError (dwErrCode=0x7f) [0278.013] GetLastError () returned 0x7f [0278.013] SetLastError (dwErrCode=0x7f) [0278.013] GetLastError () returned 0x7f [0278.014] SetLastError (dwErrCode=0x7f) [0278.014] GetLastError () returned 0x7f [0278.014] SetLastError (dwErrCode=0x7f) [0278.014] GetLastError () returned 0x7f [0278.014] SetLastError (dwErrCode=0x7f) [0278.014] GetLastError () returned 0x7f [0278.014] SetLastError (dwErrCode=0x7f) [0278.014] GetLastError () returned 0x7f [0278.014] SetLastError (dwErrCode=0x7f) [0278.014] GetLastError () returned 0x7f [0278.014] SetLastError (dwErrCode=0x7f) [0278.014] GetLastError () returned 0x7f [0278.014] SetLastError (dwErrCode=0x7f) [0278.014] GetLastError () returned 0x7f [0278.014] SetLastError (dwErrCode=0x7f) [0278.014] GetProcessHeap () returned 0x710000 [0278.014] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x6d2bd0 [0278.015] GetLastError () returned 0x7f [0278.015] SetLastError (dwErrCode=0x7f) [0278.015] GetLastError () returned 0x7f [0278.015] SetLastError (dwErrCode=0x7f) [0278.015] GetLastError () returned 0x7f [0278.015] SetLastError (dwErrCode=0x7f) [0278.015] GetLastError () returned 0x7f [0278.015] SetLastError (dwErrCode=0x7f) [0278.015] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.016] SetLastError (dwErrCode=0x7f) [0278.016] GetLastError () returned 0x7f [0278.017] SetLastError (dwErrCode=0x7f) [0278.017] GetLastError () returned 0x7f [0278.017] SetLastError (dwErrCode=0x7f) [0278.017] GetLastError () returned 0x7f [0278.017] SetLastError (dwErrCode=0x7f) [0278.017] GetVersionExA (in: lpVersionInformation=0x5ffcd8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x8e4ce0, dwBuildNumber=0x0, dwPlatformId=0x10, szCSDVersion="") | out: lpVersionInformation=0x5ffcd8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0278.017] GetModuleHandleA (lpModuleName="comctl32.dll") returned 0x7ffd40ab0000 [0278.017] GetProcAddress (hModule=0x7ffd40ab0000, lpProcName="TaskDialogIndirect") returned 0x0 [0278.017] GetLastError () returned 0x7f [0278.017] SetLastError (dwErrCode=0x7f) [0278.017] GetLastError () returned 0x7f [0278.017] SetLastError (dwErrCode=0x7f) [0278.018] GetFileVersionInfoSizeA (in: lptstrFilename="comctl32.dll", lpdwHandle=0x5ff0b8 | out: lpdwHandle=0x5ff0b8) returned 0x71c [0278.024] GetFileVersionInfoA (in: lptstrFilename="comctl32.dll", dwHandle=0x0, dwLen=0x71c, lpData=0x5ff0e0 | out: lpData=0x5ff0e0) returned 1 [0278.024] VerQueryValueA (in: pBlock=0x5ff0e0, lpSubBlock="\\", lplpBuffer=0x5ff0b0, puLen=0x5ff0c8 | out: lplpBuffer=0x5ff0b0*=0x5ff108, puLen=0x5ff0c8) returned 1 [0278.025] LoadLibraryA (lpLibFileName="msimg32.dll") returned 0x7ffd31cc0000 [0278.028] GetProcAddress (hModule=0x7ffd31cc0000, lpProcName="AlphaBlend") returned 0x7ffd31cc1090 [0278.028] GetProcAddress (hModule=0x7ffd31cc0000, lpProcName="GradientFill") returned 0x7ffd31cc1010 [0278.028] LoadLibraryA (lpLibFileName="user32.dll") returned 0x7ffd4e9d0000 [0278.028] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetComboBoxInfo") returned 0x7ffd4ea08f20 [0278.028] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetMenuBarInfo") returned 0x7ffd4ea036a0 [0278.028] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="GetWindowInfo") returned 0x7ffd4e9e31e0 [0278.028] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetLayeredWindowAttributes") returned 0x7ffd4ea0a440 [0278.028] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="UpdateLayeredWindow") returned 0x7ffd4e9f9800 [0278.028] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="IsProcessDPIAware") returned 0x7ffd4e9f2120 [0278.029] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x7ffd4eb30000 [0278.029] GetProcAddress (hModule=0x7ffd4eb30000, lpProcName="SHGetStockIconInfo") returned 0x7ffd4ec41ad0 [0278.029] GetProcAddress (hModule=0x7ffd4eb30000, lpProcName="SHCreateItemFromParsingName") returned 0x7ffd4ec07880 [0278.029] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x7ffd4d8d0000 [0278.029] GetProcAddress (hModule=0x7ffd4d8d0000, lpProcName="SetLayout") returned 0x7ffd4d8f5c90 [0278.029] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x7ffd40ab0000 [0278.029] GetProcAddress (hModule=0x7ffd40ab0000, lpProcName="TaskDialogIndirect") returned 0x0 [0278.029] GetProcAddress (hModule=0x7ffd40ab0000, lpProcName="TaskDialog") returned 0x0 [0278.030] GlobalAddAtomA (lpString="WindowInfo") returned 0xc171 [0278.030] GetLastError () returned 0x7f [0278.030] SetLastError (dwErrCode=0x7f) [0278.030] GetLastError () returned 0x7f [0278.030] SetLastError (dwErrCode=0x7f) [0278.030] GetLastError () returned 0x7f [0278.030] SetLastError (dwErrCode=0x7f) [0278.030] GetLastError () returned 0x7f [0278.030] SetLastError (dwErrCode=0x7f) [0278.030] GetLastError () returned 0x7f [0278.030] SetLastError (dwErrCode=0x7f) [0278.030] GetLastError () returned 0x7f [0278.030] SetLastError (dwErrCode=0x7f) [0278.031] GetLastError () returned 0x7f [0278.031] SetLastError (dwErrCode=0x7f) [0278.032] GetLastError () returned 0x7f [0278.032] SetLastError (dwErrCode=0x7f) [0278.032] GetLastError () returned 0x7f [0278.032] SetLastError (dwErrCode=0x7f) [0278.032] GetLastError () returned 0x7f [0278.032] SetLastError (dwErrCode=0x7f) [0278.032] GetLastError () returned 0x7f [0278.032] SetLastError (dwErrCode=0x7f) [0278.032] GetLastError () returned 0x7f [0278.032] SetLastError (dwErrCode=0x7f) [0278.032] GetLastError () returned 0x7f [0278.032] SetLastError (dwErrCode=0x7f) [0278.032] GetLastError () returned 0x7f [0278.032] SetLastError (dwErrCode=0x7f) [0278.032] GetLastError () returned 0x7f [0278.032] SetLastError (dwErrCode=0x7f) [0278.032] GetLastError () returned 0x7f [0278.032] SetLastError (dwErrCode=0x7f) [0278.032] GetLastError () returned 0x7f [0278.032] SetLastError (dwErrCode=0x7f) [0278.033] GetLastError () returned 0x7f [0278.033] SetLastError (dwErrCode=0x7f) [0278.033] GetLastError () returned 0x7f [0278.033] SetLastError (dwErrCode=0x7f) [0278.033] GetLastError () returned 0x7f [0278.033] SetLastError (dwErrCode=0x7f) [0278.033] GetLastError () returned 0x7f [0278.033] SetLastError (dwErrCode=0x7f) [0278.033] GetProcessHeap () returned 0x710000 [0278.033] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x6dabe0 [0278.034] GetLastError () returned 0x7f [0278.034] SetLastError (dwErrCode=0x7f) [0278.034] GetProcessHeap () returned 0x710000 [0278.035] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x6e2bf0 [0278.035] LoadLibraryA (lpLibFileName="uxtheme.dll") returned 0x7ffd4b470000 [0278.036] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="OpenThemeData") returned 0x7ffd4b481a90 [0278.036] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="CloseThemeData") returned 0x7ffd4b483ff0 [0278.036] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeBackground") returned 0x7ffd4b47f870 [0278.036] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeText") returned 0x7ffd4b4742d0 [0278.036] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeBackgroundContentRect") returned 0x7ffd4b47e280 [0278.036] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeBackgroundExtent") returned 0x7ffd4b47d840 [0278.036] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemePartSize") returned 0x7ffd4b47e590 [0278.036] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeTextExtent") returned 0x7ffd4b47a390 [0278.036] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeTextMetrics") returned 0x7ffd4b4745b0 [0278.036] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeBackgroundRegion") returned 0x7ffd4b475c30 [0278.036] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="HitTestThemeBackground") returned 0x7ffd4b490c60 [0278.037] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeEdge") returned 0x7ffd4b472e90 [0278.037] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeIcon") returned 0x7ffd4b4b9c10 [0278.037] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="IsThemePartDefined") returned 0x7ffd4b483ee0 [0278.037] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="IsThemeBackgroundPartiallyTransparent") returned 0x7ffd4b477860 [0278.037] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeColor") returned 0x7ffd4b47a960 [0278.037] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeMetric") returned 0x7ffd4b474230 [0278.037] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeString") returned 0x7ffd4b4baa70 [0278.037] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeBool") returned 0x7ffd4b47d300 [0278.037] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeInt") returned 0x7ffd4b47a960 [0278.037] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeEnumValue") returned 0x7ffd4b47a2f0 [0278.037] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemePosition") returned 0x7ffd4b475b90 [0278.038] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeFont") returned 0x7ffd4b47aa00 [0278.038] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeRect") returned 0x7ffd4b4936c0 [0278.038] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeMargins") returned 0x7ffd4b47da60 [0278.038] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeIntList") returned 0x7ffd4b4ba8c0 [0278.038] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemePropertyOrigin") returned 0x7ffd4b4ba9c0 [0278.038] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="SetWindowTheme") returned 0x7ffd4b473b50 [0278.038] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeFilename") returned 0x7ffd4b4ba7f0 [0278.038] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysColor") returned 0x7ffd4b4babf0 [0278.038] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysColorBrush") returned 0x7ffd4b4bacc0 [0278.039] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysBool") returned 0x7ffd4b4bab30 [0278.039] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysSize") returned 0x7ffd4b4bb120 [0278.039] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysFont") returned 0x7ffd4b4bad90 [0278.039] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysString") returned 0x7ffd4b4bb1e0 [0278.039] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeSysInt") returned 0x7ffd4b4bb080 [0278.039] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="IsThemeActive") returned 0x7ffd4b473730 [0278.039] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="IsAppThemed") returned 0x7ffd4b473700 [0278.039] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetWindowTheme") returned 0x7ffd4b475350 [0278.039] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="EnableThemeDialogTexture") returned 0x7ffd4b4744f0 [0278.039] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="IsThemeDialogTextureEnabled") returned 0x7ffd4b4bb3d0 [0278.039] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeAppProperties") returned 0x7ffd4b475680 [0278.039] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="SetThemeAppProperties") returned 0x7ffd4b4bb8b0 [0278.040] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetCurrentThemeName") returned 0x7ffd4b476f80 [0278.040] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeDocumentationProperty") returned 0x7ffd4b4ba730 [0278.040] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeParentBackground") returned 0x7ffd4b473270 [0278.040] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="EnableTheming") returned 0x7ffd4b4b9f80 [0278.040] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="OpenThemeDataEx") returned 0x7ffd4b4bb440 [0278.040] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeBackgroundEx") returned 0x7ffd4b473db0 [0278.040] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeParentBackgroundEx") returned 0x7ffd4b473290 [0278.040] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="SetWindowThemeAttribute") returned 0x7ffd4b476970 [0278.040] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="DrawThemeTextEx") returned 0x7ffd4b481910 [0278.040] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeBitmap") returned 0x7ffd4b477ab0 [0278.040] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeStream") returned 0x7ffd4b493600 [0278.041] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BufferedPaintInit") returned 0x7ffd4b476f40 [0278.041] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BufferedPaintUnInit") returned 0x7ffd4b476e20 [0278.041] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BeginBufferedPaint") returned 0x7ffd4b47d190 [0278.041] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="EndBufferedPaint") returned 0x7ffd4b47af10 [0278.041] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetBufferedPaintTargetRect") returned 0x7ffd4b4ba500 [0278.041] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetBufferedPaintTargetDC") returned 0x7ffd4b478090 [0278.041] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetBufferedPaintDC") returned 0x7ffd4b478110 [0278.041] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetBufferedPaintBits") returned 0x7ffd4b47ad70 [0278.041] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BufferedPaintClear") returned 0x7ffd4b47ae50 [0278.041] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BufferedPaintSetAlpha") returned 0x7ffd4b478190 [0278.041] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BufferedPaintStopAllAnimations") returned 0x7ffd4b475de0 [0278.042] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BeginBufferedAnimation") returned 0x7ffd4b48f430 [0278.042] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="EndBufferedAnimation") returned 0x7ffd4b478380 [0278.042] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BufferedPaintRenderAnimation") returned 0x7ffd4b48f3c0 [0278.042] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="IsCompositionActive") returned 0x7ffd4b47a1d0 [0278.042] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="GetThemeTransitionDuration") returned 0x7ffd4b475700 [0278.042] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="BeginPanningFeedback") returned 0x7ffd4b4b0c30 [0278.042] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="UpdatePanningFeedback") returned 0x7ffd4b4b0cb0 [0278.042] GetProcAddress (hModule=0x7ffd4b470000, lpProcName="EndPanningFeedback") returned 0x7ffd4b4b0c40 [0278.042] IsAppThemed () returned 0x1 [0278.043] IsThemeActive () returned 0x1 [0278.044] GetLastError () returned 0x0 [0278.044] SetLastError (dwErrCode=0x0) [0278.044] GetFileVersionInfoSizeA (in: lptstrFilename="comctl32.dll", lpdwHandle=0x5fef68 | out: lpdwHandle=0x5fef68) returned 0x71c [0278.044] GetFileVersionInfoA (in: lptstrFilename="comctl32.dll", dwHandle=0x0, dwLen=0x71c, lpData=0x5fef90 | out: lpData=0x5fef90) returned 1 [0278.044] VerQueryValueA (in: pBlock=0x5fef90, lpSubBlock="\\", lplpBuffer=0x5fef60, puLen=0x5fef78 | out: lplpBuffer=0x5fef60*=0x5fefb8, puLen=0x5fef78) returned 1 [0278.044] GetLastError () returned 0x0 [0278.044] SetLastError (dwErrCode=0x0) [0278.044] GetLastError () returned 0x0 [0278.044] SetLastError (dwErrCode=0x0) [0278.044] SystemParametersInfoA (in: uiAction=0x29, uiParam=0x154, pvParam=0x6dac48, fWinIni=0x0 | out: pvParam=0x6dac48) returned 1 [0278.052] CreateFontIndirectA (lplf=0x6dad60) returned 0x1d0a094f [0278.052] GetModuleHandleA (lpModuleName="comctl32.dll") returned 0x7ffd40ab0000 [0278.052] GetProcAddress (hModule=0x7ffd40ab0000, lpProcName="InitCommonControlsEx") returned 0x7ffd40ab1700 [0278.052] GetLastError () returned 0x0 [0278.052] SetLastError (dwErrCode=0x0) [0278.052] GetFileVersionInfoSizeA (in: lptstrFilename="comctl32.dll", lpdwHandle=0x5ff0a8 | out: lpdwHandle=0x5ff0a8) returned 0x71c [0278.053] GetFileVersionInfoA (in: lptstrFilename="comctl32.dll", dwHandle=0x0, dwLen=0x71c, lpData=0x5ff0d0 | out: lpData=0x5ff0d0) returned 1 [0278.053] VerQueryValueA (in: pBlock=0x5ff0d0, lpSubBlock="\\", lplpBuffer=0x5ff0a0, puLen=0x5ff0b8 | out: lplpBuffer=0x5ff0a0*=0x5ff0f8, puLen=0x5ff0b8) returned 1 [0278.053] GetLastError () returned 0x0 [0278.053] SetLastError (dwErrCode=0x0) [0278.053] GetTickCount () returned 0xb88bd5 [0278.053] GetLastError () returned 0x0 [0278.053] SetLastError (dwErrCode=0x0) [0278.053] GetLastError () returned 0x0 [0278.053] SetLastError (dwErrCode=0x0) [0278.053] GetLastError () returned 0x0 [0278.053] SetLastError (dwErrCode=0x0) [0278.053] GetLastError () returned 0x0 [0278.053] SetLastError (dwErrCode=0x0) [0278.053] GetLastError () returned 0x0 [0278.053] SetLastError (dwErrCode=0x0) [0278.053] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x188 [0278.053] ResetEvent (hEvent=0x188) returned 1 [0278.053] GetLastError () returned 0x0 [0278.054] SetLastError (dwErrCode=0x0) [0278.054] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x194 [0278.054] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0278.054] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x1d0000 [0278.054] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.054] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetProcAddress") returned 0x7ffd4e1e0b80 [0278.055] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwClose") returned 0x7ffd50574f20 [0278.055] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateFile") returned 0x7ffd505757e0 [0278.055] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenFile") returned 0x7ffd505753a0 [0278.055] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateSection") returned 0x7ffd50575680 [0278.055] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwMapViewOfSection") returned 0x7ffd50575240 [0278.055] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnmapViewOfSection") returned 0x7ffd50575280 [0278.055] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnmapViewOfSectionEx") returned 0x7ffd50578370 [0278.056] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwReadFile") returned 0x7ffd50574e00 [0278.056] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryInformationFile") returned 0x7ffd50574f60 [0278.056] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetInformationFile") returned 0x7ffd50575220 [0278.056] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryAttributesFile") returned 0x7ffd505754e0 [0278.056] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQuerySection") returned 0x7ffd50575760 [0278.056] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryFullAttributesFile") returned 0x7ffd50577350 [0278.056] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwWriteFile") returned 0x7ffd50574e40 [0278.056] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeviceIoControlFile") returned 0x7ffd50574e20 [0278.056] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryObject") returned 0x7ffd50574f40 [0278.057] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryDirectoryFile") returned 0x7ffd505753e0 [0278.057] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryDirectoryFileEx") returned 0x0 [0278.057] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenSection") returned 0x7ffd50575420 [0278.057] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDuplicateObject") returned 0x7ffd505754c0 [0278.057] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeleteFile") returned 0x7ffd505765d0 [0278.057] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwLockFile") returned 0x7ffd50576cb0 [0278.057] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnlockFile") returned 0x7ffd50578330 [0278.057] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwTerminateProcess") returned 0x7ffd505752c0 [0278.057] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryVirtualMemory") returned 0x7ffd505751a0 [0278.058] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryVolumeInformationFile") returned 0x7ffd50575660 [0278.058] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetVolumeInformationFile") returned 0x7ffd50578050 [0278.058] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwAccessCheck") returned 0x7ffd50574d40 [0278.058] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwExtendSection") returned 0x7ffd505767b0 [0278.058] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFlushBuffersFile") returned 0x7ffd505756a0 [0278.058] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFsControlFile") returned 0x7ffd50575460 [0278.058] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwNotifyChangeDirectoryFile") returned 0x7ffd50576e10 [0278.058] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQuerySecurityObject") returned 0x7ffd505775d0 [0278.059] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetSecurityObject") returned 0x7ffd50577ef0 [0278.059] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateProcess") returned 0x7ffd505762f0 [0278.059] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateProcessEx") returned 0x7ffd505756e0 [0278.059] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateUserProcess") returned 0x7ffd50576490 [0278.059] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwResumeThread") returned 0x7ffd50575780 [0278.059] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateThread") returned 0x7ffd50575700 [0278.059] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryInformationProcess") returned 0x7ffd50575060 [0278.059] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenKey") returned 0x7ffd50574f80 [0278.060] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwOpenKeyEx") returned 0x7ffd50576f10 [0278.060] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwEnumerateValueKey") returned 0x7ffd50574fa0 [0278.060] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryKey") returned 0x7ffd50575000 [0278.060] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryValueKey") returned 0x7ffd50575020 [0278.060] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwCreateKey") returned 0x7ffd505750e0 [0278.060] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwEnumerateKey") returned 0x7ffd50575380 [0278.060] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetValueKey") returned 0x7ffd50575930 [0278.060] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeleteKey") returned 0x7ffd505765f0 [0278.061] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwDeleteValueKey") returned 0x7ffd50576650 [0278.061] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwFlushKey") returned 0x7ffd50576890 [0278.061] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwLoadKey") returned 0x7ffd50576c50 [0278.061] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwLoadKey2") returned 0x7ffd50576c70 [0278.061] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwNotifyChangeKey") returned 0x7ffd50576e30 [0278.061] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwQueryMultipleValueKey") returned 0x7ffd505774f0 [0278.061] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwReplaceKey") returned 0x7ffd505778d0 [0278.061] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwRestoreKey") returned 0x7ffd50577990 [0278.061] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSaveKey") returned 0x7ffd50577a70 [0278.061] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwSetInformationKey") returned 0x7ffd50577d10 [0278.062] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="ZwUnloadKey") returned 0x7ffd505782d0 [0278.062] VirtualFree (lpAddress=0x1d0000, dwSize=0x1000, dwFreeType=0x4000) returned 1 [0278.062] GetTickCount () returned 0xb88be5 [0278.063] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.063] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetModuleHandleA") returned 0x7ffd4e1e4c90 [0278.063] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.063] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetModuleHandleW") returned 0x7ffd4e1e3d40 [0278.063] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.063] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileA") returned 0x7ffd4e1ed8a0 [0278.063] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.063] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileW") returned 0x7ffd4e1ed8b0 [0278.063] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.064] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileMappingA") returned 0x7ffd4e1e1810 [0278.064] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.064] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CreateFileMappingW") returned 0x7ffd4e1e3af0 [0278.064] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.064] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="ReadFile") returned 0x7ffd4e1edbd0 [0278.064] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.064] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CloseHandle") returned 0x7ffd4e1ed650 [0278.064] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.064] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetFileSize") returned 0x7ffd4e1eda90 [0278.064] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.064] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="SetFilePointer") returned 0x7ffd4e1edc60 [0278.065] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.065] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="MapViewOfFile") returned 0x7ffd4e1e4860 [0278.065] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.065] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="MapViewOfFileEx") returned 0x7ffd4e1e1f30 [0278.065] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.065] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="UnmapViewOfFile") returned 0x7ffd4e1e4ce0 [0278.065] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.065] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryA") returned 0x7ffd4e1e74d0 [0278.065] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.065] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryExA") returned 0x7ffd4e1e6b80 [0278.065] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.066] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryW") returned 0x7ffd4e1e50f0 [0278.066] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.066] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LoadLibraryExW") returned 0x7ffd4e1e0dd0 [0278.066] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.066] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FreeLibrary") returned 0x7ffd4e1e4810 [0278.066] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.066] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FreeResource") returned 0x7ffd4e1e8ee0 [0278.066] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.067] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetVersion") returned 0x7ffd4e1e7550 [0278.067] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.067] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentProcessId") returned 0x7ffd4e1db4a0 [0278.067] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.067] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCurrentProcess") returned 0x7ffd4e1db7c0 [0278.067] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.067] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCommandLineA") returned 0x7ffd4e1e6d00 [0278.067] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.067] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetCommandLineW") returned 0x7ffd4e1e6a00 [0278.068] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.068] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="LockResource") returned 0x7ffd4e1e4450 [0278.068] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.068] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetProcAddress") returned 0x7ffd4e1e0b80 [0278.068] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.068] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="UnhandledExceptionFilter") returned 0x7ffd4e206a20 [0278.068] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.068] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="DebugBreak") returned 0x7ffd4e205b90 [0278.068] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.068] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="FatalAppExitA") returned 0x7ffd4e205d50 [0278.068] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.069] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="RtlRaiseException") returned 0x7ffd4e206830 [0278.069] GetModuleHandleA (lpModuleName="user32.dll") returned 0x7ffd4e9d0000 [0278.069] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetWindowsHookExA") returned 0x7ffd4e9d28e0 [0278.069] GetModuleHandleA (lpModuleName="user32.dll") returned 0x7ffd4e9d0000 [0278.069] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="SetWindowsHookExW") returned 0x7ffd4e9f5dd0 [0278.069] GetModuleHandleA (lpModuleName="user32.dll") returned 0x7ffd4e9d0000 [0278.069] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="UnhookWindowsHookEx") returned 0x7ffd4ea02c80 [0278.069] GetModuleHandleA (lpModuleName="user32.dll") returned 0x7ffd4e9d0000 [0278.069] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="PeekMessageA") returned 0x7ffd4e9ec540 [0278.069] GetModuleHandleA (lpModuleName="user32.dll") returned 0x7ffd4e9d0000 [0278.070] GetProcAddress (hModule=0x7ffd4e9d0000, lpProcName="CallNextHookEx") returned 0x7ffd4e9e6150 [0278.070] GetLastError () returned 0x7f [0278.070] SetLastError (dwErrCode=0x7f) [0278.070] GetLastError () returned 0x7f [0278.070] SetLastError (dwErrCode=0x7f) [0278.070] GetLastError () returned 0x7f [0278.070] SetLastError (dwErrCode=0x7f) [0278.070] GetSystemInfo (in: lpSystemInfo=0x7ff772b39e10 | out: lpSystemInfo=0x7ff772b39e10*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0278.070] LoadIconA (hInstance=0x7ff7727c3000, lpIconName="MAINICON") returned 0x0 [0278.071] LoadIconA (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0278.071] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0278.071] RegisterClassW (lpWndClass=0x5ffbc8) returned 0xc1d8 [0278.071] RegisterClassW (lpWndClass=0x5ffbc8) returned 0xc1e1 [0278.071] OleInitialize (pvReserved=0x0) returned 0x0 [0278.083] InitCommonControls () [0278.083] InitCommonControlsEx (picce=0x5ffc78) returned 1 [0278.084] InitCommonControlsEx (picce=0x5ffc78) returned 1 [0278.084] InitCommonControlsEx (picce=0x5ffc78) returned 1 [0278.084] InitCommonControlsEx (picce=0x5ffc78) returned 1 [0278.084] InitCommonControlsEx (picce=0x5ffc78) returned 1 [0278.085] InitCommonControlsEx (picce=0x5ffc78) returned 1 [0278.085] GetDesktopWindow () returned 0x10010 [0278.085] GetDC (hWnd=0x10010) returned 0xa0100d0 [0278.085] GetDeviceCaps (hdc=0xa0100d0, index=88) returned 96 [0278.085] GetDeviceCaps (hdc=0xa0100d0, index=90) returned 96 [0278.085] GetDeviceCaps (hdc=0xa0100d0, index=12) returned 32 [0278.085] ReleaseDC (hWnd=0x10010, hDC=0xa0100d0) returned 1 [0278.086] FindResourceA (hModule=0x7ff7727c3000, lpName="MAINICON", lpType=0xe) returned 0x0 [0278.086] HeapCreate (flOptions=0x0, dwInitialSize=0x88000, dwMaximumSize=0x88000) returned 0x2810000 [0278.088] RtlAllocateHeap (HeapHandle=0x2810000, Flags=0x0, Size=0x10000) returned 0x2810720 [0278.089] RtlAllocateHeap (HeapHandle=0x2810000, Flags=0x0, Size=0x10000) returned 0x2820730 [0278.089] RtlAllocateHeap (HeapHandle=0x2810000, Flags=0x0, Size=0x10000) returned 0x2830740 [0278.089] RtlAllocateHeap (HeapHandle=0x2810000, Flags=0x0, Size=0x10000) returned 0x2840750 [0278.089] RtlAllocateHeap (HeapHandle=0x2810000, Flags=0x0, Size=0x10000) returned 0x2850760 [0278.089] RtlAllocateHeap (HeapHandle=0x2810000, Flags=0x0, Size=0x10000) returned 0x2860770 [0278.089] RtlAllocateHeap (HeapHandle=0x2810000, Flags=0x0, Size=0x10000) returned 0x2870780 [0278.089] RtlAllocateHeap (HeapHandle=0x2810000, Flags=0x0, Size=0x10000) returned 0x2880790 [0278.089] GetLastError () returned 0x715 [0278.089] SetLastError (dwErrCode=0x715) [0278.089] GetLastError () returned 0x715 [0278.089] SetLastError (dwErrCode=0x715) [0278.089] GetLastError () returned 0x715 [0278.090] SetLastError (dwErrCode=0x715) [0278.090] GetLastError () returned 0x715 [0278.090] SetLastError (dwErrCode=0x715) [0278.090] GetLastError () returned 0x715 [0278.090] SetLastError (dwErrCode=0x715) [0278.090] GetLastError () returned 0x715 [0278.090] SetLastError (dwErrCode=0x715) [0278.090] GetLastError () returned 0x715 [0278.090] SetLastError (dwErrCode=0x715) [0278.090] GetLastError () returned 0x715 [0278.090] SetLastError (dwErrCode=0x715) [0278.090] GetLastError () returned 0x715 [0278.090] SetLastError (dwErrCode=0x715) [0278.090] GetLastError () returned 0x715 [0278.090] SetLastError (dwErrCode=0x715) [0278.091] GetLastError () returned 0x715 [0278.091] SetLastError (dwErrCode=0x715) [0278.091] GetLastError () returned 0x715 [0278.091] SetLastError (dwErrCode=0x715) [0278.091] GetLastError () returned 0x715 [0278.091] SetLastError (dwErrCode=0x715) [0278.091] GetLastError () returned 0x715 [0278.091] SetLastError (dwErrCode=0x715) [0278.092] GetLastError () returned 0x715 [0278.093] SetLastError (dwErrCode=0x715) [0278.093] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.093] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="GetVersionExA") returned 0x7ffd4e1e7450 [0278.093] GetVersionExA (in: lpVersionInformation=0x5ff908*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x7ff7, dwMinorVersion=0x16acb04, dwBuildNumber=0x0, dwPlatformId=0x71f50000, szCSDVersion="÷\x7f") | out: lpVersionInformation=0x5ff908*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0278.093] GetModuleFileNameW (in: hModule=0x7ff771f50000, lpFilename=0x6f0898, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe")) returned 0x3b [0278.093] SysReAllocStringLen (in: pbstr=0x5ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", len=0x3b | out: pbstr=0x5ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 1 [0278.093] GetLastError () returned 0x0 [0278.093] SetLastError (dwErrCode=0x0) [0278.093] GetLastError () returned 0x0 [0278.093] SetLastError (dwErrCode=0x0) [0278.093] GetLastError () returned 0x0 [0278.094] SetLastError (dwErrCode=0x0) [0278.094] GetLastError () returned 0x0 [0278.094] SetLastError (dwErrCode=0x0) [0278.094] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff7f0 | out: lpBuffer=0x0, lpFilePart=0x5ff7f0*=0x0) returned 0x2a [0278.094] GetLastError () returned 0x0 [0278.094] SetLastError (dwErrCode=0x0) [0278.094] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb3e8, lpFilePart=0x5ff7f0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff7f0*="Temp") returned 0x28 [0278.094] GetLastError () returned 0x0 [0278.094] SetLastError (dwErrCode=0x0) [0278.094] GetLastError () returned 0x0 [0278.094] SetLastError (dwErrCode=0x0) [0278.094] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.094] GetLastError () returned 0x0 [0278.094] SetLastError (dwErrCode=0x0) [0278.094] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.094] GetLastError () returned 0x0 [0278.094] SetLastError (dwErrCode=0x0) [0278.094] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.095] GetLastError () returned 0x0 [0278.095] SetLastError (dwErrCode=0x0) [0278.095] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.095] GetLastError () returned 0x0 [0278.095] SetLastError (dwErrCode=0x0) [0278.095] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.095] GetLastError () returned 0x0 [0278.095] SetLastError (dwErrCode=0x0) [0278.095] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.095] GetLastError () returned 0x0 [0278.095] SetLastError (dwErrCode=0x0) [0278.095] GetLastError () returned 0x0 [0278.095] SetLastError (dwErrCode=0x0) [0278.095] GetLastError () returned 0x0 [0278.095] SetLastError (dwErrCode=0x0) [0278.095] GetLastError () returned 0x0 [0278.095] SetLastError (dwErrCode=0x0) [0278.095] GetLastError () returned 0x0 [0278.095] SetLastError (dwErrCode=0x0) [0278.095] GetLastError () returned 0x0 [0278.095] SetLastError (dwErrCode=0x0) [0278.095] GetLastError () returned 0x0 [0278.096] SetLastError (dwErrCode=0x0) [0278.096] GetLastError () returned 0x0 [0278.096] SetLastError (dwErrCode=0x0) [0278.096] GetLastError () returned 0x0 [0278.096] SetLastError (dwErrCode=0x0) [0278.096] SysReAllocStringLen (in: pbstr=0x2560f18*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", len=0x3b | out: pbstr=0x2560f18*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 1 [0278.096] SysReAllocStringLen (in: pbstr=0x5ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", len=0x3b | out: pbstr=0x5ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 1 [0278.096] GetThreadLocale () returned 0x409 [0278.096] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.101] GetThreadLocale () returned 0x409 [0278.101] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.102] GetLastError () returned 0x0 [0278.102] SetLastError (dwErrCode=0x0) [0278.102] GetLastError () returned 0x0 [0278.102] SetLastError (dwErrCode=0x0) [0278.102] GetLastError () returned 0x0 [0278.102] SetLastError (dwErrCode=0x0) [0278.102] GetLastError () returned 0x0 [0278.102] SetLastError (dwErrCode=0x0) [0278.102] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.102] GetLastError () returned 0x0 [0278.102] SetLastError (dwErrCode=0x0) [0278.102] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb3e8, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.102] GetLastError () returned 0x0 [0278.102] SetLastError (dwErrCode=0x0) [0278.102] GetLastError () returned 0x0 [0278.102] SetLastError (dwErrCode=0x0) [0278.102] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.102] GetLastError () returned 0x0 [0278.102] SetLastError (dwErrCode=0x0) [0278.102] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.103] GetLastError () returned 0x0 [0278.103] SetLastError (dwErrCode=0x0) [0278.103] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.103] GetLastError () returned 0x0 [0278.103] SetLastError (dwErrCode=0x0) [0278.103] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.103] GetLastError () returned 0x0 [0278.103] SetLastError (dwErrCode=0x0) [0278.103] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.103] GetLastError () returned 0x0 [0278.103] SetLastError (dwErrCode=0x0) [0278.103] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.103] GetLastError () returned 0x0 [0278.103] SetLastError (dwErrCode=0x0) [0278.103] GetLastError () returned 0x0 [0278.103] SetLastError (dwErrCode=0x0) [0278.103] GetLastError () returned 0x0 [0278.103] SetLastError (dwErrCode=0x0) [0278.103] GetLastError () returned 0x0 [0278.103] SetLastError (dwErrCode=0x0) [0278.103] GetLastError () returned 0x0 [0278.104] SetLastError (dwErrCode=0x0) [0278.104] GetLastError () returned 0x0 [0278.104] SetLastError (dwErrCode=0x0) [0278.104] GetLastError () returned 0x0 [0278.104] SetLastError (dwErrCode=0x0) [0278.104] GetLastError () returned 0x0 [0278.104] SetLastError (dwErrCode=0x0) [0278.104] GetLastError () returned 0x0 [0278.104] SetLastError (dwErrCode=0x0) [0278.104] SysReAllocStringLen (in: pbstr=0x5ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", len=0x3b | out: pbstr=0x5ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 1 [0278.104] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", len=0x3b | out: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 1 [0278.104] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", cchLength=0x3b | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe") returned 0x3b [0278.104] SysReAllocStringLen (in: pbstr=0x5ffa10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe", len=0x3b | out: pbstr=0x5ffa10*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe") returned 1 [0278.105] SysReAllocStringLen (in: pbstr=0x2560f18*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe", len=0x3b | out: pbstr=0x2560f18*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe") returned 1 [0278.105] GetLastError () returned 0x0 [0278.105] SetLastError (dwErrCode=0x0) [0278.105] GetLastError () returned 0x0 [0278.105] SetLastError (dwErrCode=0x0) [0278.105] GetLastError () returned 0x0 [0278.105] SetLastError (dwErrCode=0x0) [0278.105] GetLastError () returned 0x0 [0278.105] SetLastError (dwErrCode=0x0) [0278.105] SysReAllocStringLen (in: pbstr=0x2560f38*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", len=0x30 | out: pbstr=0x2560f38*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\") returned 1 [0278.105] GetLastError () returned 0x0 [0278.105] SetLastError (dwErrCode=0x0) [0278.105] GetLastError () returned 0x0 [0278.105] SetLastError (dwErrCode=0x0) [0278.106] SysReAllocStringLen (in: pbstr=0x5ffa10*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", len=0x30 | out: pbstr=0x5ffa10*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\") returned 1 [0278.106] GetThreadLocale () returned 0x409 [0278.106] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.106] GetThreadLocale () returned 0x409 [0278.106] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.106] GetLastError () returned 0x0 [0278.106] SetLastError (dwErrCode=0x0) [0278.106] GetLastError () returned 0x0 [0278.106] SetLastError (dwErrCode=0x0) [0278.106] GetLastError () returned 0x0 [0278.106] SetLastError (dwErrCode=0x0) [0278.106] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x5ff7e8, cbMultiByte=1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1 [0278.106] GetLastError () returned 0x0 [0278.106] SetLastError (dwErrCode=0x0) [0278.106] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x5ff7e8, cbMultiByte=1, lpWideCharStr=0x8e50b8, cchWideChar=1 | out: lpWideCharStr="C") returned 1 [0278.106] GetLastError () returned 0x0 [0278.106] SetLastError (dwErrCode=0x0) [0278.106] GetLastError () returned 0x0 [0278.107] SetLastError (dwErrCode=0x0) [0278.107] GetLastError () returned 0x0 [0278.107] SetLastError (dwErrCode=0x0) [0278.107] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.107] GetLastError () returned 0x0 [0278.107] SetLastError (dwErrCode=0x0) [0278.107] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb3e8, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.107] GetLastError () returned 0x0 [0278.107] SetLastError (dwErrCode=0x0) [0278.107] GetLastError () returned 0x0 [0278.107] SetLastError (dwErrCode=0x0) [0278.107] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.107] GetLastError () returned 0x0 [0278.107] SetLastError (dwErrCode=0x0) [0278.107] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.107] GetLastError () returned 0x0 [0278.107] SetLastError (dwErrCode=0x0) [0278.108] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.108] GetLastError () returned 0x0 [0278.108] SetLastError (dwErrCode=0x0) [0278.108] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.108] GetLastError () returned 0x0 [0278.108] SetLastError (dwErrCode=0x0) [0278.108] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.108] GetLastError () returned 0x0 [0278.108] SetLastError (dwErrCode=0x0) [0278.108] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.108] GetLastError () returned 0x0 [0278.108] SetLastError (dwErrCode=0x0) [0278.108] GetLastError () returned 0x0 [0278.108] SetLastError (dwErrCode=0x0) [0278.108] GetLastError () returned 0x0 [0278.108] SetLastError (dwErrCode=0x0) [0278.108] GetLastError () returned 0x0 [0278.108] SetLastError (dwErrCode=0x0) [0278.108] GetLastError () returned 0x0 [0278.109] SetLastError (dwErrCode=0x0) [0278.109] GetLastError () returned 0x0 [0278.109] SetLastError (dwErrCode=0x0) [0278.109] GetLastError () returned 0x0 [0278.109] SetLastError (dwErrCode=0x0) [0278.109] GetLastError () returned 0x0 [0278.109] SetLastError (dwErrCode=0x0) [0278.109] GetLastError () returned 0x0 [0278.109] SetLastError (dwErrCode=0x0) [0278.109] GetLastError () returned 0x0 [0278.109] SetLastError (dwErrCode=0x0) [0278.109] SysReAllocStringLen (in: pbstr=0x5ffa10*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", psz="C:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", len=0x30 | out: pbstr=0x5ffa10*="C:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\") returned 1 [0278.109] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", psz="C:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", len=0x30 | out: pbstr=0x5ff968*="C:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\") returned 1 [0278.109] CharLowerBuffW (in: lpsz="C:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", cchLength=0x30 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\") returned 0x30 [0278.109] SysReAllocStringLen (in: pbstr=0x5ffa10*="C:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", len=0x30 | out: pbstr=0x5ffa10*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\") returned 1 [0278.109] SysReAllocStringLen (in: pbstr=0x2560f38*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", len=0x30 | out: pbstr=0x2560f38*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\") returned 1 [0278.110] GetLastError () returned 0x0 [0278.110] SetLastError (dwErrCode=0x0) [0278.111] GetSystemDirectoryW (in: lpBuffer=0x2570650, uSize=0xfffe | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0278.111] GetLastError () returned 0x0 [0278.111] SetLastError (dwErrCode=0x0) [0278.111] GetLastError () returned 0x0 [0278.111] SetLastError (dwErrCode=0x0) [0278.111] GetLastError () returned 0x0 [0278.111] SetLastError (dwErrCode=0x0) [0278.111] GetLastError () returned 0x0 [0278.111] SetLastError (dwErrCode=0x0) [0278.111] SysReAllocStringLen (in: pbstr=0x5ffa10*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", psz="C:\\Windows\\system32\\", len=0x14 | out: pbstr=0x5ffa10*="C:\\Windows\\system32\\") returned 1 [0278.111] GetThreadLocale () returned 0x409 [0278.111] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Windows\\system32\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.111] GetThreadLocale () returned 0x409 [0278.111] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Windows\\system32\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.111] GetLastError () returned 0x0 [0278.111] SetLastError (dwErrCode=0x0) [0278.111] GetLastError () returned 0x0 [0278.111] SetLastError (dwErrCode=0x0) [0278.111] GetLastError () returned 0x0 [0278.112] SetLastError (dwErrCode=0x0) [0278.112] GetLastError () returned 0x0 [0278.112] SetLastError (dwErrCode=0x0) [0278.112] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.112] GetLastError () returned 0x0 [0278.112] SetLastError (dwErrCode=0x0) [0278.112] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb468, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.112] GetLastError () returned 0x0 [0278.112] SetLastError (dwErrCode=0x0) [0278.112] GetLastError () returned 0x0 [0278.112] SetLastError (dwErrCode=0x0) [0278.112] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.112] GetLastError () returned 0x0 [0278.112] SetLastError (dwErrCode=0x0) [0278.112] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.112] GetLastError () returned 0x0 [0278.112] SetLastError (dwErrCode=0x0) [0278.112] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.112] GetLastError () returned 0x0 [0278.112] SetLastError (dwErrCode=0x0) [0278.112] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.112] GetLastError () returned 0x0 [0278.112] SetLastError (dwErrCode=0x0) [0278.112] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.112] GetLastError () returned 0x0 [0278.112] SetLastError (dwErrCode=0x0) [0278.112] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.112] GetLastError () returned 0x0 [0278.113] SetLastError (dwErrCode=0x0) [0278.113] GetLastError () returned 0x0 [0278.113] SetLastError (dwErrCode=0x0) [0278.113] GetLastError () returned 0x0 [0278.113] SetLastError (dwErrCode=0x0) [0278.113] GetLastError () returned 0x0 [0278.113] SetLastError (dwErrCode=0x0) [0278.113] GetLastError () returned 0x0 [0278.113] SetLastError (dwErrCode=0x0) [0278.113] GetLastError () returned 0x0 [0278.113] SetLastError (dwErrCode=0x0) [0278.113] GetLastError () returned 0x0 [0278.113] SetLastError (dwErrCode=0x0) [0278.113] GetLastError () returned 0x0 [0278.113] SetLastError (dwErrCode=0x0) [0278.113] GetLastError () returned 0x0 [0278.113] SetLastError (dwErrCode=0x0) [0278.113] SysReAllocStringLen (in: pbstr=0x5ffa10*="C:\\Windows\\system32\\", psz="C:\\Windows\\system32\\", len=0x14 | out: pbstr=0x5ffa10*="C:\\Windows\\system32\\") returned 1 [0278.113] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Windows\\system32\\", psz="C:\\Windows\\system32\\", len=0x14 | out: pbstr=0x5ff968*="C:\\Windows\\system32\\") returned 1 [0278.113] CharLowerBuffW (in: lpsz="C:\\Windows\\system32\\", cchLength=0x14 | out: lpsz="c:\\windows\\system32\\") returned 0x14 [0278.113] SysReAllocStringLen (in: pbstr=0x5ffa10*="C:\\Windows\\system32\\", psz="c:\\windows\\system32\\", len=0x14 | out: pbstr=0x5ffa10*="c:\\windows\\system32\\") returned 1 [0278.113] SysReAllocStringLen (in: pbstr=0x2560f30*=0x0, psz="c:\\windows\\system32\\", len=0x14 | out: pbstr=0x2560f30*="c:\\windows\\system32\\") returned 1 [0278.113] GetTempPathW (in: nBufferLength=0xfffe, lpBuffer=0x2570650 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0278.114] GetLastError () returned 0x0 [0278.114] SetLastError (dwErrCode=0x0) [0278.114] GetLastError () returned 0x0 [0278.114] SetLastError (dwErrCode=0x0) [0278.114] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Windows\\system32", psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", len=0x25 | out: pbstr=0x5ffa08*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 1 [0278.114] GetThreadLocale () returned 0x409 [0278.114] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.114] GetThreadLocale () returned 0x409 [0278.114] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.114] GetLastError () returned 0x0 [0278.114] SetLastError (dwErrCode=0x0) [0278.114] GetLastError () returned 0x0 [0278.114] SetLastError (dwErrCode=0x0) [0278.114] GetLastError () returned 0x0 [0278.114] SetLastError (dwErrCode=0x0) [0278.114] GetLastError () returned 0x0 [0278.114] SetLastError (dwErrCode=0x0) [0278.114] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.114] GetLastError () returned 0x0 [0278.115] SetLastError (dwErrCode=0x0) [0278.115] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb4e8, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.115] GetLastError () returned 0x0 [0278.115] SetLastError (dwErrCode=0x0) [0278.115] GetLastError () returned 0x0 [0278.115] SetLastError (dwErrCode=0x0) [0278.115] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.115] GetLastError () returned 0x0 [0278.115] SetLastError (dwErrCode=0x0) [0278.115] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.115] GetLastError () returned 0x0 [0278.115] SetLastError (dwErrCode=0x0) [0278.115] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.115] GetLastError () returned 0x0 [0278.115] SetLastError (dwErrCode=0x0) [0278.115] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.115] GetLastError () returned 0x0 [0278.115] SetLastError (dwErrCode=0x0) [0278.115] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.115] GetLastError () returned 0x0 [0278.115] SetLastError (dwErrCode=0x0) [0278.115] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.115] GetLastError () returned 0x0 [0278.115] SetLastError (dwErrCode=0x0) [0278.115] GetLastError () returned 0x0 [0278.115] SetLastError (dwErrCode=0x0) [0278.115] GetLastError () returned 0x0 [0278.115] SetLastError (dwErrCode=0x0) [0278.115] GetLastError () returned 0x0 [0278.116] SetLastError (dwErrCode=0x0) [0278.116] GetLastError () returned 0x0 [0278.116] SetLastError (dwErrCode=0x0) [0278.116] GetLastError () returned 0x0 [0278.116] SetLastError (dwErrCode=0x0) [0278.116] GetLastError () returned 0x0 [0278.116] SetLastError (dwErrCode=0x0) [0278.116] GetLastError () returned 0x0 [0278.116] SetLastError (dwErrCode=0x0) [0278.116] GetLastError () returned 0x0 [0278.116] SetLastError (dwErrCode=0x0) [0278.116] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", len=0x25 | out: pbstr=0x5ffa08*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 1 [0278.116] GetLastError () returned 0x0 [0278.116] SetLastError (dwErrCode=0x0) [0278.116] GetLastError () returned 0x0 [0278.116] SetLastError (dwErrCode=0x0) [0278.116] GetLastError () returned 0x0 [0278.116] SetLastError (dwErrCode=0x0) [0278.116] GetLastError () returned 0x0 [0278.116] SetLastError (dwErrCode=0x0) [0278.116] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff470 | out: lpBuffer=0x0, lpFilePart=0x5ff470*=0x0) returned 0x2a [0278.118] GetLastError () returned 0x0 [0278.118] SetLastError (dwErrCode=0x0) [0278.118] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb3e8, lpFilePart=0x5ff470 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff470*="Temp") returned 0x28 [0278.118] GetLastError () returned 0x0 [0278.118] SetLastError (dwErrCode=0x0) [0278.118] GetLastError () returned 0x0 [0278.118] SetLastError (dwErrCode=0x0) [0278.118] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.118] GetLastError () returned 0x0 [0278.118] SetLastError (dwErrCode=0x0) [0278.118] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.118] GetLastError () returned 0x0 [0278.118] SetLastError (dwErrCode=0x0) [0278.118] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.118] GetLastError () returned 0x0 [0278.118] SetLastError (dwErrCode=0x0) [0278.118] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.118] GetLastError () returned 0x0 [0278.118] SetLastError (dwErrCode=0x0) [0278.119] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.119] GetLastError () returned 0x0 [0278.119] SetLastError (dwErrCode=0x0) [0278.119] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.119] GetLastError () returned 0x0 [0278.119] SetLastError (dwErrCode=0x0) [0278.119] GetLastError () returned 0x0 [0278.119] SetLastError (dwErrCode=0x0) [0278.119] GetLastError () returned 0x0 [0278.119] SetLastError (dwErrCode=0x0) [0278.119] GetLastError () returned 0x0 [0278.119] SetLastError (dwErrCode=0x0) [0278.119] GetLastError () returned 0x0 [0278.119] SetLastError (dwErrCode=0x0) [0278.119] GetLastError () returned 0x0 [0278.119] SetLastError (dwErrCode=0x0) [0278.119] GetLastError () returned 0x0 [0278.119] SetLastError (dwErrCode=0x0) [0278.119] GetLastError () returned 0x0 [0278.119] SetLastError (dwErrCode=0x0) [0278.119] GetLastError () returned 0x0 [0278.119] SetLastError (dwErrCode=0x0) [0278.120] GetLastError () returned 0x0 [0278.120] SetLastError (dwErrCode=0x0) [0278.120] GetLastError () returned 0x0 [0278.120] SetLastError (dwErrCode=0x0) [0278.120] GetLastError () returned 0x0 [0278.120] SetLastError (dwErrCode=0x0) [0278.120] GetLastError () returned 0x0 [0278.120] SetLastError (dwErrCode=0x0) [0278.120] GetLastError () returned 0x0 [0278.120] SetLastError (dwErrCode=0x0) [0278.120] GetLastError () returned 0x0 [0278.120] SetLastError (dwErrCode=0x0) [0278.120] GetLastError () returned 0x0 [0278.120] SetLastError (dwErrCode=0x0) [0278.120] GetLastError () returned 0x0 [0278.120] SetLastError (dwErrCode=0x0) [0278.120] GetLastError () returned 0x0 [0278.120] SetLastError (dwErrCode=0x0) [0278.120] GetLastError () returned 0x0 [0278.120] SetLastError (dwErrCode=0x0) [0278.120] GetLastError () returned 0x0 [0278.121] SetLastError (dwErrCode=0x0) [0278.121] GetLastError () returned 0x0 [0278.121] SetLastError (dwErrCode=0x0) [0278.121] GetLastError () returned 0x0 [0278.121] SetLastError (dwErrCode=0x0) [0278.121] GetLastError () returned 0x0 [0278.121] SetLastError (dwErrCode=0x0) [0278.121] SysReAllocStringLen (in: pbstr=0x5ff5b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5ff5b0*="C:\\") returned 1 [0278.121] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.121] SysReAllocStringLen (in: pbstr=0x5ff5b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ff5b8*="c:\\") returned 1 [0278.121] SysReAllocStringLen (in: pbstr=0x5ff5a8*=0x0, psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", len=0x25 | out: pbstr=0x5ff5a8*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 1 [0278.121] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", cchLength=0x25 | out: lpsz="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\") returned 0x25 [0278.121] SysReAllocStringLen (in: pbstr=0x5ff5b0*=0x0, psz="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\", len=0x25 | out: pbstr=0x5ff5b0*="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\") returned 1 [0278.121] SetLastError (dwErrCode=0x0) [0278.121] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\", cchCount1=37, lpString2="c:\\", cchCount2=3) returned 3 [0278.121] GetLastError () returned 0x0 [0278.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0278.121] GetLastError () returned 0x0 [0278.121] SetLastError (dwErrCode=0x0) [0278.121] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", cchWideChar=37, lpMultiByteStr=0x8db788, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", lpUsedDefaultChar=0x0) returned 37 [0278.121] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=37, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0278.121] GetLastError () returned 0x0 [0278.121] SetLastError (dwErrCode=0x0) [0278.121] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=37, lpWideCharStr=0x8fb5e8, cchWideChar=37 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 37 [0278.122] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", lpFindFileData=0x5ff6c8 | out: lpFindFileData=0x5ff6c8*(dwFileAttributes=0x710000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x716cf0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0x40, nFileSizeHigh=0x0, nFileSizeLow=0x716d70, dwReserved0=0x0, dwReserved1=0x4, cFileName="", cAlternateFileName="翷")) returned 0xffffffffffffffff [0278.122] GetLastError () returned 0x2 [0278.122] GetLastError () returned 0x2 [0278.122] SetLastError (dwErrCode=0x2) [0278.122] GetLastError () returned 0x2 [0278.122] SetLastError (dwErrCode=0x2) [0278.122] GetLastError () returned 0x0 [0278.122] SetLastError (dwErrCode=0x0) [0278.122] GetLastError () returned 0x0 [0278.122] SetLastError (dwErrCode=0x0) [0278.122] GetLastError () returned 0x0 [0278.122] SetLastError (dwErrCode=0x0) [0278.122] GetLastError () returned 0x0 [0278.122] SetLastError (dwErrCode=0x0) [0278.123] SysReAllocStringLen (in: pbstr=0x5ff690*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp", len=0x24 | out: pbstr=0x5ff690*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp") returned 1 [0278.123] GetLastError () returned 0x0 [0278.123] SetLastError (dwErrCode=0x0) [0278.123] GetLastError () returned 0x0 [0278.123] SetLastError (dwErrCode=0x0) [0278.123] GetLastError () returned 0x0 [0278.123] SetLastError (dwErrCode=0x0) [0278.123] GetLastError () returned 0x0 [0278.123] SetLastError (dwErrCode=0x0) [0278.123] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff170 | out: lpBuffer=0x0, lpFilePart=0x5ff170*=0x0) returned 0x2a [0278.123] GetLastError () returned 0x0 [0278.123] SetLastError (dwErrCode=0x0) [0278.123] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb468, lpFilePart=0x5ff170 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff170*="Temp") returned 0x28 [0278.123] GetLastError () returned 0x0 [0278.123] SetLastError (dwErrCode=0x0) [0278.123] GetLastError () returned 0x0 [0278.123] SetLastError (dwErrCode=0x0) [0278.123] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.123] GetLastError () returned 0x0 [0278.123] SetLastError (dwErrCode=0x0) [0278.123] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50f8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.123] GetLastError () returned 0x0 [0278.123] SetLastError (dwErrCode=0x0) [0278.123] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.123] GetLastError () returned 0x0 [0278.123] SetLastError (dwErrCode=0x0) [0278.124] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50f8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.124] GetLastError () returned 0x0 [0278.124] SetLastError (dwErrCode=0x0) [0278.124] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.124] GetLastError () returned 0x0 [0278.124] SetLastError (dwErrCode=0x0) [0278.124] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50f8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.124] GetLastError () returned 0x0 [0278.124] SetLastError (dwErrCode=0x0) [0278.124] GetLastError () returned 0x0 [0278.124] SetLastError (dwErrCode=0x0) [0278.124] GetLastError () returned 0x0 [0278.124] SetLastError (dwErrCode=0x0) [0278.124] GetLastError () returned 0x0 [0278.124] SetLastError (dwErrCode=0x0) [0278.124] GetLastError () returned 0x0 [0278.124] SetLastError (dwErrCode=0x0) [0278.124] GetLastError () returned 0x0 [0278.124] SetLastError (dwErrCode=0x0) [0278.124] GetLastError () returned 0x0 [0278.124] SetLastError (dwErrCode=0x0) [0278.124] GetLastError () returned 0x0 [0278.124] SetLastError (dwErrCode=0x0) [0278.124] GetLastError () returned 0x0 [0278.124] SetLastError (dwErrCode=0x0) [0278.124] GetLastError () returned 0x0 [0278.125] SetLastError (dwErrCode=0x0) [0278.125] GetLastError () returned 0x0 [0278.125] SetLastError (dwErrCode=0x0) [0278.125] GetLastError () returned 0x0 [0278.125] SetLastError (dwErrCode=0x0) [0278.125] GetLastError () returned 0x0 [0278.125] SetLastError (dwErrCode=0x0) [0278.125] GetLastError () returned 0x0 [0278.125] SetLastError (dwErrCode=0x0) [0278.125] GetLastError () returned 0x0 [0278.125] SetLastError (dwErrCode=0x0) [0278.125] GetLastError () returned 0x0 [0278.125] SetLastError (dwErrCode=0x0) [0278.125] GetLastError () returned 0x0 [0278.125] SetLastError (dwErrCode=0x0) [0278.125] GetLastError () returned 0x0 [0278.125] SetLastError (dwErrCode=0x0) [0278.125] GetLastError () returned 0x0 [0278.125] SetLastError (dwErrCode=0x0) [0278.125] GetLastError () returned 0x0 [0278.125] SetLastError (dwErrCode=0x0) [0278.126] GetLastError () returned 0x0 [0278.126] SetLastError (dwErrCode=0x0) [0278.126] GetLastError () returned 0x0 [0278.126] SetLastError (dwErrCode=0x0) [0278.126] GetLastError () returned 0x0 [0278.126] SetLastError (dwErrCode=0x0) [0278.126] GetLastError () returned 0x0 [0278.126] SetLastError (dwErrCode=0x0) [0278.126] GetLastError () returned 0x0 [0278.126] SetLastError (dwErrCode=0x0) [0278.126] SysReAllocStringLen (in: pbstr=0x5ff2b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5ff2b0*="C:\\") returned 1 [0278.126] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.126] SysReAllocStringLen (in: pbstr=0x5ff2b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ff2b8*="c:\\") returned 1 [0278.126] SysReAllocStringLen (in: pbstr=0x5ff2a8*=0x0, psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", len=0x20 | out: pbstr=0x5ff2a8*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\") returned 1 [0278.126] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", cchLength=0x20 | out: lpsz="c:\\users\\rdhj0c~1\\appdata\\local\\") returned 0x20 [0278.126] SysReAllocStringLen (in: pbstr=0x5ff2b0*=0x0, psz="c:\\users\\rdhj0c~1\\appdata\\local\\", len=0x20 | out: pbstr=0x5ff2b0*="c:\\users\\rdhj0c~1\\appdata\\local\\") returned 1 [0278.126] SetLastError (dwErrCode=0x0) [0278.126] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\appdata\\local\\", cchCount1=32, lpString2="c:\\", cchCount2=3) returned 3 [0278.126] GetLastError () returned 0x0 [0278.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0278.127] GetLastError () returned 0x0 [0278.127] SetLastError (dwErrCode=0x0) [0278.127] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", cchWideChar=32, lpMultiByteStr=0x8db788, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", lpUsedDefaultChar=0x0) returned 32 [0278.127] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=32, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0278.127] GetLastError () returned 0x0 [0278.127] SetLastError (dwErrCode=0x0) [0278.127] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=32, lpWideCharStr=0x8fb4e8, cchWideChar=32 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\") returned 32 [0278.127] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", lpFindFileData=0x5ff3c8 | out: lpFindFileData=0x5ff3c8*(dwFileAttributes=0x710000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x718f20, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0x8fb5e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x25, cFileName="", cAlternateFileName="翷")) returned 0xffffffffffffffff [0278.127] GetLastError () returned 0x2 [0278.127] GetLastError () returned 0x2 [0278.127] SetLastError (dwErrCode=0x2) [0278.127] GetLastError () returned 0x2 [0278.127] SetLastError (dwErrCode=0x2) [0278.127] GetLastError () returned 0x0 [0278.127] SetLastError (dwErrCode=0x0) [0278.127] GetLastError () returned 0x0 [0278.127] SetLastError (dwErrCode=0x0) [0278.127] GetLastError () returned 0x0 [0278.128] SetLastError (dwErrCode=0x0) [0278.128] GetLastError () returned 0x0 [0278.128] SetLastError (dwErrCode=0x0) [0278.128] SysReAllocStringLen (in: pbstr=0x5ff390*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", psz="C:\\Users\\RDHJ0C~1\\AppData\\Local", len=0x1f | out: pbstr=0x5ff390*="C:\\Users\\RDHJ0C~1\\AppData\\Local") returned 1 [0278.128] GetLastError () returned 0x0 [0278.128] SetLastError (dwErrCode=0x0) [0278.128] GetLastError () returned 0x0 [0278.128] SetLastError (dwErrCode=0x0) [0278.128] GetLastError () returned 0x0 [0278.128] SetLastError (dwErrCode=0x0) [0278.128] GetLastError () returned 0x0 [0278.128] SetLastError (dwErrCode=0x0) [0278.128] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5fee70 | out: lpBuffer=0x0, lpFilePart=0x5fee70*=0x0) returned 0x2a [0278.128] GetLastError () returned 0x0 [0278.128] SetLastError (dwErrCode=0x0) [0278.128] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb4e8, lpFilePart=0x5fee70 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5fee70*="Temp") returned 0x28 [0278.128] GetLastError () returned 0x0 [0278.128] SetLastError (dwErrCode=0x0) [0278.128] GetLastError () returned 0x0 [0278.128] SetLastError (dwErrCode=0x0) [0278.128] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.128] GetLastError () returned 0x0 [0278.128] SetLastError (dwErrCode=0x0) [0278.128] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.128] GetLastError () returned 0x0 [0278.128] SetLastError (dwErrCode=0x0) [0278.128] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.128] GetLastError () returned 0x0 [0278.129] SetLastError (dwErrCode=0x0) [0278.129] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.129] GetLastError () returned 0x0 [0278.129] SetLastError (dwErrCode=0x0) [0278.129] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.129] GetLastError () returned 0x0 [0278.129] SetLastError (dwErrCode=0x0) [0278.129] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.129] GetLastError () returned 0x0 [0278.129] SetLastError (dwErrCode=0x0) [0278.129] GetLastError () returned 0x0 [0278.129] SetLastError (dwErrCode=0x0) [0278.129] GetLastError () returned 0x0 [0278.129] SetLastError (dwErrCode=0x0) [0278.129] GetLastError () returned 0x0 [0278.129] SetLastError (dwErrCode=0x0) [0278.129] GetLastError () returned 0x0 [0278.129] SetLastError (dwErrCode=0x0) [0278.129] GetLastError () returned 0x0 [0278.129] SetLastError (dwErrCode=0x0) [0278.129] GetLastError () returned 0x0 [0278.129] SetLastError (dwErrCode=0x0) [0278.129] GetLastError () returned 0x0 [0278.129] SetLastError (dwErrCode=0x0) [0278.129] GetLastError () returned 0x0 [0278.129] SetLastError (dwErrCode=0x0) [0278.135] GetLastError () returned 0x0 [0278.135] SetLastError (dwErrCode=0x0) [0278.135] GetLastError () returned 0x0 [0278.135] SetLastError (dwErrCode=0x0) [0278.135] GetLastError () returned 0x0 [0278.135] SetLastError (dwErrCode=0x0) [0278.135] GetLastError () returned 0x0 [0278.135] SetLastError (dwErrCode=0x0) [0278.135] GetLastError () returned 0x0 [0278.136] SetLastError (dwErrCode=0x0) [0278.136] GetLastError () returned 0x0 [0278.136] SetLastError (dwErrCode=0x0) [0278.136] GetLastError () returned 0x0 [0278.136] SetLastError (dwErrCode=0x0) [0278.136] GetLastError () returned 0x0 [0278.136] SetLastError (dwErrCode=0x0) [0278.136] GetLastError () returned 0x0 [0278.136] SetLastError (dwErrCode=0x0) [0278.136] GetLastError () returned 0x0 [0278.136] SetLastError (dwErrCode=0x0) [0278.136] GetLastError () returned 0x0 [0278.136] SetLastError (dwErrCode=0x0) [0278.136] GetLastError () returned 0x0 [0278.136] SetLastError (dwErrCode=0x0) [0278.136] GetLastError () returned 0x0 [0278.136] SetLastError (dwErrCode=0x0) [0278.136] GetLastError () returned 0x0 [0278.136] SetLastError (dwErrCode=0x0) [0278.137] GetLastError () returned 0x0 [0278.137] SetLastError (dwErrCode=0x0) [0278.137] GetLastError () returned 0x0 [0278.137] SetLastError (dwErrCode=0x0) [0278.137] SysReAllocStringLen (in: pbstr=0x5fefb0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5fefb0*="C:\\") returned 1 [0278.137] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.137] SysReAllocStringLen (in: pbstr=0x5fefb8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5fefb8*="c:\\") returned 1 [0278.137] SysReAllocStringLen (in: pbstr=0x5fefa8*=0x0, psz="C:\\Users\\RDHJ0C~1\\AppData\\", len=0x1a | out: pbstr=0x5fefa8*="C:\\Users\\RDHJ0C~1\\AppData\\") returned 1 [0278.137] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\AppData\\", cchLength=0x1a | out: lpsz="c:\\users\\rdhj0c~1\\appdata\\") returned 0x1a [0278.137] SysReAllocStringLen (in: pbstr=0x5fefb0*=0x0, psz="c:\\users\\rdhj0c~1\\appdata\\", len=0x1a | out: pbstr=0x5fefb0*="c:\\users\\rdhj0c~1\\appdata\\") returned 1 [0278.137] SetLastError (dwErrCode=0x0) [0278.137] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\appdata\\", cchCount1=26, lpString2="c:\\", cchCount2=3) returned 3 [0278.137] GetLastError () returned 0x0 [0278.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0278.137] GetLastError () returned 0x0 [0278.137] SetLastError (dwErrCode=0x0) [0278.137] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\", cchWideChar=26, lpMultiByteStr=0x8e50f8, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\", lpUsedDefaultChar=0x0) returned 26 [0278.137] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50f8, cbMultiByte=26, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0278.137] GetLastError () returned 0x0 [0278.137] SetLastError (dwErrCode=0x0) [0278.137] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50f8, cbMultiByte=26, lpWideCharStr=0x8db788, cchWideChar=26 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\") returned 26 [0278.137] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\", lpFindFileData=0x5ff0c8 | out: lpFindFileData=0x5ff0c8*(dwFileAttributes=0x710000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x716d60, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0x8fb4e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x20, cFileName="", cAlternateFileName="翷")) returned 0xffffffffffffffff [0278.138] GetLastError () returned 0x2 [0278.138] GetLastError () returned 0x2 [0278.138] SetLastError (dwErrCode=0x2) [0278.138] GetLastError () returned 0x2 [0278.138] SetLastError (dwErrCode=0x2) [0278.138] GetLastError () returned 0x0 [0278.138] SetLastError (dwErrCode=0x0) [0278.138] GetLastError () returned 0x0 [0278.138] SetLastError (dwErrCode=0x0) [0278.138] GetLastError () returned 0x0 [0278.138] SetLastError (dwErrCode=0x0) [0278.138] GetLastError () returned 0x0 [0278.138] SetLastError (dwErrCode=0x0) [0278.138] SysReAllocStringLen (in: pbstr=0x5ff090*="C:\\Users\\RDHJ0C~1\\AppData\\", psz="C:\\Users\\RDHJ0C~1\\AppData", len=0x19 | out: pbstr=0x5ff090*="C:\\Users\\RDHJ0C~1\\AppData") returned 1 [0278.138] GetLastError () returned 0x0 [0278.138] SetLastError (dwErrCode=0x0) [0278.139] GetLastError () returned 0x0 [0278.139] SetLastError (dwErrCode=0x0) [0278.139] GetLastError () returned 0x0 [0278.139] SetLastError (dwErrCode=0x0) [0278.139] GetLastError () returned 0x0 [0278.139] SetLastError (dwErrCode=0x0) [0278.139] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5feb70 | out: lpBuffer=0x0, lpFilePart=0x5feb70*=0x0) returned 0x2a [0278.139] GetLastError () returned 0x0 [0278.139] SetLastError (dwErrCode=0x0) [0278.139] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb4e8, lpFilePart=0x5feb70 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5feb70*="Temp") returned 0x28 [0278.139] GetLastError () returned 0x0 [0278.139] SetLastError (dwErrCode=0x0) [0278.139] GetLastError () returned 0x0 [0278.139] SetLastError (dwErrCode=0x0) [0278.139] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.139] GetLastError () returned 0x0 [0278.139] SetLastError (dwErrCode=0x0) [0278.139] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50f8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.139] GetLastError () returned 0x0 [0278.139] SetLastError (dwErrCode=0x0) [0278.139] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.139] GetLastError () returned 0x0 [0278.139] SetLastError (dwErrCode=0x0) [0278.139] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50f8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.139] GetLastError () returned 0x0 [0278.139] SetLastError (dwErrCode=0x0) [0278.139] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.139] GetLastError () returned 0x0 [0278.140] SetLastError (dwErrCode=0x0) [0278.140] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50f8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.140] GetLastError () returned 0x0 [0278.140] SetLastError (dwErrCode=0x0) [0278.140] GetLastError () returned 0x0 [0278.140] SetLastError (dwErrCode=0x0) [0278.140] GetLastError () returned 0x0 [0278.140] SetLastError (dwErrCode=0x0) [0278.140] GetLastError () returned 0x0 [0278.140] SetLastError (dwErrCode=0x0) [0278.140] GetLastError () returned 0x0 [0278.140] SetLastError (dwErrCode=0x0) [0278.140] GetLastError () returned 0x0 [0278.140] SetLastError (dwErrCode=0x0) [0278.140] GetLastError () returned 0x0 [0278.140] SetLastError (dwErrCode=0x0) [0278.140] GetLastError () returned 0x0 [0278.140] SetLastError (dwErrCode=0x0) [0278.140] GetLastError () returned 0x0 [0278.140] SetLastError (dwErrCode=0x0) [0278.140] GetLastError () returned 0x0 [0278.140] SetLastError (dwErrCode=0x0) [0278.140] GetLastError () returned 0x0 [0278.140] SetLastError (dwErrCode=0x0) [0278.140] GetLastError () returned 0x0 [0278.141] SetLastError (dwErrCode=0x0) [0278.141] GetLastError () returned 0x0 [0278.141] SetLastError (dwErrCode=0x0) [0278.141] GetLastError () returned 0x0 [0278.141] SetLastError (dwErrCode=0x0) [0278.141] GetLastError () returned 0x0 [0278.141] SetLastError (dwErrCode=0x0) [0278.141] GetLastError () returned 0x0 [0278.141] SetLastError (dwErrCode=0x0) [0278.141] GetLastError () returned 0x0 [0278.141] SetLastError (dwErrCode=0x0) [0278.141] GetLastError () returned 0x0 [0278.141] SetLastError (dwErrCode=0x0) [0278.141] GetLastError () returned 0x0 [0278.141] SetLastError (dwErrCode=0x0) [0278.141] GetLastError () returned 0x0 [0278.141] SetLastError (dwErrCode=0x0) [0278.141] GetLastError () returned 0x0 [0278.141] SetLastError (dwErrCode=0x0) [0278.142] GetLastError () returned 0x0 [0278.142] SetLastError (dwErrCode=0x0) [0278.142] GetLastError () returned 0x0 [0278.142] SetLastError (dwErrCode=0x0) [0278.142] GetLastError () returned 0x0 [0278.142] SetLastError (dwErrCode=0x0) [0278.142] GetLastError () returned 0x0 [0278.142] SetLastError (dwErrCode=0x0) [0278.142] SysReAllocStringLen (in: pbstr=0x5fecb0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5fecb0*="C:\\") returned 1 [0278.142] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.142] SysReAllocStringLen (in: pbstr=0x5fecb8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5fecb8*="c:\\") returned 1 [0278.142] SysReAllocStringLen (in: pbstr=0x5feca8*=0x0, psz="C:\\Users\\RDHJ0C~1\\", len=0x12 | out: pbstr=0x5feca8*="C:\\Users\\RDHJ0C~1\\") returned 1 [0278.142] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\", cchLength=0x12 | out: lpsz="c:\\users\\rdhj0c~1\\") returned 0x12 [0278.142] SysReAllocStringLen (in: pbstr=0x5fecb0*=0x0, psz="c:\\users\\rdhj0c~1\\", len=0x12 | out: pbstr=0x5fecb0*="c:\\users\\rdhj0c~1\\") returned 1 [0278.142] SetLastError (dwErrCode=0x0) [0278.142] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\", cchCount1=18, lpString2="c:\\", cchCount2=3) returned 3 [0278.142] GetLastError () returned 0x0 [0278.142] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0278.142] GetLastError () returned 0x0 [0278.142] SetLastError (dwErrCode=0x0) [0278.143] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\", cchWideChar=18, lpMultiByteStr=0x8e50b8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\", lpUsedDefaultChar=0x0) returned 18 [0278.143] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=18, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0278.143] GetLastError () returned 0x0 [0278.143] SetLastError (dwErrCode=0x0) [0278.143] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=18, lpWideCharStr=0x8db728, cchWideChar=18 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\") returned 18 [0278.143] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\", lpFindFileData=0x5fedc8 | out: lpFindFileData=0x5fedc8*(dwFileAttributes=0x710000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x725410, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0x8db788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1a, cFileName="", cAlternateFileName="翷")) returned 0xffffffffffffffff [0278.143] GetLastError () returned 0x2 [0278.143] GetLastError () returned 0x2 [0278.143] SetLastError (dwErrCode=0x2) [0278.143] GetLastError () returned 0x2 [0278.143] SetLastError (dwErrCode=0x2) [0278.143] GetLastError () returned 0x0 [0278.143] SetLastError (dwErrCode=0x0) [0278.143] GetLastError () returned 0x0 [0278.143] SetLastError (dwErrCode=0x0) [0278.143] GetLastError () returned 0x0 [0278.143] SetLastError (dwErrCode=0x0) [0278.143] GetLastError () returned 0x0 [0278.144] SetLastError (dwErrCode=0x0) [0278.144] SysReAllocStringLen (in: pbstr=0x5fed90*="C:\\Users\\RDHJ0C~1\\", psz="C:\\Users\\RDHJ0C~1", len=0x11 | out: pbstr=0x5fed90*="C:\\Users\\RDHJ0C~1") returned 1 [0278.144] GetLastError () returned 0x0 [0278.144] SetLastError (dwErrCode=0x0) [0278.144] GetLastError () returned 0x0 [0278.144] SetLastError (dwErrCode=0x0) [0278.144] GetLastError () returned 0x0 [0278.144] SetLastError (dwErrCode=0x0) [0278.144] GetLastError () returned 0x0 [0278.144] SetLastError (dwErrCode=0x0) [0278.144] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5fe870 | out: lpBuffer=0x0, lpFilePart=0x5fe870*=0x0) returned 0x2a [0278.144] GetLastError () returned 0x0 [0278.144] SetLastError (dwErrCode=0x0) [0278.144] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb4e8, lpFilePart=0x5fe870 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5fe870*="Temp") returned 0x28 [0278.144] GetLastError () returned 0x0 [0278.144] SetLastError (dwErrCode=0x0) [0278.144] GetLastError () returned 0x0 [0278.144] SetLastError (dwErrCode=0x0) [0278.144] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.144] GetLastError () returned 0x0 [0278.145] SetLastError (dwErrCode=0x0) [0278.145] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50f8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.145] GetLastError () returned 0x0 [0278.145] SetLastError (dwErrCode=0x0) [0278.145] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.145] GetLastError () returned 0x0 [0278.145] SetLastError (dwErrCode=0x0) [0278.145] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50f8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.145] GetLastError () returned 0x0 [0278.145] SetLastError (dwErrCode=0x0) [0278.145] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.145] GetLastError () returned 0x0 [0278.145] SetLastError (dwErrCode=0x0) [0278.145] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50f8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.145] GetLastError () returned 0x0 [0278.145] SetLastError (dwErrCode=0x0) [0278.145] GetLastError () returned 0x0 [0278.145] SetLastError (dwErrCode=0x0) [0278.145] GetLastError () returned 0x0 [0278.145] SetLastError (dwErrCode=0x0) [0278.145] GetLastError () returned 0x0 [0278.145] SetLastError (dwErrCode=0x0) [0278.145] GetLastError () returned 0x0 [0278.145] SetLastError (dwErrCode=0x0) [0278.146] GetLastError () returned 0x0 [0278.146] SetLastError (dwErrCode=0x0) [0278.146] GetLastError () returned 0x0 [0278.146] SetLastError (dwErrCode=0x0) [0278.146] GetLastError () returned 0x0 [0278.146] SetLastError (dwErrCode=0x0) [0278.146] GetLastError () returned 0x0 [0278.146] SetLastError (dwErrCode=0x0) [0278.146] GetLastError () returned 0x0 [0278.146] SetLastError (dwErrCode=0x0) [0278.146] GetLastError () returned 0x0 [0278.146] SetLastError (dwErrCode=0x0) [0278.146] GetLastError () returned 0x0 [0278.146] SetLastError (dwErrCode=0x0) [0278.146] GetLastError () returned 0x0 [0278.146] SetLastError (dwErrCode=0x0) [0278.146] GetLastError () returned 0x0 [0278.146] SetLastError (dwErrCode=0x0) [0278.146] GetLastError () returned 0x0 [0278.146] SetLastError (dwErrCode=0x0) [0278.147] GetLastError () returned 0x0 [0278.147] SetLastError (dwErrCode=0x0) [0278.147] GetLastError () returned 0x0 [0278.147] SetLastError (dwErrCode=0x0) [0278.147] GetLastError () returned 0x0 [0278.147] SetLastError (dwErrCode=0x0) [0278.147] GetLastError () returned 0x0 [0278.147] SetLastError (dwErrCode=0x0) [0278.147] GetLastError () returned 0x0 [0278.147] SetLastError (dwErrCode=0x0) [0278.147] GetLastError () returned 0x0 [0278.147] SetLastError (dwErrCode=0x0) [0278.147] GetLastError () returned 0x0 [0278.147] SetLastError (dwErrCode=0x0) [0278.147] GetLastError () returned 0x0 [0278.147] SetLastError (dwErrCode=0x0) [0278.147] GetLastError () returned 0x0 [0278.147] SetLastError (dwErrCode=0x0) [0278.147] GetLastError () returned 0x0 [0278.147] SetLastError (dwErrCode=0x0) [0278.148] SysReAllocStringLen (in: pbstr=0x5fe9b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5fe9b0*="C:\\") returned 1 [0278.148] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.148] SysReAllocStringLen (in: pbstr=0x5fe9b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5fe9b8*="c:\\") returned 1 [0278.148] SysReAllocStringLen (in: pbstr=0x5fe9a8*=0x0, psz="C:\\Users\\", len=0x9 | out: pbstr=0x5fe9a8*="C:\\Users\\") returned 1 [0278.148] CharLowerBuffW (in: lpsz="C:\\Users\\", cchLength=0x9 | out: lpsz="c:\\users\\") returned 0x9 [0278.148] SysReAllocStringLen (in: pbstr=0x5fe9b0*=0x0, psz="c:\\users\\", len=0x9 | out: pbstr=0x5fe9b0*="c:\\users\\") returned 1 [0278.148] SetLastError (dwErrCode=0x0) [0278.148] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\", cchCount1=9, lpString2="c:\\", cchCount2=3) returned 3 [0278.148] GetLastError () returned 0x0 [0278.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0278.148] GetLastError () returned 0x0 [0278.148] SetLastError (dwErrCode=0x0) [0278.148] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\", cchWideChar=9, lpMultiByteStr=0x8e50b8, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\", lpUsedDefaultChar=0x0) returned 9 [0278.148] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0278.148] GetLastError () returned 0x0 [0278.148] SetLastError (dwErrCode=0x0) [0278.148] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=9, lpWideCharStr=0x8e50f8, cchWideChar=9 | out: lpWideCharStr="C:\\Users\\") returned 9 [0278.148] FindFirstFileW (in: lpFileName="C:\\Users\\", lpFindFileData=0x5feac8 | out: lpFindFileData=0x5feac8*(dwFileAttributes=0x710000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x720600, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0x8db728, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="", cAlternateFileName="翷")) returned 0xffffffffffffffff [0278.149] SysReAllocStringLen (in: pbstr=0x5fea90*="C:\\Users\\", psz="C:\\Users", len=0x8 | out: pbstr=0x5fea90*="C:\\Users") returned 1 [0278.149] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5fe570 | out: lpBuffer=0x0, lpFilePart=0x5fe570*=0x0) returned 0x2a [0278.149] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb4e8, lpFilePart=0x5fe570 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5fe570*="Temp") returned 0x28 [0278.149] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.150] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5178, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.150] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.150] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5178, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.150] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.150] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5178, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.151] SysReAllocStringLen (in: pbstr=0x5fe6b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5fe6b0*="C:\\") returned 1 [0278.151] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.151] SysReAllocStringLen (in: pbstr=0x5fe6b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5fe6b8*="c:\\") returned 1 [0278.151] SysReAllocStringLen (in: pbstr=0x5fe6a8*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5fe6a8*="C:\\") returned 1 [0278.151] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.151] SysReAllocStringLen (in: pbstr=0x5fe6b0*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5fe6b0*="c:\\") returned 1 [0278.151] SetLastError (dwErrCode=0x0) [0278.151] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\", cchCount1=3, lpString2="c:\\", cchCount2=3) returned 2 [0278.151] GetLastError () returned 0x0 [0278.151] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0278.151] GetLastError () returned 0x0 [0278.151] SetLastError (dwErrCode=0x0) [0278.151] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users", cchWideChar=8, lpMultiByteStr=0x8e51b8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users", lpUsedDefaultChar=0x0) returned 8 [0278.152] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e51b8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0278.152] GetLastError () returned 0x0 [0278.152] SetLastError (dwErrCode=0x0) [0278.152] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e51b8, cbMultiByte=8, lpWideCharStr=0x8e50f8, cchWideChar=8 | out: lpWideCharStr="C:\\Users") returned 8 [0278.152] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x5fe7c8 | out: lpFindFileData=0x5fe7c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9, cFileName="Users", cAlternateFileName="")) returned 0x6c1b60 [0278.152] FileTimeToLocalFileTime (in: lpFileTime=0x5fe7dc, lpLocalFileTime=0x5fe5b0 | out: lpLocalFileTime=0x5fe5b0) returned 1 [0278.152] FileTimeToDosDateTime (in: lpFileTime=0x5fe5b0, lpFatDate=0x5fe79a, lpFatTime=0x5fe798 | out: lpFatDate=0x5fe79a, lpFatTime=0x5fe798) returned 1 [0278.152] GetLastError () returned 0x0 [0278.152] SetLastError (dwErrCode=0x0) [0278.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0278.153] GetLastError () returned 0x0 [0278.153] SetLastError (dwErrCode=0x0) [0278.153] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=5, lpMultiByteStr=0x8e5138, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Users", lpUsedDefaultChar=0x0) returned 5 [0278.153] GetLastError () returned 0x0 [0278.153] SetLastError (dwErrCode=0x0) [0278.153] GetLastError () returned 0x0 [0278.153] SetLastError (dwErrCode=0x0) [0278.153] GetLastError () returned 0x0 [0278.153] SetLastError (dwErrCode=0x0) [0278.153] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5138, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0278.153] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5138, cbMultiByte=5, lpWideCharStr=0x6c2458, cchWideChar=5 | out: lpWideCharStr="Users") returned 5 [0278.153] FindClose (in: hFindFile=0x6c1b60 | out: hFindFile=0x6c1b60) returned 1 [0278.153] GetLastError () returned 0x0 [0278.153] SetLastError (dwErrCode=0x0) [0278.153] SysReAllocStringLen (in: pbstr=0x5fea90*="C:\\Users", psz="C:\\Users", len=0x8 | out: pbstr=0x5fea90*="C:\\Users") returned 1 [0278.153] GetLastError () returned 0x0 [0278.154] SetLastError (dwErrCode=0x0) [0278.154] GetLastError () returned 0x0 [0278.154] SetLastError (dwErrCode=0x0) [0278.154] GetLastError () returned 0x0 [0278.154] SetLastError (dwErrCode=0x0) [0278.154] GetLastError () returned 0x0 [0278.154] SetLastError (dwErrCode=0x0) [0278.154] SysReAllocStringLen (in: pbstr=0x5fea90*="C:\\Users", psz="C:\\Users\\", len=0x9 | out: pbstr=0x5fea90*="C:\\Users\\") returned 1 [0278.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0278.154] GetLastError () returned 0x0 [0278.154] SetLastError (dwErrCode=0x0) [0278.154] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1", cchWideChar=17, lpMultiByteStr=0x8e51b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1", lpUsedDefaultChar=0x0) returned 17 [0278.154] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e51b8, cbMultiByte=17, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0278.154] GetLastError () returned 0x0 [0278.154] SetLastError (dwErrCode=0x0) [0278.154] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e51b8, cbMultiByte=17, lpWideCharStr=0x8db788, cchWideChar=17 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1") returned 17 [0278.154] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1", lpFindFileData=0x5feac8 | out: lpFindFileData=0x5feac8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6c1800 [0278.155] FileTimeToLocalFileTime (in: lpFileTime=0x5feadc, lpLocalFileTime=0x5fe8b0 | out: lpLocalFileTime=0x5fe8b0) returned 1 [0278.155] FileTimeToDosDateTime (in: lpFileTime=0x5fe8b0, lpFatDate=0x5fea9a, lpFatTime=0x5fea98 | out: lpFatDate=0x5fea9a, lpFatTime=0x5fea98) returned 1 [0278.155] GetLastError () returned 0x0 [0278.155] SetLastError (dwErrCode=0x0) [0278.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RDhJ0CNFevzX", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0278.155] GetLastError () returned 0x0 [0278.155] SetLastError (dwErrCode=0x0) [0278.155] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RDhJ0CNFevzX", cchWideChar=12, lpMultiByteStr=0x8e50b8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RDhJ0CNFevzX", lpUsedDefaultChar=0x0) returned 12 [0278.155] GetLastError () returned 0x0 [0278.155] SetLastError (dwErrCode=0x0) [0278.155] GetLastError () returned 0x0 [0278.155] SetLastError (dwErrCode=0x0) [0278.155] GetLastError () returned 0x0 [0278.155] SetLastError (dwErrCode=0x0) [0278.156] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0278.156] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=12, lpWideCharStr=0x724cf8, cchWideChar=12 | out: lpWideCharStr="RDhJ0CNFevzX") returned 12 [0278.156] FindClose (in: hFindFile=0x6c1800 | out: hFindFile=0x6c1800) returned 1 [0278.156] GetLastError () returned 0x0 [0278.156] SetLastError (dwErrCode=0x0) [0278.156] SysReAllocStringLen (in: pbstr=0x5fed90*="C:\\Users\\RDHJ0C~1", psz="C:\\Users\\RDhJ0CNFevzX", len=0x15 | out: pbstr=0x5fed90*="C:\\Users\\RDhJ0CNFevzX") returned 1 [0278.156] GetLastError () returned 0x0 [0278.156] SetLastError (dwErrCode=0x0) [0278.156] GetLastError () returned 0x0 [0278.156] SetLastError (dwErrCode=0x0) [0278.156] GetLastError () returned 0x0 [0278.156] SetLastError (dwErrCode=0x0) [0278.156] GetLastError () returned 0x0 [0278.156] SetLastError (dwErrCode=0x0) [0278.157] SysReAllocStringLen (in: pbstr=0x5fed90*="C:\\Users\\RDhJ0CNFevzX", psz="C:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x5fed90*="C:\\Users\\RDhJ0CNFevzX\\") returned 1 [0278.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0278.157] GetLastError () returned 0x0 [0278.157] SetLastError (dwErrCode=0x0) [0278.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData", cchWideChar=29, lpMultiByteStr=0x8e50b8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData", lpUsedDefaultChar=0x0) returned 29 [0278.157] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0278.157] GetLastError () returned 0x0 [0278.157] SetLastError (dwErrCode=0x0) [0278.157] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=29, lpWideCharStr=0x8db668, cchWideChar=29 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData") returned 29 [0278.157] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData", lpFindFileData=0x5fedc8 | out: lpFindFileData=0x5fedc8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1a, cFileName="AppData", cAlternateFileName="")) returned 0x6c1680 [0278.157] FileTimeToLocalFileTime (in: lpFileTime=0x5feddc, lpLocalFileTime=0x5febb0 | out: lpLocalFileTime=0x5febb0) returned 1 [0278.157] FileTimeToDosDateTime (in: lpFileTime=0x5febb0, lpFatDate=0x5fed9a, lpFatTime=0x5fed98 | out: lpFatDate=0x5fed9a, lpFatTime=0x5fed98) returned 1 [0278.157] GetLastError () returned 0x0 [0278.157] SetLastError (dwErrCode=0x0) [0278.157] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0278.176] GetLastError () returned 0x0 [0278.177] SetLastError (dwErrCode=0x0) [0278.177] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=7, lpMultiByteStr=0x8e5138, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppData", lpUsedDefaultChar=0x0) returned 7 [0278.177] GetLastError () returned 0x0 [0278.177] SetLastError (dwErrCode=0x0) [0278.177] GetLastError () returned 0x0 [0278.177] SetLastError (dwErrCode=0x0) [0278.177] GetLastError () returned 0x0 [0278.177] SetLastError (dwErrCode=0x0) [0278.177] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5138, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0278.177] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5138, cbMultiByte=7, lpWideCharStr=0x6c27e8, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0278.177] FindClose (in: hFindFile=0x6c1680 | out: hFindFile=0x6c1680) returned 1 [0278.179] GetLastError () returned 0x0 [0278.179] SetLastError (dwErrCode=0x0) [0278.179] SysReAllocStringLen (in: pbstr=0x5ff090*="C:\\Users\\RDHJ0C~1\\AppData", psz="C:\\Users\\RDhJ0CNFevzX\\AppData", len=0x1d | out: pbstr=0x5ff090*="C:\\Users\\RDhJ0CNFevzX\\AppData") returned 1 [0278.179] GetLastError () returned 0x0 [0278.179] SetLastError (dwErrCode=0x0) [0278.179] GetLastError () returned 0x0 [0278.179] SetLastError (dwErrCode=0x0) [0278.179] GetLastError () returned 0x0 [0278.179] SetLastError (dwErrCode=0x0) [0278.179] GetLastError () returned 0x0 [0278.180] SetLastError (dwErrCode=0x0) [0278.180] SysReAllocStringLen (in: pbstr=0x5ff090*="C:\\Users\\RDhJ0CNFevzX\\AppData", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x5ff090*="C:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0278.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0278.180] GetLastError () returned 0x0 [0278.180] SetLastError (dwErrCode=0x0) [0278.180] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", cchWideChar=35, lpMultiByteStr=0x8db788, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpUsedDefaultChar=0x0) returned 35 [0278.180] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0278.180] GetLastError () returned 0x0 [0278.180] SetLastError (dwErrCode=0x0) [0278.180] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=35, lpWideCharStr=0x8fb4e8, cchWideChar=35 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 35 [0278.180] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFindFileData=0x5ff0c8 | out: lpFindFileData=0x5ff0c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x20, cFileName="Local", cAlternateFileName="")) returned 0x6c1c20 [0278.181] FileTimeToLocalFileTime (in: lpFileTime=0x5ff0dc, lpLocalFileTime=0x5feeb0 | out: lpLocalFileTime=0x5feeb0) returned 1 [0278.181] FileTimeToDosDateTime (in: lpFileTime=0x5feeb0, lpFatDate=0x5ff09a, lpFatTime=0x5ff098 | out: lpFatDate=0x5ff09a, lpFatTime=0x5ff098) returned 1 [0278.181] GetLastError () returned 0x0 [0278.181] SetLastError (dwErrCode=0x0) [0278.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Local", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0278.181] GetLastError () returned 0x0 [0278.181] SetLastError (dwErrCode=0x0) [0278.181] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Local", cchWideChar=5, lpMultiByteStr=0x8e50b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Local", lpUsedDefaultChar=0x0) returned 5 [0278.181] GetLastError () returned 0x0 [0278.181] SetLastError (dwErrCode=0x0) [0278.181] GetLastError () returned 0x0 [0278.181] SetLastError (dwErrCode=0x0) [0278.181] GetLastError () returned 0x0 [0278.182] SetLastError (dwErrCode=0x0) [0278.182] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0278.182] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=5, lpWideCharStr=0x6c27e8, cchWideChar=5 | out: lpWideCharStr="Local") returned 5 [0278.182] FindClose (in: hFindFile=0x6c1c20 | out: hFindFile=0x6c1c20) returned 1 [0278.182] GetLastError () returned 0x0 [0278.182] SetLastError (dwErrCode=0x0) [0278.182] SysReAllocStringLen (in: pbstr=0x5ff390*="C:\\Users\\RDHJ0C~1\\AppData\\Local", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", len=0x23 | out: pbstr=0x5ff390*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 1 [0278.182] GetLastError () returned 0x0 [0278.182] SetLastError (dwErrCode=0x0) [0278.182] GetLastError () returned 0x0 [0278.182] SetLastError (dwErrCode=0x0) [0278.182] GetLastError () returned 0x0 [0278.182] SetLastError (dwErrCode=0x0) [0278.182] GetLastError () returned 0x0 [0278.182] SetLastError (dwErrCode=0x0) [0278.182] SysReAllocStringLen (in: pbstr=0x5ff390*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x5ff390*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0278.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0278.183] GetLastError () returned 0x0 [0278.183] SetLastError (dwErrCode=0x0) [0278.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", cchWideChar=40, lpMultiByteStr=0x8db788, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 40 [0278.183] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=40, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0278.183] GetLastError () returned 0x0 [0278.183] SetLastError (dwErrCode=0x0) [0278.183] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=40, lpWideCharStr=0x8fb3e8, cchWideChar=40 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp") returned 40 [0278.183] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFindFileData=0x5ff3c8 | out: lpFindFileData=0x5ff3c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xb12b8d, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x25, cFileName="Temp", cAlternateFileName="")) returned 0x6c13e0 [0278.183] FileTimeToLocalFileTime (in: lpFileTime=0x5ff3dc, lpLocalFileTime=0x5ff1b0 | out: lpLocalFileTime=0x5ff1b0) returned 1 [0278.183] FileTimeToDosDateTime (in: lpFileTime=0x5ff1b0, lpFatDate=0x5ff39a, lpFatTime=0x5ff398 | out: lpFatDate=0x5ff39a, lpFatTime=0x5ff398) returned 1 [0278.183] GetLastError () returned 0x0 [0278.183] SetLastError (dwErrCode=0x0) [0278.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Temp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0278.183] GetLastError () returned 0x0 [0278.183] SetLastError (dwErrCode=0x0) [0278.183] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Temp", cchWideChar=4, lpMultiByteStr=0x8e5138, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Temp", lpUsedDefaultChar=0x0) returned 4 [0278.183] GetLastError () returned 0x0 [0278.184] SetLastError (dwErrCode=0x0) [0278.184] GetLastError () returned 0x0 [0278.184] SetLastError (dwErrCode=0x0) [0278.184] GetLastError () returned 0x0 [0278.184] SetLastError (dwErrCode=0x0) [0278.184] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5138, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.184] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5138, cbMultiByte=4, lpWideCharStr=0x6c27e8, cchWideChar=4 | out: lpWideCharStr="Temp") returned 4 [0278.184] FindClose (in: hFindFile=0x6c13e0 | out: hFindFile=0x6c13e0) returned 1 [0278.184] GetLastError () returned 0x0 [0278.184] SetLastError (dwErrCode=0x0) [0278.184] SysReAllocStringLen (in: pbstr=0x5ff690*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", len=0x28 | out: pbstr=0x5ff690*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp") returned 1 [0278.184] GetLastError () returned 0x0 [0278.184] SetLastError (dwErrCode=0x0) [0278.184] GetLastError () returned 0x0 [0278.184] SetLastError (dwErrCode=0x0) [0278.184] GetLastError () returned 0x0 [0278.184] SetLastError (dwErrCode=0x0) [0278.184] GetLastError () returned 0x0 [0278.185] SetLastError (dwErrCode=0x0) [0278.185] SysReAllocStringLen (in: pbstr=0x5ff690*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x5ff690*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0278.185] SysReAllocStringLen (in: pbstr=0x5ff668*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x5ff668*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0278.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0278.185] GetLastError () returned 0x0 [0278.185] SetLastError (dwErrCode=0x0) [0278.185] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", cchWideChar=41, lpMultiByteStr=0x8db788, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpUsedDefaultChar=0x0) returned 41 [0278.185] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0278.185] GetLastError () returned 0x0 [0278.185] SetLastError (dwErrCode=0x0) [0278.185] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=41, lpWideCharStr=0x8fb4e8, cchWideChar=41 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 41 [0278.185] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpFindFileData=0x5ff6c8 | out: lpFindFileData=0x5ff6c8*(dwFileAttributes=0x710000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x716cf0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0x40, nFileSizeHigh=0x0, nFileSizeLow=0x716d70, dwReserved0=0x0, dwReserved1=0x4, cFileName="", cAlternateFileName="翷")) returned 0xffffffffffffffff [0278.189] GetLastError () returned 0x2 [0278.189] GetLastError () returned 0x2 [0278.189] SetLastError (dwErrCode=0x2) [0278.189] GetLastError () returned 0x2 [0278.189] SetLastError (dwErrCode=0x2) [0278.189] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", len=0x25 | out: pbstr=0x5ffa08*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 1 [0278.189] GetLastError () returned 0x0 [0278.189] SetLastError (dwErrCode=0x0) [0278.189] GetFileAttributesW (lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp")) returned 0x10 [0278.189] GetLastError () returned 0x0 [0278.189] SetLastError (dwErrCode=0x0) [0278.189] GetLastError () returned 0x0 [0278.189] SetLastError (dwErrCode=0x0) [0278.190] GetLastError () returned 0x0 [0278.190] SetLastError (dwErrCode=0x0) [0278.190] GetLastError () returned 0x0 [0278.190] SetLastError (dwErrCode=0x0) [0278.190] GetLastError () returned 0x0 [0278.190] SetLastError (dwErrCode=0x0) [0278.190] GetLastError () returned 0x0 [0278.190] SetLastError (dwErrCode=0x0) [0278.190] GetLastError () returned 0x0 [0278.190] SetLastError (dwErrCode=0x0) [0278.190] GetLastError () returned 0x0 [0278.190] SetLastError (dwErrCode=0x0) [0278.190] GetLastError () returned 0x0 [0278.190] SetLastError (dwErrCode=0x0) [0278.190] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff470 | out: lpBuffer=0x0, lpFilePart=0x5ff470*=0x0) returned 0x2a [0278.190] GetLastError () returned 0x0 [0278.190] SetLastError (dwErrCode=0x0) [0278.190] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb5e8, lpFilePart=0x5ff470 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff470*="Temp") returned 0x28 [0278.190] GetLastError () returned 0x0 [0278.190] SetLastError (dwErrCode=0x0) [0278.190] GetLastError () returned 0x0 [0278.190] SetLastError (dwErrCode=0x0) [0278.191] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.191] GetLastError () returned 0x0 [0278.191] SetLastError (dwErrCode=0x0) [0278.191] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.191] GetLastError () returned 0x0 [0278.191] SetLastError (dwErrCode=0x0) [0278.191] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.191] GetLastError () returned 0x0 [0278.191] SetLastError (dwErrCode=0x0) [0278.191] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.191] GetLastError () returned 0x0 [0278.191] SetLastError (dwErrCode=0x0) [0278.191] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.191] GetLastError () returned 0x0 [0278.191] SetLastError (dwErrCode=0x0) [0278.191] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.191] GetLastError () returned 0x0 [0278.191] SetLastError (dwErrCode=0x0) [0278.191] GetLastError () returned 0x0 [0278.191] SetLastError (dwErrCode=0x0) [0278.191] GetLastError () returned 0x0 [0278.191] SetLastError (dwErrCode=0x0) [0278.191] GetLastError () returned 0x0 [0278.192] SetLastError (dwErrCode=0x0) [0278.192] GetLastError () returned 0x0 [0278.192] SetLastError (dwErrCode=0x0) [0278.192] GetLastError () returned 0x0 [0278.192] SetLastError (dwErrCode=0x0) [0278.192] GetLastError () returned 0x0 [0278.192] SetLastError (dwErrCode=0x0) [0278.192] GetLastError () returned 0x0 [0278.192] SetLastError (dwErrCode=0x0) [0278.192] GetLastError () returned 0x0 [0278.192] SetLastError (dwErrCode=0x0) [0278.192] GetLastError () returned 0x0 [0278.192] SetLastError (dwErrCode=0x0) [0278.192] GetLastError () returned 0x0 [0278.192] SetLastError (dwErrCode=0x0) [0278.192] GetLastError () returned 0x0 [0278.192] SetLastError (dwErrCode=0x0) [0278.193] GetLastError () returned 0x0 [0278.193] SetLastError (dwErrCode=0x0) [0278.193] GetLastError () returned 0x0 [0278.193] SetLastError (dwErrCode=0x0) [0278.193] GetLastError () returned 0x0 [0278.193] SetLastError (dwErrCode=0x0) [0278.193] GetLastError () returned 0x0 [0278.193] SetLastError (dwErrCode=0x0) [0278.193] GetLastError () returned 0x0 [0278.193] SetLastError (dwErrCode=0x0) [0278.193] GetLastError () returned 0x0 [0278.193] SetLastError (dwErrCode=0x0) [0278.193] GetLastError () returned 0x0 [0278.193] SetLastError (dwErrCode=0x0) [0278.193] GetLastError () returned 0x0 [0278.193] SetLastError (dwErrCode=0x0) [0278.193] GetLastError () returned 0x0 [0278.193] SetLastError (dwErrCode=0x0) [0278.194] GetLastError () returned 0x0 [0278.194] SetLastError (dwErrCode=0x0) [0278.194] GetLastError () returned 0x0 [0278.194] SetLastError (dwErrCode=0x0) [0278.194] GetLastError () returned 0x0 [0278.194] SetLastError (dwErrCode=0x0) [0278.194] GetLastError () returned 0x0 [0278.194] SetLastError (dwErrCode=0x0) [0278.194] SysReAllocStringLen (in: pbstr=0x5ff5b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5ff5b0*="C:\\") returned 1 [0278.194] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.194] SysReAllocStringLen (in: pbstr=0x5ff5b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ff5b8*="c:\\") returned 1 [0278.194] SysReAllocStringLen (in: pbstr=0x5ff5a8*=0x0, psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", len=0x20 | out: pbstr=0x5ff5a8*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\") returned 1 [0278.194] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", cchLength=0x20 | out: lpsz="c:\\users\\rdhj0c~1\\appdata\\local\\") returned 0x20 [0278.194] SysReAllocStringLen (in: pbstr=0x5ff5b0*=0x0, psz="c:\\users\\rdhj0c~1\\appdata\\local\\", len=0x20 | out: pbstr=0x5ff5b0*="c:\\users\\rdhj0c~1\\appdata\\local\\") returned 1 [0278.194] SetLastError (dwErrCode=0x0) [0278.194] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\appdata\\local\\", cchCount1=32, lpString2="c:\\", cchCount2=3) returned 3 [0278.194] GetLastError () returned 0x0 [0278.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", cchWideChar=32, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 32 [0278.195] GetLastError () returned 0x0 [0278.195] SetLastError (dwErrCode=0x0) [0278.195] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", cchWideChar=32, lpMultiByteStr=0x8db788, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", lpUsedDefaultChar=0x0) returned 32 [0278.195] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=32, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 32 [0278.195] GetLastError () returned 0x0 [0278.195] SetLastError (dwErrCode=0x0) [0278.195] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=32, lpWideCharStr=0x8fb4e8, cchWideChar=32 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\Local\\") returned 32 [0278.195] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", lpFindFileData=0x5ff6c8 | out: lpFindFileData=0x5ff6c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x727d7dbd, dwReserved0=0x7ff7, dwReserved1=0x0, cFileName="", cAlternateFileName="翷")) returned 0xffffffffffffffff [0278.195] GetLastError () returned 0x2 [0278.195] GetLastError () returned 0x2 [0278.195] SetLastError (dwErrCode=0x2) [0278.195] GetLastError () returned 0x2 [0278.195] SetLastError (dwErrCode=0x2) [0278.195] GetLastError () returned 0x0 [0278.195] SetLastError (dwErrCode=0x0) [0278.196] GetLastError () returned 0x0 [0278.196] SetLastError (dwErrCode=0x0) [0278.196] GetLastError () returned 0x0 [0278.196] SetLastError (dwErrCode=0x0) [0278.196] GetLastError () returned 0x0 [0278.196] SetLastError (dwErrCode=0x0) [0278.196] SysReAllocStringLen (in: pbstr=0x5ff690*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\", psz="C:\\Users\\RDHJ0C~1\\AppData\\Local", len=0x1f | out: pbstr=0x5ff690*="C:\\Users\\RDHJ0C~1\\AppData\\Local") returned 1 [0278.196] GetLastError () returned 0x0 [0278.196] SetLastError (dwErrCode=0x0) [0278.196] GetLastError () returned 0x0 [0278.212] SetLastError (dwErrCode=0x0) [0278.212] GetLastError () returned 0x0 [0278.212] SetLastError (dwErrCode=0x0) [0278.212] GetLastError () returned 0x0 [0278.212] SetLastError (dwErrCode=0x0) [0278.212] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff170 | out: lpBuffer=0x0, lpFilePart=0x5ff170*=0x0) returned 0x2a [0278.212] GetLastError () returned 0x0 [0278.213] SetLastError (dwErrCode=0x0) [0278.213] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb4e8, lpFilePart=0x5ff170 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff170*="Temp") returned 0x28 [0278.213] GetLastError () returned 0x0 [0278.213] SetLastError (dwErrCode=0x0) [0278.213] GetLastError () returned 0x0 [0278.213] SetLastError (dwErrCode=0x0) [0278.213] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.213] GetLastError () returned 0x0 [0278.213] SetLastError (dwErrCode=0x0) [0278.213] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.213] GetLastError () returned 0x0 [0278.213] SetLastError (dwErrCode=0x0) [0278.213] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.213] GetLastError () returned 0x0 [0278.213] SetLastError (dwErrCode=0x0) [0278.213] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.213] GetLastError () returned 0x0 [0278.213] SetLastError (dwErrCode=0x0) [0278.213] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.213] GetLastError () returned 0x0 [0278.213] SetLastError (dwErrCode=0x0) [0278.213] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.213] GetLastError () returned 0x0 [0278.213] SetLastError (dwErrCode=0x0) [0278.213] GetLastError () returned 0x0 [0278.213] SetLastError (dwErrCode=0x0) [0278.214] GetLastError () returned 0x0 [0278.214] SetLastError (dwErrCode=0x0) [0278.214] GetLastError () returned 0x0 [0278.214] SetLastError (dwErrCode=0x0) [0278.214] GetLastError () returned 0x0 [0278.214] SetLastError (dwErrCode=0x0) [0278.214] GetLastError () returned 0x0 [0278.214] SetLastError (dwErrCode=0x0) [0278.214] GetLastError () returned 0x0 [0278.214] SetLastError (dwErrCode=0x0) [0278.214] GetLastError () returned 0x0 [0278.214] SetLastError (dwErrCode=0x0) [0278.214] GetLastError () returned 0x0 [0278.214] SetLastError (dwErrCode=0x0) [0278.214] GetLastError () returned 0x0 [0278.214] SetLastError (dwErrCode=0x0) [0278.214] GetLastError () returned 0x0 [0278.214] SetLastError (dwErrCode=0x0) [0278.214] GetLastError () returned 0x0 [0278.214] SetLastError (dwErrCode=0x0) [0278.214] GetLastError () returned 0x0 [0278.214] SetLastError (dwErrCode=0x0) [0278.215] GetLastError () returned 0x0 [0278.215] SetLastError (dwErrCode=0x0) [0278.215] GetLastError () returned 0x0 [0278.215] SetLastError (dwErrCode=0x0) [0278.215] GetLastError () returned 0x0 [0278.215] SetLastError (dwErrCode=0x0) [0278.215] GetLastError () returned 0x0 [0278.215] SetLastError (dwErrCode=0x0) [0278.215] GetLastError () returned 0x0 [0278.215] SetLastError (dwErrCode=0x0) [0278.215] GetLastError () returned 0x0 [0278.215] SetLastError (dwErrCode=0x0) [0278.215] GetLastError () returned 0x0 [0278.215] SetLastError (dwErrCode=0x0) [0278.215] GetLastError () returned 0x0 [0278.215] SetLastError (dwErrCode=0x0) [0278.215] GetLastError () returned 0x0 [0278.215] SetLastError (dwErrCode=0x0) [0278.215] GetLastError () returned 0x0 [0278.215] SetLastError (dwErrCode=0x0) [0278.215] GetLastError () returned 0x0 [0278.215] SetLastError (dwErrCode=0x0) [0278.216] GetLastError () returned 0x0 [0278.216] SetLastError (dwErrCode=0x0) [0278.216] SysReAllocStringLen (in: pbstr=0x5ff2b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5ff2b0*="C:\\") returned 1 [0278.216] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.216] SysReAllocStringLen (in: pbstr=0x5ff2b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ff2b8*="c:\\") returned 1 [0278.217] SysReAllocStringLen (in: pbstr=0x5ff2a8*=0x0, psz="C:\\Users\\RDHJ0C~1\\AppData\\", len=0x1a | out: pbstr=0x5ff2a8*="C:\\Users\\RDHJ0C~1\\AppData\\") returned 1 [0278.217] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\AppData\\", cchLength=0x1a | out: lpsz="c:\\users\\rdhj0c~1\\appdata\\") returned 0x1a [0278.217] SysReAllocStringLen (in: pbstr=0x5ff2b0*=0x0, psz="c:\\users\\rdhj0c~1\\appdata\\", len=0x1a | out: pbstr=0x5ff2b0*="c:\\users\\rdhj0c~1\\appdata\\") returned 1 [0278.217] SetLastError (dwErrCode=0x0) [0278.217] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\appdata\\", cchCount1=26, lpString2="c:\\", cchCount2=3) returned 3 [0278.217] GetLastError () returned 0x0 [0278.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0278.217] GetLastError () returned 0x0 [0278.217] SetLastError (dwErrCode=0x0) [0278.217] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\", cchWideChar=26, lpMultiByteStr=0x8e5138, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\AppData\\", lpUsedDefaultChar=0x0) returned 26 [0278.217] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5138, cbMultiByte=26, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0278.217] GetLastError () returned 0x0 [0278.217] SetLastError (dwErrCode=0x0) [0278.217] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5138, cbMultiByte=26, lpWideCharStr=0x8db788, cchWideChar=26 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\AppData\\") returned 26 [0278.218] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\AppData\\", lpFindFileData=0x5ff3c8 | out: lpFindFileData=0x5ff3c8*(dwFileAttributes=0x710000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x6c1a90, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0x8fb4e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x20, cFileName="", cAlternateFileName="翷")) returned 0xffffffffffffffff [0278.218] GetLastError () returned 0x2 [0278.218] GetLastError () returned 0x2 [0278.218] SetLastError (dwErrCode=0x2) [0278.218] GetLastError () returned 0x2 [0278.218] SetLastError (dwErrCode=0x2) [0278.218] GetLastError () returned 0x0 [0278.218] SetLastError (dwErrCode=0x0) [0278.218] GetLastError () returned 0x0 [0278.218] SetLastError (dwErrCode=0x0) [0278.218] GetLastError () returned 0x0 [0278.219] SetLastError (dwErrCode=0x0) [0278.219] GetLastError () returned 0x0 [0278.219] SetLastError (dwErrCode=0x0) [0278.219] SysReAllocStringLen (in: pbstr=0x5ff390*="C:\\Users\\RDHJ0C~1\\AppData\\", psz="C:\\Users\\RDHJ0C~1\\AppData", len=0x19 | out: pbstr=0x5ff390*="C:\\Users\\RDHJ0C~1\\AppData") returned 1 [0278.219] GetLastError () returned 0x0 [0278.219] SetLastError (dwErrCode=0x0) [0278.219] GetLastError () returned 0x0 [0278.219] SetLastError (dwErrCode=0x0) [0278.219] GetLastError () returned 0x0 [0278.219] SetLastError (dwErrCode=0x0) [0278.219] GetLastError () returned 0x0 [0278.219] SetLastError (dwErrCode=0x0) [0278.219] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5fee70 | out: lpBuffer=0x0, lpFilePart=0x5fee70*=0x0) returned 0x2a [0278.219] GetLastError () returned 0x0 [0278.219] SetLastError (dwErrCode=0x0) [0278.219] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb4e8, lpFilePart=0x5fee70 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5fee70*="Temp") returned 0x28 [0278.219] GetLastError () returned 0x0 [0278.219] SetLastError (dwErrCode=0x0) [0278.219] GetLastError () returned 0x0 [0278.219] SetLastError (dwErrCode=0x0) [0278.219] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.219] GetLastError () returned 0x0 [0278.219] SetLastError (dwErrCode=0x0) [0278.220] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.220] GetLastError () returned 0x0 [0278.220] SetLastError (dwErrCode=0x0) [0278.220] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.220] GetLastError () returned 0x0 [0278.220] SetLastError (dwErrCode=0x0) [0278.220] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.220] GetLastError () returned 0x0 [0278.220] SetLastError (dwErrCode=0x0) [0278.220] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.220] GetLastError () returned 0x0 [0278.220] SetLastError (dwErrCode=0x0) [0278.220] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.220] GetLastError () returned 0x0 [0278.220] SetLastError (dwErrCode=0x0) [0278.220] GetLastError () returned 0x0 [0278.220] SetLastError (dwErrCode=0x0) [0278.220] GetLastError () returned 0x0 [0278.220] SetLastError (dwErrCode=0x0) [0278.220] GetLastError () returned 0x0 [0278.220] SetLastError (dwErrCode=0x0) [0278.220] GetLastError () returned 0x0 [0278.220] SetLastError (dwErrCode=0x0) [0278.221] GetLastError () returned 0x0 [0278.221] SetLastError (dwErrCode=0x0) [0278.221] GetLastError () returned 0x0 [0278.221] SetLastError (dwErrCode=0x0) [0278.221] GetLastError () returned 0x0 [0278.221] SetLastError (dwErrCode=0x0) [0278.221] GetLastError () returned 0x0 [0278.221] SetLastError (dwErrCode=0x0) [0278.221] GetLastError () returned 0x0 [0278.221] SetLastError (dwErrCode=0x0) [0278.221] GetLastError () returned 0x0 [0278.221] SetLastError (dwErrCode=0x0) [0278.221] GetLastError () returned 0x0 [0278.221] SetLastError (dwErrCode=0x0) [0278.221] GetLastError () returned 0x0 [0278.221] SetLastError (dwErrCode=0x0) [0278.221] GetLastError () returned 0x0 [0278.221] SetLastError (dwErrCode=0x0) [0278.221] GetLastError () returned 0x0 [0278.222] SetLastError (dwErrCode=0x0) [0278.222] GetLastError () returned 0x0 [0278.222] SetLastError (dwErrCode=0x0) [0278.222] GetLastError () returned 0x0 [0278.222] SetLastError (dwErrCode=0x0) [0278.222] GetLastError () returned 0x0 [0278.222] SetLastError (dwErrCode=0x0) [0278.222] GetLastError () returned 0x0 [0278.222] SetLastError (dwErrCode=0x0) [0278.222] GetLastError () returned 0x0 [0278.222] SetLastError (dwErrCode=0x0) [0278.222] GetLastError () returned 0x0 [0278.222] SetLastError (dwErrCode=0x0) [0278.222] GetLastError () returned 0x0 [0278.223] SetLastError (dwErrCode=0x0) [0278.223] GetLastError () returned 0x0 [0278.223] SetLastError (dwErrCode=0x0) [0278.223] GetLastError () returned 0x0 [0278.223] SetLastError (dwErrCode=0x0) [0278.223] GetLastError () returned 0x0 [0278.223] SetLastError (dwErrCode=0x0) [0278.223] SysReAllocStringLen (in: pbstr=0x5fefb0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5fefb0*="C:\\") returned 1 [0278.223] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.223] SysReAllocStringLen (in: pbstr=0x5fefb8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5fefb8*="c:\\") returned 1 [0278.223] SysReAllocStringLen (in: pbstr=0x5fefa8*=0x0, psz="C:\\Users\\RDHJ0C~1\\", len=0x12 | out: pbstr=0x5fefa8*="C:\\Users\\RDHJ0C~1\\") returned 1 [0278.223] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\", cchLength=0x12 | out: lpsz="c:\\users\\rdhj0c~1\\") returned 0x12 [0278.223] SysReAllocStringLen (in: pbstr=0x5fefb0*=0x0, psz="c:\\users\\rdhj0c~1\\", len=0x12 | out: pbstr=0x5fefb0*="c:\\users\\rdhj0c~1\\") returned 1 [0278.223] SetLastError (dwErrCode=0x0) [0278.223] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\rdhj0c~1\\", cchCount1=18, lpString2="c:\\", cchCount2=3) returned 3 [0278.223] GetLastError () returned 0x0 [0278.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0278.223] GetLastError () returned 0x0 [0278.223] SetLastError (dwErrCode=0x0) [0278.223] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1\\", cchWideChar=18, lpMultiByteStr=0x8e50b8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1\\", lpUsedDefaultChar=0x0) returned 18 [0278.223] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=18, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 18 [0278.223] GetLastError () returned 0x0 [0278.223] SetLastError (dwErrCode=0x0) [0278.223] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=18, lpWideCharStr=0x8db6c8, cchWideChar=18 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1\\") returned 18 [0278.224] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1\\", lpFindFileData=0x5ff0c8 | out: lpFindFileData=0x5ff0c8*(dwFileAttributes=0x710000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x7255a0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0x8db788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1a, cFileName="", cAlternateFileName="翷")) returned 0xffffffffffffffff [0278.224] GetLastError () returned 0x2 [0278.224] GetLastError () returned 0x2 [0278.224] SetLastError (dwErrCode=0x2) [0278.224] GetLastError () returned 0x2 [0278.224] SetLastError (dwErrCode=0x2) [0278.224] GetLastError () returned 0x0 [0278.224] SetLastError (dwErrCode=0x0) [0278.224] GetLastError () returned 0x0 [0278.224] SetLastError (dwErrCode=0x0) [0278.224] GetLastError () returned 0x0 [0278.224] SetLastError (dwErrCode=0x0) [0278.224] GetLastError () returned 0x0 [0278.224] SetLastError (dwErrCode=0x0) [0278.224] SysReAllocStringLen (in: pbstr=0x5ff090*="C:\\Users\\RDHJ0C~1\\", psz="C:\\Users\\RDHJ0C~1", len=0x11 | out: pbstr=0x5ff090*="C:\\Users\\RDHJ0C~1") returned 1 [0278.224] GetLastError () returned 0x0 [0278.224] SetLastError (dwErrCode=0x0) [0278.224] GetLastError () returned 0x0 [0278.225] SetLastError (dwErrCode=0x0) [0278.225] GetLastError () returned 0x0 [0278.225] SetLastError (dwErrCode=0x0) [0278.225] GetLastError () returned 0x0 [0278.225] SetLastError (dwErrCode=0x0) [0278.225] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5feb70 | out: lpBuffer=0x0, lpFilePart=0x5feb70*=0x0) returned 0x2a [0278.225] GetLastError () returned 0x0 [0278.225] SetLastError (dwErrCode=0x0) [0278.225] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb4e8, lpFilePart=0x5feb70 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5feb70*="Temp") returned 0x28 [0278.225] GetLastError () returned 0x0 [0278.225] SetLastError (dwErrCode=0x0) [0278.225] GetLastError () returned 0x0 [0278.225] SetLastError (dwErrCode=0x0) [0278.225] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.225] GetLastError () returned 0x0 [0278.225] SetLastError (dwErrCode=0x0) [0278.225] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.225] GetLastError () returned 0x0 [0278.225] SetLastError (dwErrCode=0x0) [0278.225] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.225] GetLastError () returned 0x0 [0278.225] SetLastError (dwErrCode=0x0) [0278.225] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.225] GetLastError () returned 0x0 [0278.225] SetLastError (dwErrCode=0x0) [0278.225] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.225] GetLastError () returned 0x0 [0278.225] SetLastError (dwErrCode=0x0) [0278.225] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.225] GetLastError () returned 0x0 [0278.226] SetLastError (dwErrCode=0x0) [0278.226] GetLastError () returned 0x0 [0278.226] SetLastError (dwErrCode=0x0) [0278.226] GetLastError () returned 0x0 [0278.226] SetLastError (dwErrCode=0x0) [0278.226] GetLastError () returned 0x0 [0278.226] SetLastError (dwErrCode=0x0) [0278.226] GetLastError () returned 0x0 [0278.226] SetLastError (dwErrCode=0x0) [0278.226] GetLastError () returned 0x0 [0278.226] SetLastError (dwErrCode=0x0) [0278.226] GetLastError () returned 0x0 [0278.226] SetLastError (dwErrCode=0x0) [0278.226] GetLastError () returned 0x0 [0278.226] SetLastError (dwErrCode=0x0) [0278.226] GetLastError () returned 0x0 [0278.226] SetLastError (dwErrCode=0x0) [0278.226] GetLastError () returned 0x0 [0278.226] SetLastError (dwErrCode=0x0) [0278.226] GetLastError () returned 0x0 [0278.226] SetLastError (dwErrCode=0x0) [0278.227] GetLastError () returned 0x0 [0278.227] SetLastError (dwErrCode=0x0) [0278.227] GetLastError () returned 0x0 [0278.227] SetLastError (dwErrCode=0x0) [0278.227] GetLastError () returned 0x0 [0278.227] SetLastError (dwErrCode=0x0) [0278.227] GetLastError () returned 0x0 [0278.227] SetLastError (dwErrCode=0x0) [0278.227] GetLastError () returned 0x0 [0278.227] SetLastError (dwErrCode=0x0) [0278.227] GetLastError () returned 0x0 [0278.227] SetLastError (dwErrCode=0x0) [0278.227] GetLastError () returned 0x0 [0278.227] SetLastError (dwErrCode=0x0) [0278.227] GetLastError () returned 0x0 [0278.227] SetLastError (dwErrCode=0x0) [0278.227] GetLastError () returned 0x0 [0278.227] SetLastError (dwErrCode=0x0) [0278.227] GetLastError () returned 0x0 [0278.227] SetLastError (dwErrCode=0x0) [0278.227] GetLastError () returned 0x0 [0278.228] SetLastError (dwErrCode=0x0) [0278.228] GetLastError () returned 0x0 [0278.228] SetLastError (dwErrCode=0x0) [0278.228] GetLastError () returned 0x0 [0278.228] SetLastError (dwErrCode=0x0) [0278.228] SysReAllocStringLen (in: pbstr=0x5fecb0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5fecb0*="C:\\") returned 1 [0278.228] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.228] SysReAllocStringLen (in: pbstr=0x5fecb8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5fecb8*="c:\\") returned 1 [0278.228] SysReAllocStringLen (in: pbstr=0x5feca8*=0x0, psz="C:\\Users\\", len=0x9 | out: pbstr=0x5feca8*="C:\\Users\\") returned 1 [0278.228] CharLowerBuffW (in: lpsz="C:\\Users\\", cchLength=0x9 | out: lpsz="c:\\users\\") returned 0x9 [0278.228] SysReAllocStringLen (in: pbstr=0x5fecb0*=0x0, psz="c:\\users\\", len=0x9 | out: pbstr=0x5fecb0*="c:\\users\\") returned 1 [0278.228] SetLastError (dwErrCode=0x0) [0278.228] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\users\\", cchCount1=9, lpString2="c:\\", cchCount2=3) returned 3 [0278.229] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0278.229] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0278.229] GetLastError () returned 0x0 [0278.229] SetLastError (dwErrCode=0x0) [0278.229] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=9, lpWideCharStr=0x8e5138, cchWideChar=9 | out: lpWideCharStr="C:\\Users\\") returned 9 [0278.229] FindFirstFileW (in: lpFileName="C:\\Users\\", lpFindFileData=0x5fedc8 | out: lpFindFileData=0x5fedc8*(dwFileAttributes=0x710000, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x720700, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x504f3b4a, ftLastWriteTime.dwLowDateTime=0x7ffd, ftLastWriteTime.dwHighDateTime=0x8db6c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="", cAlternateFileName="翷")) returned 0xffffffffffffffff [0278.229] GetLastError () returned 0x2 [0278.229] GetLastError () returned 0x2 [0278.229] SetLastError (dwErrCode=0x2) [0278.229] GetLastError () returned 0x2 [0278.229] SetLastError (dwErrCode=0x2) [0278.229] GetLastError () returned 0x0 [0278.230] GetLastError () returned 0x0 [0278.230] SysReAllocStringLen (in: pbstr=0x5fed90*="C:\\Users\\", psz="C:\\Users", len=0x8 | out: pbstr=0x5fed90*="C:\\Users") returned 1 [0278.230] GetLastError () returned 0x0 [0278.230] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5fe870 | out: lpBuffer=0x0, lpFilePart=0x5fe870*=0x0) returned 0x2a [0278.230] GetLastError () returned 0x0 [0278.230] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb4e8, lpFilePart=0x5fe870 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5fe870*="Temp") returned 0x28 [0278.230] GetLastError () returned 0x0 [0278.230] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.230] GetLastError () returned 0x0 [0278.230] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50f8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.230] GetLastError () returned 0x0 [0278.231] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.231] GetLastError () returned 0x0 [0278.231] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50f8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.231] GetLastError () returned 0x0 [0278.231] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.231] GetLastError () returned 0x0 [0278.231] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50f8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.231] GetLastError () returned 0x0 [0278.231] GetLastError () returned 0x0 [0278.231] GetLastError () returned 0x0 [0278.231] SetLastError (dwErrCode=0x0) [0278.231] GetLastError () returned 0x0 [0278.231] SetLastError (dwErrCode=0x0) [0278.231] GetLastError () returned 0x0 [0278.232] SetLastError (dwErrCode=0x0) [0278.232] GetLastError () returned 0x0 [0278.232] SetLastError (dwErrCode=0x0) [0278.232] GetLastError () returned 0x0 [0278.232] SetLastError (dwErrCode=0x0) [0278.232] GetLastError () returned 0x0 [0278.232] SetLastError (dwErrCode=0x0) [0278.232] GetLastError () returned 0x0 [0278.232] SetLastError (dwErrCode=0x0) [0278.232] GetLastError () returned 0x0 [0278.232] SetLastError (dwErrCode=0x0) [0278.232] GetLastError () returned 0x0 [0278.232] SetLastError (dwErrCode=0x0) [0278.232] GetLastError () returned 0x0 [0278.232] SetLastError (dwErrCode=0x0) [0278.232] GetLastError () returned 0x0 [0278.232] SetLastError (dwErrCode=0x0) [0278.232] GetLastError () returned 0x0 [0278.232] SetLastError (dwErrCode=0x0) [0278.232] GetLastError () returned 0x0 [0278.232] SetLastError (dwErrCode=0x0) [0278.232] GetLastError () returned 0x0 [0278.233] SetLastError (dwErrCode=0x0) [0278.233] GetLastError () returned 0x0 [0278.233] SetLastError (dwErrCode=0x0) [0278.233] GetLastError () returned 0x0 [0278.233] SetLastError (dwErrCode=0x0) [0278.233] SysReAllocStringLen (in: pbstr=0x5fe9b0*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5fe9b0*="C:\\") returned 1 [0278.233] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.233] SysReAllocStringLen (in: pbstr=0x5fe9b8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5fe9b8*="c:\\") returned 1 [0278.233] SysReAllocStringLen (in: pbstr=0x5fe9a8*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x5fe9a8*="C:\\") returned 1 [0278.233] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0278.233] SysReAllocStringLen (in: pbstr=0x5fe9b0*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5fe9b0*="c:\\") returned 1 [0278.233] SetLastError (dwErrCode=0x0) [0278.233] CompareStringW (Locale=0x400, dwCmpFlags=0x0, lpString1="c:\\", cchCount1=3, lpString2="c:\\", cchCount2=3) returned 2 [0278.233] GetLastError () returned 0x0 [0278.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0278.233] GetLastError () returned 0x0 [0278.233] SetLastError (dwErrCode=0x0) [0278.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users", cchWideChar=8, lpMultiByteStr=0x8e5178, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users", lpUsedDefaultChar=0x0) returned 8 [0278.234] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5178, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0278.234] GetLastError () returned 0x0 [0278.234] SetLastError (dwErrCode=0x0) [0278.234] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5178, cbMultiByte=8, lpWideCharStr=0x8e5138, cchWideChar=8 | out: lpWideCharStr="C:\\Users") returned 8 [0278.234] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x5feac8 | out: lpFindFileData=0x5feac8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9, cFileName="Users", cAlternateFileName="")) returned 0x6c2160 [0278.234] FileTimeToLocalFileTime (in: lpFileTime=0x5feadc, lpLocalFileTime=0x5fe8b0 | out: lpLocalFileTime=0x5fe8b0) returned 1 [0278.234] FileTimeToDosDateTime (in: lpFileTime=0x5fe8b0, lpFatDate=0x5fea9a, lpFatTime=0x5fea98 | out: lpFatDate=0x5fea9a, lpFatTime=0x5fea98) returned 1 [0278.234] GetLastError () returned 0x0 [0278.234] SetLastError (dwErrCode=0x0) [0278.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0278.234] GetLastError () returned 0x0 [0278.234] SetLastError (dwErrCode=0x0) [0278.234] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Users", cchWideChar=5, lpMultiByteStr=0x8e51b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Users", lpUsedDefaultChar=0x0) returned 5 [0278.234] GetLastError () returned 0x0 [0278.234] SetLastError (dwErrCode=0x0) [0278.234] GetLastError () returned 0x0 [0278.234] SetLastError (dwErrCode=0x0) [0278.234] GetLastError () returned 0x0 [0278.234] SetLastError (dwErrCode=0x0) [0278.234] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e51b8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0278.234] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e51b8, cbMultiByte=5, lpWideCharStr=0x6c23f8, cchWideChar=5 | out: lpWideCharStr="Users") returned 5 [0278.235] FindClose (in: hFindFile=0x6c2160 | out: hFindFile=0x6c2160) returned 1 [0278.235] GetLastError () returned 0x0 [0278.235] SetLastError (dwErrCode=0x0) [0278.235] SysReAllocStringLen (in: pbstr=0x5fed90*="C:\\Users", psz="C:\\Users", len=0x8 | out: pbstr=0x5fed90*="C:\\Users") returned 1 [0278.235] GetLastError () returned 0x0 [0278.235] SetLastError (dwErrCode=0x0) [0278.235] GetLastError () returned 0x0 [0278.235] SetLastError (dwErrCode=0x0) [0278.235] GetLastError () returned 0x0 [0278.235] SetLastError (dwErrCode=0x0) [0278.235] GetLastError () returned 0x0 [0278.235] SetLastError (dwErrCode=0x0) [0278.235] SysReAllocStringLen (in: pbstr=0x5fed90*="C:\\Users", psz="C:\\Users\\", len=0x9 | out: pbstr=0x5fed90*="C:\\Users\\") returned 1 [0278.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0278.235] GetLastError () returned 0x0 [0278.235] SetLastError (dwErrCode=0x0) [0278.235] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDHJ0C~1", cchWideChar=17, lpMultiByteStr=0x8e5178, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDHJ0C~1", lpUsedDefaultChar=0x0) returned 17 [0278.236] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5178, cbMultiByte=17, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0278.236] GetLastError () returned 0x0 [0278.236] SetLastError (dwErrCode=0x0) [0278.236] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5178, cbMultiByte=17, lpWideCharStr=0x8db788, cchWideChar=17 | out: lpWideCharStr="C:\\Users\\RDHJ0C~1") returned 17 [0278.236] FindFirstFileW (in: lpFileName="C:\\Users\\RDHJ0C~1", lpFindFileData=0x5fedc8 | out: lpFindFileData=0x5fedc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x12, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6c1620 [0278.236] FileTimeToLocalFileTime (in: lpFileTime=0x5feddc, lpLocalFileTime=0x5febb0 | out: lpLocalFileTime=0x5febb0) returned 1 [0278.236] FileTimeToDosDateTime (in: lpFileTime=0x5febb0, lpFatDate=0x5fed9a, lpFatTime=0x5fed98 | out: lpFatDate=0x5fed9a, lpFatTime=0x5fed98) returned 1 [0278.236] GetLastError () returned 0x0 [0278.236] SetLastError (dwErrCode=0x0) [0278.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RDhJ0CNFevzX", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0278.236] GetLastError () returned 0x0 [0278.236] SetLastError (dwErrCode=0x0) [0278.236] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RDhJ0CNFevzX", cchWideChar=12, lpMultiByteStr=0x8e50b8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RDhJ0CNFevzX", lpUsedDefaultChar=0x0) returned 12 [0278.236] GetLastError () returned 0x0 [0278.236] SetLastError (dwErrCode=0x0) [0278.236] GetLastError () returned 0x0 [0278.236] SetLastError (dwErrCode=0x0) [0278.236] GetLastError () returned 0x0 [0278.236] SetLastError (dwErrCode=0x0) [0278.237] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0278.237] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=12, lpWideCharStr=0x724cf8, cchWideChar=12 | out: lpWideCharStr="RDhJ0CNFevzX") returned 12 [0278.237] FindClose (in: hFindFile=0x6c1620 | out: hFindFile=0x6c1620) returned 1 [0278.237] GetLastError () returned 0x0 [0278.237] SetLastError (dwErrCode=0x0) [0278.237] SysReAllocStringLen (in: pbstr=0x5ff090*="C:\\Users\\RDHJ0C~1", psz="C:\\Users\\RDhJ0CNFevzX", len=0x15 | out: pbstr=0x5ff090*="C:\\Users\\RDhJ0CNFevzX") returned 1 [0278.237] GetLastError () returned 0x0 [0278.237] SetLastError (dwErrCode=0x0) [0278.237] GetLastError () returned 0x0 [0278.237] SetLastError (dwErrCode=0x0) [0278.237] GetLastError () returned 0x0 [0278.237] SetLastError (dwErrCode=0x0) [0278.237] GetLastError () returned 0x0 [0278.237] SetLastError (dwErrCode=0x0) [0278.237] SysReAllocStringLen (in: pbstr=0x5ff090*="C:\\Users\\RDhJ0CNFevzX", psz="C:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x5ff090*="C:\\Users\\RDhJ0CNFevzX\\") returned 1 [0278.237] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0278.237] GetLastError () returned 0x0 [0278.238] SetLastError (dwErrCode=0x0) [0278.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData", cchWideChar=29, lpMultiByteStr=0x8e50b8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData", lpUsedDefaultChar=0x0) returned 29 [0278.238] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0278.238] GetLastError () returned 0x0 [0278.238] SetLastError (dwErrCode=0x0) [0278.238] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=29, lpWideCharStr=0x8db728, cchWideChar=29 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData") returned 29 [0278.238] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData", lpFindFileData=0x5ff0c8 | out: lpFindFileData=0x5ff0c8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1a, cFileName="AppData", cAlternateFileName="")) returned 0x6c2160 [0278.238] FileTimeToLocalFileTime (in: lpFileTime=0x5ff0dc, lpLocalFileTime=0x5feeb0 | out: lpLocalFileTime=0x5feeb0) returned 1 [0278.238] FileTimeToDosDateTime (in: lpFileTime=0x5feeb0, lpFatDate=0x5ff09a, lpFatTime=0x5ff098 | out: lpFatDate=0x5ff09a, lpFatTime=0x5ff098) returned 1 [0278.238] GetLastError () returned 0x0 [0278.238] SetLastError (dwErrCode=0x0) [0278.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0278.238] GetLastError () returned 0x0 [0278.238] SetLastError (dwErrCode=0x0) [0278.238] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="AppData", cchWideChar=7, lpMultiByteStr=0x8e51b8, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AppData", lpUsedDefaultChar=0x0) returned 7 [0278.238] GetLastError () returned 0x0 [0278.238] SetLastError (dwErrCode=0x0) [0278.238] GetLastError () returned 0x0 [0278.238] SetLastError (dwErrCode=0x0) [0278.238] GetLastError () returned 0x0 [0278.238] SetLastError (dwErrCode=0x0) [0278.238] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e51b8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0278.239] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e51b8, cbMultiByte=7, lpWideCharStr=0x6c28d8, cchWideChar=7 | out: lpWideCharStr="AppData") returned 7 [0278.239] FindClose (in: hFindFile=0x6c2160 | out: hFindFile=0x6c2160) returned 1 [0278.240] GetLastError () returned 0x0 [0278.240] SetLastError (dwErrCode=0x0) [0278.240] SysReAllocStringLen (in: pbstr=0x5ff390*="C:\\Users\\RDHJ0C~1\\AppData", psz="C:\\Users\\RDhJ0CNFevzX\\AppData", len=0x1d | out: pbstr=0x5ff390*="C:\\Users\\RDhJ0CNFevzX\\AppData") returned 1 [0278.240] GetLastError () returned 0x0 [0278.240] SetLastError (dwErrCode=0x0) [0278.240] GetLastError () returned 0x0 [0278.240] SetLastError (dwErrCode=0x0) [0278.240] GetLastError () returned 0x0 [0278.240] SetLastError (dwErrCode=0x0) [0278.240] GetLastError () returned 0x0 [0278.240] SetLastError (dwErrCode=0x0) [0278.240] SysReAllocStringLen (in: pbstr=0x5ff390*="C:\\Users\\RDhJ0CNFevzX\\AppData", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x5ff390*="C:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0278.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0278.240] GetLastError () returned 0x0 [0278.240] SetLastError (dwErrCode=0x0) [0278.240] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", cchWideChar=35, lpMultiByteStr=0x8db788, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpUsedDefaultChar=0x0) returned 35 [0278.240] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0278.240] GetLastError () returned 0x0 [0278.240] SetLastError (dwErrCode=0x0) [0278.241] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=35, lpWideCharStr=0x8fb4e8, cchWideChar=35 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 35 [0278.241] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpFindFileData=0x5ff3c8 | out: lpFindFileData=0x5ff3c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x20, cFileName="Local", cAlternateFileName="")) returned 0x6c21c0 [0278.241] FileTimeToLocalFileTime (in: lpFileTime=0x5ff3dc, lpLocalFileTime=0x5ff1b0 | out: lpLocalFileTime=0x5ff1b0) returned 1 [0278.241] FileTimeToDosDateTime (in: lpFileTime=0x5ff1b0, lpFatDate=0x5ff39a, lpFatTime=0x5ff398 | out: lpFatDate=0x5ff39a, lpFatTime=0x5ff398) returned 1 [0278.241] GetLastError () returned 0x0 [0278.241] SetLastError (dwErrCode=0x0) [0278.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Local", cchWideChar=5, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5 [0278.241] GetLastError () returned 0x0 [0278.241] SetLastError (dwErrCode=0x0) [0278.241] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Local", cchWideChar=5, lpMultiByteStr=0x8e50b8, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Local", lpUsedDefaultChar=0x0) returned 5 [0278.241] GetLastError () returned 0x0 [0278.241] SetLastError (dwErrCode=0x0) [0278.241] GetLastError () returned 0x0 [0278.241] SetLastError (dwErrCode=0x0) [0278.241] GetLastError () returned 0x0 [0278.241] SetLastError (dwErrCode=0x0) [0278.241] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0278.241] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e50b8, cbMultiByte=5, lpWideCharStr=0x6c28d8, cchWideChar=5 | out: lpWideCharStr="Local") returned 5 [0278.241] FindClose (in: hFindFile=0x6c21c0 | out: hFindFile=0x6c21c0) returned 1 [0278.242] GetLastError () returned 0x0 [0278.242] SetLastError (dwErrCode=0x0) [0278.242] SysReAllocStringLen (in: pbstr=0x5ff690*="C:\\Users\\RDHJ0C~1\\AppData\\Local", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", len=0x23 | out: pbstr=0x5ff690*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 1 [0278.242] GetLastError () returned 0x0 [0278.242] SetLastError (dwErrCode=0x0) [0278.242] GetLastError () returned 0x0 [0278.242] SetLastError (dwErrCode=0x0) [0278.242] GetLastError () returned 0x0 [0278.242] SetLastError (dwErrCode=0x0) [0278.242] GetLastError () returned 0x0 [0278.242] SetLastError (dwErrCode=0x0) [0278.242] SysReAllocStringLen (in: pbstr=0x5ff690*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x5ff690*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0278.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0278.242] GetLastError () returned 0x0 [0278.242] SetLastError (dwErrCode=0x0) [0278.242] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", cchWideChar=40, lpMultiByteStr=0x8db788, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpUsedDefaultChar=0x0) returned 40 [0278.242] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=40, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0278.242] GetLastError () returned 0x0 [0278.242] SetLastError (dwErrCode=0x0) [0278.242] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db788, cbMultiByte=40, lpWideCharStr=0x8fb468, cchWideChar=40 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp") returned 40 [0278.242] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFindFileData=0x5ff6c8 | out: lpFindFileData=0x5ff6c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xb12b8d, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff7, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0x6c1e00 [0278.243] FileTimeToLocalFileTime (in: lpFileTime=0x5ff6dc, lpLocalFileTime=0x5ff4b0 | out: lpLocalFileTime=0x5ff4b0) returned 1 [0278.243] FileTimeToDosDateTime (in: lpFileTime=0x5ff4b0, lpFatDate=0x5ff69a, lpFatTime=0x5ff698 | out: lpFatDate=0x5ff69a, lpFatTime=0x5ff698) returned 1 [0278.243] GetLastError () returned 0x0 [0278.243] SetLastError (dwErrCode=0x0) [0278.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Temp", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0278.243] GetLastError () returned 0x0 [0278.243] SetLastError (dwErrCode=0x0) [0278.243] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Temp", cchWideChar=4, lpMultiByteStr=0x8e51b8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Temp", lpUsedDefaultChar=0x0) returned 4 [0278.243] GetLastError () returned 0x0 [0278.243] SetLastError (dwErrCode=0x0) [0278.243] GetLastError () returned 0x0 [0278.243] SetLastError (dwErrCode=0x0) [0278.243] GetLastError () returned 0x0 [0278.243] SetLastError (dwErrCode=0x0) [0278.243] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e51b8, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.243] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e51b8, cbMultiByte=4, lpWideCharStr=0x6c28d8, cchWideChar=4 | out: lpWideCharStr="Temp") returned 4 [0278.243] FindClose (in: hFindFile=0x6c1e00 | out: hFindFile=0x6c1e00) returned 1 [0278.244] GetLastError () returned 0x0 [0278.244] SetLastError (dwErrCode=0x0) [0278.244] GetLastError () returned 0x0 [0278.244] SetLastError (dwErrCode=0x0) [0278.244] GetLastError () returned 0x0 [0278.244] SetLastError (dwErrCode=0x0) [0278.244] GetLastError () returned 0x0 [0278.244] SetLastError (dwErrCode=0x0) [0278.244] GetLastError () returned 0x0 [0278.244] SetLastError (dwErrCode=0x0) [0278.244] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0278.244] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0278.244] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", cchLength=0x29 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 0x29 [0278.244] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0278.244] SysReAllocStringLen (in: pbstr=0x2560f40*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", len=0x29 | out: pbstr=0x2560f40*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\") returned 1 [0278.245] GetWindowsDirectoryW (in: lpBuffer=0x2570650, uSize=0xfffe | out: lpBuffer="C:\\Windows") returned 0xa [0278.245] GetLastError () returned 0x0 [0278.245] SetLastError (dwErrCode=0x0) [0278.245] GetLastError () returned 0x0 [0278.245] SetLastError (dwErrCode=0x0) [0278.245] GetLastError () returned 0x0 [0278.245] SetLastError (dwErrCode=0x0) [0278.245] GetLastError () returned 0x0 [0278.245] SetLastError (dwErrCode=0x0) [0278.245] SysReAllocStringLen (in: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\", psz="C:\\Windows\\", len=0xb | out: pbstr=0x5ffa08*="C:\\Windows\\") returned 1 [0278.245] GetThreadLocale () returned 0x409 [0278.245] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Windows\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.245] GetThreadLocale () returned 0x409 [0278.245] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Windows\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.245] GetLastError () returned 0x0 [0278.245] SetLastError (dwErrCode=0x0) [0278.245] GetLastError () returned 0x0 [0278.245] SetLastError (dwErrCode=0x0) [0278.245] GetLastError () returned 0x0 [0278.245] SetLastError (dwErrCode=0x0) [0278.246] GetLastError () returned 0x0 [0278.246] SetLastError (dwErrCode=0x0) [0278.246] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.246] GetLastError () returned 0x0 [0278.246] SetLastError (dwErrCode=0x0) [0278.246] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb4e8, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.246] GetLastError () returned 0x0 [0278.246] SetLastError (dwErrCode=0x0) [0278.246] GetLastError () returned 0x0 [0278.246] SetLastError (dwErrCode=0x0) [0278.246] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.246] GetLastError () returned 0x0 [0278.246] SetLastError (dwErrCode=0x0) [0278.246] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.246] GetLastError () returned 0x0 [0278.246] SetLastError (dwErrCode=0x0) [0278.246] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.246] GetLastError () returned 0x0 [0278.246] SetLastError (dwErrCode=0x0) [0278.246] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.246] GetLastError () returned 0x0 [0278.246] SetLastError (dwErrCode=0x0) [0278.246] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.246] GetLastError () returned 0x0 [0278.246] SetLastError (dwErrCode=0x0) [0278.246] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.247] GetLastError () returned 0x0 [0278.247] SetLastError (dwErrCode=0x0) [0278.247] GetLastError () returned 0x0 [0278.247] SetLastError (dwErrCode=0x0) [0278.247] GetLastError () returned 0x0 [0278.247] SetLastError (dwErrCode=0x0) [0278.247] GetLastError () returned 0x0 [0278.247] SetLastError (dwErrCode=0x0) [0278.247] GetLastError () returned 0x0 [0278.247] SetLastError (dwErrCode=0x0) [0278.247] GetLastError () returned 0x0 [0278.247] SetLastError (dwErrCode=0x0) [0278.247] GetLastError () returned 0x0 [0278.247] SetLastError (dwErrCode=0x0) [0278.247] GetLastError () returned 0x0 [0278.247] SetLastError (dwErrCode=0x0) [0278.247] GetLastError () returned 0x0 [0278.247] SetLastError (dwErrCode=0x0) [0278.247] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Windows\\", psz="C:\\Windows\\", len=0xb | out: pbstr=0x5ffa08*="C:\\Windows\\") returned 1 [0278.248] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Windows\\", psz="C:\\Windows\\", len=0xb | out: pbstr=0x5ff968*="C:\\Windows\\") returned 1 [0278.248] CharLowerBuffW (in: lpsz="C:\\Windows\\", cchLength=0xb | out: lpsz="c:\\windows\\") returned 0xb [0278.248] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Windows\\", psz="c:\\windows\\", len=0xb | out: pbstr=0x5ffa08*="c:\\windows\\") returned 1 [0278.248] SysReAllocStringLen (in: pbstr=0x2560f28*=0x0, psz="c:\\windows\\", len=0xb | out: pbstr=0x2560f28*="c:\\windows\\") returned 1 [0278.248] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x2570650 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Documents") returned 0x0 [0278.258] GetLastError () returned 0x0 [0278.258] SetLastError (dwErrCode=0x0) [0278.258] GetLastError () returned 0x0 [0278.258] SetLastError (dwErrCode=0x0) [0278.258] GetLastError () returned 0x0 [0278.258] SetLastError (dwErrCode=0x0) [0278.258] GetLastError () returned 0x0 [0278.258] SetLastError (dwErrCode=0x0) [0278.259] SysReAllocStringLen (in: pbstr=0x5ffa08*="c:\\windows\\", psz="C:\\Users\\RDhJ0CNFevzX\\Documents\\", len=0x20 | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\Documents\\") returned 1 [0278.259] GetThreadLocale () returned 0x409 [0278.259] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\Documents\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.259] GetThreadLocale () returned 0x409 [0278.259] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\Documents\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.259] GetLastError () returned 0x0 [0278.259] SetLastError (dwErrCode=0x0) [0278.259] GetLastError () returned 0x0 [0278.259] SetLastError (dwErrCode=0x0) [0278.259] GetLastError () returned 0x0 [0278.259] SetLastError (dwErrCode=0x0) [0278.259] GetLastError () returned 0x0 [0278.259] SetLastError (dwErrCode=0x0) [0278.259] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.259] GetLastError () returned 0x0 [0278.259] SetLastError (dwErrCode=0x0) [0278.259] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb3e8, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.259] GetLastError () returned 0x0 [0278.259] SetLastError (dwErrCode=0x0) [0278.259] GetLastError () returned 0x0 [0278.259] SetLastError (dwErrCode=0x0) [0278.259] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.259] GetLastError () returned 0x0 [0278.260] SetLastError (dwErrCode=0x0) [0278.260] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50f8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.260] GetLastError () returned 0x0 [0278.260] SetLastError (dwErrCode=0x0) [0278.260] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.260] GetLastError () returned 0x0 [0278.260] SetLastError (dwErrCode=0x0) [0278.260] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50f8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.260] GetLastError () returned 0x0 [0278.260] SetLastError (dwErrCode=0x0) [0278.260] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.260] GetLastError () returned 0x0 [0278.260] SetLastError (dwErrCode=0x0) [0278.260] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50f8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.260] GetLastError () returned 0x0 [0278.260] SetLastError (dwErrCode=0x0) [0278.260] GetLastError () returned 0x0 [0278.260] SetLastError (dwErrCode=0x0) [0278.260] GetLastError () returned 0x0 [0278.260] SetLastError (dwErrCode=0x0) [0278.260] GetLastError () returned 0x0 [0278.260] SetLastError (dwErrCode=0x0) [0278.260] GetLastError () returned 0x0 [0278.260] SetLastError (dwErrCode=0x0) [0278.260] GetLastError () returned 0x0 [0278.260] SetLastError (dwErrCode=0x0) [0278.260] GetLastError () returned 0x0 [0278.260] SetLastError (dwErrCode=0x0) [0278.261] GetLastError () returned 0x0 [0278.261] SetLastError (dwErrCode=0x0) [0278.261] GetLastError () returned 0x0 [0278.261] SetLastError (dwErrCode=0x0) [0278.261] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\Documents\\", psz="C:\\Users\\RDhJ0CNFevzX\\Documents\\", len=0x20 | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\Documents\\") returned 1 [0278.261] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\Documents\\", psz="C:\\Users\\RDhJ0CNFevzX\\Documents\\", len=0x20 | out: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\Documents\\") returned 1 [0278.261] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\Documents\\", cchLength=0x20 | out: lpsz="c:\\users\\rdhj0cnfevzx\\documents\\") returned 0x20 [0278.261] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\Documents\\", psz="c:\\users\\rdhj0cnfevzx\\documents\\", len=0x20 | out: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\documents\\") returned 1 [0278.261] SysReAllocStringLen (in: pbstr=0x2560f20*=0x0, psz="c:\\users\\rdhj0cnfevzx\\documents\\", len=0x20 | out: pbstr=0x2560f20*="c:\\users\\rdhj0cnfevzx\\documents\\") returned 1 [0278.261] SHGetFolderPathW (in: hwnd=0x0, csidl=46, hToken=0x0, dwFlags=0x0, pszPath=0x2570650 | out: pszPath="C:\\Users\\Public\\Documents") returned 0x0 [0278.263] GetLastError () returned 0x0 [0278.263] SetLastError (dwErrCode=0x0) [0278.263] GetLastError () returned 0x0 [0278.263] SetLastError (dwErrCode=0x0) [0278.263] GetLastError () returned 0x0 [0278.263] SetLastError (dwErrCode=0x0) [0278.263] GetLastError () returned 0x0 [0278.263] SetLastError (dwErrCode=0x0) [0278.263] SysReAllocStringLen (in: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\documents\\", psz="C:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x5ffa08*="C:\\Users\\Public\\Documents\\") returned 1 [0278.263] GetThreadLocale () returned 0x409 [0278.263] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\Public\\Documents\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.263] GetThreadLocale () returned 0x409 [0278.263] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\Public\\Documents\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.320] GetLastError () returned 0x0 [0278.320] SetLastError (dwErrCode=0x0) [0278.320] GetLastError () returned 0x0 [0278.320] SetLastError (dwErrCode=0x0) [0278.320] GetLastError () returned 0x0 [0278.321] SetLastError (dwErrCode=0x0) [0278.321] GetLastError () returned 0x0 [0278.321] SetLastError (dwErrCode=0x0) [0278.321] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.321] GetLastError () returned 0x0 [0278.321] SetLastError (dwErrCode=0x0) [0278.321] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb568, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.321] GetLastError () returned 0x0 [0278.321] SetLastError (dwErrCode=0x0) [0278.321] GetLastError () returned 0x0 [0278.321] SetLastError (dwErrCode=0x0) [0278.321] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.321] GetLastError () returned 0x0 [0278.321] SetLastError (dwErrCode=0x0) [0278.321] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50f8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.321] GetLastError () returned 0x0 [0278.321] SetLastError (dwErrCode=0x0) [0278.321] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.321] GetLastError () returned 0x0 [0278.321] SetLastError (dwErrCode=0x0) [0278.321] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50f8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.321] GetLastError () returned 0x0 [0278.321] SetLastError (dwErrCode=0x0) [0278.321] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.321] GetLastError () returned 0x0 [0278.322] SetLastError (dwErrCode=0x0) [0278.322] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50f8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.322] GetLastError () returned 0x0 [0278.322] SetLastError (dwErrCode=0x0) [0278.322] GetLastError () returned 0x0 [0278.322] SetLastError (dwErrCode=0x0) [0278.322] GetLastError () returned 0x0 [0278.322] SetLastError (dwErrCode=0x0) [0278.322] GetLastError () returned 0x0 [0278.322] SetLastError (dwErrCode=0x0) [0278.322] GetLastError () returned 0x0 [0278.322] SetLastError (dwErrCode=0x0) [0278.322] GetLastError () returned 0x0 [0278.322] SetLastError (dwErrCode=0x0) [0278.322] GetLastError () returned 0x0 [0278.322] SetLastError (dwErrCode=0x0) [0278.322] GetLastError () returned 0x0 [0278.322] SetLastError (dwErrCode=0x0) [0278.322] GetLastError () returned 0x0 [0278.322] SetLastError (dwErrCode=0x0) [0278.322] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\Public\\Documents\\", psz="C:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x5ffa08*="C:\\Users\\Public\\Documents\\") returned 1 [0278.322] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Users\\Public\\Documents\\", psz="C:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x5ff968*="C:\\Users\\Public\\Documents\\") returned 1 [0278.322] CharLowerBuffW (in: lpsz="C:\\Users\\Public\\Documents\\", cchLength=0x1a | out: lpsz="c:\\users\\public\\documents\\") returned 0x1a [0278.323] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\Public\\Documents\\", psz="c:\\users\\public\\documents\\", len=0x1a | out: pbstr=0x5ffa08*="c:\\users\\public\\documents\\") returned 1 [0278.323] SysReAllocStringLen (in: pbstr=0x2560f48*=0x0, psz="c:\\users\\public\\documents\\", len=0x1a | out: pbstr=0x2560f48*="c:\\users\\public\\documents\\") returned 1 [0278.323] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x2570650 | out: pszPath="C:\\Program Files") returned 0x0 [0278.324] GetLastError () returned 0x0 [0278.324] SetLastError (dwErrCode=0x0) [0278.324] GetLastError () returned 0x0 [0278.324] SetLastError (dwErrCode=0x0) [0278.324] GetLastError () returned 0x0 [0278.324] SetLastError (dwErrCode=0x0) [0278.324] GetLastError () returned 0x0 [0278.324] SetLastError (dwErrCode=0x0) [0278.324] SysReAllocStringLen (in: pbstr=0x5ffa08*="c:\\users\\public\\documents\\", psz="C:\\Program Files\\", len=0x11 | out: pbstr=0x5ffa08*="C:\\Program Files\\") returned 1 [0278.324] GetThreadLocale () returned 0x409 [0278.324] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Program Files\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.324] GetThreadLocale () returned 0x409 [0278.324] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Program Files\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.324] GetLastError () returned 0x0 [0278.325] SetLastError (dwErrCode=0x0) [0278.325] GetLastError () returned 0x0 [0278.325] SetLastError (dwErrCode=0x0) [0278.325] GetLastError () returned 0x0 [0278.325] SetLastError (dwErrCode=0x0) [0278.325] GetLastError () returned 0x0 [0278.325] SetLastError (dwErrCode=0x0) [0278.325] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.325] GetLastError () returned 0x0 [0278.325] SetLastError (dwErrCode=0x0) [0278.325] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb568, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.325] GetLastError () returned 0x0 [0278.325] SetLastError (dwErrCode=0x0) [0278.325] GetLastError () returned 0x0 [0278.325] SetLastError (dwErrCode=0x0) [0278.325] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.325] GetLastError () returned 0x0 [0278.325] SetLastError (dwErrCode=0x0) [0278.325] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.325] GetLastError () returned 0x0 [0278.325] SetLastError (dwErrCode=0x0) [0278.325] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.325] GetLastError () returned 0x0 [0278.325] SetLastError (dwErrCode=0x0) [0278.325] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e50b8, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.325] GetLastError () returned 0x0 [0278.325] SetLastError (dwErrCode=0x0) [0278.325] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.325] GetLastError () returned 0x0 [0278.326] SetLastError (dwErrCode=0x0) [0278.326] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e50b8, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.326] GetLastError () returned 0x0 [0278.326] SetLastError (dwErrCode=0x0) [0278.326] GetLastError () returned 0x0 [0278.326] SetLastError (dwErrCode=0x0) [0278.326] GetLastError () returned 0x0 [0278.326] SetLastError (dwErrCode=0x0) [0278.326] GetLastError () returned 0x0 [0278.326] SetLastError (dwErrCode=0x0) [0278.326] GetLastError () returned 0x0 [0278.326] SetLastError (dwErrCode=0x0) [0278.326] GetLastError () returned 0x0 [0278.326] SetLastError (dwErrCode=0x0) [0278.326] GetLastError () returned 0x0 [0278.326] SetLastError (dwErrCode=0x0) [0278.326] GetLastError () returned 0x0 [0278.326] SetLastError (dwErrCode=0x0) [0278.326] GetLastError () returned 0x0 [0278.326] SetLastError (dwErrCode=0x0) [0278.326] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Program Files\\", psz="C:\\Program Files\\", len=0x11 | out: pbstr=0x5ffa08*="C:\\Program Files\\") returned 1 [0278.326] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Program Files\\", psz="C:\\Program Files\\", len=0x11 | out: pbstr=0x5ff968*="C:\\Program Files\\") returned 1 [0278.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0278.326] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Program Files\\", psz="c:\\program files\\", len=0x11 | out: pbstr=0x5ffa08*="c:\\program files\\") returned 1 [0278.327] SysReAllocStringLen (in: pbstr=0x2560f50*=0x0, psz="c:\\program files\\", len=0x11 | out: pbstr=0x2560f50*="c:\\program files\\") returned 1 [0278.327] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x2570650 | out: pszPath="C:\\ProgramData") returned 0x0 [0278.327] GetLastError () returned 0x0 [0278.328] SetLastError (dwErrCode=0x0) [0278.328] GetLastError () returned 0x0 [0278.328] SetLastError (dwErrCode=0x0) [0278.328] GetLastError () returned 0x0 [0278.328] SetLastError (dwErrCode=0x0) [0278.328] GetLastError () returned 0x0 [0278.328] SetLastError (dwErrCode=0x0) [0278.328] SysReAllocStringLen (in: pbstr=0x5ffa08*="c:\\program files\\", psz="C:\\ProgramData\\", len=0xf | out: pbstr=0x5ffa08*="C:\\ProgramData\\") returned 1 [0278.328] GetThreadLocale () returned 0x409 [0278.328] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\ProgramData\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.328] GetThreadLocale () returned 0x409 [0278.328] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\ProgramData\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.328] GetLastError () returned 0x0 [0278.328] SetLastError (dwErrCode=0x0) [0278.328] GetLastError () returned 0x0 [0278.328] SetLastError (dwErrCode=0x0) [0278.328] GetLastError () returned 0x0 [0278.328] SetLastError (dwErrCode=0x0) [0278.328] GetLastError () returned 0x0 [0278.328] SetLastError (dwErrCode=0x0) [0278.329] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.329] GetLastError () returned 0x0 [0278.329] SetLastError (dwErrCode=0x0) [0278.329] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb568, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.329] GetLastError () returned 0x0 [0278.329] SetLastError (dwErrCode=0x0) [0278.329] GetLastError () returned 0x0 [0278.329] SetLastError (dwErrCode=0x0) [0278.329] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.329] GetLastError () returned 0x0 [0278.329] SetLastError (dwErrCode=0x0) [0278.329] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5178, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.329] GetLastError () returned 0x0 [0278.329] SetLastError (dwErrCode=0x0) [0278.329] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.329] GetLastError () returned 0x0 [0278.329] SetLastError (dwErrCode=0x0) [0278.329] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5178, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.329] GetLastError () returned 0x0 [0278.329] SetLastError (dwErrCode=0x0) [0278.329] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.329] GetLastError () returned 0x0 [0278.329] SetLastError (dwErrCode=0x0) [0278.329] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5178, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.329] GetLastError () returned 0x0 [0278.329] SetLastError (dwErrCode=0x0) [0278.329] GetLastError () returned 0x0 [0278.329] SetLastError (dwErrCode=0x0) [0278.329] GetLastError () returned 0x0 [0278.330] SetLastError (dwErrCode=0x0) [0278.330] GetLastError () returned 0x0 [0278.330] SetLastError (dwErrCode=0x0) [0278.330] GetLastError () returned 0x0 [0278.330] SetLastError (dwErrCode=0x0) [0278.330] GetLastError () returned 0x0 [0278.330] SetLastError (dwErrCode=0x0) [0278.330] GetLastError () returned 0x0 [0278.330] SetLastError (dwErrCode=0x0) [0278.330] GetLastError () returned 0x0 [0278.330] SetLastError (dwErrCode=0x0) [0278.330] GetLastError () returned 0x0 [0278.330] SetLastError (dwErrCode=0x0) [0278.330] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\ProgramData\\", psz="C:\\ProgramData\\", len=0xf | out: pbstr=0x5ffa08*="C:\\ProgramData\\") returned 1 [0278.330] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\ProgramData\\", psz="C:\\ProgramData\\", len=0xf | out: pbstr=0x5ff968*="C:\\ProgramData\\") returned 1 [0278.330] CharLowerBuffW (in: lpsz="C:\\ProgramData\\", cchLength=0xf | out: lpsz="c:\\programdata\\") returned 0xf [0278.330] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\ProgramData\\", psz="c:\\programdata\\", len=0xf | out: pbstr=0x5ffa08*="c:\\programdata\\") returned 1 [0278.330] SysReAllocStringLen (in: pbstr=0x2560f58*=0x0, psz="c:\\programdata\\", len=0xf | out: pbstr=0x2560f58*="c:\\programdata\\") returned 1 [0278.330] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0x2570650 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0278.331] GetLastError () returned 0x0 [0278.331] SetLastError (dwErrCode=0x0) [0278.331] GetLastError () returned 0x0 [0278.331] SetLastError (dwErrCode=0x0) [0278.331] GetLastError () returned 0x0 [0278.331] SetLastError (dwErrCode=0x0) [0278.331] GetLastError () returned 0x0 [0278.331] SetLastError (dwErrCode=0x0) [0278.331] SysReAllocStringLen (in: pbstr=0x5ffa08*="c:\\programdata\\", psz="C:\\Program Files\\Common Files\\", len=0x1e | out: pbstr=0x5ffa08*="C:\\Program Files\\Common Files\\") returned 1 [0278.332] GetThreadLocale () returned 0x409 [0278.332] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Program Files\\Common Files\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.332] GetThreadLocale () returned 0x409 [0278.332] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Program Files\\Common Files\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.332] GetLastError () returned 0x0 [0278.332] SetLastError (dwErrCode=0x0) [0278.332] GetLastError () returned 0x0 [0278.332] SetLastError (dwErrCode=0x0) [0278.332] GetLastError () returned 0x0 [0278.332] SetLastError (dwErrCode=0x0) [0278.332] GetLastError () returned 0x0 [0278.332] SetLastError (dwErrCode=0x0) [0278.332] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.332] GetLastError () returned 0x0 [0278.332] SetLastError (dwErrCode=0x0) [0278.332] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb568, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.332] GetLastError () returned 0x0 [0278.332] SetLastError (dwErrCode=0x0) [0278.332] GetLastError () returned 0x0 [0278.332] SetLastError (dwErrCode=0x0) [0278.332] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.332] GetLastError () returned 0x0 [0278.332] SetLastError (dwErrCode=0x0) [0278.332] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.332] GetLastError () returned 0x0 [0278.332] SetLastError (dwErrCode=0x0) [0278.332] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.332] GetLastError () returned 0x0 [0278.333] SetLastError (dwErrCode=0x0) [0278.333] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.333] GetLastError () returned 0x0 [0278.333] SetLastError (dwErrCode=0x0) [0278.333] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.333] GetLastError () returned 0x0 [0278.333] SetLastError (dwErrCode=0x0) [0278.333] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.333] GetLastError () returned 0x0 [0278.333] SetLastError (dwErrCode=0x0) [0278.333] GetLastError () returned 0x0 [0278.333] SetLastError (dwErrCode=0x0) [0278.333] GetLastError () returned 0x0 [0278.333] SetLastError (dwErrCode=0x0) [0278.333] GetLastError () returned 0x0 [0278.333] SetLastError (dwErrCode=0x0) [0278.333] GetLastError () returned 0x0 [0278.333] SetLastError (dwErrCode=0x0) [0278.333] GetLastError () returned 0x0 [0278.333] SetLastError (dwErrCode=0x0) [0278.333] GetLastError () returned 0x0 [0278.333] SetLastError (dwErrCode=0x0) [0278.333] GetLastError () returned 0x0 [0278.333] SetLastError (dwErrCode=0x0) [0278.333] GetLastError () returned 0x0 [0278.333] SetLastError (dwErrCode=0x0) [0278.334] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Program Files\\Common Files\\", psz="C:\\Program Files\\Common Files\\", len=0x1e | out: pbstr=0x5ffa08*="C:\\Program Files\\Common Files\\") returned 1 [0278.334] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Program Files\\Common Files\\", psz="C:\\Program Files\\Common Files\\", len=0x1e | out: pbstr=0x5ff968*="C:\\Program Files\\Common Files\\") returned 1 [0278.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0278.334] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Program Files\\Common Files\\", psz="c:\\program files\\common files\\", len=0x1e | out: pbstr=0x5ffa08*="c:\\program files\\common files\\") returned 1 [0278.334] SysReAllocStringLen (in: pbstr=0x2560f60*=0x0, psz="c:\\program files\\common files\\", len=0x1e | out: pbstr=0x2560f60*="c:\\program files\\common files\\") returned 1 [0278.334] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x2570650 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Pictures") returned 0x0 [0278.335] GetLastError () returned 0x0 [0278.335] SetLastError (dwErrCode=0x0) [0278.335] GetLastError () returned 0x0 [0278.335] SetLastError (dwErrCode=0x0) [0278.335] GetLastError () returned 0x0 [0278.335] SetLastError (dwErrCode=0x0) [0278.335] GetLastError () returned 0x0 [0278.335] SetLastError (dwErrCode=0x0) [0278.335] SysReAllocStringLen (in: pbstr=0x5ffa08*="c:\\program files\\common files\\", psz="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", len=0x1f | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\Pictures\\") returned 1 [0278.335] GetThreadLocale () returned 0x409 [0278.335] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.335] GetThreadLocale () returned 0x409 [0278.335] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.335] GetLastError () returned 0x0 [0278.335] SetLastError (dwErrCode=0x0) [0278.336] GetLastError () returned 0x0 [0278.336] SetLastError (dwErrCode=0x0) [0278.336] GetLastError () returned 0x0 [0278.336] SetLastError (dwErrCode=0x0) [0278.336] GetLastError () returned 0x0 [0278.336] SetLastError (dwErrCode=0x0) [0278.336] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.336] GetLastError () returned 0x0 [0278.336] SetLastError (dwErrCode=0x0) [0278.336] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb568, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.336] GetLastError () returned 0x0 [0278.336] SetLastError (dwErrCode=0x0) [0278.336] GetLastError () returned 0x0 [0278.336] SetLastError (dwErrCode=0x0) [0278.336] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.336] GetLastError () returned 0x0 [0278.336] SetLastError (dwErrCode=0x0) [0278.336] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.336] GetLastError () returned 0x0 [0278.336] SetLastError (dwErrCode=0x0) [0278.336] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.336] GetLastError () returned 0x0 [0278.336] SetLastError (dwErrCode=0x0) [0278.336] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.336] GetLastError () returned 0x0 [0278.336] SetLastError (dwErrCode=0x0) [0278.336] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.336] GetLastError () returned 0x0 [0278.336] SetLastError (dwErrCode=0x0) [0278.336] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.337] GetLastError () returned 0x0 [0278.337] SetLastError (dwErrCode=0x0) [0278.337] GetLastError () returned 0x0 [0278.337] SetLastError (dwErrCode=0x0) [0278.337] GetLastError () returned 0x0 [0278.337] SetLastError (dwErrCode=0x0) [0278.337] GetLastError () returned 0x0 [0278.337] SetLastError (dwErrCode=0x0) [0278.337] GetLastError () returned 0x0 [0278.337] SetLastError (dwErrCode=0x0) [0278.337] GetLastError () returned 0x0 [0278.337] SetLastError (dwErrCode=0x0) [0278.337] GetLastError () returned 0x0 [0278.337] SetLastError (dwErrCode=0x0) [0278.337] GetLastError () returned 0x0 [0278.337] SetLastError (dwErrCode=0x0) [0278.337] GetLastError () returned 0x0 [0278.337] SetLastError (dwErrCode=0x0) [0278.337] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", psz="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", len=0x1f | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\Pictures\\") returned 1 [0278.337] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", psz="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", len=0x1f | out: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\Pictures\\") returned 1 [0278.337] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", cchLength=0x1f | out: lpsz="c:\\users\\rdhj0cnfevzx\\pictures\\") returned 0x1f [0278.337] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\Pictures\\", psz="c:\\users\\rdhj0cnfevzx\\pictures\\", len=0x1f | out: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\pictures\\") returned 1 [0278.337] SysReAllocStringLen (in: pbstr=0x2560f68*=0x0, psz="c:\\users\\rdhj0cnfevzx\\pictures\\", len=0x1f | out: pbstr=0x2560f68*="c:\\users\\rdhj0cnfevzx\\pictures\\") returned 1 [0278.337] SHGetFolderPathW (in: hwnd=0x0, csidl=34, hToken=0x0, dwFlags=0x0, pszPath=0x2570650 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x0 [0278.338] GetLastError () returned 0x0 [0278.338] SetLastError (dwErrCode=0x0) [0278.338] GetLastError () returned 0x0 [0278.338] SetLastError (dwErrCode=0x0) [0278.339] GetLastError () returned 0x0 [0278.339] SetLastError (dwErrCode=0x0) [0278.339] GetLastError () returned 0x0 [0278.339] SetLastError (dwErrCode=0x0) [0278.339] SysReAllocStringLen (in: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\pictures\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x3e | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0278.339] GetThreadLocale () returned 0x409 [0278.339] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.339] GetThreadLocale () returned 0x409 [0278.339] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.339] GetLastError () returned 0x0 [0278.339] SetLastError (dwErrCode=0x0) [0278.339] GetLastError () returned 0x0 [0278.339] SetLastError (dwErrCode=0x0) [0278.339] GetLastError () returned 0x0 [0278.339] SetLastError (dwErrCode=0x0) [0278.339] GetLastError () returned 0x0 [0278.339] SetLastError (dwErrCode=0x0) [0278.339] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.339] GetLastError () returned 0x0 [0278.339] SetLastError (dwErrCode=0x0) [0278.339] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb568, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.340] GetLastError () returned 0x0 [0278.340] SetLastError (dwErrCode=0x0) [0278.340] GetLastError () returned 0x0 [0278.340] SetLastError (dwErrCode=0x0) [0278.340] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.340] GetLastError () returned 0x0 [0278.340] SetLastError (dwErrCode=0x0) [0278.340] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.340] GetLastError () returned 0x0 [0278.340] SetLastError (dwErrCode=0x0) [0278.340] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.340] GetLastError () returned 0x0 [0278.340] SetLastError (dwErrCode=0x0) [0278.340] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.340] GetLastError () returned 0x0 [0278.340] SetLastError (dwErrCode=0x0) [0278.340] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.340] GetLastError () returned 0x0 [0278.340] SetLastError (dwErrCode=0x0) [0278.340] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.340] GetLastError () returned 0x0 [0278.340] SetLastError (dwErrCode=0x0) [0278.340] GetLastError () returned 0x0 [0278.340] SetLastError (dwErrCode=0x0) [0278.340] GetLastError () returned 0x0 [0278.340] SetLastError (dwErrCode=0x0) [0278.340] GetLastError () returned 0x0 [0278.340] SetLastError (dwErrCode=0x0) [0278.341] GetLastError () returned 0x0 [0278.341] SetLastError (dwErrCode=0x0) [0278.341] GetLastError () returned 0x0 [0278.341] SetLastError (dwErrCode=0x0) [0278.341] GetLastError () returned 0x0 [0278.341] SetLastError (dwErrCode=0x0) [0278.341] GetLastError () returned 0x0 [0278.341] SetLastError (dwErrCode=0x0) [0278.341] GetLastError () returned 0x0 [0278.341] SetLastError (dwErrCode=0x0) [0278.341] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x3e | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0278.341] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x3e | out: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0278.341] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", cchLength=0x3e | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\") returned 0x3e [0278.341] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\", len=0x3e | out: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\") returned 1 [0278.341] SysReAllocStringLen (in: pbstr=0x2560f70*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\", len=0x3e | out: pbstr=0x2560f70*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\") returned 1 [0278.341] SHGetFolderPathW (in: hwnd=0x0, csidl=33, hToken=0x0, dwFlags=0x0, pszPath=0x2570650 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies") returned 0x0 [0278.342] GetLastError () returned 0x0 [0278.342] SetLastError (dwErrCode=0x0) [0278.342] GetProcessHeap () returned 0x710000 [0278.342] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x6f0f90 [0278.343] GetLastError () returned 0x0 [0278.343] SetLastError (dwErrCode=0x0) [0278.343] GetLastError () returned 0x0 [0278.343] SetLastError (dwErrCode=0x0) [0278.344] GetLastError () returned 0x0 [0278.344] SetLastError (dwErrCode=0x0) [0278.344] SysReAllocStringLen (in: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", len=0x42 | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\") returned 1 [0278.344] GetThreadLocale () returned 0x409 [0278.344] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.344] GetThreadLocale () returned 0x409 [0278.344] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.344] GetLastError () returned 0x0 [0278.344] SetLastError (dwErrCode=0x0) [0278.344] GetLastError () returned 0x0 [0278.344] SetLastError (dwErrCode=0x0) [0278.344] GetLastError () returned 0x0 [0278.344] SetLastError (dwErrCode=0x0) [0278.344] GetLastError () returned 0x0 [0278.344] SetLastError (dwErrCode=0x0) [0278.344] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.344] GetLastError () returned 0x0 [0278.344] SetLastError (dwErrCode=0x0) [0278.344] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb568, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.344] GetLastError () returned 0x0 [0278.344] SetLastError (dwErrCode=0x0) [0278.344] GetLastError () returned 0x0 [0278.344] SetLastError (dwErrCode=0x0) [0278.344] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.344] GetLastError () returned 0x0 [0278.344] SetLastError (dwErrCode=0x0) [0278.345] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.345] GetLastError () returned 0x0 [0278.345] SetLastError (dwErrCode=0x0) [0278.345] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.345] GetLastError () returned 0x0 [0278.345] SetLastError (dwErrCode=0x0) [0278.345] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.345] GetLastError () returned 0x0 [0278.345] SetLastError (dwErrCode=0x0) [0278.345] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.345] GetLastError () returned 0x0 [0278.345] SetLastError (dwErrCode=0x0) [0278.345] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.345] GetLastError () returned 0x0 [0278.345] SetLastError (dwErrCode=0x0) [0278.345] GetLastError () returned 0x0 [0278.345] SetLastError (dwErrCode=0x0) [0278.345] GetLastError () returned 0x0 [0278.345] SetLastError (dwErrCode=0x0) [0278.345] GetLastError () returned 0x0 [0278.345] SetLastError (dwErrCode=0x0) [0278.345] GetLastError () returned 0x0 [0278.345] SetLastError (dwErrCode=0x0) [0278.345] GetLastError () returned 0x0 [0278.346] SetLastError (dwErrCode=0x0) [0278.346] GetLastError () returned 0x0 [0278.346] SetLastError (dwErrCode=0x0) [0278.346] GetLastError () returned 0x0 [0278.346] SetLastError (dwErrCode=0x0) [0278.346] GetLastError () returned 0x0 [0278.346] SetLastError (dwErrCode=0x0) [0278.346] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", len=0x42 | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\") returned 1 [0278.346] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", len=0x42 | out: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\") returned 1 [0278.346] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", cchLength=0x42 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\") returned 0x42 [0278.346] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\", len=0x42 | out: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\") returned 1 [0278.346] SysReAllocStringLen (in: pbstr=0x2560f78*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\", len=0x42 | out: pbstr=0x2560f78*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\") returned 1 [0278.346] SHGetFolderPathW (in: hwnd=0x0, csidl=32, hToken=0x0, dwFlags=0x0, pszPath=0x2570650 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache") returned 0x0 [0278.347] GetLastError () returned 0x0 [0278.347] SetLastError (dwErrCode=0x0) [0278.347] GetLastError () returned 0x0 [0278.347] SetLastError (dwErrCode=0x0) [0278.347] GetLastError () returned 0x0 [0278.347] SetLastError (dwErrCode=0x0) [0278.347] GetLastError () returned 0x0 [0278.347] SetLastError (dwErrCode=0x0) [0278.347] SysReAllocStringLen (in: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", len=0x40 | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 1 [0278.347] GetThreadLocale () returned 0x409 [0278.347] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.347] GetThreadLocale () returned 0x409 [0278.347] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.348] GetLastError () returned 0x0 [0278.348] SetLastError (dwErrCode=0x0) [0278.348] GetLastError () returned 0x0 [0278.348] SetLastError (dwErrCode=0x0) [0278.348] GetLastError () returned 0x0 [0278.348] SetLastError (dwErrCode=0x0) [0278.348] GetLastError () returned 0x0 [0278.348] SetLastError (dwErrCode=0x0) [0278.348] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.348] GetLastError () returned 0x0 [0278.348] SetLastError (dwErrCode=0x0) [0278.348] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb568, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.348] GetLastError () returned 0x0 [0278.348] SetLastError (dwErrCode=0x0) [0278.348] GetLastError () returned 0x0 [0278.348] SetLastError (dwErrCode=0x0) [0278.348] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.348] GetLastError () returned 0x0 [0278.348] SetLastError (dwErrCode=0x0) [0278.348] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.348] GetLastError () returned 0x0 [0278.348] SetLastError (dwErrCode=0x0) [0278.348] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.348] GetLastError () returned 0x0 [0278.348] SetLastError (dwErrCode=0x0) [0278.348] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.348] GetLastError () returned 0x0 [0278.348] SetLastError (dwErrCode=0x0) [0278.349] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.349] GetLastError () returned 0x0 [0278.349] SetLastError (dwErrCode=0x0) [0278.349] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.349] GetLastError () returned 0x0 [0278.349] SetLastError (dwErrCode=0x0) [0278.349] GetLastError () returned 0x0 [0278.349] SetLastError (dwErrCode=0x0) [0278.349] GetLastError () returned 0x0 [0278.349] SetLastError (dwErrCode=0x0) [0278.349] GetLastError () returned 0x0 [0278.349] SetLastError (dwErrCode=0x0) [0278.349] GetLastError () returned 0x0 [0278.349] SetLastError (dwErrCode=0x0) [0278.349] GetLastError () returned 0x0 [0278.349] SetLastError (dwErrCode=0x0) [0278.349] GetLastError () returned 0x0 [0278.349] SetLastError (dwErrCode=0x0) [0278.349] GetLastError () returned 0x0 [0278.349] SetLastError (dwErrCode=0x0) [0278.349] GetLastError () returned 0x0 [0278.349] SetLastError (dwErrCode=0x0) [0278.349] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", len=0x40 | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 1 [0278.349] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", len=0x40 | out: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 1 [0278.350] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", cchLength=0x40 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\") returned 0x40 [0278.350] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\", len=0x40 | out: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\") returned 1 [0278.350] SysReAllocStringLen (in: pbstr=0x2560f80*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\", len=0x40 | out: pbstr=0x2560f80*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\") returned 1 [0278.350] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x2570650 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0278.350] GetLastError () returned 0x0 [0278.350] SetLastError (dwErrCode=0x0) [0278.351] GetLastError () returned 0x0 [0278.351] SetLastError (dwErrCode=0x0) [0278.351] GetLastError () returned 0x0 [0278.351] SetLastError (dwErrCode=0x0) [0278.351] GetLastError () returned 0x0 [0278.351] SetLastError (dwErrCode=0x0) [0278.351] SysReAllocStringLen (in: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", len=0x26 | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\") returned 1 [0278.351] GetThreadLocale () returned 0x409 [0278.351] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", cchCount1=4, lpString2="\\\\?\\", cchCount2=4) returned 3 [0278.351] GetThreadLocale () returned 0x409 [0278.351] CompareStringW (Locale=0x409, dwCmpFlags=0x1, lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", cchCount1=4, lpString2="\\??\\", cchCount2=4) returned 3 [0278.351] GetLastError () returned 0x0 [0278.351] SetLastError (dwErrCode=0x0) [0278.351] GetLastError () returned 0x0 [0278.351] SetLastError (dwErrCode=0x0) [0278.351] GetLastError () returned 0x0 [0278.351] SetLastError (dwErrCode=0x0) [0278.351] GetLastError () returned 0x0 [0278.351] SetLastError (dwErrCode=0x0) [0278.351] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff770 | out: lpBuffer=0x0, lpFilePart=0x5ff770*=0x0) returned 0x2a [0278.352] GetLastError () returned 0x0 [0278.352] SetLastError (dwErrCode=0x0) [0278.352] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb468, lpFilePart=0x5ff770 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff770*="Temp") returned 0x28 [0278.352] GetLastError () returned 0x0 [0278.352] SetLastError (dwErrCode=0x0) [0278.352] GetLastError () returned 0x0 [0278.352] SetLastError (dwErrCode=0x0) [0278.352] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.352] GetLastError () returned 0x0 [0278.352] SetLastError (dwErrCode=0x0) [0278.352] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.352] GetLastError () returned 0x0 [0278.352] SetLastError (dwErrCode=0x0) [0278.352] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.352] GetLastError () returned 0x0 [0278.352] SetLastError (dwErrCode=0x0) [0278.352] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5138, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.352] GetLastError () returned 0x0 [0278.352] SetLastError (dwErrCode=0x0) [0278.352] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.352] GetLastError () returned 0x0 [0278.352] SetLastError (dwErrCode=0x0) [0278.352] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5138, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.352] GetLastError () returned 0x0 [0278.353] SetLastError (dwErrCode=0x0) [0278.353] GetLastError () returned 0x0 [0278.353] SetLastError (dwErrCode=0x0) [0278.353] GetLastError () returned 0x0 [0278.353] SetLastError (dwErrCode=0x0) [0278.353] GetLastError () returned 0x0 [0278.353] SetLastError (dwErrCode=0x0) [0278.353] GetLastError () returned 0x0 [0278.353] SetLastError (dwErrCode=0x0) [0278.353] GetLastError () returned 0x0 [0278.353] SetLastError (dwErrCode=0x0) [0278.353] GetLastError () returned 0x0 [0278.353] SetLastError (dwErrCode=0x0) [0278.353] GetLastError () returned 0x0 [0278.353] SetLastError (dwErrCode=0x0) [0278.353] GetLastError () returned 0x0 [0278.353] SetLastError (dwErrCode=0x0) [0278.353] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", len=0x26 | out: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\") returned 1 [0278.353] SysReAllocStringLen (in: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", len=0x26 | out: pbstr=0x5ff968*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\") returned 1 [0278.353] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", cchLength=0x26 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\") returned 0x26 [0278.353] SysReAllocStringLen (in: pbstr=0x5ffa08*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\", len=0x26 | out: pbstr=0x5ffa08*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\") returned 1 [0278.353] SysReAllocStringLen (in: pbstr=0x2560f88*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\", len=0x26 | out: pbstr=0x2560f88*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\") returned 1 [0278.353] GetLastError () returned 0x0 [0278.353] SetLastError (dwErrCode=0x0) [0278.353] GetLastError () returned 0x0 [0278.354] SetLastError (dwErrCode=0x0) [0278.354] GetLastError () returned 0x0 [0278.354] SetLastError (dwErrCode=0x0) [0278.354] GetVersion () returned 0x23f00206 [0278.354] GetCurrentProcessId () returned 0x694 [0278.354] GetCurrentProcess () returned 0xffffffffffffffff [0278.354] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe\" " [0278.354] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe\" " [0278.354] GetLastError () returned 0x0 [0278.354] SetLastError (dwErrCode=0x0) [0278.354] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe\" " [0278.354] GetCommandLineW () returned="\"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe\" " [0278.354] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0278.354] RtlDosPathNameToNtPathName_U (in: DosPathName="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe", NtPathName=0x5ff978, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0278.354] NtCreateFile (in: FileHandle=0x5ff998, DesiredAccess=0x80100080, ObjectAttributes=0x5ff948*(Length=0x30, RootDirectory=0x0, ObjectName="\\??\\c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x5ff988, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x1, CreateDisposition=0x1, CreateOptions=0x60, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x5ff998*=0x1c8, IoStatusBlock=0x5ff988*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0278.355] RtlFreeAnsiString (AnsiString="\\") [0278.355] NtSetInformationFile (FileHandle=0x1c8, IoStatusBlock=0x5ff978, FileInformation=0x5ff988, Length=0x8, FileInformationClass=0xe) returned 0x0 [0278.355] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x5ff978, Buffer=0x5ffb58, BufferLength=0x40, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x5ff978, Buffer=0x5ffb58*) returned 0x0 [0278.356] NtSetInformationFile (FileHandle=0x1c8, IoStatusBlock=0x5ff978, FileInformation=0x5ff988, Length=0x8, FileInformationClass=0xe) returned 0x0 [0278.356] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x5ff978, Buffer=0x5ffb38, BufferLength=0x14, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x5ff978, Buffer=0x5ffb38*) returned 0x0 [0278.356] NtSetInformationFile (FileHandle=0x1c8, IoStatusBlock=0x5ff978, FileInformation=0x5ff988, Length=0x8, FileInformationClass=0xe) returned 0x0 [0278.356] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x5ff978, Buffer=0x5ffa48, BufferLength=0xf0, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x5ff978, Buffer=0x5ffa48*) returned 0x0 [0278.356] NtSetInformationFile (FileHandle=0x1c8, IoStatusBlock=0x5ff978, FileInformation=0x5ff988, Length=0x8, FileInformationClass=0xe) returned 0x0 [0278.356] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x5ff978, Buffer=0x5ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x5ff978, Buffer=0x5ffa20*) returned 0x0 [0278.356] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x5ff978, Buffer=0x5ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x5ff978, Buffer=0x5ffa20*) returned 0x0 [0278.356] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x5ff978, Buffer=0x5ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x5ff978, Buffer=0x5ffa20*) returned 0x0 [0278.356] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x5ff978, Buffer=0x5ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x5ff978, Buffer=0x5ffa20*) returned 0x0 [0278.356] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x5ff978, Buffer=0x5ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x5ff978, Buffer=0x5ffa20*) returned 0x0 [0278.356] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x5ff978, Buffer=0x5ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x5ff978, Buffer=0x5ffa20*) returned 0x0 [0278.356] NtReadFile (in: FileHandle=0x1c8, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x5ff978, Buffer=0x5ffa20, BufferLength=0x28, ByteOffset=0x0, Key=0x0 | out: IoStatusBlock=0x5ff978, Buffer=0x5ffa20*) returned 0x0 [0278.356] NtClose (Handle=0x1c8) returned 0x0 [0278.357] GetLastError () returned 0x0 [0278.357] SetLastError (dwErrCode=0x0) [0278.357] GetLastError () returned 0x0 [0278.357] SetLastError (dwErrCode=0x0) [0278.357] GetLastError () returned 0x0 [0278.357] SetLastError (dwErrCode=0x0) [0278.358] GetLastError () returned 0x0 [0278.358] GetLastError () returned 0x0 [0278.358] SetLastError (dwErrCode=0x0) [0278.358] GetProcessHeap () returned 0x710000 [0278.358] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x25a1f50 [0278.359] GetLastError () returned 0x0 [0278.359] SetLastError (dwErrCode=0x0) [0278.359] SetLastError (dwErrCode=0x0) [0278.359] GetLastError () returned 0x0 [0278.359] SetLastError (dwErrCode=0x0) [0278.359] GetLastError () returned 0x0 [0278.359] SetLastError (dwErrCode=0x0) [0278.359] GetLastError () returned 0x0 [0278.359] SetLastError (dwErrCode=0x0) [0278.359] GetLastError () returned 0x0 [0278.359] SetLastError (dwErrCode=0x0) [0278.359] GetLastError () returned 0x0 [0278.359] SetLastError (dwErrCode=0x0) [0278.359] GetLastError () returned 0x0 [0278.359] SetLastError (dwErrCode=0x0) [0278.359] GetProcessHeap () returned 0x710000 [0278.359] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x25a9f60 [0278.360] GetLastError () returned 0x0 [0278.360] SetLastError (dwErrCode=0x0) [0278.360] GetLastError () returned 0x0 [0278.360] SetLastError (dwErrCode=0x0) [0278.360] GetLastError () returned 0x0 [0278.360] SetLastError (dwErrCode=0x0) [0278.360] GetLastError () returned 0x0 [0278.360] SetLastError (dwErrCode=0x0) [0278.360] GetLastError () returned 0x0 [0278.361] SetLastError (dwErrCode=0x0) [0278.361] GetLastError () returned 0x0 [0278.361] SetLastError (dwErrCode=0x0) [0278.361] GetLastError () returned 0x0 [0278.361] SetLastError (dwErrCode=0x0) [0278.361] GetLastError () returned 0x0 [0278.361] SetLastError (dwErrCode=0x0) [0278.361] GetLastError () returned 0x0 [0278.361] SetLastError (dwErrCode=0x0) [0278.361] GetLastError () returned 0x0 [0278.361] SetLastError (dwErrCode=0x0) [0278.385] GetLastError () returned 0x0 [0278.385] SetLastError (dwErrCode=0x0) [0278.385] GetCurrentThreadId () returned 0x63c [0278.385] GetLastError () returned 0x0 [0278.385] SetLastError (dwErrCode=0x0) [0278.385] GetLastError () returned 0x0 [0278.385] SetLastError (dwErrCode=0x0) [0278.387] GetLastError () returned 0x0 [0278.387] SetLastError (dwErrCode=0x0) [0278.387] GetLastError () returned 0x0 [0278.387] SetLastError (dwErrCode=0x0) [0278.387] GetLastError () returned 0x0 [0278.387] SetLastError (dwErrCode=0x0) [0278.387] GetLastError () returned 0x0 [0278.387] SetLastError (dwErrCode=0x0) [0278.387] GetLastError () returned 0x0 [0278.387] SetLastError (dwErrCode=0x0) [0278.387] GetLastError () returned 0x0 [0278.387] SetLastError (dwErrCode=0x0) [0278.388] GetLastError () returned 0x0 [0278.388] SetLastError (dwErrCode=0x0) [0278.388] GetTickCount () returned 0xb88d1e [0278.388] GetLastError () returned 0x0 [0278.388] SetLastError (dwErrCode=0x0) [0278.388] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859774332) returned 1 [0278.388] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859781491) returned 1 [0278.388] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859787398) returned 1 [0278.388] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859793213) returned 1 [0278.388] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859799007) returned 1 [0278.388] Sleep (dwMilliseconds=0x0) [0278.388] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859829026) returned 1 [0278.388] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859834989) returned 1 [0278.389] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859840885) returned 1 [0278.389] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859846672) returned 1 [0278.389] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859852597) returned 1 [0278.389] Sleep (dwMilliseconds=0x0) [0278.389] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859878976) returned 1 [0278.389] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859884895) returned 1 [0278.389] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859890579) returned 1 [0278.389] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859896355) returned 1 [0278.389] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859902564) returned 1 [0278.389] Sleep (dwMilliseconds=0x0) [0278.390] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859940518) returned 1 [0278.390] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859946438) returned 1 [0278.390] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859952320) returned 1 [0278.390] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859960414) returned 1 [0278.390] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffc60 | out: lpPerformanceCount=0x5ffc60*=1219859966281) returned 1 [0278.390] Sleep (dwMilliseconds=0x0) [0278.390] GetTickCount () returned 0xb88d2d [0278.390] GetLastError () returned 0x0 [0278.390] SetLastError (dwErrCode=0x0) [0278.390] GetLastError () returned 0x0 [0278.390] SetLastError (dwErrCode=0x0) [0278.390] GetLastError () returned 0x0 [0278.390] SetLastError (dwErrCode=0x0) [0278.390] GetLastError () returned 0x0 [0278.390] SetLastError (dwErrCode=0x0) [0278.390] GetLastError () returned 0x0 [0278.390] SetLastError (dwErrCode=0x0) [0278.391] GetLastError () returned 0x0 [0278.391] SetLastError (dwErrCode=0x0) [0278.391] GetLastError () returned 0x0 [0278.391] SetLastError (dwErrCode=0x0) [0278.391] GetLastError () returned 0x0 [0278.391] SetLastError (dwErrCode=0x0) [0278.391] GetLastError () returned 0x0 [0278.391] SetLastError (dwErrCode=0x0) [0278.391] GetLastError () returned 0x0 [0278.391] SetLastError (dwErrCode=0x0) [0278.391] GetLastError () returned 0x0 [0278.391] SetLastError (dwErrCode=0x0) [0278.397] GetLastError () returned 0x0 [0278.397] SetLastError (dwErrCode=0x0) [0278.397] GetLastError () returned 0x0 [0278.397] SetLastError (dwErrCode=0x0) [0278.399] GetLastError () returned 0x0 [0278.399] SetLastError (dwErrCode=0x0) [0278.399] GetLastError () returned 0x0 [0278.399] SetLastError (dwErrCode=0x0) [0278.797] GetProcessHeap () returned 0x710000 [0278.797] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40000) returned 0x25b1f70 [0278.799] GetLastError () returned 0x0 [0278.799] SetLastError (dwErrCode=0x0) [0278.801] GetLastError () returned 0x0 [0278.801] SetLastError (dwErrCode=0x0) [0278.801] GetLastError () returned 0x0 [0278.801] SetLastError (dwErrCode=0x0) [0278.801] GetLastError () returned 0x0 [0278.801] SetLastError (dwErrCode=0x0) [0278.801] GetLastError () returned 0x0 [0278.801] SetLastError (dwErrCode=0x0) [0278.802] GetLastError () returned 0x0 [0278.802] SetLastError (dwErrCode=0x0) [0278.802] GetLastError () returned 0x0 [0278.802] SetLastError (dwErrCode=0x0) [0278.802] GetLastError () returned 0x0 [0278.802] SetLastError (dwErrCode=0x0) [0278.803] GetLastError () returned 0x0 [0278.804] SetLastError (dwErrCode=0x0) [0278.804] GetLastError () returned 0x0 [0278.804] SetLastError (dwErrCode=0x0) [0278.804] GetLastError () returned 0x0 [0278.804] SetLastError (dwErrCode=0x0) [0278.804] GetLastError () returned 0x0 [0278.804] SetLastError (dwErrCode=0x0) [0278.804] GetLastError () returned 0x0 [0278.804] SetLastError (dwErrCode=0x0) [0278.804] GetLastError () returned 0x0 [0278.804] SetLastError (dwErrCode=0x0) [0278.804] GetLastError () returned 0x0 [0278.804] SetLastError (dwErrCode=0x0) [0278.804] GetLastError () returned 0x0 [0278.804] SetLastError (dwErrCode=0x0) [0278.804] GetLastError () returned 0x0 [0278.804] SetLastError (dwErrCode=0x0) [0278.804] GetLastError () returned 0x0 [0278.805] SetLastError (dwErrCode=0x0) [0278.805] GetLastError () returned 0x0 [0278.805] SetLastError (dwErrCode=0x0) [0278.805] GetLastError () returned 0x0 [0278.805] SetLastError (dwErrCode=0x0) [0278.805] GetLastError () returned 0x0 [0278.805] SetLastError (dwErrCode=0x0) [0278.805] GetLastError () returned 0x0 [0278.805] SetLastError (dwErrCode=0x0) [0278.805] GetLastError () returned 0x0 [0278.805] SetLastError (dwErrCode=0x0) [0278.805] GetLastError () returned 0x0 [0278.805] SetLastError (dwErrCode=0x0) [0278.805] GetLastError () returned 0x0 [0278.805] SetLastError (dwErrCode=0x0) [0278.805] GetLastError () returned 0x0 [0278.805] SetLastError (dwErrCode=0x0) [0278.805] GetLastError () returned 0x0 [0278.806] SetLastError (dwErrCode=0x0) [0278.806] GetLastError () returned 0x0 [0278.806] SetLastError (dwErrCode=0x0) [0278.806] GetLastError () returned 0x0 [0278.806] SetLastError (dwErrCode=0x0) [0278.806] GetLastError () returned 0x0 [0278.806] SetLastError (dwErrCode=0x0) [0278.806] GetLastError () returned 0x0 [0278.806] SetLastError (dwErrCode=0x0) [0278.806] GetLastError () returned 0x0 [0278.806] SetLastError (dwErrCode=0x0) [0278.806] GetLastError () returned 0x0 [0278.806] SetLastError (dwErrCode=0x0) [0278.806] GetLastError () returned 0x0 [0278.806] SetLastError (dwErrCode=0x0) [0278.806] GetLastError () returned 0x0 [0278.806] SetLastError (dwErrCode=0x0) [0278.806] GetLastError () returned 0x0 [0278.806] SetLastError (dwErrCode=0x0) [0278.806] GetLastError () returned 0x0 [0278.806] SetLastError (dwErrCode=0x0) [0278.807] GetLastError () returned 0x0 [0278.807] SetLastError (dwErrCode=0x0) [0278.807] GetLastError () returned 0x0 [0278.807] SetLastError (dwErrCode=0x0) [0278.807] GetLastError () returned 0x0 [0278.807] SetLastError (dwErrCode=0x0) [0278.807] GetLastError () returned 0x0 [0278.807] SetLastError (dwErrCode=0x0) [0278.807] GetLastError () returned 0x0 [0278.807] SetLastError (dwErrCode=0x0) [0278.807] GetLastError () returned 0x0 [0278.807] SetLastError (dwErrCode=0x0) [0278.807] GetLastError () returned 0x0 [0278.807] SetLastError (dwErrCode=0x0) [0278.807] GetLastError () returned 0x0 [0278.808] SetLastError (dwErrCode=0x0) [0278.808] GetLastError () returned 0x0 [0278.808] SetLastError (dwErrCode=0x0) [0278.808] GetLastError () returned 0x0 [0278.808] SetLastError (dwErrCode=0x0) [0278.808] GetLastError () returned 0x0 [0278.808] SetLastError (dwErrCode=0x0) [0278.808] GetLastError () returned 0x0 [0278.808] GetLastError () returned 0x0 [0278.808] SetLastError (dwErrCode=0x0) [0278.808] GetLastError () returned 0x0 [0278.808] SetLastError (dwErrCode=0x0) [0278.808] SetLastError (dwErrCode=0x0) [0278.808] GetLastError () returned 0x0 [0278.808] SetLastError (dwErrCode=0x0) [0278.808] GetLastError () returned 0x0 [0278.808] SetLastError (dwErrCode=0x0) [0278.808] GetLastError () returned 0x0 [0278.809] SetLastError (dwErrCode=0x0) [0278.809] GetLastError () returned 0x0 [0278.809] SetLastError (dwErrCode=0x0) [0278.809] GetLastError () returned 0x0 [0278.809] SetLastError (dwErrCode=0x0) [0278.809] GetLastError () returned 0x0 [0278.809] SetLastError (dwErrCode=0x0) [0278.809] GetLastError () returned 0x0 [0278.809] SetLastError (dwErrCode=0x0) [0278.809] GetLastError () returned 0x0 [0278.809] SetLastError (dwErrCode=0x0) [0278.809] GetLastError () returned 0x0 [0278.809] SetLastError (dwErrCode=0x0) [0278.809] GetLastError () returned 0x0 [0278.809] SetLastError (dwErrCode=0x0) [0278.809] GetLastError () returned 0x0 [0278.810] SetLastError (dwErrCode=0x0) [0278.810] GetLastError () returned 0x0 [0278.810] SetLastError (dwErrCode=0x0) [0278.810] GetLastError () returned 0x0 [0278.810] SetLastError (dwErrCode=0x0) [0278.810] GetLastError () returned 0x0 [0278.810] SetLastError (dwErrCode=0x0) [0278.810] GetLastError () returned 0x0 [0278.810] SetLastError (dwErrCode=0x0) [0278.810] GetLastError () returned 0x0 [0278.810] SetLastError (dwErrCode=0x0) [0278.810] GetLastError () returned 0x0 [0278.810] SetLastError (dwErrCode=0x0) [0278.810] GetLastError () returned 0x0 [0278.810] SetLastError (dwErrCode=0x0) [0278.810] GetLastError () returned 0x0 [0278.810] SetLastError (dwErrCode=0x0) [0278.811] GetLastError () returned 0x0 [0278.811] SetLastError (dwErrCode=0x0) [0278.811] GetLastError () returned 0x0 [0278.811] SetLastError (dwErrCode=0x0) [0278.811] GetLastError () returned 0x0 [0278.811] SetLastError (dwErrCode=0x0) [0278.811] GetLastError () returned 0x0 [0278.811] SetLastError (dwErrCode=0x0) [0278.811] GetLastError () returned 0x0 [0278.811] SetLastError (dwErrCode=0x0) [0278.811] GetLastError () returned 0x0 [0278.811] SetLastError (dwErrCode=0x0) [0278.811] GetLastError () returned 0x0 [0278.811] SetLastError (dwErrCode=0x0) [0278.811] GetLastError () returned 0x0 [0278.811] SetLastError (dwErrCode=0x0) [0278.811] GetLastError () returned 0x0 [0278.811] SetLastError (dwErrCode=0x0) [0278.811] GetLastError () returned 0x0 [0278.812] SetLastError (dwErrCode=0x0) [0278.812] GetLastError () returned 0x0 [0278.812] SetLastError (dwErrCode=0x0) [0278.812] GetLastError () returned 0x0 [0278.812] SetLastError (dwErrCode=0x0) [0278.812] GetLastError () returned 0x0 [0278.812] SetLastError (dwErrCode=0x0) [0278.812] GetLastError () returned 0x0 [0278.812] SetLastError (dwErrCode=0x0) [0278.812] GetLastError () returned 0x0 [0278.812] SetLastError (dwErrCode=0x0) [0278.812] GetLastError () returned 0x0 [0278.812] SetLastError (dwErrCode=0x0) [0278.812] GetLastError () returned 0x0 [0278.812] SetLastError (dwErrCode=0x0) [0278.812] GetLastError () returned 0x0 [0278.812] SetLastError (dwErrCode=0x0) [0278.813] GetLastError () returned 0x0 [0278.813] SetLastError (dwErrCode=0x0) [0278.813] GetLastError () returned 0x0 [0278.813] SetLastError (dwErrCode=0x0) [0278.813] GetLastError () returned 0x0 [0278.813] SetLastError (dwErrCode=0x0) [0278.813] GetLastError () returned 0x0 [0278.813] SetLastError (dwErrCode=0x0) [0278.813] GetLastError () returned 0x0 [0278.813] SetLastError (dwErrCode=0x0) [0278.813] GetLastError () returned 0x0 [0278.813] SetLastError (dwErrCode=0x0) [0278.813] GetLastError () returned 0x0 [0278.813] SetLastError (dwErrCode=0x0) [0278.813] GetLastError () returned 0x0 [0278.813] SetLastError (dwErrCode=0x0) [0278.813] GetLastError () returned 0x0 [0278.813] SetLastError (dwErrCode=0x0) [0278.814] GetLastError () returned 0x0 [0278.814] SetLastError (dwErrCode=0x0) [0278.814] GetLastError () returned 0x0 [0278.814] SetLastError (dwErrCode=0x0) [0278.814] GetLastError () returned 0x0 [0278.814] SetLastError (dwErrCode=0x0) [0278.814] GetLastError () returned 0x0 [0278.814] SetLastError (dwErrCode=0x0) [0278.814] GetLastError () returned 0x0 [0278.814] SetLastError (dwErrCode=0x0) [0278.814] GetLastError () returned 0x0 [0278.814] SetLastError (dwErrCode=0x0) [0278.814] GetLastError () returned 0x0 [0278.814] SetLastError (dwErrCode=0x0) [0278.814] GetLastError () returned 0x0 [0278.814] SetLastError (dwErrCode=0x0) [0278.814] GetLastError () returned 0x0 [0278.814] SetLastError (dwErrCode=0x0) [0278.814] GetLastError () returned 0x0 [0278.814] SetLastError (dwErrCode=0x0) [0278.815] GetLastError () returned 0x0 [0278.815] SetLastError (dwErrCode=0x0) [0278.815] GetLastError () returned 0x0 [0278.815] SetLastError (dwErrCode=0x0) [0278.815] GetLastError () returned 0x0 [0278.815] SetLastError (dwErrCode=0x0) [0278.815] GetLastError () returned 0x0 [0278.815] SetLastError (dwErrCode=0x0) [0278.815] GetLastError () returned 0x0 [0278.815] SetLastError (dwErrCode=0x0) [0278.815] GetLastError () returned 0x0 [0278.815] SetLastError (dwErrCode=0x0) [0278.815] GetLastError () returned 0x0 [0278.815] SetLastError (dwErrCode=0x0) [0278.815] GetLastError () returned 0x0 [0278.815] SetLastError (dwErrCode=0x0) [0278.815] GetLastError () returned 0x0 [0278.816] SetLastError (dwErrCode=0x0) [0278.816] GetLastError () returned 0x0 [0278.816] SetLastError (dwErrCode=0x0) [0278.816] GetLastError () returned 0x0 [0278.816] SetLastError (dwErrCode=0x0) [0278.816] GetLastError () returned 0x0 [0278.816] SetLastError (dwErrCode=0x0) [0278.816] GetLastError () returned 0x0 [0278.816] SetLastError (dwErrCode=0x0) [0278.816] GetLastError () returned 0x0 [0278.816] SetLastError (dwErrCode=0x0) [0278.816] GetLastError () returned 0x0 [0278.816] SetLastError (dwErrCode=0x0) [0278.816] GetLastError () returned 0x0 [0278.816] SetLastError (dwErrCode=0x0) [0278.816] GetLastError () returned 0x0 [0278.816] SetLastError (dwErrCode=0x0) [0278.816] GetLastError () returned 0x0 [0278.816] SetLastError (dwErrCode=0x0) [0278.816] GetLastError () returned 0x0 [0278.817] SetLastError (dwErrCode=0x0) [0278.817] GetLastError () returned 0x0 [0278.817] SetLastError (dwErrCode=0x0) [0278.817] GetLastError () returned 0x0 [0278.817] SetLastError (dwErrCode=0x0) [0278.817] GetLastError () returned 0x0 [0278.817] SetLastError (dwErrCode=0x0) [0278.817] GetLastError () returned 0x0 [0278.817] SetLastError (dwErrCode=0x0) [0278.817] GetLastError () returned 0x0 [0278.817] SetLastError (dwErrCode=0x0) [0278.817] GetLastError () returned 0x0 [0278.817] SetLastError (dwErrCode=0x0) [0278.817] GetLastError () returned 0x0 [0278.817] SetLastError (dwErrCode=0x0) [0278.817] GetLastError () returned 0x0 [0278.817] SetLastError (dwErrCode=0x0) [0278.817] GetCurrentThreadId () returned 0x63c [0278.818] GetLastError () returned 0x0 [0278.818] SetLastError (dwErrCode=0x0) [0278.818] GetLastError () returned 0x0 [0278.818] SetLastError (dwErrCode=0x0) [0278.818] GetLastError () returned 0x0 [0278.818] SetLastError (dwErrCode=0x0) [0278.818] GetCurrentThreadId () returned 0x63c [0278.818] GetLastError () returned 0x0 [0278.818] SetLastError (dwErrCode=0x0) [0278.818] GetLastError () returned 0x0 [0278.818] SetLastError (dwErrCode=0x0) [0278.818] GetLastError () returned 0x0 [0278.818] SetLastError (dwErrCode=0x0) [0278.818] GetCurrentThreadId () returned 0x63c [0278.818] GetLastError () returned 0x0 [0278.819] SetLastError (dwErrCode=0x0) [0278.819] GetLastError () returned 0x0 [0278.819] SetLastError (dwErrCode=0x0) [0278.819] GetLastError () returned 0x0 [0278.819] SetLastError (dwErrCode=0x0) [0278.819] GetLastError () returned 0x0 [0278.819] SetLastError (dwErrCode=0x0) [0278.819] GetLastError () returned 0x0 [0278.819] SetLastError (dwErrCode=0x0) [0278.819] GetLastError () returned 0x0 [0278.819] SetLastError (dwErrCode=0x0) [0278.819] GetLastError () returned 0x0 [0278.820] SetLastError (dwErrCode=0x0) [0278.820] GetLastError () returned 0x0 [0278.820] SetLastError (dwErrCode=0x0) [0278.820] GetLastError () returned 0x0 [0278.820] SetLastError (dwErrCode=0x0) [0278.820] GetLastError () returned 0x0 [0278.820] SetLastError (dwErrCode=0x0) [0278.820] GetLastError () returned 0x0 [0278.820] SetLastError (dwErrCode=0x0) [0278.820] GetLastError () returned 0x0 [0278.820] SetLastError (dwErrCode=0x0) [0278.820] GetLastError () returned 0x0 [0278.820] SetLastError (dwErrCode=0x0) [0278.820] GetCurrentThreadId () returned 0x63c [0278.821] GetLastError () returned 0x0 [0278.821] SetLastError (dwErrCode=0x0) [0278.821] GetLastError () returned 0x0 [0278.821] GetLastError () returned 0x0 [0278.821] SetLastError (dwErrCode=0x0) [0278.821] GetLastError () returned 0x0 [0278.821] SetLastError (dwErrCode=0x0) [0278.821] SetLastError (dwErrCode=0x0) [0278.821] GetLastError () returned 0x0 [0278.821] SetLastError (dwErrCode=0x0) [0278.821] GetCurrentThreadId () returned 0x63c [0278.821] GetLastError () returned 0x0 [0278.821] SetLastError (dwErrCode=0x0) [0278.821] GetLastError () returned 0x0 [0278.821] SetLastError (dwErrCode=0x0) [0278.821] GetLastError () returned 0x0 [0278.822] GetLastError () returned 0x0 [0278.822] SetLastError (dwErrCode=0x0) [0278.822] SetLastError (dwErrCode=0x0) [0278.822] GetLastError () returned 0x0 [0278.822] SetLastError (dwErrCode=0x0) [0278.822] GetCurrentThreadId () returned 0x63c [0278.822] GetLastError () returned 0x0 [0278.822] SetLastError (dwErrCode=0x0) [0278.822] GetLastError () returned 0x0 [0278.822] SetLastError (dwErrCode=0x0) [0278.822] GetLastError () returned 0x0 [0278.822] SetLastError (dwErrCode=0x0) [0278.822] GetCurrentThreadId () returned 0x63c [0278.822] GetLastError () returned 0x0 [0278.822] SetLastError (dwErrCode=0x0) [0278.822] GetLastError () returned 0x0 [0278.822] GetLastError () returned 0x0 [0278.823] SetLastError (dwErrCode=0x0) [0278.823] SetLastError (dwErrCode=0x0) [0278.823] GetLastError () returned 0x0 [0278.823] SetLastError (dwErrCode=0x0) [0278.823] GetCurrentThreadId () returned 0x63c [0278.823] GetLastError () returned 0x0 [0278.823] SetLastError (dwErrCode=0x0) [0278.823] GetLastError () returned 0x0 [0278.823] SetLastError (dwErrCode=0x0) [0278.823] GetLastError () returned 0x0 [0278.823] SetLastError (dwErrCode=0x0) [0278.823] GetLastError () returned 0x0 [0278.823] SetLastError (dwErrCode=0x0) [0278.823] GetCurrentThreadId () returned 0x63c [0278.823] GetLastError () returned 0x0 [0278.823] SetLastError (dwErrCode=0x0) [0278.823] GetLastError () returned 0x0 [0278.824] GetLastError () returned 0x0 [0278.824] SetLastError (dwErrCode=0x0) [0278.824] SetLastError (dwErrCode=0x0) [0278.824] GetLastError () returned 0x0 [0278.824] SetLastError (dwErrCode=0x0) [0278.824] GetLastError () returned 0x0 [0278.824] SetLastError (dwErrCode=0x0) [0278.824] GetLastError () returned 0x0 [0278.824] SetLastError (dwErrCode=0x0) [0278.824] GetLastError () returned 0x0 [0278.824] SetLastError (dwErrCode=0x0) [0278.824] GetLastError () returned 0x0 [0278.824] SetLastError (dwErrCode=0x0) [0278.824] GetLastError () returned 0x0 [0278.824] SetLastError (dwErrCode=0x0) [0278.824] GetLastError () returned 0x0 [0278.824] SetLastError (dwErrCode=0x0) [0278.824] GetLastError () returned 0x0 [0278.824] SetLastError (dwErrCode=0x0) [0278.825] GetLastError () returned 0x0 [0278.825] SetLastError (dwErrCode=0x0) [0278.825] GetLastError () returned 0x0 [0278.825] SetLastError (dwErrCode=0x0) [0278.825] GetLastError () returned 0x0 [0278.825] SetLastError (dwErrCode=0x0) [0278.825] GetLastError () returned 0x0 [0278.825] SetLastError (dwErrCode=0x0) [0278.825] GetLastError () returned 0x0 [0278.825] GetLastError () returned 0x0 [0278.825] SetLastError (dwErrCode=0x0) [0278.825] SetLastError (dwErrCode=0x0) [0278.825] GetLastError () returned 0x0 [0278.825] SetLastError (dwErrCode=0x0) [0278.825] GetLastError () returned 0x0 [0278.826] SetLastError (dwErrCode=0x0) [0278.826] GetLastError () returned 0x0 [0278.826] SetLastError (dwErrCode=0x0) [0278.826] GetLastError () returned 0x0 [0278.826] SetLastError (dwErrCode=0x0) [0278.826] GetLastError () returned 0x0 [0278.826] SetLastError (dwErrCode=0x0) [0278.826] GetLastError () returned 0x0 [0278.826] SetLastError (dwErrCode=0x0) [0278.826] GetLastError () returned 0x0 [0278.826] SetLastError (dwErrCode=0x0) [0278.826] GetLastError () returned 0x0 [0278.826] GetLastError () returned 0x0 [0278.826] SetLastError (dwErrCode=0x0) [0278.826] SetLastError (dwErrCode=0x0) [0278.826] GetLastError () returned 0x0 [0278.826] SetLastError (dwErrCode=0x0) [0278.827] GetLastError () returned 0x0 [0278.827] SetLastError (dwErrCode=0x0) [0278.827] GetLastError () returned 0x0 [0278.827] SetLastError (dwErrCode=0x0) [0278.827] GetLastError () returned 0x0 [0278.827] SetLastError (dwErrCode=0x0) [0278.827] GetLastError () returned 0x0 [0278.827] SetLastError (dwErrCode=0x0) [0278.827] GetLastError () returned 0x0 [0278.827] SetLastError (dwErrCode=0x0) [0278.827] GetLastError () returned 0x0 [0278.827] SetLastError (dwErrCode=0x0) [0278.827] GetLastError () returned 0x0 [0278.827] GetLastError () returned 0x0 [0278.827] SetLastError (dwErrCode=0x0) [0278.827] SetLastError (dwErrCode=0x0) [0278.827] GetLastError () returned 0x0 [0278.828] SetLastError (dwErrCode=0x0) [0278.828] GetLastError () returned 0x0 [0278.828] SetLastError (dwErrCode=0x0) [0278.828] GetLastError () returned 0x0 [0278.828] SetLastError (dwErrCode=0x0) [0278.828] GetLastError () returned 0x0 [0278.828] SetLastError (dwErrCode=0x0) [0278.828] GetLastError () returned 0x0 [0278.828] SetLastError (dwErrCode=0x0) [0278.828] GetLastError () returned 0x0 [0278.828] GetLastError () returned 0x0 [0278.828] SetLastError (dwErrCode=0x0) [0278.828] SetLastError (dwErrCode=0x0) [0278.828] GetLastError () returned 0x0 [0278.828] SetLastError (dwErrCode=0x0) [0278.828] GetLastError () returned 0x0 [0278.830] SetLastError (dwErrCode=0x0) [0278.830] GetLastError () returned 0x0 [0278.830] SetLastError (dwErrCode=0x0) [0278.830] GetLastError () returned 0x0 [0278.830] SetLastError (dwErrCode=0x0) [0278.830] GetLastError () returned 0x0 [0278.830] SetLastError (dwErrCode=0x0) [0278.830] GetLastError () returned 0x0 [0278.830] SetLastError (dwErrCode=0x0) [0278.830] GetLastError () returned 0x0 [0278.830] GetLastError () returned 0x0 [0278.830] SetLastError (dwErrCode=0x0) [0278.830] SetLastError (dwErrCode=0x0) [0278.830] GetLastError () returned 0x0 [0278.831] SetLastError (dwErrCode=0x0) [0278.831] GetLastError () returned 0x0 [0278.831] SetLastError (dwErrCode=0x0) [0278.831] GetLastError () returned 0x0 [0278.831] SetLastError (dwErrCode=0x0) [0278.831] GetLastError () returned 0x0 [0278.831] SetLastError (dwErrCode=0x0) [0278.831] GetLastError () returned 0x0 [0278.831] SetLastError (dwErrCode=0x0) [0278.831] GetLastError () returned 0x0 [0278.831] SetLastError (dwErrCode=0x0) [0278.831] GetLastError () returned 0x0 [0278.831] SetLastError (dwErrCode=0x0) [0278.831] GetLastError () returned 0x0 [0278.831] SetLastError (dwErrCode=0x0) [0278.831] GetLastError () returned 0x0 [0278.831] SetLastError (dwErrCode=0x0) [0278.831] GetLastError () returned 0x0 [0278.831] SetLastError (dwErrCode=0x0) [0278.832] GetLastError () returned 0x0 [0278.832] SetLastError (dwErrCode=0x0) [0278.832] GetLastError () returned 0x0 [0278.832] SetLastError (dwErrCode=0x0) [0278.832] GetLastError () returned 0x0 [0278.832] SetLastError (dwErrCode=0x0) [0278.832] GetLastError () returned 0x0 [0278.832] SetLastError (dwErrCode=0x0) [0278.832] GetLastError () returned 0x0 [0278.833] GetLastError () returned 0x0 [0278.833] SetLastError (dwErrCode=0x0) [0278.833] SetLastError (dwErrCode=0x0) [0278.833] GetLastError () returned 0x0 [0278.833] SetLastError (dwErrCode=0x0) [0278.833] GetLastError () returned 0x0 [0278.833] SetLastError (dwErrCode=0x0) [0278.833] GetLastError () returned 0x0 [0278.833] SetLastError (dwErrCode=0x0) [0278.833] GetLastError () returned 0x0 [0278.833] SetLastError (dwErrCode=0x0) [0278.833] GetLastError () returned 0x0 [0278.834] SetLastError (dwErrCode=0x0) [0278.834] GetLastError () returned 0x0 [0278.834] SetLastError (dwErrCode=0x0) [0278.834] GetLastError () returned 0x0 [0278.834] SetLastError (dwErrCode=0x0) [0278.834] GetLastError () returned 0x0 [0278.834] SetLastError (dwErrCode=0x0) [0278.834] GetLastError () returned 0x0 [0278.834] GetLastError () returned 0x0 [0278.834] SetLastError (dwErrCode=0x0) [0278.834] SetLastError (dwErrCode=0x0) [0278.834] GetLastError () returned 0x0 [0278.834] SetLastError (dwErrCode=0x0) [0278.834] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0278.834] GetLastError () returned 0x0 [0278.835] SetLastError (dwErrCode=0x0) [0278.835] GetLastError () returned 0x0 [0278.835] SetLastError (dwErrCode=0x0) [0278.835] GetLastError () returned 0x0 [0278.835] SetLastError (dwErrCode=0x0) [0278.835] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="CheckRemoteDebuggerPresent") returned 0x7ffd4e1eaa60 [0278.835] GetLastError () returned 0x0 [0278.835] SetLastError (dwErrCode=0x0) [0278.835] GetLastError () returned 0x0 [0278.835] GetLastError () returned 0x0 [0278.835] SetLastError (dwErrCode=0x0) [0278.835] SetLastError (dwErrCode=0x0) [0278.835] GetLastError () returned 0x0 [0278.835] SetLastError (dwErrCode=0x0) [0278.835] GetModuleFileNameW (in: hModule=0x7ff771f50000, lpFilename=0x6f9258, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe")) returned 0x3b [0278.836] SysReAllocStringLen (in: pbstr=0x5ffab0*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", len=0x3b | out: pbstr=0x5ffab0*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 1 [0278.836] GetLastError () returned 0x0 [0278.836] SetLastError (dwErrCode=0x0) [0278.836] GetLastError () returned 0x0 [0278.836] SetLastError (dwErrCode=0x0) [0278.836] GetLastError () returned 0x0 [0278.836] SetLastError (dwErrCode=0x0) [0278.836] GetLastError () returned 0x0 [0278.836] SetLastError (dwErrCode=0x0) [0278.836] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x5ff8a0 | out: lpBuffer=0x0, lpFilePart=0x5ff8a0*=0x0) returned 0x2a [0278.836] GetLastError () returned 0x0 [0278.836] SetLastError (dwErrCode=0x0) [0278.836] GetFullPathNameW (in: lpFileName="C:", nBufferLength=0x2a, lpBuffer=0x8fb4e8, lpFilePart=0x5ff8a0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", lpFilePart=0x5ff8a0*="Temp") returned 0x28 [0278.836] GetLastError () returned 0x0 [0278.836] SetLastError (dwErrCode=0x0) [0278.836] GetLastError () returned 0x0 [0278.836] SetLastError (dwErrCode=0x0) [0278.836] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.836] GetLastError () returned 0x0 [0278.836] SetLastError (dwErrCode=0x0) [0278.836] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a08, cbMultiByte=3, lpWideCharStr=0x8e5778, cchWideChar=3 | out: lpWideCharStr="\\.\\") returned 3 [0278.836] GetLastError () returned 0x0 [0278.836] SetLastError (dwErrCode=0x0) [0278.836] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0278.837] GetLastError () returned 0x0 [0278.837] SetLastError (dwErrCode=0x0) [0278.837] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a28, cbMultiByte=4, lpWideCharStr=0x8e5778, cchWideChar=4 | out: lpWideCharStr="\\..\\") returned 4 [0278.837] GetLastError () returned 0x0 [0278.837] SetLastError (dwErrCode=0x0) [0278.837] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0278.837] GetLastError () returned 0x0 [0278.837] SetLastError (dwErrCode=0x0) [0278.837] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x7ff772a33a48, cbMultiByte=3, lpWideCharStr=0x8e5778, cchWideChar=3 | out: lpWideCharStr="\\..") returned 3 [0278.837] GetLastError () returned 0x0 [0278.837] SetLastError (dwErrCode=0x0) [0278.837] GetLastError () returned 0x0 [0278.837] SetLastError (dwErrCode=0x0) [0278.837] GetLastError () returned 0x0 [0278.837] SetLastError (dwErrCode=0x0) [0278.837] GetLastError () returned 0x0 [0278.837] SetLastError (dwErrCode=0x0) [0278.837] GetLastError () returned 0x0 [0278.837] SetLastError (dwErrCode=0x0) [0278.837] GetLastError () returned 0x0 [0278.837] SetLastError (dwErrCode=0x0) [0278.837] GetLastError () returned 0x0 [0278.837] SetLastError (dwErrCode=0x0) [0278.837] GetLastError () returned 0x0 [0278.837] SetLastError (dwErrCode=0x0) [0278.837] GetLastError () returned 0x0 [0278.838] SetLastError (dwErrCode=0x0) [0278.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0278.838] GetLastError () returned 0x0 [0278.838] SetLastError (dwErrCode=0x0) [0278.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", cchWideChar=59, lpMultiByteStr=0x8db908, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", lpUsedDefaultChar=0x0) returned 59 [0278.838] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=59, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 59 [0278.838] GetLastError () returned 0x0 [0278.838] SetLastError (dwErrCode=0x0) [0278.838] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=59, lpWideCharStr=0x6c3108, cchWideChar=59 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 59 [0278.838] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", lpFindFileData=0x5ffae8 | out: lpFindFileData=0x5ffae8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0162f, ftCreationTime.dwHighDateTime=0x1d7fc90, ftLastAccessTime.dwLowDateTime=0xec0162f, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xfbbeb2e, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x817400, dwReserved0=0x7ffd, dwReserved1=0x0, cFileName="RegHost.exe", cAlternateFileName="")) returned 0x6c1620 [0278.838] FileTimeToLocalFileTime (in: lpFileTime=0x5ffafc, lpLocalFileTime=0x5ff8e0 | out: lpLocalFileTime=0x5ff8e0) returned 1 [0278.838] FileTimeToDosDateTime (in: lpFileTime=0x5ff8e0, lpFatDate=0x5ffaba, lpFatTime=0x5ffab8 | out: lpFatDate=0x5ffaba, lpFatTime=0x5ffab8) returned 1 [0278.838] GetLastError () returned 0x0 [0278.838] SetLastError (dwErrCode=0x0) [0278.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RegHost.exe", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0278.838] GetLastError () returned 0x0 [0278.838] SetLastError (dwErrCode=0x0) [0278.838] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="RegHost.exe", cchWideChar=11, lpMultiByteStr=0x8e57b8, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RegHost.exe", lpUsedDefaultChar=0x0) returned 11 [0278.838] GetLastError () returned 0x0 [0278.838] SetLastError (dwErrCode=0x0) [0278.838] GetLastError () returned 0x0 [0278.839] SetLastError (dwErrCode=0x0) [0278.839] GetLastError () returned 0x0 [0278.839] SetLastError (dwErrCode=0x0) [0278.839] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57b8, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0278.839] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57b8, cbMultiByte=11, lpWideCharStr=0x6c28d8, cchWideChar=11 | out: lpWideCharStr="RegHost.exe") returned 11 [0278.839] GetLastError () returned 0x0 [0278.839] SetLastError (dwErrCode=0x0) [0278.839] GetLastError () returned 0x0 [0278.839] SetLastError (dwErrCode=0x0) [0278.839] GetLastError () returned 0x0 [0278.839] SetLastError (dwErrCode=0x0) [0278.839] GetLastError () returned 0x0 [0278.839] SetLastError (dwErrCode=0x0) [0278.839] GetLastError () returned 0x0 [0278.839] SetLastError (dwErrCode=0x0) [0278.839] GetLastError () returned 0x0 [0278.839] SetLastError (dwErrCode=0x0) [0278.839] SysReAllocStringLen (in: pbstr=0x5ffaa0*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\", psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", len=0x3b | out: pbstr=0x5ffaa0*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 1 [0278.840] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", cchLength=0x3b | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe") returned 0x3b [0278.840] SysReAllocStringLen (in: pbstr=0x5ffe10*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe", len=0x3b | out: pbstr=0x5ffe10*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe") returned 1 [0278.840] GetLastError () returned 0x0 [0278.840] SetLastError (dwErrCode=0x0) [0278.840] GetLastError () returned 0x0 [0278.840] SetLastError (dwErrCode=0x0) [0278.840] GetLastError () returned 0x0 [0278.840] SetLastError (dwErrCode=0x0) [0278.840] GetLastError () returned 0x0 [0278.840] SetLastError (dwErrCode=0x0) [0278.840] SysReAllocStringLen (in: pbstr=0x7ff772b3a130*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe", len=0x3b | out: pbstr=0x7ff772b3a130*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe") returned 1 [0278.840] GetLastError () returned 0x0 [0278.841] SetLastError (dwErrCode=0x0) [0278.841] GetLastError () returned 0x0 [0278.841] GetLastError () returned 0x0 [0278.841] SetLastError (dwErrCode=0x0) [0278.841] SetLastError (dwErrCode=0x0) [0278.841] GetLastError () returned 0x0 [0278.841] SetLastError (dwErrCode=0x0) [0278.841] GetLastError () returned 0x0 [0278.841] SetLastError (dwErrCode=0x0) [0278.841] SysReAllocStringLen (in: pbstr=0x6c2dd8*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe", len=0x3b | out: pbstr=0x6c2dd8*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe") returned 1 [0278.841] GetLastError () returned 0x0 [0278.841] SetLastError (dwErrCode=0x0) [0278.841] GetLastError () returned 0x0 [0278.841] SetLastError (dwErrCode=0x0) [0278.841] GetLastError () returned 0x0 [0278.841] SetLastError (dwErrCode=0x0) [0278.841] GetLastError () returned 0x0 [0278.841] SetLastError (dwErrCode=0x0) [0278.841] SysReAllocStringLen (in: pbstr=0x6c2e00*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", len=0x30 | out: pbstr=0x6c2e00*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\") returned 1 [0278.841] GetLastError () returned 0x0 [0278.842] SetLastError (dwErrCode=0x0) [0278.842] GetLastError () returned 0x0 [0278.842] SetLastError (dwErrCode=0x0) [0278.842] GetLastError () returned 0x0 [0278.842] SetLastError (dwErrCode=0x0) [0278.842] GetLastError () returned 0x0 [0278.842] SetLastError (dwErrCode=0x0) [0278.842] GetLastError () returned 0x0 [0278.842] SetLastError (dwErrCode=0x0) [0278.842] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", len=0x30 | out: pbstr=0x5ff970*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\") returned 1 [0278.842] CharLowerBuffW (in: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", cchLength=0x30 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\") returned 0x30 [0278.842] SysReAllocStringLen (in: pbstr=0x8e57a8*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", len=0x30 | out: pbstr=0x8e57a8*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\") returned 1 [0278.842] GetLastError () returned 0x0 [0278.842] SetLastError (dwErrCode=0x0) [0278.842] GetLastError () returned 0x0 [0278.842] SetLastError (dwErrCode=0x0) [0278.842] GetLastError () returned 0x0 [0278.842] SetLastError (dwErrCode=0x0) [0278.842] GetLastError () returned 0x0 [0278.842] SetLastError (dwErrCode=0x0) [0278.842] SysReAllocStringLen (in: pbstr=0x8e57b0*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e57b0*="c:") returned 1 [0278.843] GetLastError () returned 0x0 [0278.843] SetLastError (dwErrCode=0x0) [0278.843] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="users", len=0x5 | out: pbstr=0x8f3740*="users") returned 1 [0278.843] GetLastError () returned 0x0 [0278.843] SetLastError (dwErrCode=0x0) [0278.843] GetLastError () returned 0x0 [0278.843] SetLastError (dwErrCode=0x0) [0278.843] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x8f3760*="rdhj0cnfevzx") returned 1 [0278.843] GetLastError () returned 0x0 [0278.843] SetLastError (dwErrCode=0x0) [0278.843] SysReAllocStringLen (in: pbstr=0x8f3780*=0x0, psz="appdata", len=0x7 | out: pbstr=0x8f3780*="appdata") returned 1 [0278.843] GetLastError () returned 0x0 [0278.843] SetLastError (dwErrCode=0x0) [0278.843] SysReAllocStringLen (in: pbstr=0x8f37a0*=0x0, psz="roaming", len=0x7 | out: pbstr=0x8f37a0*="roaming") returned 1 [0278.843] GetLastError () returned 0x0 [0278.843] SetLastError (dwErrCode=0x0) [0278.843] SysReAllocStringLen (in: pbstr=0x8f37c0*=0x0, psz="microsoft", len=0x9 | out: pbstr=0x8f37c0*="microsoft") returned 1 [0278.843] GetLastError () returned 0x0 [0278.843] SetLastError (dwErrCode=0x0) [0278.843] GetLastError () returned 0x0 [0278.844] SetLastError (dwErrCode=0x0) [0278.844] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.844] GetLastError () returned 0x0 [0278.844] SetLastError (dwErrCode=0x0) [0278.844] GetLastError () returned 0x0 [0278.844] SetLastError (dwErrCode=0x0) [0278.844] GetLastError () returned 0x0 [0278.844] SetLastError (dwErrCode=0x0) [0278.844] GetLastError () returned 0x0 [0278.844] SetLastError (dwErrCode=0x0) [0278.844] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.844] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x5ffa00*="users") returned 1 [0278.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0278.845] GetLastError () returned 0x0 [0278.845] SetLastError (dwErrCode=0x0) [0278.845] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0278.845] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0278.845] GetLastError () returned 0x0 [0278.845] SetLastError (dwErrCode=0x0) [0278.845] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpWideCharStr=0x8e57f8, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0278.845] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c1b00 [0278.845] FindNextFileW (in: hFindFile=0x6c1b00, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0278.845] GetLastError () returned 0x12 [0278.845] FindClose (in: hFindFile=0x6c1b00 | out: hFindFile=0x6c1b00) returned 1 [0278.845] GetLastError () returned 0x12 [0278.845] SetLastError (dwErrCode=0x12) [0278.845] GetLastError () returned 0x12 [0278.845] SetLastError (dwErrCode=0x12) [0278.846] GetLastError () returned 0x0 [0278.846] SetLastError (dwErrCode=0x0) [0278.846] GetLastError () returned 0x0 [0278.846] SetLastError (dwErrCode=0x0) [0278.846] GetLastError () returned 0x0 [0278.846] SetLastError (dwErrCode=0x0) [0278.846] GetLastError () returned 0x0 [0278.846] SetLastError (dwErrCode=0x0) [0278.846] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x5ffd08*="c:\\Users\\") returned 1 [0278.846] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x5ffa00*="rdhj0cnfevzx") returned 1 [0278.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0278.846] GetLastError () returned 0x0 [0278.846] SetLastError (dwErrCode=0x0) [0278.846] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0278.846] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0278.846] GetLastError () returned 0x0 [0278.846] SetLastError (dwErrCode=0x0) [0278.846] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpWideCharStr=0x8db908, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0278.846] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6c1bc0 [0278.847] FindNextFileW (in: hFindFile=0x6c1bc0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0278.847] GetLastError () returned 0x12 [0278.847] FindClose (in: hFindFile=0x6c1bc0 | out: hFindFile=0x6c1bc0) returned 1 [0278.847] GetLastError () returned 0x12 [0278.847] SetLastError (dwErrCode=0x12) [0278.847] GetLastError () returned 0x12 [0278.847] SetLastError (dwErrCode=0x12) [0278.847] GetLastError () returned 0x0 [0278.847] SetLastError (dwErrCode=0x0) [0278.847] GetLastError () returned 0x0 [0278.847] SetLastError (dwErrCode=0x0) [0278.847] GetLastError () returned 0x0 [0278.847] SetLastError (dwErrCode=0x0) [0278.847] GetLastError () returned 0x0 [0278.847] SetLastError (dwErrCode=0x0) [0278.847] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0278.847] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x5ffa00*="appdata") returned 1 [0278.847] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0278.847] GetLastError () returned 0x0 [0278.848] SetLastError (dwErrCode=0x0) [0278.848] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0278.848] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0278.848] GetLastError () returned 0x0 [0278.848] SetLastError (dwErrCode=0x0) [0278.848] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpWideCharStr=0x8db968, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0278.848] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x6c1ce0 [0278.848] FindNextFileW (in: hFindFile=0x6c1ce0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0278.848] GetLastError () returned 0x12 [0278.848] FindClose (in: hFindFile=0x6c1ce0 | out: hFindFile=0x6c1ce0) returned 1 [0278.848] GetLastError () returned 0x12 [0278.848] SetLastError (dwErrCode=0x12) [0278.848] GetLastError () returned 0x12 [0278.848] SetLastError (dwErrCode=0x12) [0278.848] GetLastError () returned 0x0 [0278.848] SetLastError (dwErrCode=0x0) [0278.848] GetLastError () returned 0x0 [0278.848] SetLastError (dwErrCode=0x0) [0278.849] GetLastError () returned 0x0 [0278.849] SetLastError (dwErrCode=0x0) [0278.849] GetLastError () returned 0x0 [0278.849] SetLastError (dwErrCode=0x0) [0278.849] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0278.849] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="roaming", len=0x7 | out: pbstr=0x5ffa00*="roaming") returned 1 [0278.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0278.849] GetLastError () returned 0x0 [0278.849] SetLastError (dwErrCode=0x0) [0278.849] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming", cchWideChar=37, lpMultiByteStr=0x8db908, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming", lpUsedDefaultChar=0x0) returned 37 [0278.849] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=37, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0278.849] GetLastError () returned 0x0 [0278.849] SetLastError (dwErrCode=0x0) [0278.849] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=37, lpWideCharStr=0x8fb4e8, cchWideChar=37 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming") returned 37 [0278.849] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb8e6fbcd, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb8e6fbcd, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0x6c1e00 [0278.849] FindNextFileW (in: hFindFile=0x6c1e00, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb8e6fbcd, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb8e6fbcd, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0278.849] GetLastError () returned 0x12 [0278.849] FindClose (in: hFindFile=0x6c1e00 | out: hFindFile=0x6c1e00) returned 1 [0278.849] GetLastError () returned 0x12 [0278.849] SetLastError (dwErrCode=0x12) [0278.849] GetLastError () returned 0x12 [0278.849] SetLastError (dwErrCode=0x12) [0278.850] GetLastError () returned 0x0 [0278.850] SetLastError (dwErrCode=0x0) [0278.850] GetLastError () returned 0x0 [0278.850] SetLastError (dwErrCode=0x0) [0278.850] GetLastError () returned 0x0 [0278.850] SetLastError (dwErrCode=0x0) [0278.850] GetLastError () returned 0x0 [0278.850] SetLastError (dwErrCode=0x0) [0278.850] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", len=0x26 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\") returned 1 [0278.850] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", psz="microsoft", len=0x9 | out: pbstr=0x5ffa00*="microsoft") returned 1 [0278.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\microsoft", cchWideChar=47, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0278.850] GetLastError () returned 0x0 [0278.850] SetLastError (dwErrCode=0x0) [0278.850] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\microsoft", cchWideChar=47, lpMultiByteStr=0x8db908, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\microsoft", lpUsedDefaultChar=0x0) returned 47 [0278.850] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=47, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0278.850] GetLastError () returned 0x0 [0278.850] SetLastError (dwErrCode=0x0) [0278.850] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=47, lpWideCharStr=0x8fb568, cchWideChar=47 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\microsoft") returned 47 [0278.850] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\microsoft", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xec02964, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xec02964, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x6c1f20 [0278.851] FindNextFileW (in: hFindFile=0x6c1f20, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xec02964, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xec02964, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0278.851] GetLastError () returned 0x12 [0278.851] FindClose (in: hFindFile=0x6c1f20 | out: hFindFile=0x6c1f20) returned 1 [0278.851] GetLastError () returned 0x12 [0278.851] SetLastError (dwErrCode=0x12) [0278.851] GetLastError () returned 0x12 [0278.851] SetLastError (dwErrCode=0x12) [0278.851] GetLastError () returned 0x0 [0278.851] SetLastError (dwErrCode=0x0) [0278.851] GetLastError () returned 0x0 [0278.851] SetLastError (dwErrCode=0x0) [0278.851] GetLastError () returned 0x0 [0278.851] SetLastError (dwErrCode=0x0) [0278.851] GetLastError () returned 0x0 [0278.851] SetLastError (dwErrCode=0x0) [0278.851] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\", len=0x30 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\") returned 1 [0278.851] GetLastError () returned 0x0 [0278.851] SetLastError (dwErrCode=0x0) [0278.851] GetLastError () returned 0x0 [0278.852] SetLastError (dwErrCode=0x0) [0278.852] GetLastError () returned 0x0 [0278.852] SetLastError (dwErrCode=0x0) [0278.852] GetLastError () returned 0x0 [0278.852] SetLastError (dwErrCode=0x0) [0278.852] GetLastError () returned 0x0 [0278.852] SetLastError (dwErrCode=0x0) [0278.852] GetLastError () returned 0x0 [0278.852] SetLastError (dwErrCode=0x0) [0278.852] GetLastError () returned 0x0 [0278.852] SetLastError (dwErrCode=0x0) [0278.852] GetLastError () returned 0x0 [0278.852] SetLastError (dwErrCode=0x0) [0278.852] GetLastError () returned 0x0 [0278.852] SetLastError (dwErrCode=0x0) [0278.852] GetLastError () returned 0x0 [0278.852] SetLastError (dwErrCode=0x0) [0278.852] GetLastError () returned 0x0 [0278.852] SetLastError (dwErrCode=0x0) [0278.852] GetLastError () returned 0x0 [0278.852] SetLastError (dwErrCode=0x0) [0278.852] GetLastError () returned 0x0 [0278.852] SetLastError (dwErrCode=0x0) [0278.852] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft", len=0x2f | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft") returned 1 [0278.853] GetLastError () returned 0x0 [0278.853] SetLastError (dwErrCode=0x0) [0278.853] GetLastError () returned 0x0 [0278.853] SetLastError (dwErrCode=0x0) [0278.853] GetLastError () returned 0x0 [0278.853] SetLastError (dwErrCode=0x0) [0278.853] GetLastError () returned 0x0 [0278.853] SetLastError (dwErrCode=0x0) [0278.853] SysReAllocStringLen (in: pbstr=0x6c2e00*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\", len=0x30 | out: pbstr=0x6c2e00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\") returned 1 [0278.853] GetLastError () returned 0x0 [0278.853] SetLastError (dwErrCode=0x0) [0278.853] GetProcessHeap () returned 0x710000 [0278.853] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40000) returned 0x25f1f80 [0278.856] GetSystemDirectoryW (in: lpBuffer=0x25f1fd0, uSize=0xfffe | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0278.856] GetLastError () returned 0x0 [0278.856] SetLastError (dwErrCode=0x0) [0278.856] GetLastError () returned 0x0 [0278.856] SetLastError (dwErrCode=0x0) [0278.856] GetLastError () returned 0x0 [0278.856] SetLastError (dwErrCode=0x0) [0278.856] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Windows\\system32", len=0x13 | out: pbstr=0x5ff970*="C:\\Windows\\system32") returned 1 [0278.856] CharLowerBuffW (in: lpsz="C:\\Windows\\system32", cchLength=0x13 | out: lpsz="c:\\windows\\system32") returned 0x13 [0278.856] SysReAllocStringLen (in: pbstr=0x8e57a8*=0x0, psz="c:\\windows\\system32", len=0x13 | out: pbstr=0x8e57a8*="c:\\windows\\system32") returned 1 [0278.856] GetLastError () returned 0x0 [0278.856] SetLastError (dwErrCode=0x0) [0278.856] GetLastError () returned 0x0 [0278.856] SetLastError (dwErrCode=0x0) [0278.857] GetLastError () returned 0x0 [0278.857] SetLastError (dwErrCode=0x0) [0278.857] GetLastError () returned 0x0 [0278.857] SetLastError (dwErrCode=0x0) [0278.857] SysReAllocStringLen (in: pbstr=0x8e57b0*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e57b0*="c:") returned 1 [0278.857] GetLastError () returned 0x0 [0278.857] SetLastError (dwErrCode=0x0) [0278.857] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="windows", len=0x7 | out: pbstr=0x8f3740*="windows") returned 1 [0278.857] GetLastError () returned 0x0 [0278.857] SetLastError (dwErrCode=0x0) [0278.857] GetLastError () returned 0x0 [0278.857] SetLastError (dwErrCode=0x0) [0278.857] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="system32", len=0x8 | out: pbstr=0x8f3760*="system32") returned 1 [0278.857] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.857] GetLastError () returned 0x0 [0278.857] SetLastError (dwErrCode=0x0) [0278.857] GetLastError () returned 0x0 [0278.858] SetLastError (dwErrCode=0x0) [0278.858] GetLastError () returned 0x0 [0278.858] SetLastError (dwErrCode=0x0) [0278.858] GetLastError () returned 0x0 [0278.858] SetLastError (dwErrCode=0x0) [0278.858] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.858] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="windows", len=0x7 | out: pbstr=0x5ffa00*="windows") returned 1 [0278.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\windows", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0278.858] GetLastError () returned 0x0 [0278.858] SetLastError (dwErrCode=0x0) [0278.858] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\windows", cchWideChar=10, lpMultiByteStr=0x8e5878, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\windows", lpUsedDefaultChar=0x0) returned 10 [0278.858] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0278.858] GetLastError () returned 0x0 [0278.858] SetLastError (dwErrCode=0x0) [0278.858] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=10, lpWideCharStr=0x8e5838, cchWideChar=10 | out: lpWideCharStr="c:\\windows") returned 10 [0278.858] FindFirstFileW (in: lpFileName="c:\\windows", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x6c14a0 [0278.858] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0278.859] GetLastError () returned 0x12 [0278.859] FindClose (in: hFindFile=0x6c14a0 | out: hFindFile=0x6c14a0) returned 1 [0278.859] GetLastError () returned 0x12 [0278.859] SetLastError (dwErrCode=0x12) [0278.859] GetLastError () returned 0x12 [0278.859] SetLastError (dwErrCode=0x12) [0278.859] GetLastError () returned 0x0 [0278.859] SetLastError (dwErrCode=0x0) [0278.859] GetLastError () returned 0x0 [0278.859] SetLastError (dwErrCode=0x0) [0278.859] GetLastError () returned 0x0 [0278.859] SetLastError (dwErrCode=0x0) [0278.859] GetLastError () returned 0x0 [0278.860] SetLastError (dwErrCode=0x0) [0278.860] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Windows", psz="c:\\Windows\\", len=0xb | out: pbstr=0x5ffd08*="c:\\Windows\\") returned 1 [0278.860] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Windows\\", psz="system32", len=0x8 | out: pbstr=0x5ffa00*="system32") returned 1 [0278.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Windows\\system32", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0278.860] GetLastError () returned 0x0 [0278.860] SetLastError (dwErrCode=0x0) [0278.860] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Windows\\system32", cchWideChar=19, lpMultiByteStr=0x8e5838, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Windows\\system32", lpUsedDefaultChar=0x0) returned 19 [0278.860] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=19, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 19 [0278.860] GetLastError () returned 0x0 [0278.860] SetLastError (dwErrCode=0x0) [0278.860] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=19, lpWideCharStr=0x8db908, cchWideChar=19 | out: lpWideCharStr="c:\\Windows\\system32") returned 19 [0278.860] FindFirstFileW (in: lpFileName="c:\\Windows\\system32", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xbae59694, ftLastAccessTime.dwHighDateTime=0x1d7e768, ftLastWriteTime.dwLowDateTime=0xbae59694, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x6c1980 [0278.860] FindNextFileW (in: hFindFile=0x6c1980, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xbae59694, ftLastAccessTime.dwHighDateTime=0x1d7e768, ftLastWriteTime.dwLowDateTime=0xbae59694, ftLastWriteTime.dwHighDateTime=0x1d7e768, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0 [0278.860] GetLastError () returned 0x12 [0278.860] FindClose (in: hFindFile=0x6c1980 | out: hFindFile=0x6c1980) returned 1 [0278.861] GetLastError () returned 0x12 [0278.861] SetLastError (dwErrCode=0x12) [0278.861] GetLastError () returned 0x12 [0278.861] SetLastError (dwErrCode=0x12) [0278.861] GetLastError () returned 0x0 [0278.861] SetLastError (dwErrCode=0x0) [0278.861] GetLastError () returned 0x0 [0278.861] SetLastError (dwErrCode=0x0) [0278.861] GetLastError () returned 0x0 [0278.861] SetLastError (dwErrCode=0x0) [0278.861] GetLastError () returned 0x0 [0278.861] SetLastError (dwErrCode=0x0) [0278.861] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Windows\\System32", psz="c:\\Windows\\System32\\", len=0x14 | out: pbstr=0x5ffd08*="c:\\Windows\\System32\\") returned 1 [0278.861] GetLastError () returned 0x0 [0278.861] SetLastError (dwErrCode=0x0) [0278.861] GetLastError () returned 0x0 [0278.862] SetLastError (dwErrCode=0x0) [0278.862] GetLastError () returned 0x0 [0278.862] SetLastError (dwErrCode=0x0) [0278.862] GetLastError () returned 0x0 [0278.862] SetLastError (dwErrCode=0x0) [0278.862] GetLastError () returned 0x0 [0278.862] SetLastError (dwErrCode=0x0) [0278.862] GetLastError () returned 0x0 [0278.862] SetLastError (dwErrCode=0x0) [0278.862] GetLastError () returned 0x0 [0278.862] SetLastError (dwErrCode=0x0) [0278.862] GetLastError () returned 0x0 [0278.862] SetLastError (dwErrCode=0x0) [0278.862] GetLastError () returned 0x0 [0278.862] SetLastError (dwErrCode=0x0) [0278.862] GetLastError () returned 0x0 [0278.862] SetLastError (dwErrCode=0x0) [0278.862] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Windows\\System32\\", psz="c:\\Windows\\System32", len=0x13 | out: pbstr=0x5ffd08*="c:\\Windows\\System32") returned 1 [0278.862] GetLastError () returned 0x0 [0278.863] SetLastError (dwErrCode=0x0) [0278.863] GetLastError () returned 0x0 [0278.863] SetLastError (dwErrCode=0x0) [0278.863] GetLastError () returned 0x0 [0278.863] SetLastError (dwErrCode=0x0) [0278.863] GetLastError () returned 0x0 [0278.863] SetLastError (dwErrCode=0x0) [0278.863] SysReAllocStringLen (in: pbstr=0x6c2df0*=0x0, psz="c:\\Windows\\System32\\", len=0x14 | out: pbstr=0x6c2df0*="c:\\Windows\\System32\\") returned 1 [0278.863] GetLastError () returned 0x0 [0278.863] SetLastError (dwErrCode=0x0) [0278.863] GetLastError () returned 0x0 [0278.863] SetLastError (dwErrCode=0x0) [0278.863] GetLastError () returned 0x0 [0278.863] SetLastError (dwErrCode=0x0) [0278.863] GetLastError () returned 0x0 [0278.863] SetLastError (dwErrCode=0x0) [0278.863] GetLastError () returned 0x0 [0278.863] SetLastError (dwErrCode=0x0) [0278.863] GetLastError () returned 0x0 [0278.864] SetLastError (dwErrCode=0x0) [0278.864] GetLastError () returned 0x0 [0278.864] SetLastError (dwErrCode=0x0) [0278.864] GetLastError () returned 0x0 [0278.864] SetLastError (dwErrCode=0x0) [0278.864] SysReAllocStringLen (in: pbstr=0x6c2df8*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x6c2df8*="c:\\") returned 1 [0278.864] GetTempPathW (in: nBufferLength=0xfffe, lpBuffer=0x25f1fd0 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25 [0278.864] GetLastError () returned 0x0 [0278.864] SetLastError (dwErrCode=0x0) [0278.864] GetLastError () returned 0x0 [0278.864] SetLastError (dwErrCode=0x0) [0278.864] GetLastError () returned 0x0 [0278.864] SetLastError (dwErrCode=0x0) [0278.864] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", len=0x25 | out: pbstr=0x5ff970*="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 1 [0278.864] CharLowerBuffW (in: lpsz="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\", cchLength=0x25 | out: lpsz="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\") returned 0x25 [0278.865] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\", len=0x25 | out: pbstr=0x8e5768*="c:\\users\\rdhj0c~1\\appdata\\local\\temp\\") returned 1 [0278.865] GetLastError () returned 0x0 [0278.865] SetLastError (dwErrCode=0x0) [0278.865] GetLastError () returned 0x0 [0278.865] SetLastError (dwErrCode=0x0) [0278.865] GetLastError () returned 0x0 [0278.865] SetLastError (dwErrCode=0x0) [0278.865] GetLastError () returned 0x0 [0278.865] SetLastError (dwErrCode=0x0) [0278.865] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.865] GetLastError () returned 0x0 [0278.865] SetLastError (dwErrCode=0x0) [0278.865] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="users", len=0x5 | out: pbstr=0x8f3740*="users") returned 1 [0278.865] GetLastError () returned 0x0 [0278.865] SetLastError (dwErrCode=0x0) [0278.866] GetLastError () returned 0x0 [0278.866] SetLastError (dwErrCode=0x0) [0278.866] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="rdhj0c~1", len=0x8 | out: pbstr=0x8f3760*="rdhj0c~1") returned 1 [0278.866] GetLastError () returned 0x0 [0278.866] SetLastError (dwErrCode=0x0) [0278.866] SysReAllocStringLen (in: pbstr=0x8f3780*=0x0, psz="appdata", len=0x7 | out: pbstr=0x8f3780*="appdata") returned 1 [0278.866] GetLastError () returned 0x0 [0278.866] SetLastError (dwErrCode=0x0) [0278.866] SysReAllocStringLen (in: pbstr=0x8f37a0*=0x0, psz="local", len=0x5 | out: pbstr=0x8f37a0*="local") returned 1 [0278.866] GetLastError () returned 0x0 [0278.866] SetLastError (dwErrCode=0x0) [0278.866] SysReAllocStringLen (in: pbstr=0x8f37c0*=0x0, psz="temp", len=0x4 | out: pbstr=0x8f37c0*="temp") returned 1 [0278.866] GetLastError () returned 0x0 [0278.866] SetLastError (dwErrCode=0x0) [0278.866] GetLastError () returned 0x0 [0278.866] SetLastError (dwErrCode=0x0) [0278.867] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.867] GetLastError () returned 0x0 [0278.867] SetLastError (dwErrCode=0x0) [0278.867] GetLastError () returned 0x0 [0278.867] SetLastError (dwErrCode=0x0) [0278.867] GetLastError () returned 0x0 [0278.867] SetLastError (dwErrCode=0x0) [0278.867] GetLastError () returned 0x0 [0278.867] SetLastError (dwErrCode=0x0) [0278.867] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.867] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x5ffa00*="users") returned 1 [0278.867] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0278.868] GetLastError () returned 0x0 [0278.868] SetLastError (dwErrCode=0x0) [0278.868] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0278.868] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0278.868] GetLastError () returned 0x0 [0278.868] SetLastError (dwErrCode=0x0) [0278.868] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpWideCharStr=0x8e57f8, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0278.868] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c14a0 [0278.868] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0278.868] GetLastError () returned 0x12 [0278.868] FindClose (in: hFindFile=0x6c14a0 | out: hFindFile=0x6c14a0) returned 1 [0278.868] GetLastError () returned 0x12 [0278.868] SetLastError (dwErrCode=0x12) [0278.868] GetLastError () returned 0x12 [0278.868] SetLastError (dwErrCode=0x12) [0278.868] GetLastError () returned 0x0 [0278.869] SetLastError (dwErrCode=0x0) [0278.869] GetLastError () returned 0x0 [0278.869] SetLastError (dwErrCode=0x0) [0278.869] GetLastError () returned 0x0 [0278.869] SetLastError (dwErrCode=0x0) [0278.869] GetLastError () returned 0x0 [0278.869] SetLastError (dwErrCode=0x0) [0278.869] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x5ffd08*="c:\\Users\\") returned 1 [0278.869] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\", psz="rdhj0c~1", len=0x8 | out: pbstr=0x5ffa00*="rdhj0c~1") returned 1 [0278.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0c~1", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0278.869] GetLastError () returned 0x0 [0278.869] SetLastError (dwErrCode=0x0) [0278.869] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0c~1", cchWideChar=17, lpMultiByteStr=0x8e57f8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0c~1", lpUsedDefaultChar=0x0) returned 17 [0278.869] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=17, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0278.869] GetLastError () returned 0x0 [0278.869] SetLastError (dwErrCode=0x0) [0278.869] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=17, lpWideCharStr=0x8db968, cchWideChar=17 | out: lpWideCharStr="c:\\Users\\rdhj0c~1") returned 17 [0278.869] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0c~1", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6c13e0 [0278.869] FindNextFileW (in: hFindFile=0x6c13e0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0278.870] GetLastError () returned 0x12 [0278.870] FindClose (in: hFindFile=0x6c13e0 | out: hFindFile=0x6c13e0) returned 1 [0278.870] GetLastError () returned 0x12 [0278.870] SetLastError (dwErrCode=0x12) [0278.870] GetLastError () returned 0x12 [0278.870] SetLastError (dwErrCode=0x12) [0278.870] GetLastError () returned 0x0 [0278.870] SetLastError (dwErrCode=0x0) [0278.870] GetLastError () returned 0x0 [0278.870] SetLastError (dwErrCode=0x0) [0278.870] GetLastError () returned 0x0 [0278.870] SetLastError (dwErrCode=0x0) [0278.870] GetLastError () returned 0x0 [0278.870] SetLastError (dwErrCode=0x0) [0278.870] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0278.870] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x5ffa00*="appdata") returned 1 [0278.870] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0278.870] GetLastError () returned 0x0 [0278.870] SetLastError (dwErrCode=0x0) [0278.871] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0278.871] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0278.871] GetLastError () returned 0x0 [0278.871] SetLastError (dwErrCode=0x0) [0278.871] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpWideCharStr=0x8db908, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0278.871] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x6c1680 [0278.871] FindNextFileW (in: hFindFile=0x6c1680, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0278.871] GetLastError () returned 0x12 [0278.871] FindClose (in: hFindFile=0x6c1680 | out: hFindFile=0x6c1680) returned 1 [0278.871] GetLastError () returned 0x12 [0278.871] SetLastError (dwErrCode=0x12) [0278.871] GetLastError () returned 0x12 [0278.871] SetLastError (dwErrCode=0x12) [0278.871] GetLastError () returned 0x0 [0278.871] SetLastError (dwErrCode=0x0) [0278.871] GetLastError () returned 0x0 [0278.871] SetLastError (dwErrCode=0x0) [0278.871] GetLastError () returned 0x0 [0278.871] SetLastError (dwErrCode=0x0) [0278.872] GetLastError () returned 0x0 [0278.872] SetLastError (dwErrCode=0x0) [0278.872] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0278.872] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="local", len=0x5 | out: pbstr=0x5ffa00*="local") returned 1 [0278.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0278.872] GetLastError () returned 0x0 [0278.872] SetLastError (dwErrCode=0x0) [0278.872] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x8db968, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpUsedDefaultChar=0x0) returned 35 [0278.872] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db968, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0278.872] GetLastError () returned 0x0 [0278.872] SetLastError (dwErrCode=0x0) [0278.872] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db968, cbMultiByte=35, lpWideCharStr=0x8fb568, cchWideChar=35 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local") returned 35 [0278.872] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x6c1f80 [0278.872] FindNextFileW (in: hFindFile=0x6c1f80, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0278.872] GetLastError () returned 0x12 [0278.872] FindClose (in: hFindFile=0x6c1f80 | out: hFindFile=0x6c1f80) returned 1 [0278.872] GetLastError () returned 0x12 [0278.872] SetLastError (dwErrCode=0x12) [0278.872] GetLastError () returned 0x12 [0278.872] SetLastError (dwErrCode=0x12) [0278.873] GetLastError () returned 0x0 [0278.873] SetLastError (dwErrCode=0x0) [0278.873] GetLastError () returned 0x0 [0278.873] SetLastError (dwErrCode=0x0) [0278.873] GetLastError () returned 0x0 [0278.873] SetLastError (dwErrCode=0x0) [0278.873] GetLastError () returned 0x0 [0278.873] SetLastError (dwErrCode=0x0) [0278.873] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0278.873] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", psz="temp", len=0x4 | out: pbstr=0x5ffa00*="temp") returned 1 [0278.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0278.873] GetLastError () returned 0x0 [0278.873] SetLastError (dwErrCode=0x0) [0278.873] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp", cchWideChar=40, lpMultiByteStr=0x8db968, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp", lpUsedDefaultChar=0x0) returned 40 [0278.873] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db968, cbMultiByte=40, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 40 [0278.873] GetLastError () returned 0x0 [0278.873] SetLastError (dwErrCode=0x0) [0278.873] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db968, cbMultiByte=40, lpWideCharStr=0x8fb4e8, cchWideChar=40 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp") returned 40 [0278.873] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\temp", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xb12b8d, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0x6c18c0 [0278.874] FindNextFileW (in: hFindFile=0x6c18c0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb12b8d, ftLastAccessTime.dwHighDateTime=0x1d7fc90, ftLastWriteTime.dwLowDateTime=0xb12b8d, ftLastWriteTime.dwHighDateTime=0x1d7fc90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0278.874] GetLastError () returned 0x12 [0278.874] FindClose (in: hFindFile=0x6c18c0 | out: hFindFile=0x6c18c0) returned 1 [0278.874] GetLastError () returned 0x12 [0278.874] SetLastError (dwErrCode=0x12) [0278.874] GetLastError () returned 0x12 [0278.874] SetLastError (dwErrCode=0x12) [0278.874] GetLastError () returned 0x0 [0278.874] SetLastError (dwErrCode=0x0) [0278.874] GetLastError () returned 0x0 [0278.874] SetLastError (dwErrCode=0x0) [0278.874] GetLastError () returned 0x0 [0278.874] SetLastError (dwErrCode=0x0) [0278.874] GetLastError () returned 0x0 [0278.875] SetLastError (dwErrCode=0x0) [0278.875] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0278.875] GetLastError () returned 0x0 [0278.875] SetLastError (dwErrCode=0x0) [0278.875] GetLastError () returned 0x0 [0278.875] SetLastError (dwErrCode=0x0) [0278.875] GetLastError () returned 0x0 [0278.875] SetLastError (dwErrCode=0x0) [0278.875] GetLastError () returned 0x0 [0278.875] SetLastError (dwErrCode=0x0) [0278.875] GetLastError () returned 0x0 [0278.875] SetLastError (dwErrCode=0x0) [0278.875] GetLastError () returned 0x0 [0278.875] SetLastError (dwErrCode=0x0) [0278.875] GetLastError () returned 0x0 [0278.875] SetLastError (dwErrCode=0x0) [0278.875] GetLastError () returned 0x0 [0278.875] SetLastError (dwErrCode=0x0) [0278.875] GetLastError () returned 0x0 [0278.875] SetLastError (dwErrCode=0x0) [0278.876] GetLastError () returned 0x0 [0278.876] SetLastError (dwErrCode=0x0) [0278.876] GetLastError () returned 0x0 [0278.876] SetLastError (dwErrCode=0x0) [0278.876] GetLastError () returned 0x0 [0278.876] SetLastError (dwErrCode=0x0) [0278.876] GetLastError () returned 0x0 [0278.876] SetLastError (dwErrCode=0x0) [0278.876] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp", len=0x28 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp") returned 1 [0278.876] GetLastError () returned 0x0 [0278.876] SetLastError (dwErrCode=0x0) [0278.876] GetLastError () returned 0x0 [0278.876] SetLastError (dwErrCode=0x0) [0278.876] GetLastError () returned 0x0 [0278.876] SetLastError (dwErrCode=0x0) [0278.876] GetLastError () returned 0x0 [0278.877] SetLastError (dwErrCode=0x0) [0278.877] SysReAllocStringLen (in: pbstr=0x6c2e08*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", len=0x29 | out: pbstr=0x6c2e08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\") returned 1 [0278.877] GetWindowsDirectoryW (in: lpBuffer=0x25f1fd0, uSize=0xfffe | out: lpBuffer="C:\\Windows") returned 0xa [0278.877] GetLastError () returned 0x0 [0278.877] SetLastError (dwErrCode=0x0) [0278.877] GetLastError () returned 0x0 [0278.877] SetLastError (dwErrCode=0x0) [0278.877] GetLastError () returned 0x0 [0278.877] SetLastError (dwErrCode=0x0) [0278.877] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Windows", len=0xa | out: pbstr=0x5ff970*="C:\\Windows") returned 1 [0278.877] CharLowerBuffW (in: lpsz="C:\\Windows", cchLength=0xa | out: lpsz="c:\\windows") returned 0xa [0278.877] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\windows", len=0xa | out: pbstr=0x8e5768*="c:\\windows") returned 1 [0278.877] GetLastError () returned 0x0 [0278.877] SetLastError (dwErrCode=0x0) [0278.877] GetLastError () returned 0x0 [0278.877] SetLastError (dwErrCode=0x0) [0278.878] GetLastError () returned 0x0 [0278.878] SetLastError (dwErrCode=0x0) [0278.878] GetLastError () returned 0x0 [0278.878] SetLastError (dwErrCode=0x0) [0278.878] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.878] GetLastError () returned 0x0 [0278.878] SetLastError (dwErrCode=0x0) [0278.878] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="windows", len=0x7 | out: pbstr=0x8f3740*="windows") returned 1 [0278.878] GetLastError () returned 0x0 [0278.878] SetLastError (dwErrCode=0x0) [0278.878] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.878] GetLastError () returned 0x0 [0278.878] SetLastError (dwErrCode=0x0) [0278.878] GetLastError () returned 0x0 [0278.878] SetLastError (dwErrCode=0x0) [0278.878] GetLastError () returned 0x0 [0278.878] SetLastError (dwErrCode=0x0) [0278.879] GetLastError () returned 0x0 [0278.879] SetLastError (dwErrCode=0x0) [0278.879] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.879] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="windows", len=0x7 | out: pbstr=0x5ffa00*="windows") returned 1 [0278.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\windows", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0278.879] GetLastError () returned 0x0 [0278.879] SetLastError (dwErrCode=0x0) [0278.879] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\windows", cchWideChar=10, lpMultiByteStr=0x8e5878, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\windows", lpUsedDefaultChar=0x0) returned 10 [0278.879] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0278.879] GetLastError () returned 0x0 [0278.879] SetLastError (dwErrCode=0x0) [0278.879] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=10, lpWideCharStr=0x8e57f8, cchWideChar=10 | out: lpWideCharStr="c:\\windows") returned 10 [0278.879] FindFirstFileW (in: lpFileName="c:\\windows", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x6c14a0 [0278.879] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xd9a60a69, ftLastAccessTime.dwHighDateTime=0x1d70067, ftLastWriteTime.dwLowDateTime=0xd9a60a69, ftLastWriteTime.dwHighDateTime=0x1d70067, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0278.879] GetLastError () returned 0x12 [0278.879] FindClose (in: hFindFile=0x6c14a0 | out: hFindFile=0x6c14a0) returned 1 [0278.879] GetLastError () returned 0x12 [0278.879] SetLastError (dwErrCode=0x12) [0278.879] GetLastError () returned 0x12 [0278.880] SetLastError (dwErrCode=0x12) [0278.880] GetLastError () returned 0x0 [0278.880] SetLastError (dwErrCode=0x0) [0278.880] GetLastError () returned 0x0 [0278.880] SetLastError (dwErrCode=0x0) [0278.880] GetLastError () returned 0x0 [0278.880] SetLastError (dwErrCode=0x0) [0278.880] GetLastError () returned 0x0 [0278.880] SetLastError (dwErrCode=0x0) [0278.880] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Windows", psz="c:\\Windows\\", len=0xb | out: pbstr=0x5ffd08*="c:\\Windows\\") returned 1 [0278.880] GetLastError () returned 0x0 [0278.880] SetLastError (dwErrCode=0x0) [0278.880] GetLastError () returned 0x0 [0278.880] SetLastError (dwErrCode=0x0) [0278.880] GetLastError () returned 0x0 [0278.880] SetLastError (dwErrCode=0x0) [0278.880] GetLastError () returned 0x0 [0278.880] SetLastError (dwErrCode=0x0) [0278.881] GetLastError () returned 0x0 [0278.881] SetLastError (dwErrCode=0x0) [0278.881] GetLastError () returned 0x0 [0278.881] SetLastError (dwErrCode=0x0) [0278.881] GetLastError () returned 0x0 [0278.881] SetLastError (dwErrCode=0x0) [0278.881] GetLastError () returned 0x0 [0278.881] SetLastError (dwErrCode=0x0) [0278.881] GetLastError () returned 0x0 [0278.881] SetLastError (dwErrCode=0x0) [0278.881] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Windows\\", psz="c:\\Windows", len=0xa | out: pbstr=0x5ffd08*="c:\\Windows") returned 1 [0278.881] GetLastError () returned 0x0 [0278.881] SetLastError (dwErrCode=0x0) [0278.881] GetLastError () returned 0x0 [0278.881] SetLastError (dwErrCode=0x0) [0278.881] GetLastError () returned 0x0 [0278.881] SetLastError (dwErrCode=0x0) [0278.881] GetLastError () returned 0x0 [0278.881] SetLastError (dwErrCode=0x0) [0278.882] SysReAllocStringLen (in: pbstr=0x6c2de8*=0x0, psz="c:\\Windows\\", len=0xb | out: pbstr=0x6c2de8*="c:\\Windows\\") returned 1 [0278.882] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x25f1fd0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Documents") returned 0x0 [0278.882] GetLastError () returned 0x0 [0278.882] SetLastError (dwErrCode=0x0) [0278.882] GetLastError () returned 0x0 [0278.882] SetLastError (dwErrCode=0x0) [0278.882] GetLastError () returned 0x0 [0278.882] SetLastError (dwErrCode=0x0) [0278.882] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\Documents", len=0x1f | out: pbstr=0x5ff970*="C:\\Users\\RDhJ0CNFevzX\\Documents") returned 1 [0278.882] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\Documents", cchLength=0x1f | out: lpsz="c:\\users\\rdhj0cnfevzx\\documents") returned 0x1f [0278.882] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\users\\rdhj0cnfevzx\\documents", len=0x1f | out: pbstr=0x8e5768*="c:\\users\\rdhj0cnfevzx\\documents") returned 1 [0278.882] GetLastError () returned 0x0 [0278.882] SetLastError (dwErrCode=0x0) [0278.882] GetLastError () returned 0x0 [0278.882] SetLastError (dwErrCode=0x0) [0278.882] GetLastError () returned 0x0 [0278.882] SetLastError (dwErrCode=0x0) [0278.882] GetLastError () returned 0x0 [0278.884] SetLastError (dwErrCode=0x0) [0278.884] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.884] GetLastError () returned 0x0 [0278.884] SetLastError (dwErrCode=0x0) [0278.884] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="users", len=0x5 | out: pbstr=0x8f3740*="users") returned 1 [0278.884] GetLastError () returned 0x0 [0278.884] SetLastError (dwErrCode=0x0) [0278.884] GetLastError () returned 0x0 [0278.884] SetLastError (dwErrCode=0x0) [0278.884] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x8f3760*="rdhj0cnfevzx") returned 1 [0278.884] GetLastError () returned 0x0 [0278.884] SetLastError (dwErrCode=0x0) [0278.884] SysReAllocStringLen (in: pbstr=0x8f3780*=0x0, psz="documents", len=0x9 | out: pbstr=0x8f3780*="documents") returned 1 [0278.885] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.885] GetLastError () returned 0x0 [0278.885] SetLastError (dwErrCode=0x0) [0278.885] GetLastError () returned 0x0 [0278.885] SetLastError (dwErrCode=0x0) [0278.885] GetLastError () returned 0x0 [0278.885] SetLastError (dwErrCode=0x0) [0278.885] GetLastError () returned 0x0 [0278.885] SetLastError (dwErrCode=0x0) [0278.885] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.885] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x5ffa00*="users") returned 1 [0278.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0278.885] GetLastError () returned 0x0 [0278.885] SetLastError (dwErrCode=0x0) [0278.885] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x8e5878, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0278.885] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0278.885] GetLastError () returned 0x0 [0278.885] SetLastError (dwErrCode=0x0) [0278.885] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=8, lpWideCharStr=0x8e57f8, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0278.885] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c1f80 [0278.886] FindNextFileW (in: hFindFile=0x6c1f80, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0278.886] GetLastError () returned 0x12 [0278.886] FindClose (in: hFindFile=0x6c1f80 | out: hFindFile=0x6c1f80) returned 1 [0278.886] GetLastError () returned 0x12 [0278.886] SetLastError (dwErrCode=0x12) [0278.886] GetLastError () returned 0x12 [0278.886] SetLastError (dwErrCode=0x12) [0278.886] GetLastError () returned 0x0 [0278.886] SetLastError (dwErrCode=0x0) [0278.886] GetLastError () returned 0x0 [0278.886] SetLastError (dwErrCode=0x0) [0278.886] GetLastError () returned 0x0 [0278.886] SetLastError (dwErrCode=0x0) [0278.886] GetLastError () returned 0x0 [0278.886] SetLastError (dwErrCode=0x0) [0278.887] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x5ffd08*="c:\\Users\\") returned 1 [0278.887] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x5ffa00*="rdhj0cnfevzx") returned 1 [0278.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0278.887] GetLastError () returned 0x0 [0278.887] SetLastError (dwErrCode=0x0) [0278.887] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0278.887] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0278.887] GetLastError () returned 0x0 [0278.887] SetLastError (dwErrCode=0x0) [0278.887] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpWideCharStr=0x8db968, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0278.887] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6c1980 [0278.887] FindNextFileW (in: hFindFile=0x6c1980, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0278.887] GetLastError () returned 0x12 [0278.887] FindClose (in: hFindFile=0x6c1980 | out: hFindFile=0x6c1980) returned 1 [0278.887] GetLastError () returned 0x12 [0278.887] SetLastError (dwErrCode=0x12) [0278.887] GetLastError () returned 0x12 [0278.887] SetLastError (dwErrCode=0x12) [0278.888] GetLastError () returned 0x0 [0278.888] SetLastError (dwErrCode=0x0) [0278.888] GetLastError () returned 0x0 [0278.888] SetLastError (dwErrCode=0x0) [0278.888] GetLastError () returned 0x0 [0278.888] SetLastError (dwErrCode=0x0) [0278.888] GetLastError () returned 0x0 [0278.888] SetLastError (dwErrCode=0x0) [0278.888] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0278.888] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="documents", len=0x9 | out: pbstr=0x5ffa00*="documents") returned 1 [0278.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\documents", cchWideChar=31, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 31 [0278.888] GetLastError () returned 0x0 [0278.888] SetLastError (dwErrCode=0x0) [0278.888] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\documents", cchWideChar=31, lpMultiByteStr=0x8e57f8, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\documents", lpUsedDefaultChar=0x0) returned 31 [0278.888] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0278.888] GetLastError () returned 0x0 [0278.888] SetLastError (dwErrCode=0x0) [0278.888] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=31, lpWideCharStr=0x8db908, cchWideChar=31 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\documents") returned 31 [0278.888] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\documents", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb8a6983f, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb8a6983f, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0x6c1860 [0278.888] FindNextFileW (in: hFindFile=0x6c1860, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb8a6983f, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb8a6983f, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0278.888] GetLastError () returned 0x12 [0278.889] FindClose (in: hFindFile=0x6c1860 | out: hFindFile=0x6c1860) returned 1 [0278.889] GetLastError () returned 0x12 [0278.889] SetLastError (dwErrCode=0x12) [0278.889] GetLastError () returned 0x12 [0278.889] SetLastError (dwErrCode=0x12) [0278.889] GetLastError () returned 0x0 [0278.889] SetLastError (dwErrCode=0x0) [0278.889] GetLastError () returned 0x0 [0278.889] SetLastError (dwErrCode=0x0) [0278.889] GetLastError () returned 0x0 [0278.889] SetLastError (dwErrCode=0x0) [0278.889] GetLastError () returned 0x0 [0278.889] SetLastError (dwErrCode=0x0) [0278.889] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\Documents", psz="c:\\Users\\RDhJ0CNFevzX\\Documents\\", len=0x20 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\Documents\\") returned 1 [0278.889] GetLastError () returned 0x0 [0278.889] SetLastError (dwErrCode=0x0) [0278.889] GetLastError () returned 0x0 [0278.889] SetLastError (dwErrCode=0x0) [0278.890] GetLastError () returned 0x0 [0278.890] SetLastError (dwErrCode=0x0) [0278.890] GetLastError () returned 0x0 [0278.890] SetLastError (dwErrCode=0x0) [0278.890] GetLastError () returned 0x0 [0278.890] SetLastError (dwErrCode=0x0) [0278.890] GetLastError () returned 0x0 [0278.890] SetLastError (dwErrCode=0x0) [0278.890] GetLastError () returned 0x0 [0278.890] SetLastError (dwErrCode=0x0) [0278.890] GetLastError () returned 0x0 [0278.890] SetLastError (dwErrCode=0x0) [0278.890] GetLastError () returned 0x0 [0278.890] SetLastError (dwErrCode=0x0) [0278.890] GetLastError () returned 0x0 [0278.890] SetLastError (dwErrCode=0x0) [0278.890] GetLastError () returned 0x0 [0278.890] SetLastError (dwErrCode=0x0) [0278.890] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\Documents\\", psz="c:\\Users\\RDhJ0CNFevzX\\Documents", len=0x1f | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\Documents") returned 1 [0278.890] GetLastError () returned 0x0 [0278.891] SetLastError (dwErrCode=0x0) [0278.891] GetLastError () returned 0x0 [0278.891] SetLastError (dwErrCode=0x0) [0278.891] GetLastError () returned 0x0 [0278.891] SetLastError (dwErrCode=0x0) [0278.891] GetLastError () returned 0x0 [0278.891] SetLastError (dwErrCode=0x0) [0278.891] SysReAllocStringLen (in: pbstr=0x6c2de0*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\Documents\\", len=0x20 | out: pbstr=0x6c2de0*="c:\\Users\\RDhJ0CNFevzX\\Documents\\") returned 1 [0278.891] SHGetFolderPathW (in: hwnd=0x0, csidl=46, hToken=0x0, dwFlags=0x0, pszPath=0x25f1fd0 | out: pszPath="C:\\Users\\Public\\Documents") returned 0x0 [0278.891] GetLastError () returned 0x0 [0278.891] SetLastError (dwErrCode=0x0) [0278.891] GetLastError () returned 0x0 [0278.891] SetLastError (dwErrCode=0x0) [0278.891] GetLastError () returned 0x0 [0278.891] SetLastError (dwErrCode=0x0) [0278.891] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Users\\Public\\Documents", len=0x19 | out: pbstr=0x5ff970*="C:\\Users\\Public\\Documents") returned 1 [0278.891] CharLowerBuffW (in: lpsz="C:\\Users\\Public\\Documents", cchLength=0x19 | out: lpsz="c:\\users\\public\\documents") returned 0x19 [0278.891] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\users\\public\\documents", len=0x19 | out: pbstr=0x8e5768*="c:\\users\\public\\documents") returned 1 [0278.891] GetLastError () returned 0x0 [0278.892] SetLastError (dwErrCode=0x0) [0278.892] GetLastError () returned 0x0 [0278.892] SetLastError (dwErrCode=0x0) [0278.892] GetLastError () returned 0x0 [0278.892] SetLastError (dwErrCode=0x0) [0278.892] GetLastError () returned 0x0 [0278.892] SetLastError (dwErrCode=0x0) [0278.892] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.892] GetLastError () returned 0x0 [0278.892] SetLastError (dwErrCode=0x0) [0278.892] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="users", len=0x5 | out: pbstr=0x8f3740*="users") returned 1 [0278.892] GetLastError () returned 0x0 [0278.892] SetLastError (dwErrCode=0x0) [0278.893] GetLastError () returned 0x0 [0278.893] SetLastError (dwErrCode=0x0) [0278.893] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="public", len=0x6 | out: pbstr=0x8f3760*="public") returned 1 [0278.893] GetLastError () returned 0x0 [0278.893] SetLastError (dwErrCode=0x0) [0278.893] SysReAllocStringLen (in: pbstr=0x8f3780*=0x0, psz="documents", len=0x9 | out: pbstr=0x8f3780*="documents") returned 1 [0278.893] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.893] GetLastError () returned 0x0 [0278.893] SetLastError (dwErrCode=0x0) [0278.893] GetLastError () returned 0x0 [0278.893] SetLastError (dwErrCode=0x0) [0278.893] GetLastError () returned 0x0 [0278.893] SetLastError (dwErrCode=0x0) [0278.893] GetLastError () returned 0x0 [0278.893] SetLastError (dwErrCode=0x0) [0278.894] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.894] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x5ffa00*="users") returned 1 [0278.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0278.894] GetLastError () returned 0x0 [0278.894] SetLastError (dwErrCode=0x0) [0278.894] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x8e5878, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0278.894] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0278.894] GetLastError () returned 0x0 [0278.894] SetLastError (dwErrCode=0x0) [0278.894] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=8, lpWideCharStr=0x8e57f8, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0278.894] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c1e00 [0278.894] FindNextFileW (in: hFindFile=0x6c1e00, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0278.894] GetLastError () returned 0x12 [0278.894] FindClose (in: hFindFile=0x6c1e00 | out: hFindFile=0x6c1e00) returned 1 [0278.895] GetLastError () returned 0x12 [0278.895] SetLastError (dwErrCode=0x12) [0278.895] GetLastError () returned 0x12 [0278.895] SetLastError (dwErrCode=0x12) [0278.895] GetLastError () returned 0x0 [0278.895] SetLastError (dwErrCode=0x0) [0278.895] GetLastError () returned 0x0 [0278.895] SetLastError (dwErrCode=0x0) [0278.896] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x5ffd08*="c:\\Users\\") returned 1 [0278.896] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\", psz="public", len=0x6 | out: pbstr=0x5ffa00*="public") returned 1 [0278.896] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\public", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0278.896] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0278.896] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=15, lpWideCharStr=0x8e5878, cchWideChar=15 | out: lpWideCharStr="c:\\Users\\public") returned 15 [0278.896] FindFirstFileW (in: lpFileName="c:\\Users\\public", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0x6c14a0 [0278.896] FindNextFileW (in: hFindFile=0x6c14a0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x436238c4, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x436238c4, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0278.896] FindClose (in: hFindFile=0x6c14a0 | out: hFindFile=0x6c14a0) returned 1 [0278.896] GetLastError () returned 0x12 [0278.896] SetLastError (dwErrCode=0x12) [0278.897] GetLastError () returned 0x12 [0278.897] SetLastError (dwErrCode=0x12) [0278.897] GetLastError () returned 0x0 [0278.897] SetLastError (dwErrCode=0x0) [0278.897] GetLastError () returned 0x0 [0278.897] SetLastError (dwErrCode=0x0) [0278.897] GetLastError () returned 0x0 [0278.897] SetLastError (dwErrCode=0x0) [0278.897] GetLastError () returned 0x0 [0278.897] SetLastError (dwErrCode=0x0) [0278.897] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\Public", psz="c:\\Users\\Public\\", len=0x10 | out: pbstr=0x5ffd08*="c:\\Users\\Public\\") returned 1 [0278.897] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\Public\\", psz="documents", len=0x9 | out: pbstr=0x5ffa00*="documents") returned 1 [0278.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\Public\\documents", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0278.897] GetLastError () returned 0x0 [0278.897] SetLastError (dwErrCode=0x0) [0278.897] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\Public\\documents", cchWideChar=25, lpMultiByteStr=0x8e57f8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\Public\\documents", lpUsedDefaultChar=0x0) returned 25 [0278.897] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0278.897] GetLastError () returned 0x0 [0278.897] SetLastError (dwErrCode=0x0) [0278.897] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=25, lpWideCharStr=0x8db908, cchWideChar=25 | out: lpWideCharStr="c:\\Users\\Public\\documents") returned 25 [0278.897] FindFirstFileW (in: lpFileName="c:\\Users\\Public\\documents", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0x6c1a40 [0278.898] FindNextFileW (in: hFindFile=0x6c1a40, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x5d5bfea2, ftLastAccessTime.dwHighDateTime=0x1d7005f, ftLastWriteTime.dwLowDateTime=0x5d5bfea2, ftLastWriteTime.dwHighDateTime=0x1d7005f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 0 [0278.898] GetLastError () returned 0x12 [0278.898] FindClose (in: hFindFile=0x6c1a40 | out: hFindFile=0x6c1a40) returned 1 [0278.898] GetLastError () returned 0x12 [0278.898] SetLastError (dwErrCode=0x12) [0278.898] GetLastError () returned 0x12 [0278.898] SetLastError (dwErrCode=0x12) [0278.898] GetLastError () returned 0x0 [0278.898] SetLastError (dwErrCode=0x0) [0278.898] GetLastError () returned 0x0 [0278.898] SetLastError (dwErrCode=0x0) [0278.898] GetLastError () returned 0x0 [0278.898] SetLastError (dwErrCode=0x0) [0278.898] GetLastError () returned 0x0 [0278.899] SetLastError (dwErrCode=0x0) [0278.899] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\Public\\Documents", psz="c:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x5ffd08*="c:\\Users\\Public\\Documents\\") returned 1 [0278.899] GetLastError () returned 0x0 [0278.899] SetLastError (dwErrCode=0x0) [0278.899] GetLastError () returned 0x0 [0278.899] SetLastError (dwErrCode=0x0) [0278.899] GetLastError () returned 0x0 [0278.899] SetLastError (dwErrCode=0x0) [0278.899] GetLastError () returned 0x0 [0278.899] SetLastError (dwErrCode=0x0) [0278.899] GetLastError () returned 0x0 [0278.899] SetLastError (dwErrCode=0x0) [0278.899] GetLastError () returned 0x0 [0278.899] SetLastError (dwErrCode=0x0) [0278.899] GetLastError () returned 0x0 [0278.899] SetLastError (dwErrCode=0x0) [0278.899] GetLastError () returned 0x0 [0278.899] SetLastError (dwErrCode=0x0) [0278.899] GetLastError () returned 0x0 [0278.899] SetLastError (dwErrCode=0x0) [0278.899] GetLastError () returned 0x0 [0278.900] SetLastError (dwErrCode=0x0) [0278.900] GetLastError () returned 0x0 [0278.900] SetLastError (dwErrCode=0x0) [0278.900] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\Public\\Documents\\", psz="c:\\Users\\Public\\Documents", len=0x19 | out: pbstr=0x5ffd08*="c:\\Users\\Public\\Documents") returned 1 [0278.900] GetLastError () returned 0x0 [0278.900] SetLastError (dwErrCode=0x0) [0278.900] GetLastError () returned 0x0 [0278.900] SetLastError (dwErrCode=0x0) [0278.900] GetLastError () returned 0x0 [0278.900] SetLastError (dwErrCode=0x0) [0278.900] GetLastError () returned 0x0 [0278.900] SetLastError (dwErrCode=0x0) [0278.900] SysReAllocStringLen (in: pbstr=0x6c2e10*=0x0, psz="c:\\Users\\Public\\Documents\\", len=0x1a | out: pbstr=0x6c2e10*="c:\\Users\\Public\\Documents\\") returned 1 [0278.900] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x25f1fd0 | out: pszPath="C:\\Program Files") returned 0x0 [0278.900] GetLastError () returned 0x0 [0278.900] SetLastError (dwErrCode=0x0) [0278.900] GetLastError () returned 0x0 [0278.901] SetLastError (dwErrCode=0x0) [0278.901] GetLastError () returned 0x0 [0278.901] SetLastError (dwErrCode=0x0) [0278.901] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Program Files", len=0x10 | out: pbstr=0x5ff970*="C:\\Program Files") returned 1 [0278.901] CharLowerBuffW (in: lpsz="C:\\Program Files", cchLength=0x10 | out: lpsz="c:\\program files") returned 0x10 [0278.901] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\program files", len=0x10 | out: pbstr=0x8e5768*="c:\\program files") returned 1 [0278.901] GetLastError () returned 0x0 [0278.901] SetLastError (dwErrCode=0x0) [0278.901] GetLastError () returned 0x0 [0278.901] SetLastError (dwErrCode=0x0) [0278.901] GetLastError () returned 0x0 [0278.901] SetLastError (dwErrCode=0x0) [0278.901] GetLastError () returned 0x0 [0278.901] SetLastError (dwErrCode=0x0) [0278.901] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.901] GetLastError () returned 0x0 [0278.901] SetLastError (dwErrCode=0x0) [0278.901] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="program files", len=0xd | out: pbstr=0x8f3740*="program files") returned 1 [0278.901] GetLastError () returned 0x0 [0278.901] SetLastError (dwErrCode=0x0) [0278.902] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.902] GetLastError () returned 0x0 [0278.902] SetLastError (dwErrCode=0x0) [0278.902] GetLastError () returned 0x0 [0278.902] SetLastError (dwErrCode=0x0) [0278.902] GetLastError () returned 0x0 [0278.902] SetLastError (dwErrCode=0x0) [0278.902] GetLastError () returned 0x0 [0278.902] SetLastError (dwErrCode=0x0) [0278.902] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.902] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="program files", len=0xd | out: pbstr=0x5ffa00*="program files") returned 1 [0278.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\program files", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0278.902] GetLastError () returned 0x0 [0278.902] SetLastError (dwErrCode=0x0) [0278.902] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\program files", cchWideChar=16, lpMultiByteStr=0x8e5878, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\program files", lpUsedDefaultChar=0x0) returned 16 [0278.902] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0278.902] GetLastError () returned 0x0 [0278.902] SetLastError (dwErrCode=0x0) [0278.902] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=16, lpWideCharStr=0x8db968, cchWideChar=16 | out: lpWideCharStr="c:\\program files") returned 16 [0278.902] FindFirstFileW (in: lpFileName="c:\\program files", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc4bf156c, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc4bf156c, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x6c1980 [0278.903] FindNextFileW (in: hFindFile=0x6c1980, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc4bf156c, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc4bf156c, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0 [0278.903] GetLastError () returned 0x12 [0278.903] FindClose (in: hFindFile=0x6c1980 | out: hFindFile=0x6c1980) returned 1 [0278.903] GetLastError () returned 0x12 [0278.903] SetLastError (dwErrCode=0x12) [0278.903] GetLastError () returned 0x12 [0278.903] SetLastError (dwErrCode=0x12) [0278.903] GetLastError () returned 0x0 [0278.903] SetLastError (dwErrCode=0x0) [0278.903] GetLastError () returned 0x0 [0278.903] SetLastError (dwErrCode=0x0) [0278.903] GetLastError () returned 0x0 [0278.903] SetLastError (dwErrCode=0x0) [0278.903] GetLastError () returned 0x0 [0278.903] SetLastError (dwErrCode=0x0) [0278.903] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Program Files", psz="c:\\Program Files\\", len=0x11 | out: pbstr=0x5ffd08*="c:\\Program Files\\") returned 1 [0278.904] GetLastError () returned 0x0 [0278.904] SetLastError (dwErrCode=0x0) [0278.904] GetLastError () returned 0x0 [0278.904] SetLastError (dwErrCode=0x0) [0278.904] GetLastError () returned 0x0 [0278.904] SetLastError (dwErrCode=0x0) [0278.904] GetLastError () returned 0x0 [0278.904] SetLastError (dwErrCode=0x0) [0278.904] GetLastError () returned 0x0 [0278.904] SetLastError (dwErrCode=0x0) [0278.904] GetLastError () returned 0x0 [0278.904] SetLastError (dwErrCode=0x0) [0278.904] GetLastError () returned 0x0 [0278.904] SetLastError (dwErrCode=0x0) [0278.904] GetLastError () returned 0x0 [0278.904] SetLastError (dwErrCode=0x0) [0278.904] GetLastError () returned 0x0 [0278.904] SetLastError (dwErrCode=0x0) [0278.904] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Program Files\\", psz="c:\\Program Files", len=0x10 | out: pbstr=0x5ffd08*="c:\\Program Files") returned 1 [0278.905] GetLastError () returned 0x0 [0278.905] SetLastError (dwErrCode=0x0) [0278.905] GetLastError () returned 0x0 [0278.905] SetLastError (dwErrCode=0x0) [0278.905] GetLastError () returned 0x0 [0278.905] SetLastError (dwErrCode=0x0) [0278.905] GetLastError () returned 0x0 [0278.905] SetLastError (dwErrCode=0x0) [0278.905] SysReAllocStringLen (in: pbstr=0x6c2e18*=0x0, psz="c:\\Program Files\\", len=0x11 | out: pbstr=0x6c2e18*="c:\\Program Files\\") returned 1 [0278.905] SHGetFolderPathW (in: hwnd=0x0, csidl=35, hToken=0x0, dwFlags=0x0, pszPath=0x25f1fd0 | out: pszPath="C:\\ProgramData") returned 0x0 [0278.905] GetLastError () returned 0x0 [0278.905] SetLastError (dwErrCode=0x0) [0278.905] GetLastError () returned 0x0 [0278.905] SetLastError (dwErrCode=0x0) [0278.905] GetLastError () returned 0x0 [0278.906] SetLastError (dwErrCode=0x0) [0278.906] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\ProgramData", len=0xe | out: pbstr=0x5ff970*="C:\\ProgramData") returned 1 [0278.906] CharLowerBuffW (in: lpsz="C:\\ProgramData", cchLength=0xe | out: lpsz="c:\\programdata") returned 0xe [0278.906] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\programdata", len=0xe | out: pbstr=0x8e5768*="c:\\programdata") returned 1 [0278.906] GetLastError () returned 0x0 [0278.906] SetLastError (dwErrCode=0x0) [0278.906] GetLastError () returned 0x0 [0278.906] SetLastError (dwErrCode=0x0) [0278.906] GetLastError () returned 0x0 [0278.906] SetLastError (dwErrCode=0x0) [0278.906] GetLastError () returned 0x0 [0278.906] SetLastError (dwErrCode=0x0) [0278.906] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.906] GetLastError () returned 0x0 [0278.906] SetLastError (dwErrCode=0x0) [0278.906] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="programdata", len=0xb | out: pbstr=0x8f3740*="programdata") returned 1 [0278.906] GetLastError () returned 0x0 [0278.906] SetLastError (dwErrCode=0x0) [0278.907] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.907] GetLastError () returned 0x0 [0278.907] SetLastError (dwErrCode=0x0) [0278.907] GetLastError () returned 0x0 [0278.907] SetLastError (dwErrCode=0x0) [0278.907] GetLastError () returned 0x0 [0278.907] SetLastError (dwErrCode=0x0) [0278.907] GetLastError () returned 0x0 [0278.907] SetLastError (dwErrCode=0x0) [0278.907] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.907] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="programdata", len=0xb | out: pbstr=0x5ffa00*="programdata") returned 1 [0278.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\programdata", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0278.907] GetLastError () returned 0x0 [0278.907] SetLastError (dwErrCode=0x0) [0278.907] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\programdata", cchWideChar=14, lpMultiByteStr=0x8e57f8, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\programdata", lpUsedDefaultChar=0x0) returned 14 [0278.907] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0278.907] GetLastError () returned 0x0 [0278.907] SetLastError (dwErrCode=0x0) [0278.907] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=14, lpWideCharStr=0x8e5838, cchWideChar=14 | out: lpWideCharStr="c:\\programdata") returned 14 [0278.907] FindFirstFileW (in: lpFileName="c:\\programdata", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x387f5bb4, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x387f5bb4, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x6c1e60 [0278.908] FindNextFileW (in: hFindFile=0x6c1e60, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x387f5bb4, ftLastAccessTime.dwHighDateTime=0x1d705cc, ftLastWriteTime.dwLowDateTime=0x387f5bb4, ftLastWriteTime.dwHighDateTime=0x1d705cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0 [0278.908] GetLastError () returned 0x12 [0278.908] FindClose (in: hFindFile=0x6c1e60 | out: hFindFile=0x6c1e60) returned 1 [0278.908] GetLastError () returned 0x12 [0278.908] SetLastError (dwErrCode=0x12) [0278.908] GetLastError () returned 0x12 [0278.908] SetLastError (dwErrCode=0x12) [0278.908] GetLastError () returned 0x0 [0278.908] SetLastError (dwErrCode=0x0) [0278.908] GetLastError () returned 0x0 [0278.908] SetLastError (dwErrCode=0x0) [0278.908] GetLastError () returned 0x0 [0278.908] SetLastError (dwErrCode=0x0) [0278.908] GetLastError () returned 0x0 [0278.909] SetLastError (dwErrCode=0x0) [0278.909] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\ProgramData", psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x5ffd08*="c:\\ProgramData\\") returned 1 [0278.909] GetLastError () returned 0x0 [0278.909] SetLastError (dwErrCode=0x0) [0278.909] GetLastError () returned 0x0 [0278.909] SetLastError (dwErrCode=0x0) [0278.909] GetLastError () returned 0x0 [0278.909] SetLastError (dwErrCode=0x0) [0278.909] GetLastError () returned 0x0 [0278.909] SetLastError (dwErrCode=0x0) [0278.909] GetLastError () returned 0x0 [0278.909] SetLastError (dwErrCode=0x0) [0278.909] GetLastError () returned 0x0 [0278.909] SetLastError (dwErrCode=0x0) [0278.909] GetLastError () returned 0x0 [0278.909] SetLastError (dwErrCode=0x0) [0278.909] GetLastError () returned 0x0 [0278.910] SetLastError (dwErrCode=0x0) [0278.910] GetLastError () returned 0x0 [0278.910] SetLastError (dwErrCode=0x0) [0278.910] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\ProgramData\\", psz="c:\\ProgramData", len=0xe | out: pbstr=0x5ffd08*="c:\\ProgramData") returned 1 [0278.910] GetLastError () returned 0x0 [0278.910] SetLastError (dwErrCode=0x0) [0278.910] GetLastError () returned 0x0 [0278.910] SetLastError (dwErrCode=0x0) [0278.910] GetLastError () returned 0x0 [0278.910] SetLastError (dwErrCode=0x0) [0278.910] GetLastError () returned 0x0 [0278.910] SetLastError (dwErrCode=0x0) [0278.910] SysReAllocStringLen (in: pbstr=0x6c2e20*=0x0, psz="c:\\ProgramData\\", len=0xf | out: pbstr=0x6c2e20*="c:\\ProgramData\\") returned 1 [0278.910] SHGetFolderPathW (in: hwnd=0x0, csidl=43, hToken=0x0, dwFlags=0x0, pszPath=0x25f1fd0 | out: pszPath="C:\\Program Files\\Common Files") returned 0x0 [0278.911] GetLastError () returned 0x0 [0278.911] SetLastError (dwErrCode=0x0) [0278.911] GetLastError () returned 0x0 [0278.911] SetLastError (dwErrCode=0x0) [0278.911] GetLastError () returned 0x0 [0278.911] SetLastError (dwErrCode=0x0) [0278.911] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Program Files\\Common Files", len=0x1d | out: pbstr=0x5ff970*="C:\\Program Files\\Common Files") returned 1 [0278.911] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files", cchLength=0x1d | out: lpsz="c:\\program files\\common files") returned 0x1d [0278.911] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\program files\\common files", len=0x1d | out: pbstr=0x8e5768*="c:\\program files\\common files") returned 1 [0278.911] GetLastError () returned 0x0 [0278.911] SetLastError (dwErrCode=0x0) [0278.911] GetLastError () returned 0x0 [0278.911] SetLastError (dwErrCode=0x0) [0278.911] GetLastError () returned 0x0 [0278.911] SetLastError (dwErrCode=0x0) [0278.911] GetLastError () returned 0x0 [0278.911] SetLastError (dwErrCode=0x0) [0278.911] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.911] GetLastError () returned 0x0 [0278.911] SetLastError (dwErrCode=0x0) [0278.911] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="program files", len=0xd | out: pbstr=0x8f3740*="program files") returned 1 [0278.911] GetLastError () returned 0x0 [0278.912] SetLastError (dwErrCode=0x0) [0278.912] GetLastError () returned 0x0 [0278.912] SetLastError (dwErrCode=0x0) [0278.912] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="common files", len=0xc | out: pbstr=0x8f3760*="common files") returned 1 [0278.912] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.912] GetLastError () returned 0x0 [0278.912] SetLastError (dwErrCode=0x0) [0278.912] GetLastError () returned 0x0 [0278.912] SetLastError (dwErrCode=0x0) [0278.912] GetLastError () returned 0x0 [0278.912] SetLastError (dwErrCode=0x0) [0278.912] GetLastError () returned 0x0 [0278.912] SetLastError (dwErrCode=0x0) [0278.913] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.913] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="program files", len=0xd | out: pbstr=0x5ffa00*="program files") returned 1 [0278.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\program files", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0278.913] GetLastError () returned 0x0 [0278.913] SetLastError (dwErrCode=0x0) [0278.913] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\program files", cchWideChar=16, lpMultiByteStr=0x8e57f8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\program files", lpUsedDefaultChar=0x0) returned 16 [0278.913] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0278.913] GetLastError () returned 0x0 [0278.913] SetLastError (dwErrCode=0x0) [0278.913] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=16, lpWideCharStr=0x8db908, cchWideChar=16 | out: lpWideCharStr="c:\\program files") returned 16 [0278.913] FindFirstFileW (in: lpFileName="c:\\program files", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc4bf156c, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc4bf156c, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0x6c19e0 [0278.913] FindNextFileW (in: hFindFile=0x6c19e0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xc4bf156c, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xc4bf156c, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 0 [0278.913] GetLastError () returned 0x12 [0278.913] FindClose (in: hFindFile=0x6c19e0 | out: hFindFile=0x6c19e0) returned 1 [0278.913] GetLastError () returned 0x12 [0278.914] SetLastError (dwErrCode=0x12) [0278.914] GetLastError () returned 0x12 [0278.914] SetLastError (dwErrCode=0x12) [0278.914] GetLastError () returned 0x0 [0278.914] SetLastError (dwErrCode=0x0) [0278.914] GetLastError () returned 0x0 [0278.914] SetLastError (dwErrCode=0x0) [0278.914] GetLastError () returned 0x0 [0278.914] SetLastError (dwErrCode=0x0) [0278.914] GetLastError () returned 0x0 [0278.914] SetLastError (dwErrCode=0x0) [0278.914] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Program Files", psz="c:\\Program Files\\", len=0x11 | out: pbstr=0x5ffd08*="c:\\Program Files\\") returned 1 [0278.914] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Program Files\\", psz="common files", len=0xc | out: pbstr=0x5ffa00*="common files") returned 1 [0278.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Program Files\\common files", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0278.914] GetLastError () returned 0x0 [0278.914] SetLastError (dwErrCode=0x0) [0278.914] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Program Files\\common files", cchWideChar=29, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Program Files\\common files", lpUsedDefaultChar=0x0) returned 29 [0278.914] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0278.914] GetLastError () returned 0x0 [0278.914] SetLastError (dwErrCode=0x0) [0278.914] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpWideCharStr=0x8db968, cchWideChar=29 | out: lpWideCharStr="c:\\Program Files\\common files") returned 29 [0278.915] FindFirstFileW (in: lpFileName="c:\\Program Files\\common files", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb953a580, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb953a580, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 0x6c1bc0 [0278.915] FindNextFileW (in: hFindFile=0x6c1bc0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xb953a580, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb953a580, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 0 [0278.915] GetLastError () returned 0x12 [0278.915] FindClose (in: hFindFile=0x6c1bc0 | out: hFindFile=0x6c1bc0) returned 1 [0278.915] GetLastError () returned 0x12 [0278.915] SetLastError (dwErrCode=0x12) [0278.915] GetLastError () returned 0x12 [0278.915] SetLastError (dwErrCode=0x12) [0278.915] GetLastError () returned 0x0 [0278.915] SetLastError (dwErrCode=0x0) [0278.915] GetLastError () returned 0x0 [0278.915] SetLastError (dwErrCode=0x0) [0278.915] GetLastError () returned 0x0 [0278.915] SetLastError (dwErrCode=0x0) [0278.915] GetLastError () returned 0x0 [0278.915] SetLastError (dwErrCode=0x0) [0278.916] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Program Files\\Common Files", psz="c:\\Program Files\\Common Files\\", len=0x1e | out: pbstr=0x5ffd08*="c:\\Program Files\\Common Files\\") returned 1 [0278.916] GetLastError () returned 0x0 [0278.916] SetLastError (dwErrCode=0x0) [0278.916] GetLastError () returned 0x0 [0278.916] SetLastError (dwErrCode=0x0) [0278.916] GetLastError () returned 0x0 [0278.916] SetLastError (dwErrCode=0x0) [0278.916] GetLastError () returned 0x0 [0278.916] SetLastError (dwErrCode=0x0) [0278.916] GetLastError () returned 0x0 [0278.916] SetLastError (dwErrCode=0x0) [0278.916] GetLastError () returned 0x0 [0278.916] SetLastError (dwErrCode=0x0) [0278.916] GetLastError () returned 0x0 [0278.916] SetLastError (dwErrCode=0x0) [0278.916] GetLastError () returned 0x0 [0278.916] SetLastError (dwErrCode=0x0) [0278.916] GetLastError () returned 0x0 [0278.916] SetLastError (dwErrCode=0x0) [0278.916] GetLastError () returned 0x0 [0278.916] SetLastError (dwErrCode=0x0) [0278.916] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Program Files\\Common Files\\", psz="c:\\Program Files\\Common Files", len=0x1d | out: pbstr=0x5ffd08*="c:\\Program Files\\Common Files") returned 1 [0278.917] GetLastError () returned 0x0 [0278.917] SetLastError (dwErrCode=0x0) [0278.917] GetLastError () returned 0x0 [0278.917] SetLastError (dwErrCode=0x0) [0278.917] GetLastError () returned 0x0 [0278.917] SetLastError (dwErrCode=0x0) [0278.917] GetLastError () returned 0x0 [0278.917] SetLastError (dwErrCode=0x0) [0278.917] SysReAllocStringLen (in: pbstr=0x6c2e28*=0x0, psz="c:\\Program Files\\Common Files\\", len=0x1e | out: pbstr=0x6c2e28*="c:\\Program Files\\Common Files\\") returned 1 [0278.917] SHGetFolderPathW (in: hwnd=0x0, csidl=39, hToken=0x0, dwFlags=0x0, pszPath=0x25f1fd0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\Pictures") returned 0x0 [0278.917] GetLastError () returned 0x0 [0278.917] SetLastError (dwErrCode=0x0) [0278.917] GetLastError () returned 0x0 [0278.917] SetLastError (dwErrCode=0x0) [0278.917] GetLastError () returned 0x0 [0278.918] SetLastError (dwErrCode=0x0) [0278.918] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\Pictures", len=0x1e | out: pbstr=0x5ff970*="C:\\Users\\RDhJ0CNFevzX\\Pictures") returned 1 [0278.918] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\Pictures", cchLength=0x1e | out: lpsz="c:\\users\\rdhj0cnfevzx\\pictures") returned 0x1e [0278.918] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\users\\rdhj0cnfevzx\\pictures", len=0x1e | out: pbstr=0x8e5768*="c:\\users\\rdhj0cnfevzx\\pictures") returned 1 [0278.918] GetLastError () returned 0x0 [0278.918] SetLastError (dwErrCode=0x0) [0278.918] GetLastError () returned 0x0 [0278.918] SetLastError (dwErrCode=0x0) [0278.918] GetLastError () returned 0x0 [0278.918] SetLastError (dwErrCode=0x0) [0278.918] GetLastError () returned 0x0 [0278.918] SetLastError (dwErrCode=0x0) [0278.918] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.918] GetLastError () returned 0x0 [0278.918] SetLastError (dwErrCode=0x0) [0278.919] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="users", len=0x5 | out: pbstr=0x8f3740*="users") returned 1 [0278.919] GetLastError () returned 0x0 [0278.919] SetLastError (dwErrCode=0x0) [0278.919] GetLastError () returned 0x0 [0278.919] SetLastError (dwErrCode=0x0) [0278.919] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x8f3760*="rdhj0cnfevzx") returned 1 [0278.919] GetLastError () returned 0x0 [0278.919] SetLastError (dwErrCode=0x0) [0278.919] SysReAllocStringLen (in: pbstr=0x8f3780*=0x0, psz="pictures", len=0x8 | out: pbstr=0x8f3780*="pictures") returned 1 [0278.919] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.919] GetLastError () returned 0x0 [0278.919] SetLastError (dwErrCode=0x0) [0278.920] GetLastError () returned 0x0 [0278.920] SetLastError (dwErrCode=0x0) [0278.920] GetLastError () returned 0x0 [0278.920] SetLastError (dwErrCode=0x0) [0278.920] GetLastError () returned 0x0 [0278.920] SetLastError (dwErrCode=0x0) [0278.920] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.920] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x5ffa00*="users") returned 1 [0278.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0278.920] GetLastError () returned 0x0 [0278.920] SetLastError (dwErrCode=0x0) [0278.920] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0278.920] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0278.920] GetLastError () returned 0x0 [0278.920] SetLastError (dwErrCode=0x0) [0278.920] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpWideCharStr=0x8e57f8, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0278.920] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c1e00 [0278.921] FindNextFileW (in: hFindFile=0x6c1e00, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0278.921] GetLastError () returned 0x12 [0278.921] FindClose (in: hFindFile=0x6c1e00 | out: hFindFile=0x6c1e00) returned 1 [0278.921] GetLastError () returned 0x12 [0278.921] SetLastError (dwErrCode=0x12) [0278.921] GetLastError () returned 0x12 [0278.921] SetLastError (dwErrCode=0x12) [0278.921] GetLastError () returned 0x0 [0278.921] SetLastError (dwErrCode=0x0) [0278.921] GetLastError () returned 0x0 [0278.921] SetLastError (dwErrCode=0x0) [0278.921] GetLastError () returned 0x0 [0278.921] SetLastError (dwErrCode=0x0) [0278.921] GetLastError () returned 0x0 [0278.921] SetLastError (dwErrCode=0x0) [0278.921] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x5ffd08*="c:\\Users\\") returned 1 [0278.921] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x5ffa00*="rdhj0cnfevzx") returned 1 [0278.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0278.922] GetLastError () returned 0x0 [0278.922] SetLastError (dwErrCode=0x0) [0278.922] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0278.922] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0278.922] GetLastError () returned 0x0 [0278.922] SetLastError (dwErrCode=0x0) [0278.922] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpWideCharStr=0x8db908, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0278.922] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6c1860 [0278.922] FindNextFileW (in: hFindFile=0x6c1860, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0278.922] GetLastError () returned 0x12 [0278.922] FindClose (in: hFindFile=0x6c1860 | out: hFindFile=0x6c1860) returned 1 [0278.922] GetLastError () returned 0x12 [0278.922] SetLastError (dwErrCode=0x12) [0278.922] GetLastError () returned 0x12 [0278.922] SetLastError (dwErrCode=0x12) [0278.922] GetLastError () returned 0x0 [0278.922] SetLastError (dwErrCode=0x0) [0278.923] GetLastError () returned 0x0 [0278.923] SetLastError (dwErrCode=0x0) [0278.923] GetLastError () returned 0x0 [0278.923] SetLastError (dwErrCode=0x0) [0278.923] GetLastError () returned 0x0 [0278.923] SetLastError (dwErrCode=0x0) [0278.923] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0278.923] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="pictures", len=0x8 | out: pbstr=0x5ffa00*="pictures") returned 1 [0278.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\pictures", cchWideChar=30, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 30 [0278.923] GetLastError () returned 0x0 [0278.923] SetLastError (dwErrCode=0x0) [0278.923] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\pictures", cchWideChar=30, lpMultiByteStr=0x8e57f8, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\pictures", lpUsedDefaultChar=0x0) returned 30 [0278.923] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=30, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 30 [0278.923] GetLastError () returned 0x0 [0278.923] SetLastError (dwErrCode=0x0) [0278.923] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=30, lpWideCharStr=0x8db968, cchWideChar=30 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\pictures") returned 30 [0278.923] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\pictures", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb85b0d8b, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb85b0d8b, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 0x6c2280 [0278.923] FindNextFileW (in: hFindFile=0x6c2280, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ceb0231, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb85b0d8b, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb85b0d8b, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 0 [0278.923] GetLastError () returned 0x12 [0278.923] FindClose (in: hFindFile=0x6c2280 | out: hFindFile=0x6c2280) returned 1 [0278.924] GetLastError () returned 0x12 [0278.924] SetLastError (dwErrCode=0x12) [0278.924] GetLastError () returned 0x12 [0278.924] SetLastError (dwErrCode=0x12) [0278.924] GetLastError () returned 0x0 [0278.924] SetLastError (dwErrCode=0x0) [0278.924] GetLastError () returned 0x0 [0278.924] SetLastError (dwErrCode=0x0) [0278.924] GetLastError () returned 0x0 [0278.924] SetLastError (dwErrCode=0x0) [0278.924] GetLastError () returned 0x0 [0278.924] SetLastError (dwErrCode=0x0) [0278.924] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\Pictures", psz="c:\\Users\\RDhJ0CNFevzX\\Pictures\\", len=0x1f | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\Pictures\\") returned 1 [0278.924] GetLastError () returned 0x0 [0278.924] SetLastError (dwErrCode=0x0) [0278.924] GetLastError () returned 0x0 [0278.924] SetLastError (dwErrCode=0x0) [0278.924] GetLastError () returned 0x0 [0278.925] SetLastError (dwErrCode=0x0) [0278.925] GetLastError () returned 0x0 [0278.925] SetLastError (dwErrCode=0x0) [0278.925] GetLastError () returned 0x0 [0278.925] SetLastError (dwErrCode=0x0) [0278.925] GetLastError () returned 0x0 [0278.925] SetLastError (dwErrCode=0x0) [0278.925] GetLastError () returned 0x0 [0278.925] SetLastError (dwErrCode=0x0) [0278.925] GetLastError () returned 0x0 [0278.925] SetLastError (dwErrCode=0x0) [0278.925] GetLastError () returned 0x0 [0278.925] SetLastError (dwErrCode=0x0) [0278.925] GetLastError () returned 0x0 [0278.925] SetLastError (dwErrCode=0x0) [0278.925] GetLastError () returned 0x0 [0278.925] SetLastError (dwErrCode=0x0) [0278.925] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\Pictures\\", psz="c:\\Users\\RDhJ0CNFevzX\\Pictures", len=0x1e | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\Pictures") returned 1 [0278.925] GetLastError () returned 0x0 [0278.925] SetLastError (dwErrCode=0x0) [0278.925] GetLastError () returned 0x0 [0278.926] SetLastError (dwErrCode=0x0) [0278.926] GetLastError () returned 0x0 [0278.926] SetLastError (dwErrCode=0x0) [0278.926] GetLastError () returned 0x0 [0278.926] SetLastError (dwErrCode=0x0) [0278.926] SysReAllocStringLen (in: pbstr=0x6c2e30*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\Pictures\\", len=0x1f | out: pbstr=0x6c2e30*="c:\\Users\\RDhJ0CNFevzX\\Pictures\\") returned 1 [0278.926] SHGetFolderPathW (in: hwnd=0x0, csidl=34, hToken=0x0, dwFlags=0x0, pszPath=0x25f1fd0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History") returned 0x0 [0278.926] GetLastError () returned 0x0 [0278.926] SetLastError (dwErrCode=0x0) [0278.926] GetLastError () returned 0x0 [0278.926] SetLastError (dwErrCode=0x0) [0278.926] GetLastError () returned 0x0 [0278.926] SetLastError (dwErrCode=0x0) [0278.926] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History", len=0x3d | out: pbstr=0x5ff970*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History") returned 1 [0278.926] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History", cchLength=0x3d | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history") returned 0x3d [0278.926] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history", len=0x3d | out: pbstr=0x8e5768*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\history") returned 1 [0278.926] GetLastError () returned 0x0 [0278.926] SetLastError (dwErrCode=0x0) [0278.926] GetLastError () returned 0x0 [0278.927] SetLastError (dwErrCode=0x0) [0278.927] GetLastError () returned 0x0 [0278.927] SetLastError (dwErrCode=0x0) [0278.927] GetLastError () returned 0x0 [0278.927] SetLastError (dwErrCode=0x0) [0278.927] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.927] GetLastError () returned 0x0 [0278.927] SetLastError (dwErrCode=0x0) [0278.927] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="users", len=0x5 | out: pbstr=0x8f3740*="users") returned 1 [0278.927] GetLastError () returned 0x0 [0278.927] SetLastError (dwErrCode=0x0) [0278.927] GetLastError () returned 0x0 [0278.927] SetLastError (dwErrCode=0x0) [0278.927] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x8f3760*="rdhj0cnfevzx") returned 1 [0278.927] GetLastError () returned 0x0 [0278.927] SetLastError (dwErrCode=0x0) [0278.927] SysReAllocStringLen (in: pbstr=0x8f3780*=0x0, psz="appdata", len=0x7 | out: pbstr=0x8f3780*="appdata") returned 1 [0278.928] GetLastError () returned 0x0 [0278.928] SetLastError (dwErrCode=0x0) [0278.928] SysReAllocStringLen (in: pbstr=0x8f37a0*=0x0, psz="local", len=0x5 | out: pbstr=0x8f37a0*="local") returned 1 [0278.928] GetLastError () returned 0x0 [0278.928] SetLastError (dwErrCode=0x0) [0278.928] SysReAllocStringLen (in: pbstr=0x8f37c0*=0x0, psz="microsoft", len=0x9 | out: pbstr=0x8f37c0*="microsoft") returned 1 [0278.928] GetLastError () returned 0x0 [0278.928] SetLastError (dwErrCode=0x0) [0278.928] GetLastError () returned 0x0 [0278.928] SetLastError (dwErrCode=0x0) [0278.928] GetLastError () returned 0x0 [0278.928] SetLastError (dwErrCode=0x0) [0278.929] SysReAllocStringLen (in: pbstr=0x8f37e0*=0x0, psz="windows", len=0x7 | out: pbstr=0x8f37e0*="windows") returned 1 [0278.929] GetLastError () returned 0x0 [0278.929] SetLastError (dwErrCode=0x0) [0278.929] SysReAllocStringLen (in: pbstr=0x8f3800*=0x0, psz="history", len=0x7 | out: pbstr=0x8f3800*="history") returned 1 [0278.929] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.929] GetLastError () returned 0x0 [0278.929] SetLastError (dwErrCode=0x0) [0278.929] GetLastError () returned 0x0 [0278.929] SetLastError (dwErrCode=0x0) [0278.929] GetLastError () returned 0x0 [0278.929] SetLastError (dwErrCode=0x0) [0278.929] GetLastError () returned 0x0 [0278.930] SetLastError (dwErrCode=0x0) [0278.930] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.930] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x5ffa00*="users") returned 1 [0278.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0278.931] GetLastError () returned 0x0 [0278.931] SetLastError (dwErrCode=0x0) [0278.931] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x8e57f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0278.931] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0278.931] GetLastError () returned 0x0 [0278.931] SetLastError (dwErrCode=0x0) [0278.931] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=8, lpWideCharStr=0x8e5878, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0278.931] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c1f80 [0278.931] FindNextFileW (in: hFindFile=0x6c1f80, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0278.931] GetLastError () returned 0x12 [0278.931] FindClose (in: hFindFile=0x6c1f80 | out: hFindFile=0x6c1f80) returned 1 [0278.931] GetLastError () returned 0x12 [0278.931] SetLastError (dwErrCode=0x12) [0278.931] GetLastError () returned 0x12 [0278.931] SetLastError (dwErrCode=0x12) [0278.931] GetLastError () returned 0x0 [0278.932] SetLastError (dwErrCode=0x0) [0278.932] GetLastError () returned 0x0 [0278.932] SetLastError (dwErrCode=0x0) [0278.932] GetLastError () returned 0x0 [0278.932] SetLastError (dwErrCode=0x0) [0278.932] GetLastError () returned 0x0 [0278.932] SetLastError (dwErrCode=0x0) [0278.932] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x5ffd08*="c:\\Users\\") returned 1 [0278.932] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x5ffa00*="rdhj0cnfevzx") returned 1 [0278.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0278.932] GetLastError () returned 0x0 [0278.932] SetLastError (dwErrCode=0x0) [0278.932] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x8e5878, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0278.932] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0278.932] GetLastError () returned 0x0 [0278.932] SetLastError (dwErrCode=0x0) [0278.932] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=21, lpWideCharStr=0x8db908, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0278.932] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6c1980 [0278.932] FindNextFileW (in: hFindFile=0x6c1980, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0278.933] GetLastError () returned 0x12 [0278.933] FindClose (in: hFindFile=0x6c1980 | out: hFindFile=0x6c1980) returned 1 [0278.933] GetLastError () returned 0x12 [0278.933] SetLastError (dwErrCode=0x12) [0278.933] GetLastError () returned 0x12 [0278.933] SetLastError (dwErrCode=0x12) [0278.933] GetLastError () returned 0x0 [0278.934] SetLastError (dwErrCode=0x0) [0278.934] GetLastError () returned 0x0 [0278.934] SetLastError (dwErrCode=0x0) [0278.934] GetLastError () returned 0x0 [0278.934] SetLastError (dwErrCode=0x0) [0278.934] GetLastError () returned 0x0 [0278.934] SetLastError (dwErrCode=0x0) [0278.934] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0278.934] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x5ffa00*="appdata") returned 1 [0278.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0278.934] GetLastError () returned 0x0 [0278.934] SetLastError (dwErrCode=0x0) [0278.934] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x8e5878, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0278.935] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0278.935] GetLastError () returned 0x0 [0278.935] SetLastError (dwErrCode=0x0) [0278.935] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=29, lpWideCharStr=0x8db968, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0278.935] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x6c1b00 [0278.935] FindNextFileW (in: hFindFile=0x6c1b00, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0278.935] GetLastError () returned 0x12 [0278.935] FindClose (in: hFindFile=0x6c1b00 | out: hFindFile=0x6c1b00) returned 1 [0278.935] GetLastError () returned 0x12 [0278.935] SetLastError (dwErrCode=0x12) [0278.935] GetLastError () returned 0x12 [0278.935] SetLastError (dwErrCode=0x12) [0278.935] GetLastError () returned 0x0 [0278.935] SetLastError (dwErrCode=0x0) [0278.935] GetLastError () returned 0x0 [0278.935] SetLastError (dwErrCode=0x0) [0278.935] GetLastError () returned 0x0 [0278.936] SetLastError (dwErrCode=0x0) [0278.936] GetLastError () returned 0x0 [0278.936] SetLastError (dwErrCode=0x0) [0278.936] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0278.936] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="local", len=0x5 | out: pbstr=0x5ffa00*="local") returned 1 [0278.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0278.936] GetLastError () returned 0x0 [0278.936] SetLastError (dwErrCode=0x0) [0278.936] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x8db908, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpUsedDefaultChar=0x0) returned 35 [0278.936] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0278.936] GetLastError () returned 0x0 [0278.936] SetLastError (dwErrCode=0x0) [0278.936] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=35, lpWideCharStr=0x8fb568, cchWideChar=35 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local") returned 35 [0278.936] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x6c1a40 [0278.936] FindNextFileW (in: hFindFile=0x6c1a40, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0278.936] GetLastError () returned 0x12 [0278.936] FindClose (in: hFindFile=0x6c1a40 | out: hFindFile=0x6c1a40) returned 1 [0278.936] GetLastError () returned 0x12 [0278.936] SetLastError (dwErrCode=0x12) [0278.936] GetLastError () returned 0x12 [0278.937] SetLastError (dwErrCode=0x12) [0278.937] GetLastError () returned 0x0 [0278.937] SetLastError (dwErrCode=0x0) [0278.937] GetLastError () returned 0x0 [0278.937] SetLastError (dwErrCode=0x0) [0278.937] GetLastError () returned 0x0 [0278.937] SetLastError (dwErrCode=0x0) [0278.937] GetLastError () returned 0x0 [0278.937] SetLastError (dwErrCode=0x0) [0278.937] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0278.937] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", psz="microsoft", len=0x9 | out: pbstr=0x5ffa00*="microsoft") returned 1 [0278.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0278.937] GetLastError () returned 0x0 [0278.937] SetLastError (dwErrCode=0x0) [0278.937] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", cchWideChar=45, lpMultiByteStr=0x8db908, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", lpUsedDefaultChar=0x0) returned 45 [0278.937] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0278.937] GetLastError () returned 0x0 [0278.938] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=45, lpWideCharStr=0x8fb4e8, cchWideChar=45 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft") returned 45 [0278.938] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x6c1860 [0278.938] FindNextFileW (in: hFindFile=0x6c1860, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0278.938] GetLastError () returned 0x12 [0278.938] FindClose (in: hFindFile=0x6c1860 | out: hFindFile=0x6c1860) returned 1 [0278.938] GetLastError () returned 0x12 [0278.939] GetLastError () returned 0x0 [0278.939] SetLastError (dwErrCode=0x0) [0278.939] GetLastError () returned 0x0 [0278.939] SetLastError (dwErrCode=0x0) [0278.939] GetLastError () returned 0x0 [0278.939] SetLastError (dwErrCode=0x0) [0278.939] GetLastError () returned 0x0 [0278.939] SetLastError (dwErrCode=0x0) [0278.939] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", len=0x2e | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\") returned 1 [0278.939] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", psz="windows", len=0x7 | out: pbstr=0x5ffa00*="windows") returned 1 [0278.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0278.939] GetLastError () returned 0x0 [0278.939] SetLastError (dwErrCode=0x0) [0278.939] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", cchWideChar=53, lpMultiByteStr=0x8db908, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", lpUsedDefaultChar=0x0) returned 53 [0278.939] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0278.939] GetLastError () returned 0x0 [0278.939] SetLastError (dwErrCode=0x0) [0278.939] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=53, lpWideCharStr=0x6c3108, cchWideChar=53 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows") returned 53 [0278.939] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x6c18c0 [0278.940] FindNextFileW (in: hFindFile=0x6c18c0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0278.940] GetLastError () returned 0x12 [0278.940] FindClose (in: hFindFile=0x6c18c0 | out: hFindFile=0x6c18c0) returned 1 [0278.940] GetLastError () returned 0x12 [0278.940] SetLastError (dwErrCode=0x12) [0278.940] GetLastError () returned 0x12 [0278.940] SetLastError (dwErrCode=0x12) [0278.940] GetLastError () returned 0x0 [0278.940] SetLastError (dwErrCode=0x0) [0278.940] GetLastError () returned 0x0 [0278.940] SetLastError (dwErrCode=0x0) [0278.940] GetLastError () returned 0x0 [0278.940] SetLastError (dwErrCode=0x0) [0278.941] GetLastError () returned 0x0 [0278.941] SetLastError (dwErrCode=0x0) [0278.941] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\", len=0x36 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\") returned 1 [0278.941] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\", psz="history", len=0x7 | out: pbstr=0x5ffa00*="history") returned 1 [0278.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\history", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0278.941] GetLastError () returned 0x0 [0278.941] SetLastError (dwErrCode=0x0) [0278.941] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\history", cchWideChar=61, lpMultiByteStr=0x8db908, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\history", lpUsedDefaultChar=0x0) returned 61 [0278.941] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=61, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 61 [0278.941] GetLastError () returned 0x0 [0278.941] SetLastError (dwErrCode=0x0) [0278.941] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=61, lpWideCharStr=0x6c3068, cchWideChar=61 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\history") returned 61 [0278.941] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\history", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4f959ee, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4f959ee, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 0x6c1ce0 [0278.941] FindNextFileW (in: hFindFile=0x6c1ce0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x4f959ee, ftLastAccessTime.dwHighDateTime=0x1d70460, ftLastWriteTime.dwLowDateTime=0x4f959ee, ftLastWriteTime.dwHighDateTime=0x1d70460, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 0 [0278.941] GetLastError () returned 0x12 [0278.941] FindClose (in: hFindFile=0x6c1ce0 | out: hFindFile=0x6c1ce0) returned 1 [0278.941] GetLastError () returned 0x12 [0278.941] SetLastError (dwErrCode=0x12) [0278.941] GetLastError () returned 0x12 [0278.942] SetLastError (dwErrCode=0x12) [0278.942] GetLastError () returned 0x0 [0278.942] SetLastError (dwErrCode=0x0) [0278.942] GetLastError () returned 0x0 [0278.942] SetLastError (dwErrCode=0x0) [0278.942] GetLastError () returned 0x0 [0278.942] SetLastError (dwErrCode=0x0) [0278.942] GetLastError () returned 0x0 [0278.942] SetLastError (dwErrCode=0x0) [0278.942] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x3e | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0278.942] GetLastError () returned 0x0 [0278.942] SetLastError (dwErrCode=0x0) [0278.942] GetLastError () returned 0x0 [0278.942] SetLastError (dwErrCode=0x0) [0278.942] GetLastError () returned 0x0 [0278.943] SetLastError (dwErrCode=0x0) [0278.943] GetLastError () returned 0x0 [0278.943] SetLastError (dwErrCode=0x0) [0278.943] GetLastError () returned 0x0 [0278.943] SetLastError (dwErrCode=0x0) [0278.943] GetLastError () returned 0x0 [0278.943] SetLastError (dwErrCode=0x0) [0278.943] GetLastError () returned 0x0 [0278.943] SetLastError (dwErrCode=0x0) [0278.943] GetLastError () returned 0x0 [0278.943] SetLastError (dwErrCode=0x0) [0278.943] GetLastError () returned 0x0 [0278.943] SetLastError (dwErrCode=0x0) [0278.943] GetLastError () returned 0x0 [0278.943] SetLastError (dwErrCode=0x0) [0278.943] GetLastError () returned 0x0 [0278.943] SetLastError (dwErrCode=0x0) [0278.943] GetLastError () returned 0x0 [0278.943] SetLastError (dwErrCode=0x0) [0278.943] GetLastError () returned 0x0 [0278.943] SetLastError (dwErrCode=0x0) [0278.943] GetLastError () returned 0x0 [0278.944] SetLastError (dwErrCode=0x0) [0278.944] GetLastError () returned 0x0 [0278.944] SetLastError (dwErrCode=0x0) [0278.944] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History", len=0x3d | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History") returned 1 [0278.944] GetLastError () returned 0x0 [0278.944] SetLastError (dwErrCode=0x0) [0278.944] GetLastError () returned 0x0 [0278.944] SetLastError (dwErrCode=0x0) [0278.944] GetLastError () returned 0x0 [0278.944] SetLastError (dwErrCode=0x0) [0278.944] GetLastError () returned 0x0 [0278.944] SetLastError (dwErrCode=0x0) [0278.944] SysReAllocStringLen (in: pbstr=0x6c2e38*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\", len=0x3e | out: pbstr=0x6c2e38*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\History\\") returned 1 [0278.944] SHGetFolderPathW (in: hwnd=0x0, csidl=33, hToken=0x0, dwFlags=0x0, pszPath=0x25f1fd0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies") returned 0x0 [0278.944] GetLastError () returned 0x0 [0278.944] SetLastError (dwErrCode=0x0) [0278.944] GetLastError () returned 0x0 [0278.945] SetLastError (dwErrCode=0x0) [0278.945] GetLastError () returned 0x0 [0278.945] SetLastError (dwErrCode=0x0) [0278.945] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies", len=0x41 | out: pbstr=0x5ff970*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies") returned 1 [0278.945] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies", cchLength=0x41 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies") returned 0x41 [0278.945] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies", len=0x41 | out: pbstr=0x8e5768*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcookies") returned 1 [0278.945] GetLastError () returned 0x0 [0278.945] SetLastError (dwErrCode=0x0) [0278.945] GetLastError () returned 0x0 [0278.945] SetLastError (dwErrCode=0x0) [0278.945] GetLastError () returned 0x0 [0278.945] SetLastError (dwErrCode=0x0) [0278.945] GetLastError () returned 0x0 [0278.945] SetLastError (dwErrCode=0x0) [0278.945] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.945] GetLastError () returned 0x0 [0278.945] SetLastError (dwErrCode=0x0) [0278.945] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="users", len=0x5 | out: pbstr=0x8f3740*="users") returned 1 [0278.945] GetLastError () returned 0x0 [0278.946] SetLastError (dwErrCode=0x0) [0278.946] GetLastError () returned 0x0 [0278.946] SetLastError (dwErrCode=0x0) [0278.946] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x8f3760*="rdhj0cnfevzx") returned 1 [0278.946] GetLastError () returned 0x0 [0278.946] SetLastError (dwErrCode=0x0) [0278.946] SysReAllocStringLen (in: pbstr=0x8f3780*=0x0, psz="appdata", len=0x7 | out: pbstr=0x8f3780*="appdata") returned 1 [0278.946] GetLastError () returned 0x0 [0278.946] SetLastError (dwErrCode=0x0) [0278.946] SysReAllocStringLen (in: pbstr=0x8f37a0*=0x0, psz="local", len=0x5 | out: pbstr=0x8f37a0*="local") returned 1 [0278.946] GetLastError () returned 0x0 [0278.946] SetLastError (dwErrCode=0x0) [0278.946] SysReAllocStringLen (in: pbstr=0x8f37c0*=0x0, psz="microsoft", len=0x9 | out: pbstr=0x8f37c0*="microsoft") returned 1 [0278.946] GetLastError () returned 0x0 [0278.946] SetLastError (dwErrCode=0x0) [0278.946] GetLastError () returned 0x0 [0278.946] SetLastError (dwErrCode=0x0) [0278.946] GetLastError () returned 0x0 [0278.946] SetLastError (dwErrCode=0x0) [0278.946] SysReAllocStringLen (in: pbstr=0x8f37e0*=0x0, psz="windows", len=0x7 | out: pbstr=0x8f37e0*="windows") returned 1 [0278.947] GetLastError () returned 0x0 [0278.947] SetLastError (dwErrCode=0x0) [0278.947] SysReAllocStringLen (in: pbstr=0x8f3800*=0x0, psz="inetcookies", len=0xb | out: pbstr=0x8f3800*="inetcookies") returned 1 [0278.947] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.947] GetLastError () returned 0x0 [0278.947] SetLastError (dwErrCode=0x0) [0278.947] GetLastError () returned 0x0 [0278.947] SetLastError (dwErrCode=0x0) [0278.947] GetLastError () returned 0x0 [0278.947] SetLastError (dwErrCode=0x0) [0278.947] GetLastError () returned 0x0 [0278.947] SetLastError (dwErrCode=0x0) [0278.947] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.948] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x5ffa00*="users") returned 1 [0278.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0278.948] GetLastError () returned 0x0 [0278.948] SetLastError (dwErrCode=0x0) [0278.948] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x8e57f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0278.948] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0278.948] GetLastError () returned 0x0 [0278.948] SetLastError (dwErrCode=0x0) [0278.948] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=8, lpWideCharStr=0x8e5878, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0278.948] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c1860 [0278.948] FindNextFileW (in: hFindFile=0x6c1860, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0278.948] GetLastError () returned 0x12 [0278.948] FindClose (in: hFindFile=0x6c1860 | out: hFindFile=0x6c1860) returned 1 [0278.948] GetLastError () returned 0x12 [0278.949] SetLastError (dwErrCode=0x12) [0278.949] GetLastError () returned 0x12 [0278.949] SetLastError (dwErrCode=0x12) [0278.949] GetLastError () returned 0x0 [0278.949] SetLastError (dwErrCode=0x0) [0278.949] GetLastError () returned 0x0 [0278.949] SetLastError (dwErrCode=0x0) [0278.949] GetLastError () returned 0x0 [0278.949] SetLastError (dwErrCode=0x0) [0278.949] GetLastError () returned 0x0 [0278.949] SetLastError (dwErrCode=0x0) [0278.949] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x5ffd08*="c:\\Users\\") returned 1 [0278.949] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x5ffa00*="rdhj0cnfevzx") returned 1 [0278.949] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0278.950] GetLastError () returned 0x0 [0278.950] SetLastError (dwErrCode=0x0) [0278.950] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x8e5878, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0278.950] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0278.950] GetLastError () returned 0x0 [0278.950] SetLastError (dwErrCode=0x0) [0278.950] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=21, lpWideCharStr=0x8db908, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0278.950] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6c1e00 [0278.950] FindNextFileW (in: hFindFile=0x6c1e00, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0278.950] GetLastError () returned 0x12 [0278.950] FindClose (in: hFindFile=0x6c1e00 | out: hFindFile=0x6c1e00) returned 1 [0278.950] GetLastError () returned 0x12 [0278.950] SetLastError (dwErrCode=0x12) [0278.950] GetLastError () returned 0x12 [0278.950] SetLastError (dwErrCode=0x12) [0278.951] GetLastError () returned 0x0 [0278.951] SetLastError (dwErrCode=0x0) [0278.951] GetLastError () returned 0x0 [0278.951] SetLastError (dwErrCode=0x0) [0278.951] GetLastError () returned 0x0 [0278.951] SetLastError (dwErrCode=0x0) [0278.951] GetLastError () returned 0x0 [0278.951] SetLastError (dwErrCode=0x0) [0278.951] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0278.951] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x5ffa00*="appdata") returned 1 [0278.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0278.951] GetLastError () returned 0x0 [0278.951] SetLastError (dwErrCode=0x0) [0278.951] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x8e5878, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0278.951] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0278.951] GetLastError () returned 0x0 [0278.951] SetLastError (dwErrCode=0x0) [0278.951] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=29, lpWideCharStr=0x8db968, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0278.951] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x6c1860 [0278.951] FindNextFileW (in: hFindFile=0x6c1860, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0278.952] GetLastError () returned 0x12 [0278.952] FindClose (in: hFindFile=0x6c1860 | out: hFindFile=0x6c1860) returned 1 [0278.952] GetLastError () returned 0x12 [0278.952] SetLastError (dwErrCode=0x12) [0278.952] GetLastError () returned 0x12 [0278.952] SetLastError (dwErrCode=0x12) [0278.952] GetLastError () returned 0x0 [0278.952] SetLastError (dwErrCode=0x0) [0278.952] GetLastError () returned 0x0 [0278.952] SetLastError (dwErrCode=0x0) [0278.952] GetLastError () returned 0x0 [0278.952] SetLastError (dwErrCode=0x0) [0278.952] GetLastError () returned 0x0 [0278.952] SetLastError (dwErrCode=0x0) [0278.952] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0278.952] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="local", len=0x5 | out: pbstr=0x5ffa00*="local") returned 1 [0278.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0278.953] GetLastError () returned 0x0 [0278.953] SetLastError (dwErrCode=0x0) [0278.953] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x8db908, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpUsedDefaultChar=0x0) returned 35 [0278.953] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0278.953] GetLastError () returned 0x0 [0278.953] SetLastError (dwErrCode=0x0) [0278.953] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=35, lpWideCharStr=0x8fb568, cchWideChar=35 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local") returned 35 [0278.953] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x6c1ce0 [0278.953] FindNextFileW (in: hFindFile=0x6c1ce0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0278.953] GetLastError () returned 0x12 [0278.953] FindClose (in: hFindFile=0x6c1ce0 | out: hFindFile=0x6c1ce0) returned 1 [0278.953] GetLastError () returned 0x12 [0278.954] SetLastError (dwErrCode=0x12) [0278.954] GetLastError () returned 0x12 [0278.954] SetLastError (dwErrCode=0x12) [0278.954] GetLastError () returned 0x0 [0278.954] SetLastError (dwErrCode=0x0) [0278.954] GetLastError () returned 0x0 [0278.954] SetLastError (dwErrCode=0x0) [0278.954] GetLastError () returned 0x0 [0278.954] SetLastError (dwErrCode=0x0) [0278.954] GetLastError () returned 0x0 [0278.954] SetLastError (dwErrCode=0x0) [0278.954] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0278.954] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", psz="microsoft", len=0x9 | out: pbstr=0x5ffa00*="microsoft") returned 1 [0278.954] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0278.954] GetLastError () returned 0x0 [0278.954] SetLastError (dwErrCode=0x0) [0278.955] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", cchWideChar=45, lpMultiByteStr=0x8db908, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", lpUsedDefaultChar=0x0) returned 45 [0278.955] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0278.955] GetLastError () returned 0x0 [0278.955] SetLastError (dwErrCode=0x0) [0278.955] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=45, lpWideCharStr=0x8fb4e8, cchWideChar=45 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft") returned 45 [0278.955] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x6c1500 [0278.955] FindNextFileW (in: hFindFile=0x6c1500, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0278.955] GetLastError () returned 0x12 [0278.955] FindClose (in: hFindFile=0x6c1500 | out: hFindFile=0x6c1500) returned 1 [0278.955] GetLastError () returned 0x12 [0278.955] SetLastError (dwErrCode=0x12) [0278.955] GetLastError () returned 0x12 [0278.955] SetLastError (dwErrCode=0x12) [0278.955] GetLastError () returned 0x0 [0278.955] SetLastError (dwErrCode=0x0) [0278.955] GetLastError () returned 0x0 [0278.955] SetLastError (dwErrCode=0x0) [0278.955] GetLastError () returned 0x0 [0278.956] SetLastError (dwErrCode=0x0) [0278.956] GetLastError () returned 0x0 [0278.956] SetLastError (dwErrCode=0x0) [0278.956] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", len=0x2e | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\") returned 1 [0278.956] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", psz="windows", len=0x7 | out: pbstr=0x5ffa00*="windows") returned 1 [0278.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0278.956] GetLastError () returned 0x0 [0278.956] SetLastError (dwErrCode=0x0) [0278.956] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", cchWideChar=53, lpMultiByteStr=0x8db908, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", lpUsedDefaultChar=0x0) returned 53 [0278.956] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0278.956] GetLastError () returned 0x0 [0278.956] SetLastError (dwErrCode=0x0) [0278.956] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=53, lpWideCharStr=0x6c3108, cchWideChar=53 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows") returned 53 [0278.956] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x6c1680 [0278.956] FindNextFileW (in: hFindFile=0x6c1680, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0278.956] GetLastError () returned 0x12 [0278.957] FindClose (in: hFindFile=0x6c1680 | out: hFindFile=0x6c1680) returned 1 [0278.957] GetLastError () returned 0x12 [0278.957] SetLastError (dwErrCode=0x12) [0278.957] GetLastError () returned 0x12 [0278.957] SetLastError (dwErrCode=0x12) [0278.957] GetLastError () returned 0x0 [0278.957] SetLastError (dwErrCode=0x0) [0278.957] GetLastError () returned 0x0 [0278.957] SetLastError (dwErrCode=0x0) [0278.957] GetLastError () returned 0x0 [0278.957] SetLastError (dwErrCode=0x0) [0278.957] GetLastError () returned 0x0 [0278.957] SetLastError (dwErrCode=0x0) [0278.957] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\", len=0x36 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\") returned 1 [0278.957] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\", psz="inetcookies", len=0xb | out: pbstr=0x5ffa00*="inetcookies") returned 1 [0278.957] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcookies", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0278.957] GetLastError () returned 0x0 [0278.957] SetLastError (dwErrCode=0x0) [0278.958] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcookies", cchWideChar=65, lpMultiByteStr=0x8fb568, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcookies", lpUsedDefaultChar=0x0) returned 65 [0278.958] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8fb568, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0278.958] GetLastError () returned 0x0 [0278.958] SetLastError (dwErrCode=0x0) [0278.958] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8fb568, cbMultiByte=65, lpWideCharStr=0x6f0fe8, cchWideChar=65 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcookies") returned 65 [0278.958] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcookies", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc5e4ca02, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xc5e4ca02, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 0x6c1e00 [0278.958] FindNextFileW (in: hFindFile=0x6c1e00, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xc5e4ca02, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xc5e4ca02, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCookies", cAlternateFileName="INETCO~1")) returned 0 [0278.958] GetLastError () returned 0x12 [0278.958] FindClose (in: hFindFile=0x6c1e00 | out: hFindFile=0x6c1e00) returned 1 [0278.958] GetLastError () returned 0x12 [0278.958] SetLastError (dwErrCode=0x12) [0278.958] GetLastError () returned 0x12 [0278.958] SetLastError (dwErrCode=0x12) [0278.958] GetLastError () returned 0x0 [0278.959] SetLastError (dwErrCode=0x0) [0278.959] GetLastError () returned 0x0 [0278.959] SetLastError (dwErrCode=0x0) [0278.959] GetLastError () returned 0x0 [0278.959] SetLastError (dwErrCode=0x0) [0278.959] GetLastError () returned 0x0 [0278.959] SetLastError (dwErrCode=0x0) [0278.959] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", len=0x42 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\") returned 1 [0278.959] GetLastError () returned 0x0 [0278.959] SetLastError (dwErrCode=0x0) [0278.959] GetLastError () returned 0x0 [0278.959] SetLastError (dwErrCode=0x0) [0278.959] GetLastError () returned 0x0 [0278.959] SetLastError (dwErrCode=0x0) [0278.959] GetLastError () returned 0x0 [0278.959] SetLastError (dwErrCode=0x0) [0278.959] GetLastError () returned 0x0 [0278.959] SetLastError (dwErrCode=0x0) [0278.959] GetLastError () returned 0x0 [0278.959] SetLastError (dwErrCode=0x0) [0278.960] GetLastError () returned 0x0 [0278.960] SetLastError (dwErrCode=0x0) [0278.960] GetLastError () returned 0x0 [0278.960] SetLastError (dwErrCode=0x0) [0278.960] GetLastError () returned 0x0 [0278.960] SetLastError (dwErrCode=0x0) [0278.960] GetLastError () returned 0x0 [0278.960] SetLastError (dwErrCode=0x0) [0278.960] GetLastError () returned 0x0 [0278.960] SetLastError (dwErrCode=0x0) [0278.960] GetLastError () returned 0x0 [0278.960] SetLastError (dwErrCode=0x0) [0278.960] GetLastError () returned 0x0 [0278.960] SetLastError (dwErrCode=0x0) [0278.960] GetLastError () returned 0x0 [0278.960] SetLastError (dwErrCode=0x0) [0278.960] GetLastError () returned 0x0 [0278.960] SetLastError (dwErrCode=0x0) [0278.961] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies", len=0x41 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies") returned 1 [0278.961] GetLastError () returned 0x0 [0278.961] SetLastError (dwErrCode=0x0) [0278.961] GetLastError () returned 0x0 [0278.961] SetLastError (dwErrCode=0x0) [0278.961] GetLastError () returned 0x0 [0278.961] SetLastError (dwErrCode=0x0) [0278.961] GetLastError () returned 0x0 [0278.961] SetLastError (dwErrCode=0x0) [0278.961] SysReAllocStringLen (in: pbstr=0x6c2e40*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\", len=0x42 | out: pbstr=0x6c2e40*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\") returned 1 [0278.961] SHGetFolderPathW (in: hwnd=0x0, csidl=32, hToken=0x0, dwFlags=0x0, pszPath=0x25f1fd0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache") returned 0x0 [0278.961] GetLastError () returned 0x0 [0278.961] SetLastError (dwErrCode=0x0) [0278.961] GetLastError () returned 0x0 [0278.961] SetLastError (dwErrCode=0x0) [0278.961] GetLastError () returned 0x0 [0278.962] SetLastError (dwErrCode=0x0) [0278.962] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache", len=0x3f | out: pbstr=0x5ff970*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache") returned 1 [0278.962] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache", cchLength=0x3f | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache") returned 0x3f [0278.962] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache", len=0x3f | out: pbstr=0x8e5768*="c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache") returned 1 [0278.962] GetLastError () returned 0x0 [0278.962] SetLastError (dwErrCode=0x0) [0278.962] GetLastError () returned 0x0 [0278.962] SetLastError (dwErrCode=0x0) [0278.962] GetLastError () returned 0x0 [0278.962] SetLastError (dwErrCode=0x0) [0278.962] GetLastError () returned 0x0 [0278.962] SetLastError (dwErrCode=0x0) [0278.962] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.962] GetLastError () returned 0x0 [0278.962] SetLastError (dwErrCode=0x0) [0278.962] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="users", len=0x5 | out: pbstr=0x8f3740*="users") returned 1 [0278.962] GetLastError () returned 0x0 [0278.962] SetLastError (dwErrCode=0x0) [0278.963] GetLastError () returned 0x0 [0278.963] SetLastError (dwErrCode=0x0) [0278.963] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x8f3760*="rdhj0cnfevzx") returned 1 [0278.963] GetLastError () returned 0x0 [0278.963] SetLastError (dwErrCode=0x0) [0278.963] SysReAllocStringLen (in: pbstr=0x8f3780*=0x0, psz="appdata", len=0x7 | out: pbstr=0x8f3780*="appdata") returned 1 [0278.963] GetLastError () returned 0x0 [0278.963] SetLastError (dwErrCode=0x0) [0278.963] SysReAllocStringLen (in: pbstr=0x8f37a0*=0x0, psz="local", len=0x5 | out: pbstr=0x8f37a0*="local") returned 1 [0278.963] GetLastError () returned 0x0 [0278.963] SetLastError (dwErrCode=0x0) [0278.963] SysReAllocStringLen (in: pbstr=0x8f37c0*=0x0, psz="microsoft", len=0x9 | out: pbstr=0x8f37c0*="microsoft") returned 1 [0278.963] GetLastError () returned 0x0 [0278.963] SetLastError (dwErrCode=0x0) [0278.963] GetLastError () returned 0x0 [0278.964] SetLastError (dwErrCode=0x0) [0278.964] GetLastError () returned 0x0 [0278.964] SetLastError (dwErrCode=0x0) [0278.964] SysReAllocStringLen (in: pbstr=0x8f37e0*=0x0, psz="windows", len=0x7 | out: pbstr=0x8f37e0*="windows") returned 1 [0278.964] GetLastError () returned 0x0 [0278.964] SetLastError (dwErrCode=0x0) [0278.964] SysReAllocStringLen (in: pbstr=0x8f3800*=0x0, psz="inetcache", len=0x9 | out: pbstr=0x8f3800*="inetcache") returned 1 [0278.964] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.964] GetLastError () returned 0x0 [0278.964] SetLastError (dwErrCode=0x0) [0278.964] GetLastError () returned 0x0 [0278.964] SetLastError (dwErrCode=0x0) [0278.965] GetLastError () returned 0x0 [0278.965] SetLastError (dwErrCode=0x0) [0278.965] GetLastError () returned 0x0 [0278.965] SetLastError (dwErrCode=0x0) [0278.965] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.965] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x5ffa00*="users") returned 1 [0278.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0278.965] GetLastError () returned 0x0 [0278.965] SetLastError (dwErrCode=0x0) [0278.965] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x8e57f8, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0278.965] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0278.965] GetLastError () returned 0x0 [0278.965] SetLastError (dwErrCode=0x0) [0278.965] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=8, lpWideCharStr=0x8e5878, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0278.965] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c1980 [0278.965] FindNextFileW (in: hFindFile=0x6c1980, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0278.965] GetLastError () returned 0x12 [0278.965] FindClose (in: hFindFile=0x6c1980 | out: hFindFile=0x6c1980) returned 1 [0278.966] GetLastError () returned 0x12 [0278.966] SetLastError (dwErrCode=0x12) [0278.966] GetLastError () returned 0x12 [0278.966] SetLastError (dwErrCode=0x12) [0278.966] GetLastError () returned 0x0 [0278.966] SetLastError (dwErrCode=0x0) [0278.966] GetLastError () returned 0x0 [0278.966] SetLastError (dwErrCode=0x0) [0278.966] GetLastError () returned 0x0 [0278.966] SetLastError (dwErrCode=0x0) [0278.966] GetLastError () returned 0x0 [0278.966] SetLastError (dwErrCode=0x0) [0278.966] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x5ffd08*="c:\\Users\\") returned 1 [0278.966] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x5ffa00*="rdhj0cnfevzx") returned 1 [0278.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0278.967] GetLastError () returned 0x0 [0278.967] SetLastError (dwErrCode=0x0) [0278.967] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x8e5878, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0278.967] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0278.967] GetLastError () returned 0x0 [0278.967] SetLastError (dwErrCode=0x0) [0278.967] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=21, lpWideCharStr=0x8db908, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0278.967] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6c1c80 [0278.967] FindNextFileW (in: hFindFile=0x6c1c80, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0278.967] GetLastError () returned 0x12 [0278.967] FindClose (in: hFindFile=0x6c1c80 | out: hFindFile=0x6c1c80) returned 1 [0278.967] GetLastError () returned 0x12 [0278.967] SetLastError (dwErrCode=0x12) [0278.967] GetLastError () returned 0x12 [0278.967] SetLastError (dwErrCode=0x12) [0278.968] GetLastError () returned 0x0 [0278.968] SetLastError (dwErrCode=0x0) [0278.968] GetLastError () returned 0x0 [0278.968] SetLastError (dwErrCode=0x0) [0278.968] GetLastError () returned 0x0 [0278.968] SetLastError (dwErrCode=0x0) [0278.968] GetLastError () returned 0x0 [0278.968] SetLastError (dwErrCode=0x0) [0278.968] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0278.968] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x5ffa00*="appdata") returned 1 [0278.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0278.968] GetLastError () returned 0x0 [0278.968] SetLastError (dwErrCode=0x0) [0278.968] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x8e5878, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0278.968] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0278.968] GetLastError () returned 0x0 [0278.968] SetLastError (dwErrCode=0x0) [0278.968] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=29, lpWideCharStr=0x8db968, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0278.968] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x6c1f80 [0278.969] FindNextFileW (in: hFindFile=0x6c1f80, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0278.969] GetLastError () returned 0x12 [0278.969] FindClose (in: hFindFile=0x6c1f80 | out: hFindFile=0x6c1f80) returned 1 [0278.969] GetLastError () returned 0x12 [0278.969] SetLastError (dwErrCode=0x12) [0278.969] GetLastError () returned 0x12 [0278.969] SetLastError (dwErrCode=0x12) [0278.969] GetLastError () returned 0x0 [0278.969] SetLastError (dwErrCode=0x0) [0278.969] GetLastError () returned 0x0 [0278.969] SetLastError (dwErrCode=0x0) [0278.969] GetLastError () returned 0x0 [0278.969] SetLastError (dwErrCode=0x0) [0278.969] GetLastError () returned 0x0 [0278.969] SetLastError (dwErrCode=0x0) [0278.969] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0278.969] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="local", len=0x5 | out: pbstr=0x5ffa00*="local") returned 1 [0278.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0278.970] GetLastError () returned 0x0 [0278.970] SetLastError (dwErrCode=0x0) [0278.970] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x8db908, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpUsedDefaultChar=0x0) returned 35 [0278.970] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0278.970] GetLastError () returned 0x0 [0278.970] SetLastError (dwErrCode=0x0) [0278.970] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=35, lpWideCharStr=0x8fb568, cchWideChar=35 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local") returned 35 [0278.970] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x6c2280 [0278.970] FindNextFileW (in: hFindFile=0x6c2280, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0278.970] GetLastError () returned 0x12 [0278.970] FindClose (in: hFindFile=0x6c2280 | out: hFindFile=0x6c2280) returned 1 [0278.970] GetLastError () returned 0x12 [0278.970] SetLastError (dwErrCode=0x12) [0278.970] GetLastError () returned 0x12 [0278.970] SetLastError (dwErrCode=0x12) [0278.971] GetLastError () returned 0x0 [0278.971] SetLastError (dwErrCode=0x0) [0278.971] GetLastError () returned 0x0 [0278.971] SetLastError (dwErrCode=0x0) [0278.971] GetLastError () returned 0x0 [0278.971] SetLastError (dwErrCode=0x0) [0278.971] GetLastError () returned 0x0 [0278.971] SetLastError (dwErrCode=0x0) [0278.971] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0278.971] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", psz="microsoft", len=0x9 | out: pbstr=0x5ffa00*="microsoft") returned 1 [0278.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0278.971] GetLastError () returned 0x0 [0278.971] SetLastError (dwErrCode=0x0) [0278.971] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", cchWideChar=45, lpMultiByteStr=0x8db908, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", lpUsedDefaultChar=0x0) returned 45 [0278.971] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=45, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0278.971] GetLastError () returned 0x0 [0278.971] SetLastError (dwErrCode=0x0) [0278.971] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=45, lpWideCharStr=0x8fb4e8, cchWideChar=45 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft") returned 45 [0278.971] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\microsoft", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0x6c1680 [0278.972] FindNextFileW (in: hFindFile=0x6c1680, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3a17d745, ftLastAccessTime.dwHighDateTime=0x1d70699, ftLastWriteTime.dwLowDateTime=0x3a17d745, ftLastWriteTime.dwHighDateTime=0x1d70699, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0278.972] GetLastError () returned 0x12 [0278.972] FindClose (in: hFindFile=0x6c1680 | out: hFindFile=0x6c1680) returned 1 [0278.972] GetLastError () returned 0x12 [0278.972] SetLastError (dwErrCode=0x12) [0278.972] GetLastError () returned 0x12 [0278.972] SetLastError (dwErrCode=0x12) [0278.972] GetLastError () returned 0x0 [0278.972] SetLastError (dwErrCode=0x0) [0278.972] GetLastError () returned 0x0 [0278.972] SetLastError (dwErrCode=0x0) [0278.972] GetLastError () returned 0x0 [0278.972] SetLastError (dwErrCode=0x0) [0278.973] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", len=0x2e | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\") returned 1 [0278.973] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\", psz="windows", len=0x7 | out: pbstr=0x5ffa00*="windows") returned 1 [0278.973] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0278.973] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=53, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 53 [0278.973] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=53, lpWideCharStr=0x6c3068, cchWideChar=53 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows") returned 53 [0278.973] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\windows", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x6c1b00 [0278.973] FindNextFileW (in: hFindFile=0x6c1b00, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb774c934, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb774c934, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0278.973] FindClose (in: hFindFile=0x6c1b00 | out: hFindFile=0x6c1b00) returned 1 [0278.974] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\", len=0x36 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\") returned 1 [0278.974] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\", psz="inetcache", len=0x9 | out: pbstr=0x5ffa00*="inetcache") returned 1 [0278.974] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcache", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0278.974] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=63, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 63 [0278.974] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=63, lpWideCharStr=0x6c3108, cchWideChar=63 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcache") returned 63 [0278.974] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\inetcache", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa49dfe15, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa49dfe15, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 0x6c1ce0 [0278.974] FindNextFileW (in: hFindFile=0x6c1ce0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xa49dfe15, ftLastAccessTime.dwHighDateTime=0x1d705ee, ftLastWriteTime.dwLowDateTime=0xa49dfe15, ftLastWriteTime.dwHighDateTime=0x1d705ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INetCache", cAlternateFileName="INETCA~1")) returned 0 [0278.975] FindClose (in: hFindFile=0x6c1ce0 | out: hFindFile=0x6c1ce0) returned 1 [0278.975] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", len=0x40 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 1 [0278.976] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache", len=0x3f | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache") returned 1 [0278.976] SysReAllocStringLen (in: pbstr=0x6c2e48*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\", len=0x40 | out: pbstr=0x6c2e48*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 1 [0278.976] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x25f1fd0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0278.977] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", len=0x25 | out: pbstr=0x5ff970*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 1 [0278.977] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", cchLength=0x25 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming") returned 0x25 [0278.977] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\roaming", len=0x25 | out: pbstr=0x8e5768*="c:\\users\\rdhj0cnfevzx\\appdata\\roaming") returned 1 [0278.977] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.977] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="users", len=0x5 | out: pbstr=0x8f3740*="users") returned 1 [0278.977] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x8f3760*="rdhj0cnfevzx") returned 1 [0278.978] SysReAllocStringLen (in: pbstr=0x8f3780*=0x0, psz="appdata", len=0x7 | out: pbstr=0x8f3780*="appdata") returned 1 [0278.978] SysReAllocStringLen (in: pbstr=0x8f37a0*=0x0, psz="roaming", len=0x7 | out: pbstr=0x8f37a0*="roaming") returned 1 [0278.978] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.978] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.983] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x5ffa00*="users") returned 1 [0278.983] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0278.983] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0278.983] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpWideCharStr=0x8e57f8, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0278.983] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c18c0 [0278.983] FindNextFileW (in: hFindFile=0x6c18c0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0278.984] FindClose (in: hFindFile=0x6c18c0 | out: hFindFile=0x6c18c0) returned 1 [0278.985] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x5ffd08*="c:\\Users\\") returned 1 [0278.985] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x5ffa00*="rdhj0cnfevzx") returned 1 [0278.985] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0278.985] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0278.985] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpWideCharStr=0x8db908, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0278.985] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6c1e00 [0278.985] FindNextFileW (in: hFindFile=0x6c1e00, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0278.986] FindClose (in: hFindFile=0x6c1e00 | out: hFindFile=0x6c1e00) returned 1 [0278.986] GetLastError () returned 0x0 [0278.986] SetLastError (dwErrCode=0x0) [0278.986] GetLastError () returned 0x0 [0278.986] SetLastError (dwErrCode=0x0) [0278.986] GetLastError () returned 0x0 [0278.986] SetLastError (dwErrCode=0x0) [0278.986] GetLastError () returned 0x0 [0278.986] SetLastError (dwErrCode=0x0) [0278.986] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0278.986] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x5ffa00*="appdata") returned 1 [0278.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0278.987] GetLastError () returned 0x0 [0278.987] SetLastError (dwErrCode=0x0) [0278.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0278.987] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0278.987] GetLastError () returned 0x0 [0278.987] SetLastError (dwErrCode=0x0) [0278.987] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpWideCharStr=0x8db968, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0278.987] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x6c1800 [0278.987] FindNextFileW (in: hFindFile=0x6c1800, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0278.987] GetLastError () returned 0x12 [0278.987] FindClose (in: hFindFile=0x6c1800 | out: hFindFile=0x6c1800) returned 1 [0278.987] GetLastError () returned 0x12 [0278.987] SetLastError (dwErrCode=0x12) [0278.987] GetLastError () returned 0x12 [0278.987] SetLastError (dwErrCode=0x12) [0278.987] GetLastError () returned 0x0 [0278.987] SetLastError (dwErrCode=0x0) [0278.987] GetLastError () returned 0x0 [0278.988] SetLastError (dwErrCode=0x0) [0278.988] GetLastError () returned 0x0 [0278.988] SetLastError (dwErrCode=0x0) [0278.988] GetLastError () returned 0x0 [0278.988] SetLastError (dwErrCode=0x0) [0278.988] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0278.988] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="roaming", len=0x7 | out: pbstr=0x5ffa00*="roaming") returned 1 [0278.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0278.988] GetLastError () returned 0x0 [0278.988] SetLastError (dwErrCode=0x0) [0278.988] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming", cchWideChar=37, lpMultiByteStr=0x8db908, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming", lpUsedDefaultChar=0x0) returned 37 [0278.988] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=37, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 37 [0278.988] GetLastError () returned 0x0 [0278.988] SetLastError (dwErrCode=0x0) [0278.988] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=37, lpWideCharStr=0x8fb568, cchWideChar=37 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming") returned 37 [0278.988] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\roaming", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb8e6fbcd, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb8e6fbcd, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0x6c2100 [0278.988] FindNextFileW (in: hFindFile=0x6c2100, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xb8e6fbcd, ftLastAccessTime.dwHighDateTime=0x1d7e78c, ftLastWriteTime.dwLowDateTime=0xb8e6fbcd, ftLastWriteTime.dwHighDateTime=0x1d7e78c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0278.988] GetLastError () returned 0x12 [0278.988] FindClose (in: hFindFile=0x6c2100 | out: hFindFile=0x6c2100) returned 1 [0278.989] GetLastError () returned 0x12 [0278.989] SetLastError (dwErrCode=0x12) [0278.989] GetLastError () returned 0x12 [0278.989] SetLastError (dwErrCode=0x12) [0278.989] GetLastError () returned 0x0 [0278.989] SetLastError (dwErrCode=0x0) [0278.989] GetLastError () returned 0x0 [0278.989] SetLastError (dwErrCode=0x0) [0278.989] GetLastError () returned 0x0 [0278.989] SetLastError (dwErrCode=0x0) [0278.989] GetLastError () returned 0x0 [0278.989] SetLastError (dwErrCode=0x0) [0278.989] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", len=0x26 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\") returned 1 [0278.989] GetLastError () returned 0x0 [0278.990] SetLastError (dwErrCode=0x0) [0278.990] GetLastError () returned 0x0 [0278.990] SetLastError (dwErrCode=0x0) [0278.990] GetLastError () returned 0x0 [0278.990] SetLastError (dwErrCode=0x0) [0278.990] GetLastError () returned 0x0 [0278.990] SetLastError (dwErrCode=0x0) [0278.990] GetLastError () returned 0x0 [0278.990] SetLastError (dwErrCode=0x0) [0278.990] GetLastError () returned 0x0 [0278.990] SetLastError (dwErrCode=0x0) [0278.990] GetLastError () returned 0x0 [0278.990] SetLastError (dwErrCode=0x0) [0278.990] GetLastError () returned 0x0 [0278.990] SetLastError (dwErrCode=0x0) [0278.990] GetLastError () returned 0x0 [0278.990] SetLastError (dwErrCode=0x0) [0278.990] GetLastError () returned 0x0 [0278.990] SetLastError (dwErrCode=0x0) [0278.990] GetLastError () returned 0x0 [0278.990] SetLastError (dwErrCode=0x0) [0278.991] GetLastError () returned 0x0 [0278.991] SetLastError (dwErrCode=0x0) [0278.991] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", len=0x25 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 1 [0278.991] GetLastError () returned 0x0 [0278.991] SetLastError (dwErrCode=0x0) [0278.991] GetLastError () returned 0x0 [0278.991] SetLastError (dwErrCode=0x0) [0278.991] GetLastError () returned 0x0 [0278.991] SetLastError (dwErrCode=0x0) [0278.991] GetLastError () returned 0x0 [0278.991] SetLastError (dwErrCode=0x0) [0278.991] SysReAllocStringLen (in: pbstr=0x6c2e50*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\", len=0x26 | out: pbstr=0x6c2e50*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\") returned 1 [0278.991] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x25f1fd0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0278.992] GetLastError () returned 0x0 [0278.992] SetLastError (dwErrCode=0x0) [0278.992] GetLastError () returned 0x0 [0278.992] SetLastError (dwErrCode=0x0) [0278.992] GetLastError () returned 0x0 [0278.993] SetLastError (dwErrCode=0x0) [0278.993] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", len=0x23 | out: pbstr=0x5ff970*="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 1 [0278.993] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", cchLength=0x23 | out: lpsz="c:\\users\\rdhj0cnfevzx\\appdata\\local") returned 0x23 [0278.993] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\users\\rdhj0cnfevzx\\appdata\\local", len=0x23 | out: pbstr=0x8e5768*="c:\\users\\rdhj0cnfevzx\\appdata\\local") returned 1 [0278.993] GetLastError () returned 0x0 [0278.993] SetLastError (dwErrCode=0x0) [0278.993] GetLastError () returned 0x0 [0278.993] SetLastError (dwErrCode=0x0) [0278.993] GetLastError () returned 0x0 [0278.993] SetLastError (dwErrCode=0x0) [0278.993] GetLastError () returned 0x0 [0278.993] SetLastError (dwErrCode=0x0) [0278.993] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0278.993] GetLastError () returned 0x0 [0278.993] SetLastError (dwErrCode=0x0) [0278.993] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="users", len=0x5 | out: pbstr=0x8f3740*="users") returned 1 [0278.993] GetLastError () returned 0x0 [0278.993] SetLastError (dwErrCode=0x0) [0278.993] GetLastError () returned 0x0 [0278.994] SetLastError (dwErrCode=0x0) [0278.994] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x8f3760*="rdhj0cnfevzx") returned 1 [0278.994] GetLastError () returned 0x0 [0278.994] SetLastError (dwErrCode=0x0) [0278.994] SysReAllocStringLen (in: pbstr=0x8f3780*=0x0, psz="appdata", len=0x7 | out: pbstr=0x8f3780*="appdata") returned 1 [0278.994] GetLastError () returned 0x0 [0278.994] SetLastError (dwErrCode=0x0) [0278.994] SysReAllocStringLen (in: pbstr=0x8f37a0*=0x0, psz="local", len=0x5 | out: pbstr=0x8f37a0*="local") returned 1 [0278.994] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0278.994] GetLastError () returned 0x0 [0278.994] SetLastError (dwErrCode=0x0) [0278.994] GetLastError () returned 0x0 [0278.994] SetLastError (dwErrCode=0x0) [0278.994] GetLastError () returned 0x0 [0278.994] SetLastError (dwErrCode=0x0) [0278.994] GetLastError () returned 0x0 [0278.995] SetLastError (dwErrCode=0x0) [0278.995] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0278.995] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x5ffa00*="users") returned 1 [0278.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0278.995] GetLastError () returned 0x0 [0278.995] SetLastError (dwErrCode=0x0) [0278.995] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0278.995] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0278.995] GetLastError () returned 0x0 [0278.995] SetLastError (dwErrCode=0x0) [0278.995] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpWideCharStr=0x8e57f8, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0278.995] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c2100 [0278.995] FindNextFileW (in: hFindFile=0x6c2100, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0278.995] GetLastError () returned 0x12 [0278.995] FindClose (in: hFindFile=0x6c2100 | out: hFindFile=0x6c2100) returned 1 [0278.995] GetLastError () returned 0x12 [0278.995] SetLastError (dwErrCode=0x12) [0278.995] GetLastError () returned 0x12 [0278.995] SetLastError (dwErrCode=0x12) [0278.996] GetLastError () returned 0x0 [0278.996] SetLastError (dwErrCode=0x0) [0278.996] GetLastError () returned 0x0 [0278.996] SetLastError (dwErrCode=0x0) [0278.996] GetLastError () returned 0x0 [0278.996] SetLastError (dwErrCode=0x0) [0278.996] GetLastError () returned 0x0 [0278.996] SetLastError (dwErrCode=0x0) [0278.996] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x5ffd08*="c:\\Users\\") returned 1 [0278.996] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x5ffa00*="rdhj0cnfevzx") returned 1 [0278.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0278.996] GetLastError () returned 0x0 [0278.996] SetLastError (dwErrCode=0x0) [0278.996] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0278.996] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0278.996] GetLastError () returned 0x0 [0278.996] SetLastError (dwErrCode=0x0) [0278.996] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpWideCharStr=0x8db908, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0278.996] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6c1800 [0278.997] FindNextFileW (in: hFindFile=0x6c1800, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0278.997] GetLastError () returned 0x12 [0278.997] FindClose (in: hFindFile=0x6c1800 | out: hFindFile=0x6c1800) returned 1 [0278.997] GetLastError () returned 0x12 [0278.997] SetLastError (dwErrCode=0x12) [0278.997] GetLastError () returned 0x12 [0278.997] SetLastError (dwErrCode=0x12) [0278.997] GetLastError () returned 0x0 [0278.997] SetLastError (dwErrCode=0x0) [0278.997] GetLastError () returned 0x0 [0278.997] SetLastError (dwErrCode=0x0) [0278.997] GetLastError () returned 0x0 [0278.997] SetLastError (dwErrCode=0x0) [0278.997] GetLastError () returned 0x0 [0278.997] SetLastError (dwErrCode=0x0) [0278.997] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0278.997] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\", psz="appdata", len=0x7 | out: pbstr=0x5ffa00*="appdata") returned 1 [0278.997] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0278.997] GetLastError () returned 0x0 [0278.998] SetLastError (dwErrCode=0x0) [0278.998] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata", cchWideChar=29, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\appdata", lpUsedDefaultChar=0x0) returned 29 [0278.998] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 29 [0278.998] GetLastError () returned 0x0 [0278.998] SetLastError (dwErrCode=0x0) [0278.998] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=29, lpWideCharStr=0x8db968, cchWideChar=29 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\appdata") returned 29 [0278.998] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\appdata", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x6c1500 [0278.998] FindNextFileW (in: hFindFile=0x6c1500, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x3d39b021, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3d39b021, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0278.998] GetLastError () returned 0x12 [0278.998] FindClose (in: hFindFile=0x6c1500 | out: hFindFile=0x6c1500) returned 1 [0278.998] GetLastError () returned 0x12 [0278.998] SetLastError (dwErrCode=0x12) [0278.998] GetLastError () returned 0x12 [0278.998] SetLastError (dwErrCode=0x12) [0278.998] GetLastError () returned 0x0 [0278.998] SetLastError (dwErrCode=0x0) [0278.998] GetLastError () returned 0x0 [0278.998] SetLastError (dwErrCode=0x0) [0278.999] GetLastError () returned 0x0 [0278.999] SetLastError (dwErrCode=0x0) [0278.999] GetLastError () returned 0x0 [0278.999] SetLastError (dwErrCode=0x0) [0278.999] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\", len=0x1e | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\") returned 1 [0278.999] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\RDhJ0CNFevzX\\AppData\\", psz="local", len=0x5 | out: pbstr=0x5ffa00*="local") returned 1 [0278.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 35 [0278.999] GetLastError () returned 0x0 [0278.999] SetLastError (dwErrCode=0x0) [0278.999] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", cchWideChar=35, lpMultiByteStr=0x8db908, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpUsedDefaultChar=0x0) returned 35 [0279.000] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=35, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 35 [0279.000] GetLastError () returned 0x0 [0279.000] SetLastError (dwErrCode=0x0) [0279.000] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db908, cbMultiByte=35, lpWideCharStr=0x8fb4e8, cchWideChar=35 | out: lpWideCharStr="c:\\Users\\RDhJ0CNFevzX\\AppData\\local") returned 35 [0279.000] FindFirstFileW (in: lpFileName="c:\\Users\\RDhJ0CNFevzX\\AppData\\local", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0x6c1800 [0279.000] FindNextFileW (in: hFindFile=0x6c1800, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cefc6a2, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0xee5f28e7, ftLastAccessTime.dwHighDateTime=0x1d7fc8f, ftLastWriteTime.dwLowDateTime=0xee5f28e7, ftLastWriteTime.dwHighDateTime=0x1d7fc8f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 0 [0279.000] GetLastError () returned 0x12 [0279.000] FindClose (in: hFindFile=0x6c1800 | out: hFindFile=0x6c1800) returned 1 [0279.000] GetLastError () returned 0x12 [0279.000] SetLastError (dwErrCode=0x12) [0279.000] GetLastError () returned 0x12 [0279.000] SetLastError (dwErrCode=0x12) [0279.001] GetLastError () returned 0x0 [0279.001] SetLastError (dwErrCode=0x0) [0279.001] GetLastError () returned 0x0 [0279.001] SetLastError (dwErrCode=0x0) [0279.001] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0279.001] GetLastError () returned 0x0 [0279.001] SetLastError (dwErrCode=0x0) [0279.001] GetLastError () returned 0x0 [0279.001] SetLastError (dwErrCode=0x0) [0279.001] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local", len=0x23 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 1 [0279.002] GetLastError () returned 0x0 [0279.002] SetLastError (dwErrCode=0x0) [0279.002] GetLastError () returned 0x0 [0279.002] SetLastError (dwErrCode=0x0) [0279.002] SysReAllocStringLen (in: pbstr=0x6c2e58*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\", len=0x24 | out: pbstr=0x6c2e58*="c:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\") returned 1 [0279.003] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x25f1fd0 | out: pszPath="C:\\Users\\RDhJ0CNFevzX") returned 0x0 [0279.005] GetLastError () returned 0x0 [0279.005] SetLastError (dwErrCode=0x0) [0279.005] GetLastError () returned 0x0 [0279.005] SetLastError (dwErrCode=0x0) [0279.005] GetLastError () returned 0x0 [0279.005] SetLastError (dwErrCode=0x0) [0279.005] SysReAllocStringLen (in: pbstr=0x5ff970*=0x0, psz="C:\\Users\\RDhJ0CNFevzX", len=0x15 | out: pbstr=0x5ff970*="C:\\Users\\RDhJ0CNFevzX") returned 1 [0279.005] CharLowerBuffW (in: lpsz="C:\\Users\\RDhJ0CNFevzX", cchLength=0x15 | out: lpsz="c:\\users\\rdhj0cnfevzx") returned 0x15 [0279.005] SysReAllocStringLen (in: pbstr=0x8e5768*=0x0, psz="c:\\users\\rdhj0cnfevzx", len=0x15 | out: pbstr=0x8e5768*="c:\\users\\rdhj0cnfevzx") returned 1 [0279.005] GetLastError () returned 0x0 [0279.005] SetLastError (dwErrCode=0x0) [0279.005] GetLastError () returned 0x0 [0279.005] SetLastError (dwErrCode=0x0) [0279.005] GetLastError () returned 0x0 [0279.005] SetLastError (dwErrCode=0x0) [0279.005] GetLastError () returned 0x0 [0279.005] SetLastError (dwErrCode=0x0) [0279.005] SysReAllocStringLen (in: pbstr=0x8e5770*=0x0, psz="c:", len=0x2 | out: pbstr=0x8e5770*="c:") returned 1 [0279.006] GetLastError () returned 0x0 [0279.006] SetLastError (dwErrCode=0x0) [0279.006] SysReAllocStringLen (in: pbstr=0x8f3740*=0x0, psz="users", len=0x5 | out: pbstr=0x8f3740*="users") returned 1 [0279.006] GetLastError () returned 0x0 [0279.006] SetLastError (dwErrCode=0x0) [0279.006] GetLastError () returned 0x0 [0279.006] SetLastError (dwErrCode=0x0) [0279.006] SysReAllocStringLen (in: pbstr=0x8f3760*=0x0, psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x8f3760*="rdhj0cnfevzx") returned 1 [0279.006] SysReAllocStringLen (in: pbstr=0x5ffa00*=0x0, psz="c:", len=0x2 | out: pbstr=0x5ffa00*="c:") returned 1 [0279.006] GetLastError () returned 0x0 [0279.006] SetLastError (dwErrCode=0x0) [0279.006] GetLastError () returned 0x0 [0279.006] SetLastError (dwErrCode=0x0) [0279.006] GetLastError () returned 0x0 [0279.006] SetLastError (dwErrCode=0x0) [0279.006] GetLastError () returned 0x0 [0279.006] SetLastError (dwErrCode=0x0) [0279.006] SysReAllocStringLen (in: pbstr=0x5ffd08*=0x0, psz="c:\\", len=0x3 | out: pbstr=0x5ffd08*="c:\\") returned 1 [0279.007] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:", psz="users", len=0x5 | out: pbstr=0x5ffa00*="users") returned 1 [0279.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 8 [0279.007] GetLastError () returned 0x0 [0279.007] SetLastError (dwErrCode=0x0) [0279.007] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\users", cchWideChar=8, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\users", lpUsedDefaultChar=0x0) returned 8 [0279.007] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0279.007] GetLastError () returned 0x0 [0279.007] SetLastError (dwErrCode=0x0) [0279.007] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5838, cbMultiByte=8, lpWideCharStr=0x8e57f8, cchWideChar=8 | out: lpWideCharStr="c:\\users") returned 8 [0279.007] FindFirstFileW (in: lpFileName="c:\\users", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x6c1ce0 [0279.007] FindNextFileW (in: hFindFile=0x6c1ce0, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x31bae0f4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0x3ce179de, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x3ce179de, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0279.007] GetLastError () returned 0x12 [0279.007] FindClose (in: hFindFile=0x6c1ce0 | out: hFindFile=0x6c1ce0) returned 1 [0279.007] GetLastError () returned 0x12 [0279.007] SetLastError (dwErrCode=0x12) [0279.007] GetLastError () returned 0x12 [0279.007] SetLastError (dwErrCode=0x12) [0279.007] GetLastError () returned 0x0 [0279.008] SetLastError (dwErrCode=0x0) [0279.008] GetLastError () returned 0x0 [0279.008] SetLastError (dwErrCode=0x0) [0279.008] GetLastError () returned 0x0 [0279.008] SetLastError (dwErrCode=0x0) [0279.008] GetLastError () returned 0x0 [0279.008] SetLastError (dwErrCode=0x0) [0279.008] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users", psz="c:\\Users\\", len=0x9 | out: pbstr=0x5ffd08*="c:\\Users\\") returned 1 [0279.008] SysReAllocStringLen (in: pbstr=0x5ffa00*="c:\\Users\\", psz="rdhj0cnfevzx", len=0xc | out: pbstr=0x5ffa00*="rdhj0cnfevzx") returned 1 [0279.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0279.008] GetLastError () returned 0x0 [0279.008] SetLastError (dwErrCode=0x0) [0279.008] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="c:\\Users\\rdhj0cnfevzx", cchWideChar=21, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="c:\\Users\\rdhj0cnfevzx", lpUsedDefaultChar=0x0) returned 21 [0279.008] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0279.008] GetLastError () returned 0x0 [0279.008] SetLastError (dwErrCode=0x0) [0279.008] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=21, lpWideCharStr=0x8db908, cchWideChar=21 | out: lpWideCharStr="c:\\Users\\rdhj0cnfevzx") returned 21 [0279.008] FindFirstFileW (in: lpFileName="c:\\Users\\rdhj0cnfevzx", lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0x6c2280 [0279.008] FindNextFileW (in: hFindFile=0x6c2280, lpFindFileData=0x5ffa50 | out: lpFindFileData=0x5ffa50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3ce179de, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x84ac775d, ftLastAccessTime.dwHighDateTime=0x1d70074, ftLastWriteTime.dwLowDateTime=0x84ac775d, ftLastWriteTime.dwHighDateTime=0x1d70074, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RDhJ0CNFevzX", cAlternateFileName="RDHJ0C~1")) returned 0 [0279.008] GetLastError () returned 0x12 [0279.009] FindClose (in: hFindFile=0x6c2280 | out: hFindFile=0x6c2280) returned 1 [0279.009] GetLastError () returned 0x12 [0279.009] SetLastError (dwErrCode=0x12) [0279.009] GetLastError () returned 0x12 [0279.009] SetLastError (dwErrCode=0x12) [0279.009] GetLastError () returned 0x0 [0279.009] SetLastError (dwErrCode=0x0) [0279.009] GetLastError () returned 0x0 [0279.009] SetLastError (dwErrCode=0x0) [0279.009] GetLastError () returned 0x0 [0279.009] SetLastError (dwErrCode=0x0) [0279.009] GetLastError () returned 0x0 [0279.009] SetLastError (dwErrCode=0x0) [0279.009] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX", psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0279.009] GetLastError () returned 0x0 [0279.009] SetLastError (dwErrCode=0x0) [0279.010] GetLastError () returned 0x0 [0279.010] SetLastError (dwErrCode=0x0) [0279.010] GetLastError () returned 0x0 [0279.010] SetLastError (dwErrCode=0x0) [0279.010] GetLastError () returned 0x0 [0279.010] SetLastError (dwErrCode=0x0) [0279.010] GetLastError () returned 0x0 [0279.010] SetLastError (dwErrCode=0x0) [0279.010] GetLastError () returned 0x0 [0279.010] SetLastError (dwErrCode=0x0) [0279.010] GetLastError () returned 0x0 [0279.010] SetLastError (dwErrCode=0x0) [0279.010] GetLastError () returned 0x0 [0279.010] SetLastError (dwErrCode=0x0) [0279.010] GetLastError () returned 0x0 [0279.010] SetLastError (dwErrCode=0x0) [0279.010] GetLastError () returned 0x0 [0279.010] SetLastError (dwErrCode=0x0) [0279.010] SysReAllocStringLen (in: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX\\", psz="c:\\Users\\RDhJ0CNFevzX", len=0x15 | out: pbstr=0x5ffd08*="c:\\Users\\RDhJ0CNFevzX") returned 1 [0279.011] GetLastError () returned 0x0 [0279.011] SetLastError (dwErrCode=0x0) [0279.011] GetLastError () returned 0x0 [0279.011] SetLastError (dwErrCode=0x0) [0279.011] GetLastError () returned 0x0 [0279.011] SetLastError (dwErrCode=0x0) [0279.011] GetLastError () returned 0x0 [0279.011] SetLastError (dwErrCode=0x0) [0279.011] SysReAllocStringLen (in: pbstr=0x6c2e60*=0x0, psz="c:\\Users\\RDhJ0CNFevzX\\", len=0x16 | out: pbstr=0x6c2e60*="c:\\Users\\RDhJ0CNFevzX\\") returned 1 [0279.011] GetLastError () returned 0x0 [0279.011] SetLastError (dwErrCode=0x0) [0279.011] GetLastError () returned 0x0 [0279.011] SetLastError (dwErrCode=0x0) [0279.011] GetLastError () returned 0x0 [0279.011] SetLastError (dwErrCode=0x0) [0279.011] GetLastError () returned 0x0 [0279.012] SetLastError (dwErrCode=0x0) [0279.012] GetLastError () returned 0x0 [0279.012] SetLastError (dwErrCode=0x0) [0279.012] GetLastError () returned 0x0 [0279.012] SetLastError (dwErrCode=0x0) [0279.012] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.012] GetProcAddress (hModule=0x7ffd504d0000, lpProcName="NtSetInformationThread") returned 0x7ffd50574ee0 [0279.012] GetCurrentThread () returned 0xfffffffffffffffe [0279.012] NtSetInformationThread (ThreadHandle=0xfffffffffffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0279.012] GetLastError () returned 0x0 [0279.012] SetLastError (dwErrCode=0x0) [0279.012] GetLastError () returned 0x0 [0279.012] SetLastError (dwErrCode=0x0) [0279.013] GetLastError () returned 0x0 [0279.013] SetLastError (dwErrCode=0x0) [0279.013] GetLastError () returned 0x0 [0279.013] GetLastError () returned 0x0 [0279.013] SetLastError (dwErrCode=0x0) [0279.013] SetLastError (dwErrCode=0x0) [0279.013] GetLastError () returned 0x0 [0279.013] SetLastError (dwErrCode=0x0) [0279.013] GetLastError () returned 0x0 [0279.013] SetLastError (dwErrCode=0x0) [0279.013] GetLastError () returned 0x0 [0279.013] SetLastError (dwErrCode=0x0) [0279.013] GetLastError () returned 0x0 [0279.013] SetLastError (dwErrCode=0x0) [0279.013] GetLastError () returned 0x0 [0279.014] SetLastError (dwErrCode=0x0) [0279.014] GetLastError () returned 0x0 [0279.014] SetLastError (dwErrCode=0x0) [0279.014] GetLastError () returned 0x0 [0279.014] SetLastError (dwErrCode=0x0) [0279.014] GetLastError () returned 0x0 [0279.014] SetLastError (dwErrCode=0x0) [0279.014] GetLastError () returned 0x0 [0279.014] SetLastError (dwErrCode=0x0) [0279.014] GetLastError () returned 0x0 [0279.014] GetLastError () returned 0x0 [0279.014] SetLastError (dwErrCode=0x0) [0279.014] SetLastError (dwErrCode=0x0) [0279.014] GetLastError () returned 0x0 [0279.014] SetLastError (dwErrCode=0x0) [0279.014] GetLastError () returned 0x0 [0279.014] SetLastError (dwErrCode=0x0) [0279.014] GetLastError () returned 0x0 [0279.015] SetLastError (dwErrCode=0x0) [0279.015] GetLastError () returned 0x0 [0279.015] SetLastError (dwErrCode=0x0) [0279.015] GetLastError () returned 0x0 [0279.015] SetLastError (dwErrCode=0x0) [0279.015] GetLastError () returned 0x0 [0279.015] SetLastError (dwErrCode=0x0) [0279.034] GetLastError () returned 0x0 [0279.034] SetLastError (dwErrCode=0x0) [0279.034] GetLastError () returned 0x0 [0279.034] SetLastError (dwErrCode=0x0) [0279.043] GetLastError () returned 0x0 [0279.043] SetLastError (dwErrCode=0x0) [0279.043] GetLastError () returned 0x0 [0279.043] SetLastError (dwErrCode=0x0) [0279.048] GetLastError () returned 0x0 [0279.048] SetLastError (dwErrCode=0x0) [0279.048] GetLastError () returned 0x0 [0279.048] SetLastError (dwErrCode=0x0) [0279.049] GetLastError () returned 0x0 [0279.049] SetLastError (dwErrCode=0x0) [0279.049] GetLastError () returned 0x0 [0279.049] SetLastError (dwErrCode=0x0) [0279.049] GetLastError () returned 0x0 [0279.049] SetLastError (dwErrCode=0x0) [0279.049] GetLastError () returned 0x0 [0279.049] SetLastError (dwErrCode=0x0) [0279.051] GetLastError () returned 0x0 [0279.051] SetLastError (dwErrCode=0x0) [0279.051] GetLastError () returned 0x0 [0279.051] SetLastError (dwErrCode=0x0) [0279.051] GetLastError () returned 0x0 [0279.051] SetLastError (dwErrCode=0x0) [0279.051] GetLastError () returned 0x0 [0279.051] SetLastError (dwErrCode=0x0) [0279.052] GetLastError () returned 0x0 [0279.052] SetLastError (dwErrCode=0x0) [0279.052] GetLastError () returned 0x0 [0279.052] SetLastError (dwErrCode=0x0) [0279.078] GetLastError () returned 0x0 [0279.078] SetLastError (dwErrCode=0x0) [0279.078] GetLastError () returned 0x0 [0279.078] SetLastError (dwErrCode=0x0) [0279.079] GetLastError () returned 0x0 [0279.079] SetLastError (dwErrCode=0x0) [0279.079] GetLastError () returned 0x0 [0279.079] SetLastError (dwErrCode=0x0) [0279.080] GetLastError () returned 0x0 [0279.080] SetLastError (dwErrCode=0x0) [0279.080] GetLastError () returned 0x0 [0279.080] SetLastError (dwErrCode=0x0) [0279.080] GetLastError () returned 0x0 [0279.080] GetLastError () returned 0x0 [0279.080] SetLastError (dwErrCode=0x0) [0279.080] SetLastError (dwErrCode=0x0) [0279.081] GetLastError () returned 0x0 [0279.081] SetLastError (dwErrCode=0x0) [0279.081] GetLastError () returned 0x0 [0279.081] SetLastError (dwErrCode=0x0) [0279.081] GetLastError () returned 0x0 [0279.081] SetLastError (dwErrCode=0x0) [0279.081] GetLastError () returned 0x0 [0279.081] SetLastError (dwErrCode=0x0) [0279.081] GetUserNameA (in: lpBuffer=0x7ff772b39ec0, pcbBuffer=0x7ff772b39eb0 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x7ff772b39eb0) returned 1 [0279.101] GetLastError () returned 0x0 [0279.101] SetLastError (dwErrCode=0x0) [0279.101] GetLastError () returned 0x0 [0279.101] GetLastError () returned 0x0 [0279.101] SetLastError (dwErrCode=0x0) [0279.101] SetLastError (dwErrCode=0x0) [0279.101] GetLastError () returned 0x0 [0279.101] SetLastError (dwErrCode=0x0) [0279.101] GetLastError () returned 0x0 [0279.101] SetLastError (dwErrCode=0x0) [0279.101] GetLastError () returned 0x0 [0279.101] SetLastError (dwErrCode=0x0) [0279.101] GetLastError () returned 0x0 [0279.101] SetLastError (dwErrCode=0x0) [0279.101] GetLastError () returned 0x0 [0279.102] SetLastError (dwErrCode=0x0) [0279.102] GetLastError () returned 0x0 [0279.102] SetLastError (dwErrCode=0x0) [0279.102] GetComputerNameA (in: lpBuffer=0x7ff772b39fe0, nSize=0x7ff772b39fd0 | out: lpBuffer="XC64ZB", nSize=0x7ff772b39fd0) returned 1 [0279.102] GetLastError () returned 0xcb [0279.102] SetLastError (dwErrCode=0xcb) [0279.102] GetLastError () returned 0xcb [0279.102] GetLastError () returned 0xcb [0279.102] SetLastError (dwErrCode=0xcb) [0279.102] SetLastError (dwErrCode=0xcb) [0279.102] GetLastError () returned 0xcb [0279.102] SetLastError (dwErrCode=0xcb) [0279.102] GetLastError () returned 0xcb [0279.103] SetLastError (dwErrCode=0xcb) [0279.103] GetLastError () returned 0xcb [0279.103] SetLastError (dwErrCode=0xcb) [0279.103] GetLastError () returned 0xcb [0279.103] SetLastError (dwErrCode=0xcb) [0279.103] GetLastError () returned 0xcb [0279.103] SetLastError (dwErrCode=0xcb) [0279.103] GetLastError () returned 0xcb [0279.103] SetLastError (dwErrCode=0xcb) [0279.103] GetLastError () returned 0xcb [0279.103] SetLastError (dwErrCode=0xcb) [0279.103] GetLastError () returned 0xcb [0279.103] SetLastError (dwErrCode=0xcb) [0279.104] GetLastError () returned 0xcb [0279.104] GetLastError () returned 0xcb [0279.104] SetLastError (dwErrCode=0xcb) [0279.104] SetLastError (dwErrCode=0xcb) [0279.104] GetLastError () returned 0xcb [0279.104] SetLastError (dwErrCode=0xcb) [0279.104] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db968, cbMultiByte=43, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 43 [0279.104] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8db968, cbMultiByte=43, lpWideCharStr=0x6f9848, cchWideChar=43 | out: lpWideCharStr="Software\\Enigma Protector\\%.8x%.8x-%.8x%.8x") returned 43 [0279.104] GetLastError () returned 0x0 [0279.104] SetLastError (dwErrCode=0x0) [0279.104] GetLastError () returned 0x0 [0279.104] SetLastError (dwErrCode=0x0) [0279.104] GetLastError () returned 0x0 [0279.104] SetLastError (dwErrCode=0x0) [0279.105] SysReAllocStringLen (in: pbstr=0x5ffe00*=0x0, psz="Software\\Enigma Protector\\", len=0x1a | out: pbstr=0x5ffe00*="Software\\Enigma Protector\\") returned 1 [0279.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0279.105] GetLastError () returned 0x0 [0279.105] SetLastError (dwErrCode=0x0) [0279.105] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x8e5778, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8", lpUsedDefaultChar=0x0) returned 1 [0279.105] GetLastError () returned 0x0 [0279.105] SetLastError (dwErrCode=0x0) [0279.105] GetLastError () returned 0x0 [0279.105] SetLastError (dwErrCode=0x0) [0279.105] GetLastError () returned 0x0 [0279.105] SetLastError (dwErrCode=0x0) [0279.105] CharUpperBuffW (in: lpsz="x", cchLength=0x1 | out: lpsz="X") returned 0x1 [0279.105] GetLastError () returned 0x0 [0279.105] SetLastError (dwErrCode=0x0) [0279.105] GetLastError () returned 0x0 [0279.106] SetLastError (dwErrCode=0x0) [0279.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0279.106] GetLastError () returned 0x0 [0279.106] SetLastError (dwErrCode=0x0) [0279.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x8e5778, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0279.106] GetLastError () returned 0x0 [0279.106] SetLastError (dwErrCode=0x0) [0279.106] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x5ffb91, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0279.106] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x5ffb91, cbMultiByte=8, lpWideCharStr=0x6c2b48, cchWideChar=8 | out: lpWideCharStr="29AEB4A0") returned 8 [0279.106] SysReAllocStringLen (in: pbstr=0x5ffcc0*=0x0, psz="29AEB4A0", len=0x8 | out: pbstr=0x5ffcc0*="29AEB4A0") returned 1 [0279.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0279.106] GetLastError () returned 0x0 [0279.106] SetLastError (dwErrCode=0x0) [0279.106] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x8e5778, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8", lpUsedDefaultChar=0x0) returned 1 [0279.106] GetLastError () returned 0x0 [0279.106] SetLastError (dwErrCode=0x0) [0279.106] GetLastError () returned 0x0 [0279.107] SetLastError (dwErrCode=0x0) [0279.107] GetLastError () returned 0x0 [0279.107] SetLastError (dwErrCode=0x0) [0279.107] CharUpperBuffW (in: lpsz="x", cchLength=0x1 | out: lpsz="X") returned 0x1 [0279.107] GetLastError () returned 0x0 [0279.107] SetLastError (dwErrCode=0x0) [0279.107] GetLastError () returned 0x0 [0279.107] SetLastError (dwErrCode=0x0) [0279.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0279.107] GetLastError () returned 0x0 [0279.107] SetLastError (dwErrCode=0x0) [0279.107] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x8e5778, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0279.107] GetLastError () returned 0x0 [0279.107] SetLastError (dwErrCode=0x0) [0279.107] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x5ffb91, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0279.107] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x5ffb91, cbMultiByte=8, lpWideCharStr=0x6c28d8, cchWideChar=8 | out: lpWideCharStr="365755F6") returned 8 [0279.107] SysReAllocStringLen (in: pbstr=0x5ffcc0*="29AEB4A0", psz="365755F6", len=0x8 | out: pbstr=0x5ffcc0*="365755F6") returned 1 [0279.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0279.108] GetLastError () returned 0x0 [0279.108] SetLastError (dwErrCode=0x0) [0279.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x8e5778, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8", lpUsedDefaultChar=0x0) returned 1 [0279.108] GetLastError () returned 0x0 [0279.108] SetLastError (dwErrCode=0x0) [0279.108] GetLastError () returned 0x0 [0279.108] SetLastError (dwErrCode=0x0) [0279.108] GetLastError () returned 0x0 [0279.108] SetLastError (dwErrCode=0x0) [0279.108] CharUpperBuffW (in: lpsz="x", cchLength=0x1 | out: lpsz="X") returned 0x1 [0279.108] GetLastError () returned 0x0 [0279.108] SetLastError (dwErrCode=0x0) [0279.108] GetLastError () returned 0x0 [0279.108] SetLastError (dwErrCode=0x0) [0279.108] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0279.108] GetLastError () returned 0x0 [0279.108] SetLastError (dwErrCode=0x0) [0279.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x8e5778, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0279.112] GetLastError () returned 0x0 [0279.112] SetLastError (dwErrCode=0x0) [0279.112] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x5ffb91, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0279.112] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x5ffb91, cbMultiByte=8, lpWideCharStr=0x6c28d8, cchWideChar=8 | out: lpWideCharStr="B862CAE9") returned 8 [0279.112] SysReAllocStringLen (in: pbstr=0x5ffcc0*="365755F6", psz="B862CAE9", len=0x8 | out: pbstr=0x5ffcc0*="B862CAE9") returned 1 [0279.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0279.112] GetLastError () returned 0x0 [0279.112] SetLastError (dwErrCode=0x0) [0279.112] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x8e5778, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8", lpUsedDefaultChar=0x0) returned 1 [0279.112] GetLastError () returned 0x0 [0279.112] SetLastError (dwErrCode=0x0) [0279.113] GetLastError () returned 0x0 [0279.113] SetLastError (dwErrCode=0x0) [0279.113] GetLastError () returned 0x0 [0279.113] SetLastError (dwErrCode=0x0) [0279.113] CharUpperBuffW (in: lpsz="x", cchLength=0x1 | out: lpsz="X") returned 0x1 [0279.113] GetLastError () returned 0x0 [0279.113] SetLastError (dwErrCode=0x0) [0279.113] GetLastError () returned 0x0 [0279.113] SetLastError (dwErrCode=0x0) [0279.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1 [0279.113] GetLastError () returned 0x0 [0279.113] SetLastError (dwErrCode=0x0) [0279.113] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="X", cchWideChar=1, lpMultiByteStr=0x8e5778, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="X", lpUsedDefaultChar=0x0) returned 1 [0279.113] GetLastError () returned 0x0 [0279.113] SetLastError (dwErrCode=0x0) [0279.113] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x5ffb91, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0279.113] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x5ffb91, cbMultiByte=8, lpWideCharStr=0x6c2b48, cchWideChar=8 | out: lpWideCharStr="84EA4D0E") returned 8 [0279.113] SysReAllocStringLen (in: pbstr=0x5ffcc0*="B862CAE9", psz="84EA4D0E", len=0x8 | out: pbstr=0x5ffcc0*="84EA4D0E") returned 1 [0279.114] GetLastError () returned 0x0 [0279.114] SetLastError (dwErrCode=0x0) [0279.114] GetLastError () returned 0x0 [0279.114] GetLastError () returned 0x0 [0279.114] SetLastError (dwErrCode=0x0) [0279.114] SetLastError (dwErrCode=0x0) [0279.114] GetLastError () returned 0x0 [0279.114] SetLastError (dwErrCode=0x0) [0279.115] SysReAllocStringLen (in: pbstr=0x2570608*=0x0, psz="Software\\Enigma Protector\\29AEB4A0365755F6-B862CAE984EA4D0E", len=0x3b | out: pbstr=0x2570608*="Software\\Enigma Protector\\29AEB4A0365755F6-B862CAE984EA4D0E") returned 1 [0279.115] GetLastError () returned 0x0 [0279.115] SetLastError (dwErrCode=0x0) [0279.115] GetLastError () returned 0x0 [0279.115] SetLastError (dwErrCode=0x0) [0279.115] GetLastError () returned 0x0 [0279.115] SetLastError (dwErrCode=0x0) [0279.115] GetWindowsDirectoryA (in: lpBuffer=0x5ffb30, uSize=0x105 | out: lpBuffer="C:\\Windows") returned 0xa [0279.115] GetLastError () returned 0x0 [0279.115] SetLastError (dwErrCode=0x0) [0279.115] GetLastError () returned 0x0 [0279.115] SetLastError (dwErrCode=0x0) [0279.115] GetLastError () returned 0x0 [0279.115] SetLastError (dwErrCode=0x0) [0279.115] GetLastError () returned 0x0 [0279.116] SetLastError (dwErrCode=0x0) [0279.116] CreateFileA (lpFileName="\\\\.\\C:" (normalized: "c:"), dwDesiredAccess=0x0, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0279.116] GetLastError () returned 0x0 [0279.116] SetLastError (dwErrCode=0x0) [0279.116] DeviceIoControl (in: hDevice=0x1e8, dwIoControlCode=0x2d1400, lpInBuffer=0x5ffc50*, nInBufferSize=0xc, lpOutBuffer=0x2591db0, nOutBufferSize=0x2710, lpBytesReturned=0x5ffc48, lpOverlapped=0x0 | out: lpInBuffer=0x5ffc50*, lpOutBuffer=0x2591db0*, lpBytesReturned=0x5ffc48*=0x148, lpOverlapped=0x0) returned 1 [0279.117] GetLastError () returned 0x0 [0279.117] SetLastError (dwErrCode=0x0) [0279.117] GetLastError () returned 0x0 [0279.117] SetLastError (dwErrCode=0x0) [0279.117] GetLastError () returned 0x0 [0279.117] SetLastError (dwErrCode=0x0) [0279.117] GetLastError () returned 0x0 [0279.117] SetLastError (dwErrCode=0x0) [0279.117] GetLastError () returned 0x0 [0279.117] SetLastError (dwErrCode=0x0) [0279.117] CloseHandle (hObject=0x1e8) returned 1 [0279.117] GetLastError () returned 0x0 [0279.117] SetLastError (dwErrCode=0x0) [0279.117] GetLastError () returned 0x0 [0279.117] SetLastError (dwErrCode=0x0) [0279.117] GetLastError () returned 0x0 [0279.117] SetLastError (dwErrCode=0x0) [0279.117] GetLastError () returned 0x0 [0279.117] SetLastError (dwErrCode=0x0) [0279.118] GetLastError () returned 0x0 [0279.118] SetLastError (dwErrCode=0x0) [0279.118] GetLastError () returned 0x0 [0279.118] SetLastError (dwErrCode=0x0) [0279.118] GetLastError () returned 0x0 [0279.118] SetLastError (dwErrCode=0x0) [0279.118] GetLastError () returned 0x0 [0279.118] SetLastError (dwErrCode=0x0) [0279.118] GetLastError () returned 0x0 [0279.118] SetLastError (dwErrCode=0x0) [0279.118] GetLastError () returned 0x0 [0279.118] GetLastError () returned 0x0 [0279.118] SetLastError (dwErrCode=0x0) [0279.118] SetLastError (dwErrCode=0x0) [0279.118] GetLastError () returned 0x0 [0279.118] SetLastError (dwErrCode=0x0) [0279.118] GetLastError () returned 0x0 [0279.119] SetLastError (dwErrCode=0x0) [0279.119] GetLastError () returned 0x0 [0279.119] SetLastError (dwErrCode=0x0) [0279.119] GetLastError () returned 0x0 [0279.119] SetLastError (dwErrCode=0x0) [0279.119] GetLastError () returned 0x0 [0279.119] SetLastError (dwErrCode=0x0) [0279.119] GetLastError () returned 0x0 [0279.119] GetLastError () returned 0x0 [0279.119] SetLastError (dwErrCode=0x0) [0279.119] SetLastError (dwErrCode=0x0) [0279.119] GetLastError () returned 0x0 [0279.119] SetLastError (dwErrCode=0x0) [0279.119] GetCurrentProcessId () returned 0x694 [0279.119] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x694) returned 0x1ec [0279.126] Module32First (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.127] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.127] GetLastError () returned 0x0 [0279.128] SetLastError (dwErrCode=0x0) [0279.128] GetProcessHeap () returned 0x710000 [0279.128] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8000) returned 0x2635fb0 [0279.129] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.130] GetLastError () returned 0x0 [0279.130] SetLastError (dwErrCode=0x0) [0279.130] GetLastError () returned 0x0 [0279.130] SetLastError (dwErrCode=0x0) [0279.130] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.131] GetLastError () returned 0x0 [0279.131] SetLastError (dwErrCode=0x0) [0279.131] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.132] GetLastError () returned 0x0 [0279.132] SetLastError (dwErrCode=0x0) [0279.132] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.133] GetLastError () returned 0x0 [0279.133] SetLastError (dwErrCode=0x0) [0279.134] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.134] GetLastError () returned 0x0 [0279.134] SetLastError (dwErrCode=0x0) [0279.134] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.135] GetLastError () returned 0x0 [0279.135] SetLastError (dwErrCode=0x0) [0279.135] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.137] GetLastError () returned 0x0 [0279.137] SetLastError (dwErrCode=0x0) [0279.137] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.138] GetLastError () returned 0x0 [0279.138] SetLastError (dwErrCode=0x0) [0279.138] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.139] GetLastError () returned 0x0 [0279.139] SetLastError (dwErrCode=0x0) [0279.139] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.140] GetLastError () returned 0x0 [0279.140] SetLastError (dwErrCode=0x0) [0279.140] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.141] GetLastError () returned 0x0 [0279.141] SetLastError (dwErrCode=0x0) [0279.141] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.142] GetLastError () returned 0x0 [0279.142] SetLastError (dwErrCode=0x0) [0279.142] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.142] GetLastError () returned 0x0 [0279.143] SetLastError (dwErrCode=0x0) [0279.143] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.144] GetLastError () returned 0x0 [0279.144] SetLastError (dwErrCode=0x0) [0279.144] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.145] GetLastError () returned 0x0 [0279.145] SetLastError (dwErrCode=0x0) [0279.145] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.146] GetLastError () returned 0x0 [0279.146] SetLastError (dwErrCode=0x0) [0279.146] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.147] GetLastError () returned 0x0 [0279.147] SetLastError (dwErrCode=0x0) [0279.147] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.148] GetLastError () returned 0x0 [0279.148] SetLastError (dwErrCode=0x0) [0279.148] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.148] GetLastError () returned 0x0 [0279.148] SetLastError (dwErrCode=0x0) [0279.148] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.149] GetLastError () returned 0x0 [0279.149] SetLastError (dwErrCode=0x0) [0279.149] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.150] GetLastError () returned 0x0 [0279.150] SetLastError (dwErrCode=0x0) [0279.150] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.151] GetLastError () returned 0x0 [0279.151] SetLastError (dwErrCode=0x0) [0279.151] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.151] GetLastError () returned 0x0 [0279.152] SetLastError (dwErrCode=0x0) [0279.152] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.152] GetLastError () returned 0x0 [0279.152] SetLastError (dwErrCode=0x0) [0279.152] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.153] GetLastError () returned 0x0 [0279.153] SetLastError (dwErrCode=0x0) [0279.153] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.154] GetLastError () returned 0x0 [0279.154] SetLastError (dwErrCode=0x0) [0279.154] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.155] GetLastError () returned 0x0 [0279.155] SetLastError (dwErrCode=0x0) [0279.155] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.156] GetLastError () returned 0x0 [0279.156] SetLastError (dwErrCode=0x0) [0279.156] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 1 [0279.157] GetLastError () returned 0x0 [0279.157] SetLastError (dwErrCode=0x0) [0279.157] Module32Next (hSnapshot=0x1ec, lpme=0x5ffb08) returned 0 [0279.158] CloseHandle (hObject=0x1ec) returned 1 [0279.158] GetLastError () returned 0x12 [0279.158] SetLastError (dwErrCode=0x12) [0279.158] GetLastError () returned 0x12 [0279.158] SetLastError (dwErrCode=0x12) [0279.158] GetLastError () returned 0x12 [0279.158] SetLastError (dwErrCode=0x12) [0279.158] GetLastError () returned 0x12 [0279.158] SetLastError (dwErrCode=0x12) [0279.158] GetLastError () returned 0x12 [0279.158] GetLastError () returned 0x12 [0279.158] SetLastError (dwErrCode=0x12) [0279.158] SetLastError (dwErrCode=0x12) [0279.158] GetLastError () returned 0x12 [0279.158] SetLastError (dwErrCode=0x12) [0279.158] GetLastError () returned 0x12 [0279.159] SetLastError (dwErrCode=0x12) [0279.159] GetLastError () returned 0x12 [0279.159] SetLastError (dwErrCode=0x12) [0279.159] GetLastError () returned 0x12 [0279.159] SetLastError (dwErrCode=0x12) [0279.159] GetLastError () returned 0x12 [0279.159] SetLastError (dwErrCode=0x12) [0279.159] GetLastError () returned 0x12 [0279.159] GetLastError () returned 0x12 [0279.159] SetLastError (dwErrCode=0x12) [0279.159] SetLastError (dwErrCode=0x12) [0279.159] GetLastError () returned 0x12 [0279.159] SetLastError (dwErrCode=0x12) [0279.159] GetLastError () returned 0x12 [0279.159] SetLastError (dwErrCode=0x12) [0279.159] GetLastError () returned 0x12 [0279.159] SetLastError (dwErrCode=0x12) [0279.159] GetLastError () returned 0x12 [0279.160] SetLastError (dwErrCode=0x12) [0279.160] GetLastError () returned 0x12 [0279.160] SetLastError (dwErrCode=0x12) [0279.160] GetLastError () returned 0x12 [0279.160] GetLastError () returned 0x12 [0279.160] SetLastError (dwErrCode=0x12) [0279.160] SetLastError (dwErrCode=0x12) [0279.160] GetLastError () returned 0x12 [0279.160] SetLastError (dwErrCode=0x12) [0279.160] GetLastError () returned 0x12 [0279.160] SetLastError (dwErrCode=0x12) [0279.160] GetLastError () returned 0x12 [0279.160] SetLastError (dwErrCode=0x12) [0279.160] GetLastError () returned 0x12 [0279.160] SetLastError (dwErrCode=0x12) [0279.160] GetLastError () returned 0x12 [0279.160] SetLastError (dwErrCode=0x12) [0279.161] GetLastError () returned 0x12 [0279.161] GetLastError () returned 0x12 [0279.161] SetLastError (dwErrCode=0x12) [0279.161] SetLastError (dwErrCode=0x12) [0279.161] GetLastError () returned 0x12 [0279.161] SetLastError (dwErrCode=0x12) [0279.161] GetLastError () returned 0x12 [0279.161] SetLastError (dwErrCode=0x12) [0279.161] GetLastError () returned 0x12 [0279.161] SetLastError (dwErrCode=0x12) [0279.161] GetLastError () returned 0x12 [0279.161] SetLastError (dwErrCode=0x12) [0279.161] GetLastError () returned 0x12 [0279.161] SetLastError (dwErrCode=0x12) [0279.161] GetLastError () returned 0x12 [0279.162] GetLastError () returned 0x12 [0279.162] SetLastError (dwErrCode=0x12) [0279.162] SetLastError (dwErrCode=0x12) [0279.162] GetLastError () returned 0x12 [0279.162] SetLastError (dwErrCode=0x12) [0279.162] GetLastError () returned 0x12 [0279.162] SetLastError (dwErrCode=0x12) [0279.162] GetLastError () returned 0x12 [0279.162] SetLastError (dwErrCode=0x12) [0279.162] GetLastError () returned 0x12 [0279.162] SetLastError (dwErrCode=0x12) [0279.162] GetLastError () returned 0x12 [0279.162] SetLastError (dwErrCode=0x12) [0279.162] GetLastError () returned 0x12 [0279.162] GetLastError () returned 0x12 [0279.162] SetLastError (dwErrCode=0x12) [0279.162] SetLastError (dwErrCode=0x12) [0279.162] GetLastError () returned 0x12 [0279.162] SetLastError (dwErrCode=0x12) [0279.163] GetLastError () returned 0x12 [0279.163] SetLastError (dwErrCode=0x12) [0279.163] GetLastError () returned 0x12 [0279.163] SetLastError (dwErrCode=0x12) [0279.163] GetLastError () returned 0x12 [0279.163] SetLastError (dwErrCode=0x12) [0279.163] GetLastError () returned 0x12 [0279.163] SetLastError (dwErrCode=0x12) [0279.163] GetLastError () returned 0x12 [0279.163] SetLastError (dwErrCode=0x12) [0279.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SOFTWARE\\EnigmaDevelopers", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0279.163] GetLastError () returned 0x0 [0279.163] SetLastError (dwErrCode=0x0) [0279.163] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="SOFTWARE\\EnigmaDevelopers", cchWideChar=25, lpMultiByteStr=0x8e58b8, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SOFTWARE\\EnigmaDevelopers", lpUsedDefaultChar=0x0) returned 25 [0279.163] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="SOFTWARE\\EnigmaDevelopers", ulOptions=0x0, samDesired=0x20019, phkResult=0x5ffb68 | out: phkResult=0x5ffb68*=0x0) returned 0x2 [0279.164] GetLastError () returned 0x0 [0279.164] SetLastError (dwErrCode=0x0) [0279.164] GetLastError () returned 0x0 [0279.164] SetLastError (dwErrCode=0x0) [0279.164] GetLastError () returned 0x0 [0279.164] SetLastError (dwErrCode=0x0) [0279.164] GetLastError () returned 0x0 [0279.164] SetLastError (dwErrCode=0x0) [0279.164] GetLastError () returned 0x0 [0279.164] GetLastError () returned 0x0 [0279.164] SetLastError (dwErrCode=0x0) [0279.164] SetLastError (dwErrCode=0x0) [0279.164] GetLastError () returned 0x0 [0279.164] SetLastError (dwErrCode=0x0) [0279.164] GetLastError () returned 0x0 [0279.164] SetLastError (dwErrCode=0x0) [0279.165] GetLastError () returned 0x0 [0279.165] SetLastError (dwErrCode=0x0) [0279.165] GetLastError () returned 0x0 [0279.165] SetLastError (dwErrCode=0x0) [0279.165] GetLastError () returned 0x0 [0279.165] SetLastError (dwErrCode=0x0) [0279.165] GetLocalTime (in: lpSystemTime=0x5ffc40 | out: lpSystemTime=0x5ffc40*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2b, wSecond=0x8, wMilliseconds=0x12)) [0279.165] GetLocalTime (in: lpSystemTime=0x5ffc40 | out: lpSystemTime=0x5ffc40*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2b, wSecond=0x8, wMilliseconds=0x12)) [0279.165] GetLastError () returned 0x0 [0279.166] SetLastError (dwErrCode=0x0) [0279.166] GetLastError () returned 0x0 [0279.166] SetLastError (dwErrCode=0x0) [0279.166] GetLastError () returned 0x0 [0279.166] SetLastError (dwErrCode=0x0) [0279.166] GetLastError () returned 0x0 [0279.166] SetLastError (dwErrCode=0x0) [0279.166] GetLastError () returned 0x0 [0279.166] SetLastError (dwErrCode=0x0) [0279.166] GetLastError () returned 0x0 [0279.166] SetLastError (dwErrCode=0x0) [0279.166] GetLastError () returned 0x0 [0279.166] SetLastError (dwErrCode=0x0) [0279.166] GetLastError () returned 0x0 [0279.166] SetLastError (dwErrCode=0x0) [0279.166] GetLastError () returned 0x0 [0279.166] SetLastError (dwErrCode=0x0) [0279.166] GetLastError () returned 0x0 [0279.166] SetLastError (dwErrCode=0x0) [0279.166] GetLastError () returned 0x0 [0279.166] SetLastError (dwErrCode=0x0) [0279.166] GetLastError () returned 0x0 [0279.166] SetLastError (dwErrCode=0x0) [0279.166] GetLastError () returned 0x0 [0279.167] SetLastError (dwErrCode=0x0) [0279.167] GetLastError () returned 0x0 [0279.167] SetLastError (dwErrCode=0x0) [0279.167] GetLastError () returned 0x0 [0279.167] SetLastError (dwErrCode=0x0) [0279.167] GetLastError () returned 0x0 [0279.167] SetLastError (dwErrCode=0x0) [0279.167] GetLastError () returned 0x0 [0279.167] SetLastError (dwErrCode=0x0) [0279.167] GetLastError () returned 0x0 [0279.167] SetLastError (dwErrCode=0x0) [0279.167] GetLastError () returned 0x0 [0279.167] SetLastError (dwErrCode=0x0) [0279.167] GetLastError () returned 0x0 [0279.167] SetLastError (dwErrCode=0x0) [0279.167] GetLastError () returned 0x0 [0279.167] SetLastError (dwErrCode=0x0) [0279.167] GetLastError () returned 0x0 [0279.167] SetLastError (dwErrCode=0x0) [0279.167] GetLastError () returned 0x0 [0279.167] SetLastError (dwErrCode=0x0) [0279.167] GetLastError () returned 0x0 [0279.167] SetLastError (dwErrCode=0x0) [0279.168] GetLastError () returned 0x0 [0279.168] SetLastError (dwErrCode=0x0) [0279.168] GetLastError () returned 0x0 [0279.168] SetLastError (dwErrCode=0x0) [0279.168] GetLastError () returned 0x0 [0279.168] SetLastError (dwErrCode=0x0) [0279.168] GetLastError () returned 0x0 [0279.168] SetLastError (dwErrCode=0x0) [0279.168] GetLastError () returned 0x0 [0279.168] SetLastError (dwErrCode=0x0) [0279.168] GetLastError () returned 0x0 [0279.168] SetLastError (dwErrCode=0x0) [0279.168] GetLastError () returned 0x0 [0279.168] SetLastError (dwErrCode=0x0) [0279.168] GetLastError () returned 0x0 [0279.168] SetLastError (dwErrCode=0x0) [0279.168] GetLastError () returned 0x0 [0279.168] SetLastError (dwErrCode=0x0) [0279.168] GetLastError () returned 0x0 [0279.168] SetLastError (dwErrCode=0x0) [0279.168] GetLastError () returned 0x0 [0279.168] SetLastError (dwErrCode=0x0) [0279.169] GetLastError () returned 0x0 [0279.169] SetLastError (dwErrCode=0x0) [0279.169] GetLastError () returned 0x0 [0279.169] SetLastError (dwErrCode=0x0) [0279.169] GetLastError () returned 0x0 [0279.169] SetLastError (dwErrCode=0x0) [0279.169] GetLastError () returned 0x0 [0279.169] SetLastError (dwErrCode=0x0) [0279.169] GetLastError () returned 0x0 [0279.169] SetLastError (dwErrCode=0x0) [0279.169] GetLastError () returned 0x0 [0279.169] SetLastError (dwErrCode=0x0) [0279.169] GetLastError () returned 0x0 [0279.169] SetLastError (dwErrCode=0x0) [0279.169] GetLastError () returned 0x0 [0279.169] SetLastError (dwErrCode=0x0) [0279.169] GetLastError () returned 0x0 [0279.169] SetLastError (dwErrCode=0x0) [0279.169] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0279.169] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e5878, cbMultiByte=8, lpWideCharStr=0x6c2b48, cchWideChar=8 | out: lpWideCharStr="80EB2F5C") returned 8 [0279.169] GetLocalTime (in: lpSystemTime=0x5ffae0 | out: lpSystemTime=0x5ffae0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2b, wSecond=0x8, wMilliseconds=0x16)) [0279.169] GetLocalTime (in: lpSystemTime=0x5ffae0 | out: lpSystemTime=0x5ffae0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2b, wSecond=0x8, wMilliseconds=0x16)) [0279.169] GetLocalTime (in: lpSystemTime=0x5ffae0 | out: lpSystemTime=0x5ffae0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2b, wSecond=0x8, wMilliseconds=0x16)) [0279.169] GetLastError () returned 0x0 [0279.170] SetLastError (dwErrCode=0x0) [0279.170] GetLastError () returned 0x0 [0279.170] SetLastError (dwErrCode=0x0) [0279.170] RegOpenKeyExA (in: hKey=0xffffffff80000001, lpSubKey="Software\\Enigma Protector\\29AEB4A0365755F6-B862CAE984EA4D0E\\02F01F553A112DCE-00C9DB38C18D5FD1", ulOptions=0x0, samDesired=0x20019, phkResult=0x5ffa98 | out: phkResult=0x5ffa98*=0x0) returned 0x2 [0279.170] GetLastError () returned 0x0 [0279.170] SetLastError (dwErrCode=0x0) [0279.170] GetLastError () returned 0x0 [0279.170] SetLastError (dwErrCode=0x0) [0279.170] CreateFileW (lpFileName="c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\80EB2F5C" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\80eb2f5c"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0279.170] GetLocalTime (in: lpSystemTime=0x5ffae0 | out: lpSystemTime=0x5ffae0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2b, wSecond=0x8, wMilliseconds=0x17)) [0279.170] GetLastError () returned 0x0 [0279.171] SetLastError (dwErrCode=0x0) [0279.171] GetLastError () returned 0x0 [0279.171] SetLastError (dwErrCode=0x0) [0279.171] GetLastError () returned 0x0 [0279.171] SetLastError (dwErrCode=0x0) [0279.171] GetLastError () returned 0x0 [0279.171] GetLastError () returned 0x0 [0279.171] SetLastError (dwErrCode=0x0) [0279.171] SetLastError (dwErrCode=0x0) [0279.171] GetLastError () returned 0x0 [0279.171] SetLastError (dwErrCode=0x0) [0279.171] GetLocalTime (in: lpSystemTime=0x5ffcd0 | out: lpSystemTime=0x5ffcd0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2b, wSecond=0x8, wMilliseconds=0x17)) [0279.171] GetLastError () returned 0x0 [0279.171] SetLastError (dwErrCode=0x0) [0279.171] GetLastError () returned 0x0 [0279.171] SetLastError (dwErrCode=0x0) [0279.171] GetLastError () returned 0x0 [0279.171] SetLastError (dwErrCode=0x0) [0279.171] GetLastError () returned 0x0 [0279.172] SetLastError (dwErrCode=0x0) [0279.172] GetLastError () returned 0x0 [0279.172] SetLastError (dwErrCode=0x0) [0279.172] GetLastError () returned 0x0 [0279.172] GetLastError () returned 0x0 [0279.172] SetLastError (dwErrCode=0x0) [0279.172] SetLastError (dwErrCode=0x0) [0279.172] GetLastError () returned 0x0 [0279.172] SetLastError (dwErrCode=0x0) [0279.172] GetLastError () returned 0x0 [0279.172] SetLastError (dwErrCode=0x0) [0279.172] GetLastError () returned 0x0 [0279.172] SetLastError (dwErrCode=0x0) [0279.172] GetLastError () returned 0x0 [0279.173] SetLastError (dwErrCode=0x0) [0279.173] GetLastError () returned 0x0 [0279.173] SetLastError (dwErrCode=0x0) [0279.173] GetLastError () returned 0x0 [0279.173] GetLastError () returned 0x0 [0279.173] SetLastError (dwErrCode=0x0) [0279.173] SetLastError (dwErrCode=0x0) [0279.173] GetLastError () returned 0x0 [0279.173] SetLastError (dwErrCode=0x0) [0279.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x7ff772830640, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x5ffd40 | out: lpThreadId=0x5ffd40*=0x1150) returned 0x1ec [0279.179] GetLastError () returned 0x0 [0279.179] SetLastError (dwErrCode=0x0) [0279.180] GetLastError () returned 0x0 [0279.180] SetLastError (dwErrCode=0x0) [0279.180] GetLastError () returned 0x0 [0279.180] SetLastError (dwErrCode=0x0) [0279.180] GetLastError () returned 0x0 [0279.180] SetLastError (dwErrCode=0x0) [0279.180] GetLastError () returned 0x0 [0279.180] GetLastError () returned 0x0 [0279.180] SetLastError (dwErrCode=0x0) [0279.180] SetLastError (dwErrCode=0x0) [0279.180] GetLastError () returned 0x0 [0279.180] SetLastError (dwErrCode=0x0) [0279.180] GetCurrentProcessId () returned 0x694 [0279.180] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x694) returned 0x1f0 [0279.184] Module32First (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.185] GetLastError () returned 0x0 [0279.185] SetLastError (dwErrCode=0x0) [0279.185] GetLastError () returned 0x0 [0279.185] SetLastError (dwErrCode=0x0) [0279.185] GetLastError () returned 0x0 [0279.185] SetLastError (dwErrCode=0x0) [0279.185] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.186] GetLastError () returned 0x0 [0279.186] SetLastError (dwErrCode=0x0) [0279.186] GetLastError () returned 0x0 [0279.186] SetLastError (dwErrCode=0x0) [0279.186] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.187] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.188] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.188] GetLastError () returned 0x0 [0279.188] SetLastError (dwErrCode=0x0) [0279.188] GetLastError () returned 0x0 [0279.188] SetLastError (dwErrCode=0x0) [0279.189] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.189] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.195] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c208, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.195] VirtualAlloc (lpAddress=0x7ffd4e1c0000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0279.195] VirtualAlloc (lpAddress=0x7ffd4e1d0000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0279.195] VirtualAlloc (lpAddress=0x7ffd4e1e0000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0279.195] VirtualAlloc (lpAddress=0x7ffd4e1f0000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0279.195] VirtualAlloc (lpAddress=0x7ffd4e200000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0279.195] VirtualAlloc (lpAddress=0x7ffd4e210000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0279.195] VirtualAlloc (lpAddress=0x7ffd4e220000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0279.196] VirtualAlloc (lpAddress=0x7ffd4e230000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0279.196] VirtualAlloc (lpAddress=0x7ffd4e240000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0279.196] VirtualAlloc (lpAddress=0x7ffd4e250000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0279.196] VirtualAlloc (lpAddress=0x7ffd4e260000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x0 [0279.196] VirtualAlloc (lpAddress=0x7ffd4e270000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x40) returned 0x7ffd4e270000 [0279.196] VirtualAlloc (lpAddress=0x7ffd4e270000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x40) returned 0x7ffd4e270000 [0279.197] GetLastError () returned 0x1e7 [0279.197] SetLastError (dwErrCode=0x1e7) [0279.197] GetLastError () returned 0x1e7 [0279.197] SetLastError (dwErrCode=0x1e7) [0279.197] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff77280077f, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.198] GetCurrentProcess () returned 0xffffffffffffffff [0279.198] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c208, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.198] GetCurrentProcess () returned 0xffffffffffffffff [0279.198] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c2f8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.198] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.199] GetCurrentProcess () returned 0xffffffffffffffff [0279.199] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c2f8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.199] GetCurrentProcess () returned 0xffffffffffffffff [0279.199] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c2fc, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.199] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.199] GetCurrentProcess () returned 0xffffffffffffffff [0279.199] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c2fc, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.200] GetCurrentProcess () returned 0xffffffffffffffff [0279.200] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c30c, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.200] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.200] GetCurrentProcess () returned 0xffffffffffffffff [0279.200] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c30c, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.200] GetCurrentProcess () returned 0xffffffffffffffff [0279.200] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c318, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.200] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.201] GetCurrentProcess () returned 0xffffffffffffffff [0279.201] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c318, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.201] GetCurrentProcess () returned 0xffffffffffffffff [0279.201] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c6a8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.201] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.201] GetCurrentProcess () returned 0xffffffffffffffff [0279.201] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c6a8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.201] GetCurrentProcess () returned 0xffffffffffffffff [0279.201] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c6b8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.202] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.202] GetCurrentProcess () returned 0xffffffffffffffff [0279.202] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c6b8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.202] GetCurrentProcess () returned 0xffffffffffffffff [0279.202] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c754, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.202] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.202] GetCurrentProcess () returned 0xffffffffffffffff [0279.202] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c754, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.203] GetCurrentProcess () returned 0xffffffffffffffff [0279.203] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c758, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.203] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.203] GetCurrentProcess () returned 0xffffffffffffffff [0279.203] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c758, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.203] GetCurrentProcess () returned 0xffffffffffffffff [0279.203] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c858, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.204] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.204] GetCurrentProcess () returned 0xffffffffffffffff [0279.204] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c858, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.204] GetCurrentProcess () returned 0xffffffffffffffff [0279.204] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c85c, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.204] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.204] GetCurrentProcess () returned 0xffffffffffffffff [0279.204] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c85c, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.204] GetCurrentProcess () returned 0xffffffffffffffff [0279.204] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c924, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.205] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.205] GetCurrentProcess () returned 0xffffffffffffffff [0279.205] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c924, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.205] GetCurrentProcess () returned 0xffffffffffffffff [0279.205] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c9c4, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.205] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.205] GetCurrentProcess () returned 0xffffffffffffffff [0279.205] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c9c4, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.205] GetCurrentProcess () returned 0xffffffffffffffff [0279.205] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c9d0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.205] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.206] GetCurrentProcess () returned 0xffffffffffffffff [0279.206] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24c9d0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.206] GetCurrentProcess () returned 0xffffffffffffffff [0279.206] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24caac, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.206] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.206] GetCurrentProcess () returned 0xffffffffffffffff [0279.206] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24caac, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.206] GetCurrentProcess () returned 0xffffffffffffffff [0279.206] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24cc58, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.207] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.207] GetCurrentProcess () returned 0xffffffffffffffff [0279.207] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24cc58, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.207] GetCurrentProcess () returned 0xffffffffffffffff [0279.207] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24ced4, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.208] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.208] GetCurrentProcess () returned 0xffffffffffffffff [0279.208] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24ced4, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.208] GetCurrentProcess () returned 0xffffffffffffffff [0279.208] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24ced8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.208] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.208] GetCurrentProcess () returned 0xffffffffffffffff [0279.208] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24ced8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.208] GetCurrentProcess () returned 0xffffffffffffffff [0279.209] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24cedc, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.209] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.209] GetCurrentProcess () returned 0xffffffffffffffff [0279.209] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24cedc, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.209] GetCurrentProcess () returned 0xffffffffffffffff [0279.209] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24cee0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.209] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.209] GetCurrentProcess () returned 0xffffffffffffffff [0279.209] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24cee0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.209] GetCurrentProcess () returned 0xffffffffffffffff [0279.210] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24cf34, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.210] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.210] GetCurrentProcess () returned 0xffffffffffffffff [0279.210] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24cf34, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.211] GetCurrentProcess () returned 0xffffffffffffffff [0279.211] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24cf40, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.211] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.211] GetCurrentProcess () returned 0xffffffffffffffff [0279.211] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24cf40, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.211] GetCurrentProcess () returned 0xffffffffffffffff [0279.211] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24cf44, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.211] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.211] GetCurrentProcess () returned 0xffffffffffffffff [0279.211] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24cf44, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24c000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.212] GetCurrentProcess () returned 0xffffffffffffffff [0279.212] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24d194, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.212] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.212] GetCurrentProcess () returned 0xffffffffffffffff [0279.212] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24d194, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.212] GetCurrentProcess () returned 0xffffffffffffffff [0279.212] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24d474, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.212] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.212] GetCurrentProcess () returned 0xffffffffffffffff [0279.213] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24d474, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.213] GetCurrentProcess () returned 0xffffffffffffffff [0279.213] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24d6a8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.213] RtlUnwindEx (TargetFrame=0x5ff990, TargetIp=0x7ff772800646, ExceptionRecord=0x0, ReturnValue=0x0, ContextRecord=0x5ff510, HistoryTable=0x0) [0279.213] GetCurrentProcess () returned 0xffffffffffffffff [0279.213] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e24d6a8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e24d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.213] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.214] GetLastError () returned 0x1e7 [0279.214] SetLastError (dwErrCode=0x1e7) [0279.214] GetLastError () returned 0x1e7 [0279.214] SetLastError (dwErrCode=0x1e7) [0279.215] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.215] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.215] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.216] GetLastError () returned 0x1e7 [0279.216] SetLastError (dwErrCode=0x1e7) [0279.216] GetLastError () returned 0x1e7 [0279.216] SetLastError (dwErrCode=0x1e7) [0279.216] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.216] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.217] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4a8bf1b8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4a8bf000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.217] GetCurrentProcess () returned 0xffffffffffffffff [0279.217] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4a8bf1b8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4a8bf000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.218] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4a8bf1d0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4a8bf000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.218] GetCurrentProcess () returned 0xffffffffffffffff [0279.218] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4a8bf1d0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4a8bf000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.218] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.219] GetLastError () returned 0x1e7 [0279.219] SetLastError (dwErrCode=0x1e7) [0279.219] GetLastError () returned 0x1e7 [0279.220] SetLastError (dwErrCode=0x1e7) [0279.220] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.220] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.220] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4ea60748, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4ea60000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.221] GetCurrentProcess () returned 0xffffffffffffffff [0279.221] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4ea60748, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4ea60000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.221] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4ea60770, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4ea60000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.222] GetCurrentProcess () returned 0xffffffffffffffff [0279.222] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4ea60770, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4ea60000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.222] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.223] GetLastError () returned 0x1e7 [0279.223] SetLastError (dwErrCode=0x1e7) [0279.223] GetLastError () returned 0x1e7 [0279.223] SetLastError (dwErrCode=0x1e7) [0279.223] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.223] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.224] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d99b360, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d99b000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.224] GetCurrentProcess () returned 0xffffffffffffffff [0279.224] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d99b360, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d99b000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.224] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d99b368, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d99b000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.224] GetCurrentProcess () returned 0xffffffffffffffff [0279.224] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d99b368, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d99b000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.225] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.225] GetLastError () returned 0x1e7 [0279.225] SetLastError (dwErrCode=0x1e7) [0279.225] GetLastError () returned 0x1e7 [0279.225] SetLastError (dwErrCode=0x1e7) [0279.226] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.226] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.226] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4510, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.226] GetCurrentProcess () returned 0xffffffffffffffff [0279.226] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4510, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.226] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4528, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.227] GetCurrentProcess () returned 0xffffffffffffffff [0279.227] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4528, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.227] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4010, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.227] GetCurrentProcess () returned 0xffffffffffffffff [0279.228] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4010, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.228] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4028, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.228] GetCurrentProcess () returned 0xffffffffffffffff [0279.228] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4028, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.228] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4030, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.229] GetCurrentProcess () returned 0xffffffffffffffff [0279.229] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4030, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.229] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4038, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.229] GetCurrentProcess () returned 0xffffffffffffffff [0279.229] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4038, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.230] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4040, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.230] GetCurrentProcess () returned 0xffffffffffffffff [0279.230] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4040, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.230] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e40a8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.230] GetCurrentProcess () returned 0xffffffffffffffff [0279.230] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e40a8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.231] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e40d8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.231] GetCurrentProcess () returned 0xffffffffffffffff [0279.231] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e40d8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.231] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e40e0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.232] GetCurrentProcess () returned 0xffffffffffffffff [0279.232] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e40e0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.232] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e40f0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.232] GetCurrentProcess () returned 0xffffffffffffffff [0279.232] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e40f0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.232] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4190, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.233] GetCurrentProcess () returned 0xffffffffffffffff [0279.233] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4190, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.233] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e41a0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.233] GetCurrentProcess () returned 0xffffffffffffffff [0279.233] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e41a0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.234] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e41a8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.234] GetCurrentProcess () returned 0xffffffffffffffff [0279.234] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e41a8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.234] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e41b0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.234] GetCurrentProcess () returned 0xffffffffffffffff [0279.235] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e41b0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.235] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4290, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.235] GetCurrentProcess () returned 0xffffffffffffffff [0279.235] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e4290, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.235] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e42c8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.236] GetCurrentProcess () returned 0xffffffffffffffff [0279.236] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e4e42c8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e4e4000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.236] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.237] GetLastError () returned 0x1e7 [0279.237] SetLastError (dwErrCode=0x1e7) [0279.237] GetLastError () returned 0x1e7 [0279.237] SetLastError (dwErrCode=0x1e7) [0279.237] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.239] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.239] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4df75400, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4df75000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.240] GetCurrentProcess () returned 0xffffffffffffffff [0279.240] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4df75400, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4df75000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.240] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4df75440, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4df75000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.240] GetCurrentProcess () returned 0xffffffffffffffff [0279.240] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4df75440, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4df75000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.240] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.241] GetLastError () returned 0x1e7 [0279.241] SetLastError (dwErrCode=0x1e7) [0279.241] GetLastError () returned 0x1e7 [0279.241] SetLastError (dwErrCode=0x1e7) [0279.242] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.242] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.242] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e194388, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e194000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.242] GetCurrentProcess () returned 0xffffffffffffffff [0279.242] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e194388, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e194000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.243] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e1943e0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e194000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.243] GetCurrentProcess () returned 0xffffffffffffffff [0279.243] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e1943e0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e194000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.243] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.244] GetLastError () returned 0x1e7 [0279.244] SetLastError (dwErrCode=0x1e7) [0279.244] GetLastError () returned 0x1e7 [0279.244] SetLastError (dwErrCode=0x1e7) [0279.244] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.244] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.244] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4db3d1f8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4db3d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.245] GetCurrentProcess () returned 0xffffffffffffffff [0279.245] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4db3d1f8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4db3d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.245] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4db3d208, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4db3d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.246] GetCurrentProcess () returned 0xffffffffffffffff [0279.246] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4db3d208, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4db3d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.246] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.247] GetLastError () returned 0x1e7 [0279.247] SetLastError (dwErrCode=0x1e7) [0279.247] GetLastError () returned 0x1e7 [0279.247] SetLastError (dwErrCode=0x1e7) [0279.247] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.247] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.248] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4dc0d2e8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4dc0d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.248] GetCurrentProcess () returned 0xffffffffffffffff [0279.248] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4dc0d2e8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4dc0d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.248] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4dc0d318, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4dc0d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.248] GetCurrentProcess () returned 0xffffffffffffffff [0279.249] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4dc0d318, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4dc0d000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.249] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.250] GetLastError () returned 0x1e7 [0279.250] SetLastError (dwErrCode=0x1e7) [0279.250] GetLastError () returned 0x1e7 [0279.250] SetLastError (dwErrCode=0x1e7) [0279.250] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.250] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.250] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4de1f630, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4de1f000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.251] GetCurrentProcess () returned 0xffffffffffffffff [0279.251] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4de1f630, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4de1f000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.251] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4de1f650, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4de1f000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.251] GetCurrentProcess () returned 0xffffffffffffffff [0279.251] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4de1f650, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4de1f000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.251] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.252] GetLastError () returned 0x1e7 [0279.252] SetLastError (dwErrCode=0x1e7) [0279.252] GetLastError () returned 0x1e7 [0279.252] SetLastError (dwErrCode=0x1e7) [0279.253] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.253] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.253] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d8b2090, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d8b2000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.253] GetCurrentProcess () returned 0xffffffffffffffff [0279.253] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d8b2090, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d8b2000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.254] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.254] GetLastError () returned 0x1e7 [0279.254] SetLastError (dwErrCode=0x1e7) [0279.254] GetLastError () returned 0x1e7 [0279.255] SetLastError (dwErrCode=0x1e7) [0279.255] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.255] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.255] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4f10a3d0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4f10a000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.255] GetCurrentProcess () returned 0xffffffffffffffff [0279.255] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4f10a3d0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4f10a000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.256] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4f10a438, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4f10a000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.256] GetCurrentProcess () returned 0xffffffffffffffff [0279.256] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4f10a438, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4f10a000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.256] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.257] GetLastError () returned 0x1e7 [0279.257] SetLastError (dwErrCode=0x1e7) [0279.257] GetLastError () returned 0x1e7 [0279.257] SetLastError (dwErrCode=0x1e7) [0279.258] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.258] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.258] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cbaf250, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cbaf000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.258] GetCurrentProcess () returned 0xffffffffffffffff [0279.258] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cbaf250, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cbaf000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.258] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cbaf260, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cbaf000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.259] GetCurrentProcess () returned 0xffffffffffffffff [0279.259] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cbaf260, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cbaf000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.259] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.260] GetLastError () returned 0x1e7 [0279.260] SetLastError (dwErrCode=0x1e7) [0279.260] GetLastError () returned 0x1e7 [0279.260] SetLastError (dwErrCode=0x1e7) [0279.260] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.260] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.261] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d1946a8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d194000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.261] GetCurrentProcess () returned 0xffffffffffffffff [0279.261] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d1946a8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d194000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.261] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d1946c8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d194000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.261] GetCurrentProcess () returned 0xffffffffffffffff [0279.261] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d1946c8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d194000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.262] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0279.263] GetLastError () returned 0x1e7 [0279.263] SetLastError (dwErrCode=0x1e7) [0279.263] GetLastError () returned 0x1e7 [0279.263] SetLastError (dwErrCode=0x1e7) [0279.263] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0279.263] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0279.263] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd5011b528, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd5011b000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0279.264] GetCurrentProcess () returned 0xffffffffffffffff [0279.264] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd5011b528, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd5011b000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0279.264] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd5011b558, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd5011b000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.484] GetCurrentProcess () returned 0xffffffffffffffff [0283.484] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd5011b558, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd5011b000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.504] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.506] GetLastError () returned 0x1e7 [0283.506] SetLastError (dwErrCode=0x1e7) [0283.506] GetLastError () returned 0x1e7 [0283.506] SetLastError (dwErrCode=0x1e7) [0283.506] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.506] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.507] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cb745f8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cb74000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.507] GetCurrentProcess () returned 0xffffffffffffffff [0283.507] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cb745f8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cb74000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.507] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.508] GetLastError () returned 0x1e7 [0283.508] SetLastError (dwErrCode=0x1e7) [0283.508] GetLastError () returned 0x1e7 [0283.508] SetLastError (dwErrCode=0x1e7) [0283.508] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.508] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.508] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d62a320, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d62a000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.509] GetCurrentProcess () returned 0xffffffffffffffff [0283.509] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d62a320, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d62a000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.509] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d62a330, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d62a000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.512] GetCurrentProcess () returned 0xffffffffffffffff [0283.512] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4d62a330, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4d62a000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.512] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.513] GetLastError () returned 0x1e7 [0283.513] SetLastError (dwErrCode=0x1e7) [0283.513] GetLastError () returned 0x1e7 [0283.513] SetLastError (dwErrCode=0x1e7) [0283.513] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.514] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.514] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cb230f8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cb23000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.514] GetCurrentProcess () returned 0xffffffffffffffff [0283.514] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cb230f8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cb23000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.514] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cb23100, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cb23000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.515] GetCurrentProcess () returned 0xffffffffffffffff [0283.515] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cb23100, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cb23000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.515] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.515] GetLastError () returned 0x1e7 [0283.516] SetLastError (dwErrCode=0x1e7) [0283.516] GetLastError () returned 0x1e7 [0283.516] SetLastError (dwErrCode=0x1e7) [0283.516] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.516] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.516] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cafa158, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cafa000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.516] GetCurrentProcess () returned 0xffffffffffffffff [0283.516] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cafa158, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cafa000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.517] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cafa168, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cafa000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.517] GetCurrentProcess () returned 0xffffffffffffffff [0283.517] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4cafa168, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4cafa000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.517] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.518] GetLastError () returned 0x1e7 [0283.518] SetLastError (dwErrCode=0x1e7) [0283.518] GetLastError () returned 0x1e7 [0283.518] SetLastError (dwErrCode=0x1e7) [0283.518] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.518] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.518] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd50444000, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd50444000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.519] GetCurrentProcess () returned 0xffffffffffffffff [0283.519] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd50444000, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd50444000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.519] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd50444008, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd50444000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.519] GetCurrentProcess () returned 0xffffffffffffffff [0283.519] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd50444008, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd50444000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.519] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd504432d0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd50443000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.520] GetCurrentProcess () returned 0xffffffffffffffff [0283.521] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd504432d0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd50443000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.521] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.522] GetLastError () returned 0x1e7 [0283.522] SetLastError (dwErrCode=0x1e7) [0283.522] GetLastError () returned 0x1e7 [0283.522] SetLastError (dwErrCode=0x1e7) [0283.522] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.522] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.522] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd41d74158, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd41d74000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.523] GetCurrentProcess () returned 0xffffffffffffffff [0283.523] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd41d74158, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd41d74000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.523] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd41d74170, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd41d74000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.523] GetCurrentProcess () returned 0xffffffffffffffff [0283.523] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd41d74170, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd41d74000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.523] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.524] GetLastError () returned 0x1e7 [0283.524] SetLastError (dwErrCode=0x1e7) [0283.524] GetLastError () returned 0x1e7 [0283.524] SetLastError (dwErrCode=0x1e7) [0283.525] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.525] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.525] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e3063c8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e306000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.528] GetCurrentProcess () returned 0xffffffffffffffff [0283.528] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e3063c8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e306000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.528] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e3063f8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e306000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.528] GetCurrentProcess () returned 0xffffffffffffffff [0283.528] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e3063f8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e306000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.528] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.529] GetLastError () returned 0x1e7 [0283.529] SetLastError (dwErrCode=0x1e7) [0283.529] GetLastError () returned 0x1e7 [0283.529] SetLastError (dwErrCode=0x1e7) [0283.530] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.530] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.530] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33310, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.531] GetCurrentProcess () returned 0xffffffffffffffff [0283.531] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33310, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.531] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33328, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.531] GetCurrentProcess () returned 0xffffffffffffffff [0283.532] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33328, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.532] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33338, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.532] GetCurrentProcess () returned 0xffffffffffffffff [0283.532] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33338, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.532] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33340, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.533] GetCurrentProcess () returned 0xffffffffffffffff [0283.533] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33340, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.533] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b333a0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.533] GetCurrentProcess () returned 0xffffffffffffffff [0283.533] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b333a0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.534] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b333b8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.534] GetCurrentProcess () returned 0xffffffffffffffff [0283.534] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b333b8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.534] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b333c0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.535] GetCurrentProcess () returned 0xffffffffffffffff [0283.535] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b333c0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.535] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b333c8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.535] GetCurrentProcess () returned 0xffffffffffffffff [0283.535] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b333c8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.535] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33438, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.536] GetCurrentProcess () returned 0xffffffffffffffff [0283.536] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33438, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.536] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33528, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.536] GetCurrentProcess () returned 0xffffffffffffffff [0283.536] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33528, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.536] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33530, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.537] GetCurrentProcess () returned 0xffffffffffffffff [0283.537] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33530, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.537] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33538, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.537] GetCurrentProcess () returned 0xffffffffffffffff [0283.537] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33538, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.537] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33540, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.538] GetCurrentProcess () returned 0xffffffffffffffff [0283.538] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33540, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.538] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33548, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.538] GetCurrentProcess () returned 0xffffffffffffffff [0283.538] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33548, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.538] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33550, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.539] GetCurrentProcess () returned 0xffffffffffffffff [0283.539] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33550, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.539] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33660, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.539] GetCurrentProcess () returned 0xffffffffffffffff [0283.539] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33660, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.539] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33678, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.540] GetCurrentProcess () returned 0xffffffffffffffff [0283.540] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd40b33678, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd40b33000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.540] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.545] GetLastError () returned 0x1e7 [0283.545] SetLastError (dwErrCode=0x1e7) [0283.545] GetLastError () returned 0x1e7 [0283.546] SetLastError (dwErrCode=0x1e7) [0283.546] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.546] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.546] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e962028, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e962000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.547] GetCurrentProcess () returned 0xffffffffffffffff [0283.547] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e962028, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e962000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.547] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e962030, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e962000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.548] GetCurrentProcess () returned 0xffffffffffffffff [0283.548] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4e962030, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4e962000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.548] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.549] GetLastError () returned 0x1e7 [0283.549] SetLastError (dwErrCode=0x1e7) [0283.549] GetLastError () returned 0x1e7 [0283.549] SetLastError (dwErrCode=0x1e7) [0283.549] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.550] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.550] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4b4c78d0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4b4c7000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.550] GetCurrentProcess () returned 0xffffffffffffffff [0283.550] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4b4c78d0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4b4c7000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.551] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4b4c7900, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4b4c7000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.551] GetCurrentProcess () returned 0xffffffffffffffff [0283.551] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4b4c7900, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4b4c7000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.551] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.552] GetLastError () returned 0x1e7 [0283.552] SetLastError (dwErrCode=0x1e7) [0283.552] GetLastError () returned 0x1e7 [0283.552] SetLastError (dwErrCode=0x1e7) [0283.553] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.553] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.553] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd45f82050, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd45f82000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.553] GetCurrentProcess () returned 0xffffffffffffffff [0283.553] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd45f82050, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd45f82000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.553] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd45f82058, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd45f82000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.554] GetCurrentProcess () returned 0xffffffffffffffff [0283.554] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd45f82058, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd45f82000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.554] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.555] GetLastError () returned 0x1e7 [0283.555] SetLastError (dwErrCode=0x1e7) [0283.555] GetLastError () returned 0x1e7 [0283.555] SetLastError (dwErrCode=0x1e7) [0283.555] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.555] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.555] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd31cc2078, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd31cc2000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.555] GetCurrentProcess () returned 0xffffffffffffffff [0283.555] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd31cc2078, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd31cc2000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.556] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd31cc2080, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd31cc2000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.556] GetCurrentProcess () returned 0xffffffffffffffff [0283.556] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd31cc2080, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd31cc2000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.571] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 1 [0283.583] GetLastError () returned 0x1e7 [0283.583] SetLastError (dwErrCode=0x1e7) [0283.583] GetLastError () returned 0x1e7 [0283.583] SetLastError (dwErrCode=0x1e7) [0283.583] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x7ffd4e1c0000 [0283.583] GetModuleHandleA (lpModuleName="ntdll.dll") returned 0x7ffd504d0000 [0283.584] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4c78e1d8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4c78e000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.584] GetCurrentProcess () returned 0xffffffffffffffff [0283.584] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4c78e1d8, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4c78e000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.584] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4c78e1f0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x4, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4c78e000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x2) returned 0x0 [0283.584] GetCurrentProcess () returned 0xffffffffffffffff [0283.584] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x5ff978*=0x7ffd4c78e1f0, NumberOfBytesToProtect=0x5ff970, NewAccessProtection=0x2, OldAccessProtection=0x5ffa50 | out: BaseAddress=0x5ff978*=0x7ffd4c78e000, NumberOfBytesToProtect=0x5ff970, OldAccessProtection=0x5ffa50*=0x4) returned 0x0 [0283.585] Module32Next (hSnapshot=0x1f0, lpme=0x5ffb08) returned 0 [0283.586] CloseHandle (hObject=0x1f0) returned 1 [0283.586] GetLastError () returned 0x12 [0283.586] SetLastError (dwErrCode=0x12) [0283.586] GetLastError () returned 0x12 [0283.586] SetLastError (dwErrCode=0x12) [0283.586] GetLastError () returned 0x12 [0283.587] SetLastError (dwErrCode=0x12) [0283.587] GetLastError () returned 0x12 [0283.587] SetLastError (dwErrCode=0x12) [0283.587] GetLastError () returned 0x12 [0283.587] SetLastError (dwErrCode=0x12) [0283.601] GetLastError () returned 0x12 [0283.601] SetLastError (dwErrCode=0x12) [0283.601] GetLastError () returned 0x12 [0283.601] SetLastError (dwErrCode=0x12) [0283.608] GetLastError () returned 0x12 [0283.608] SetLastError (dwErrCode=0x12) [0283.608] GetLastError () returned 0x12 [0283.608] SetLastError (dwErrCode=0x12) [0283.608] GetProcessHeap () returned 0x710000 [0283.608] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x500000) returned 0x2de7040 [0284.358] GetProcessHeap () returned 0x710000 [0284.358] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x2de7040 | out: hHeap=0x710000) returned 1 [0284.396] GetLastError () returned 0x12 [0284.396] SetLastError (dwErrCode=0x12) [0284.396] GetLastError () returned 0x12 [0284.396] SetLastError (dwErrCode=0x12) [0284.397] GetLastError () returned 0x12 [0284.397] SetLastError (dwErrCode=0x12) [0284.397] GetLastError () returned 0x12 [0284.397] SetLastError (dwErrCode=0x12) [0284.397] GetLastError () returned 0x12 [0284.397] SetLastError (dwErrCode=0x12) [0284.397] GetLastError () returned 0x12 [0284.397] GetLastError () returned 0x12 [0284.397] SetLastError (dwErrCode=0x12) [0284.397] SetLastError (dwErrCode=0x12) [0284.397] GetLastError () returned 0x12 [0284.397] SetLastError (dwErrCode=0x12) [0284.397] GetLastError () returned 0x12 [0284.397] SetLastError (dwErrCode=0x12) [0284.398] GetLastError () returned 0x12 [0284.398] SetLastError (dwErrCode=0x12) [0284.398] GetLastError () returned 0x12 [0284.398] SetLastError (dwErrCode=0x12) [0284.398] GetLastError () returned 0x12 [0284.398] SetLastError (dwErrCode=0x12) [0284.398] GetLastError () returned 0x12 [0284.398] SetLastError (dwErrCode=0x12) [0284.398] GetLastError () returned 0x12 [0284.398] SetLastError (dwErrCode=0x12) [0284.398] GetLastError () returned 0x12 [0284.398] SetLastError (dwErrCode=0x12) [0284.398] GetLastError () returned 0x12 [0284.398] GetLastError () returned 0x12 [0284.398] SetLastError (dwErrCode=0x12) [0284.398] SetLastError (dwErrCode=0x12) [0284.398] GetLastError () returned 0x12 [0284.399] SetLastError (dwErrCode=0x12) [0284.399] GetLastError () returned 0x12 [0284.399] SetLastError (dwErrCode=0x12) [0284.399] GetLastError () returned 0x12 [0284.399] SetLastError (dwErrCode=0x12) [0284.399] GetLastError () returned 0x12 [0284.399] SetLastError (dwErrCode=0x12) [0284.399] GetLastError () returned 0x12 [0284.399] SetLastError (dwErrCode=0x12) [0284.399] GetLastError () returned 0x12 [0284.399] SetLastError (dwErrCode=0x12) [0284.399] GetLastError () returned 0x12 [0284.399] SetLastError (dwErrCode=0x12) [0284.399] GetLastError () returned 0x12 [0284.400] SetLastError (dwErrCode=0x12) [0284.400] GetLastError () returned 0x12 [0284.400] SetLastError (dwErrCode=0x12) [0284.400] GetLastError () returned 0x12 [0284.400] SetLastError (dwErrCode=0x12) [0284.400] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0284.400] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=10, lpWideCharStr=0x6c2b48, cchWideChar=10 | out: lpWideCharStr="USER32.dll") returned 10 [0284.400] GetLastError () returned 0x0 [0284.400] SetLastError (dwErrCode=0x0) [0284.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="USER32.dll", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0284.400] GetLastError () returned 0x0 [0284.400] SetLastError (dwErrCode=0x0) [0284.400] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="USER32.dll", cchWideChar=10, lpMultiByteStr=0x8e57f8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="USER32.dll", lpUsedDefaultChar=0x0) returned 10 [0284.400] GetLastError () returned 0x0 [0284.400] SetLastError (dwErrCode=0x0) [0284.400] GetLastError () returned 0x0 [0284.401] SetLastError (dwErrCode=0x0) [0284.401] GetLastError () returned 0x0 [0284.401] SetLastError (dwErrCode=0x0) [0284.401] GetLastError () returned 0x0 [0284.401] SetLastError (dwErrCode=0x0) [0284.401] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="EnumDisplayDevicesA" | out: DestinationString="EnumDisplayDevicesA") [0284.401] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e9d0000, Name="EnumDisplayDevicesA", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e9f2800) returned 0x0 [0284.401] GetLastError () returned 0x0 [0284.401] SetLastError (dwErrCode=0x0) [0284.401] GetLastError () returned 0x0 [0284.401] SetLastError (dwErrCode=0x0) [0284.401] GetLastError () returned 0x0 [0284.401] SetLastError (dwErrCode=0x0) [0284.401] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0284.402] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=12, lpWideCharStr=0x903cc8, cchWideChar=12 | out: lpWideCharStr="ADVAPI32.dll") returned 12 [0284.402] GetLastError () returned 0x0 [0284.402] SetLastError (dwErrCode=0x0) [0284.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADVAPI32.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0284.402] GetLastError () returned 0x0 [0284.402] SetLastError (dwErrCode=0x0) [0284.402] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ADVAPI32.dll", cchWideChar=12, lpMultiByteStr=0x8e57f8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ADVAPI32.dll", lpUsedDefaultChar=0x0) returned 12 [0284.402] GetLastError () returned 0x0 [0284.402] SetLastError (dwErrCode=0x0) [0284.402] GetLastError () returned 0x0 [0284.405] SetLastError (dwErrCode=0x0) [0284.405] GetLastError () returned 0x0 [0284.405] SetLastError (dwErrCode=0x0) [0284.405] GetLastError () returned 0x0 [0284.405] SetLastError (dwErrCode=0x0) [0284.405] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="RegCreateKeyExA" | out: DestinationString="RegCreateKeyExA") [0284.405] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegCreateKeyExA", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e498000) returned 0x0 [0284.406] GetLastError () returned 0x0 [0284.406] SetLastError (dwErrCode=0x0) [0284.406] GetLastError () returned 0x0 [0284.406] SetLastError (dwErrCode=0x0) [0284.406] GetLastError () returned 0x0 [0284.406] SetLastError (dwErrCode=0x0) [0284.406] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="RegSetValueExA" | out: DestinationString="RegSetValueExA") [0284.406] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegSetValueExA", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e482520) returned 0x0 [0284.406] GetLastError () returned 0x0 [0284.406] SetLastError (dwErrCode=0x0) [0284.406] GetLastError () returned 0x0 [0284.406] SetLastError (dwErrCode=0x0) [0284.406] GetLastError () returned 0x0 [0284.406] SetLastError (dwErrCode=0x0) [0284.406] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="OpenProcessToken" | out: DestinationString="OpenProcessToken") [0284.407] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="OpenProcessToken", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e497180) returned 0x0 [0284.407] GetLastError () returned 0x0 [0284.407] SetLastError (dwErrCode=0x0) [0284.407] GetLastError () returned 0x0 [0284.407] SetLastError (dwErrCode=0x0) [0284.407] GetLastError () returned 0x0 [0284.407] SetLastError (dwErrCode=0x0) [0284.407] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="GetTokenInformation" | out: DestinationString="GetTokenInformation") [0284.407] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="GetTokenInformation", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e496610) returned 0x0 [0284.407] GetLastError () returned 0x0 [0284.407] SetLastError (dwErrCode=0x0) [0284.407] GetLastError () returned 0x0 [0284.407] SetLastError (dwErrCode=0x0) [0284.407] GetLastError () returned 0x0 [0284.407] SetLastError (dwErrCode=0x0) [0284.407] GetLastError () returned 0x0 [0284.407] SetLastError (dwErrCode=0x0) [0284.407] GetLastError () returned 0x0 [0284.407] SetLastError (dwErrCode=0x0) [0284.407] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="InitializeSecurityDescriptor" | out: DestinationString="InitializeSecurityDescriptor") [0284.408] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="InitializeSecurityDescriptor", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e497de0) returned 0x0 [0284.408] GetLastError () returned 0x0 [0284.408] SetLastError (dwErrCode=0x0) [0284.408] GetLastError () returned 0x0 [0284.408] SetLastError (dwErrCode=0x0) [0284.408] GetLastError () returned 0x0 [0284.408] SetLastError (dwErrCode=0x0) [0284.408] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="SetSecurityDescriptorDacl" | out: DestinationString="SetSecurityDescriptorDacl") [0284.408] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="SetSecurityDescriptorDacl", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e497dd0) returned 0x0 [0284.408] GetLastError () returned 0x0 [0284.408] SetLastError (dwErrCode=0x0) [0284.408] GetLastError () returned 0x0 [0284.408] SetLastError (dwErrCode=0x0) [0284.408] GetLastError () returned 0x0 [0284.408] SetLastError (dwErrCode=0x0) [0284.408] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="RegCloseKey" | out: DestinationString="RegCloseKey") [0284.409] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegCloseKey", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e496620) returned 0x0 [0284.409] GetLastError () returned 0x0 [0284.409] SetLastError (dwErrCode=0x0) [0284.409] GetLastError () returned 0x0 [0284.409] SetLastError (dwErrCode=0x0) [0284.409] GetLastError () returned 0x0 [0284.409] SetLastError (dwErrCode=0x0) [0284.409] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="RegOpenKeyExA" | out: DestinationString="RegOpenKeyExA") [0284.409] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegOpenKeyExA", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e497200) returned 0x0 [0284.409] GetLastError () returned 0x0 [0284.409] SetLastError (dwErrCode=0x0) [0284.409] GetLastError () returned 0x0 [0284.409] SetLastError (dwErrCode=0x0) [0284.409] GetLastError () returned 0x0 [0284.409] SetLastError (dwErrCode=0x0) [0284.409] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="RegDeleteKeyA" | out: DestinationString="RegDeleteKeyA") [0284.409] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegDeleteKeyA", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e482480) returned 0x0 [0284.409] GetLastError () returned 0x0 [0284.410] SetLastError (dwErrCode=0x0) [0284.410] GetLastError () returned 0x0 [0284.410] SetLastError (dwErrCode=0x0) [0284.410] GetLastError () returned 0x0 [0284.410] SetLastError (dwErrCode=0x0) [0284.410] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="RegDeleteValueA" | out: DestinationString="RegDeleteValueA") [0284.410] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegDeleteValueA", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e482800) returned 0x0 [0284.410] GetLastError () returned 0x0 [0284.410] SetLastError (dwErrCode=0x0) [0284.410] GetLastError () returned 0x0 [0284.410] SetLastError (dwErrCode=0x0) [0284.410] GetLastError () returned 0x0 [0284.410] SetLastError (dwErrCode=0x0) [0284.410] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="RegQueryValueExA" | out: DestinationString="RegQueryValueExA") [0284.410] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e480000, Name="RegQueryValueExA", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e4972d0) returned 0x0 [0284.410] GetLastError () returned 0x0 [0284.410] SetLastError (dwErrCode=0x0) [0284.410] GetLastError () returned 0x0 [0284.411] SetLastError (dwErrCode=0x0) [0284.411] GetLastError () returned 0x0 [0284.411] SetLastError (dwErrCode=0x0) [0284.411] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0284.411] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x8e57f8, cbMultiByte=12, lpWideCharStr=0x903cc8, cchWideChar=12 | out: lpWideCharStr="KERNEL32.dll") returned 12 [0284.411] GetLastError () returned 0x0 [0284.411] SetLastError (dwErrCode=0x0) [0284.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KERNEL32.dll", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0284.411] GetLastError () returned 0x0 [0284.411] SetLastError (dwErrCode=0x0) [0284.411] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="KERNEL32.dll", cchWideChar=12, lpMultiByteStr=0x8e57f8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KERNEL32.dll", lpUsedDefaultChar=0x0) returned 12 [0284.411] GetLastError () returned 0x0 [0284.411] SetLastError (dwErrCode=0x0) [0284.411] GetLastError () returned 0x0 [0284.411] SetLastError (dwErrCode=0x0) [0284.411] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="RtlUnwind" | out: DestinationString="RtlUnwind") [0284.411] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RtlUnwind", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e206850) returned 0x0 [0284.412] GetLastError () returned 0x0 [0284.412] SetLastError (dwErrCode=0x0) [0284.412] GetLastError () returned 0x0 [0284.412] SetLastError (dwErrCode=0x0) [0284.412] GetLastError () returned 0x0 [0284.412] SetLastError (dwErrCode=0x0) [0284.412] GetLastError () returned 0x0 [0284.412] SetLastError (dwErrCode=0x0) [0284.412] GetLastError () returned 0x0 [0284.412] SetLastError (dwErrCode=0x0) [0284.412] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="SetEndOfFile" | out: DestinationString="SetEndOfFile") [0284.412] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetEndOfFile", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1edc20) returned 0x0 [0284.412] GetLastError () returned 0x0 [0284.412] SetLastError (dwErrCode=0x0) [0284.412] GetLastError () returned 0x0 [0284.412] SetLastError (dwErrCode=0x0) [0284.412] GetLastError () returned 0x0 [0284.412] SetLastError (dwErrCode=0x0) [0284.413] GetLastError () returned 0x0 [0284.413] SetLastError (dwErrCode=0x0) [0284.413] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="SetLastError" | out: DestinationString="SetLastError") [0284.413] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetLastError", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1db730) returned 0x0 [0284.413] GetLastError () returned 0x0 [0284.413] SetLastError (dwErrCode=0x0) [0284.413] GetLastError () returned 0x0 [0284.413] SetLastError (dwErrCode=0x0) [0284.413] GetLastError () returned 0x0 [0284.413] SetLastError (dwErrCode=0x0) [0284.413] GetLastError () returned 0x0 [0284.413] SetLastError (dwErrCode=0x0) [0284.413] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="WaitForSingleObject" | out: DestinationString="WaitForSingleObject") [0284.413] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="WaitForSingleObject", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ed840) returned 0x0 [0284.413] GetLastError () returned 0x0 [0284.413] SetLastError (dwErrCode=0x0) [0284.413] GetLastError () returned 0x0 [0284.413] SetLastError (dwErrCode=0x0) [0284.413] GetLastError () returned 0x0 [0284.414] SetLastError (dwErrCode=0x0) [0284.414] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="ResumeThread" | out: DestinationString="ResumeThread") [0284.414] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="ResumeThread", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e4e70) returned 0x0 [0284.414] GetLastError () returned 0x0 [0284.414] SetLastError (dwErrCode=0x0) [0284.414] GetLastError () returned 0x0 [0284.414] SetLastError (dwErrCode=0x0) [0284.414] GetLastError () returned 0x0 [0284.414] SetLastError (dwErrCode=0x0) [0284.414] GetLastError () returned 0x0 [0284.414] SetLastError (dwErrCode=0x0) [0284.414] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="CreateProcessA" | out: DestinationString="CreateProcessA") [0284.415] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="CreateProcessA", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e3600) returned 0x0 [0284.415] GetLastError () returned 0x0 [0284.415] SetLastError (dwErrCode=0x0) [0284.415] GetLastError () returned 0x0 [0284.415] SetLastError (dwErrCode=0x0) [0284.415] GetLastError () returned 0x0 [0284.415] SetLastError (dwErrCode=0x0) [0284.415] GetLastError () returned 0x0 [0284.415] SetLastError (dwErrCode=0x0) [0284.415] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="SetPriorityClass" | out: DestinationString="SetPriorityClass") [0284.415] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetPriorityClass", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e8b20) returned 0x0 [0284.415] GetLastError () returned 0x0 [0284.415] SetLastError (dwErrCode=0x0) [0284.415] GetLastError () returned 0x0 [0284.415] SetLastError (dwErrCode=0x0) [0284.416] GetLastError () returned 0x0 [0284.416] SetLastError (dwErrCode=0x0) [0284.416] GetLastError () returned 0x0 [0284.416] SetLastError (dwErrCode=0x0) [0284.416] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="GetThreadContext" | out: DestinationString="GetThreadContext") [0284.416] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetThreadContext", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e6780) returned 0x0 [0284.416] GetLastError () returned 0x0 [0284.416] SetLastError (dwErrCode=0x0) [0284.416] GetLastError () returned 0x0 [0284.416] SetLastError (dwErrCode=0x0) [0284.416] GetLastError () returned 0x0 [0284.416] SetLastError (dwErrCode=0x0) [0284.416] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="SetThreadContext" | out: DestinationString="SetThreadContext") [0284.416] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetThreadContext", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ec890) returned 0x0 [0284.416] GetLastError () returned 0x0 [0284.416] SetLastError (dwErrCode=0x0) [0284.416] GetLastError () returned 0x0 [0284.417] SetLastError (dwErrCode=0x0) [0284.417] GetLastError () returned 0x0 [0284.417] SetLastError (dwErrCode=0x0) [0284.417] GetLastError () returned 0x0 [0284.417] SetLastError (dwErrCode=0x0) [0284.417] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="VirtualAlloc" | out: DestinationString="VirtualAlloc") [0284.417] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="VirtualAlloc", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e28c0) returned 0x0 [0284.417] GetLastError () returned 0x0 [0284.417] SetLastError (dwErrCode=0x0) [0284.417] GetLastError () returned 0x0 [0284.417] SetLastError (dwErrCode=0x0) [0284.417] GetLastError () returned 0x0 [0284.417] SetLastError (dwErrCode=0x0) [0284.417] GetLastError () returned 0x0 [0284.417] SetLastError (dwErrCode=0x0) [0284.417] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="VirtualAllocEx" | out: DestinationString="VirtualAllocEx") [0284.417] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="VirtualAllocEx", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ea400) returned 0x0 [0284.417] GetLastError () returned 0x0 [0284.417] SetLastError (dwErrCode=0x0) [0284.418] GetLastError () returned 0x0 [0284.418] SetLastError (dwErrCode=0x0) [0284.418] GetLastError () returned 0x0 [0284.418] SetLastError (dwErrCode=0x0) [0284.418] GetLastError () returned 0x0 [0284.418] SetLastError (dwErrCode=0x0) [0284.418] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="WriteProcessMemory" | out: DestinationString="WriteProcessMemory") [0284.418] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="WriteProcessMemory", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ea3f0) returned 0x0 [0284.422] GetLastError () returned 0x0 [0284.422] SetLastError (dwErrCode=0x0) [0284.422] GetLastError () returned 0x0 [0284.422] SetLastError (dwErrCode=0x0) [0284.422] GetLastError () returned 0x0 [0284.422] SetLastError (dwErrCode=0x0) [0284.422] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="WinExec" | out: DestinationString="WinExec") [0284.422] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="WinExec", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e205290) returned 0x0 [0284.422] GetLastError () returned 0x0 [0284.422] SetLastError (dwErrCode=0x0) [0284.422] GetLastError () returned 0x0 [0284.422] SetLastError (dwErrCode=0x0) [0284.422] GetLastError () returned 0x0 [0284.422] SetLastError (dwErrCode=0x0) [0284.422] GetLastError () returned 0x0 [0284.422] SetLastError (dwErrCode=0x0) [0284.422] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="lstrlenA" | out: DestinationString="lstrlenA") [0284.423] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="lstrlenA", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e0c60) returned 0x0 [0284.423] GetLastError () returned 0x0 [0284.423] SetLastError (dwErrCode=0x0) [0284.423] GetLastError () returned 0x0 [0284.423] SetLastError (dwErrCode=0x0) [0284.423] GetLastError () returned 0x0 [0284.423] SetLastError (dwErrCode=0x0) [0284.423] GetLastError () returned 0x0 [0284.423] SetLastError (dwErrCode=0x0) [0284.423] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="FreeConsole" | out: DestinationString="FreeConsole") [0284.423] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FreeConsole", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ee0c0) returned 0x0 [0284.423] GetLastError () returned 0x0 [0284.423] SetLastError (dwErrCode=0x0) [0284.423] GetLastError () returned 0x0 [0284.423] SetLastError (dwErrCode=0x0) [0284.423] GetLastError () returned 0x0 [0284.423] SetLastError (dwErrCode=0x0) [0284.423] GetLastError () returned 0x0 [0284.424] SetLastError (dwErrCode=0x0) [0284.424] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="EnterCriticalSection" | out: DestinationString="EnterCriticalSection") [0284.424] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="EnterCriticalSection", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd504fe600) returned 0x0 [0284.424] GetLastError () returned 0x0 [0284.424] SetLastError (dwErrCode=0x0) [0284.424] GetLastError () returned 0x0 [0284.424] SetLastError (dwErrCode=0x0) [0284.424] GetLastError () returned 0x0 [0284.424] SetLastError (dwErrCode=0x0) [0284.424] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="LeaveCriticalSection" | out: DestinationString="LeaveCriticalSection") [0284.424] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="LeaveCriticalSection", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd504feb00) returned 0x0 [0284.425] GetLastError () returned 0x0 [0284.425] SetLastError (dwErrCode=0x0) [0284.425] GetLastError () returned 0x0 [0284.425] SetLastError (dwErrCode=0x0) [0284.425] GetLastError () returned 0x0 [0284.425] SetLastError (dwErrCode=0x0) [0284.425] GetLastError () returned 0x0 [0284.425] SetLastError (dwErrCode=0x0) [0284.425] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="InitializeCriticalSectionEx" | out: DestinationString="InitializeCriticalSectionEx") [0284.425] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="InitializeCriticalSectionEx", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ed760) returned 0x0 [0284.425] GetLastError () returned 0x0 [0284.425] SetLastError (dwErrCode=0x0) [0284.425] GetLastError () returned 0x0 [0284.425] SetLastError (dwErrCode=0x0) [0284.425] GetLastError () returned 0x0 [0284.425] SetLastError (dwErrCode=0x0) [0284.425] GetLastError () returned 0x0 [0284.425] SetLastError (dwErrCode=0x0) [0284.425] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="DeleteCriticalSection" | out: DestinationString="DeleteCriticalSection") [0284.426] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="DeleteCriticalSection", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd505299d0) returned 0x0 [0284.426] GetLastError () returned 0x0 [0284.426] SetLastError (dwErrCode=0x0) [0284.426] GetLastError () returned 0x0 [0284.426] SetLastError (dwErrCode=0x0) [0284.426] GetLastError () returned 0x0 [0284.426] SetLastError (dwErrCode=0x0) [0284.426] GetLastError () returned 0x0 [0284.426] SetLastError (dwErrCode=0x0) [0284.426] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="EncodePointer" | out: DestinationString="EncodePointer") [0284.426] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="EncodePointer", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd50542780) returned 0x0 [0284.426] GetLastError () returned 0x0 [0284.426] SetLastError (dwErrCode=0x0) [0284.427] GetLastError () returned 0x0 [0284.427] SetLastError (dwErrCode=0x0) [0284.427] GetLastError () returned 0x0 [0284.427] SetLastError (dwErrCode=0x0) [0284.427] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="DecodePointer" | out: DestinationString="DecodePointer") [0284.427] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="DecodePointer", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd5052c630) returned 0x0 [0284.427] GetLastError () returned 0x0 [0284.427] SetLastError (dwErrCode=0x0) [0284.427] GetLastError () returned 0x0 [0284.427] SetLastError (dwErrCode=0x0) [0284.427] GetLastError () returned 0x0 [0284.427] SetLastError (dwErrCode=0x0) [0284.427] GetLastError () returned 0x0 [0284.427] SetLastError (dwErrCode=0x0) [0284.427] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="MultiByteToWideChar" | out: DestinationString="MultiByteToWideChar") [0284.427] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="MultiByteToWideChar", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1dd500) returned 0x0 [0284.427] GetLastError () returned 0x0 [0284.428] SetLastError (dwErrCode=0x0) [0284.428] GetLastError () returned 0x0 [0284.428] SetLastError (dwErrCode=0x0) [0284.428] GetLastError () returned 0x0 [0284.428] SetLastError (dwErrCode=0x0) [0284.428] GetLastError () returned 0x0 [0284.428] SetLastError (dwErrCode=0x0) [0284.428] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="WideCharToMultiByte" | out: DestinationString="WideCharToMultiByte") [0284.428] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="WideCharToMultiByte", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1db490) returned 0x0 [0284.428] GetLastError () returned 0x0 [0284.428] SetLastError (dwErrCode=0x0) [0284.428] GetLastError () returned 0x0 [0284.428] SetLastError (dwErrCode=0x0) [0284.428] GetLastError () returned 0x0 [0284.428] SetLastError (dwErrCode=0x0) [0284.428] GetLastError () returned 0x0 [0284.428] SetLastError (dwErrCode=0x0) [0284.428] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="LCMapStringEx" | out: DestinationString="LCMapStringEx") [0284.428] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="LCMapStringEx", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1dd560) returned 0x0 [0284.428] GetLastError () returned 0x0 [0284.429] SetLastError (dwErrCode=0x0) [0284.429] GetLastError () returned 0x0 [0284.429] SetLastError (dwErrCode=0x0) [0284.429] GetLastError () returned 0x0 [0284.429] SetLastError (dwErrCode=0x0) [0284.429] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="GetStringTypeW" | out: DestinationString="GetStringTypeW") [0284.429] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetStringTypeW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e4bf0) returned 0x0 [0284.429] GetLastError () returned 0x0 [0284.429] SetLastError (dwErrCode=0x0) [0284.429] GetLastError () returned 0x0 [0284.429] SetLastError (dwErrCode=0x0) [0284.429] GetLastError () returned 0x0 [0284.429] SetLastError (dwErrCode=0x0) [0284.429] GetLastError () returned 0x0 [0284.429] SetLastError (dwErrCode=0x0) [0284.429] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="GetCPInfo" | out: DestinationString="GetCPInfo") [0284.429] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetCPInfo", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e31e0) returned 0x0 [0284.429] GetLastError () returned 0x0 [0284.429] SetLastError (dwErrCode=0x0) [0284.430] GetLastError () returned 0x0 [0284.430] SetLastError (dwErrCode=0x0) [0284.430] GetLastError () returned 0x0 [0284.430] SetLastError (dwErrCode=0x0) [0284.430] GetLastError () returned 0x0 [0284.430] SetLastError (dwErrCode=0x0) [0284.430] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="RtlCaptureContext" | out: DestinationString="RtlCaptureContext") [0284.430] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RtlCaptureContext", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ed410) returned 0x0 [0284.430] GetLastError () returned 0x0 [0284.430] SetLastError (dwErrCode=0x0) [0284.430] GetLastError () returned 0x0 [0284.430] SetLastError (dwErrCode=0x0) [0284.430] GetLastError () returned 0x0 [0284.430] SetLastError (dwErrCode=0x0) [0284.430] GetLastError () returned 0x0 [0284.430] SetLastError (dwErrCode=0x0) [0284.430] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="RtlLookupFunctionEntry" | out: DestinationString="RtlLookupFunctionEntry") [0284.430] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RtlLookupFunctionEntry", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e6e60) returned 0x0 [0284.431] GetLastError () returned 0x0 [0284.431] SetLastError (dwErrCode=0x0) [0284.431] GetLastError () returned 0x0 [0284.431] SetLastError (dwErrCode=0x0) [0284.431] GetLastError () returned 0x0 [0284.431] SetLastError (dwErrCode=0x0) [0284.431] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="RtlVirtualUnwind" | out: DestinationString="RtlVirtualUnwind") [0284.431] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RtlVirtualUnwind", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ea410) returned 0x0 [0284.431] GetLastError () returned 0x0 [0284.431] SetLastError (dwErrCode=0x0) [0284.431] GetLastError () returned 0x0 [0284.431] SetLastError (dwErrCode=0x0) [0284.431] GetLastError () returned 0x0 [0284.431] SetLastError (dwErrCode=0x0) [0284.431] GetLastError () returned 0x0 [0284.431] SetLastError (dwErrCode=0x0) [0284.431] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="UnhandledExceptionFilter" | out: DestinationString="UnhandledExceptionFilter") [0284.431] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="UnhandledExceptionFilter", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e206a20) returned 0x0 [0284.431] GetLastError () returned 0x0 [0284.432] SetLastError (dwErrCode=0x0) [0284.432] GetLastError () returned 0x0 [0284.432] SetLastError (dwErrCode=0x0) [0284.432] GetLastError () returned 0x0 [0284.432] SetLastError (dwErrCode=0x0) [0284.432] GetLastError () returned 0x0 [0284.432] SetLastError (dwErrCode=0x0) [0284.432] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="SetUnhandledExceptionFilter" | out: DestinationString="SetUnhandledExceptionFilter") [0284.432] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetUnhandledExceptionFilter", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e6ea0) returned 0x0 [0284.432] GetLastError () returned 0x0 [0284.432] SetLastError (dwErrCode=0x0) [0284.432] GetLastError () returned 0x0 [0284.432] SetLastError (dwErrCode=0x0) [0284.432] GetLastError () returned 0x0 [0284.432] SetLastError (dwErrCode=0x0) [0284.432] GetLastError () returned 0x0 [0284.432] SetLastError (dwErrCode=0x0) [0284.432] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="TerminateProcess" | out: DestinationString="TerminateProcess") [0284.432] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="TerminateProcess", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e8cf0) returned 0x0 [0284.433] GetLastError () returned 0x0 [0284.433] SetLastError (dwErrCode=0x0) [0284.433] GetLastError () returned 0x0 [0284.433] SetLastError (dwErrCode=0x0) [0284.433] GetLastError () returned 0x0 [0284.433] SetLastError (dwErrCode=0x0) [0284.433] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="IsProcessorFeaturePresent" | out: DestinationString="IsProcessorFeaturePresent") [0284.433] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="IsProcessorFeaturePresent", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e3d30) returned 0x0 [0284.433] GetLastError () returned 0x0 [0284.433] SetLastError (dwErrCode=0x0) [0284.433] GetLastError () returned 0x0 [0284.433] SetLastError (dwErrCode=0x0) [0284.433] GetLastError () returned 0x0 [0284.433] SetLastError (dwErrCode=0x0) [0284.433] GetLastError () returned 0x0 [0284.433] SetLastError (dwErrCode=0x0) [0284.433] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="IsDebuggerPresent" | out: DestinationString="IsDebuggerPresent") [0284.434] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="IsDebuggerPresent", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e7460) returned 0x0 [0284.434] GetLastError () returned 0x0 [0284.434] SetLastError (dwErrCode=0x0) [0284.434] GetLastError () returned 0x0 [0284.434] SetLastError (dwErrCode=0x0) [0284.434] GetLastError () returned 0x0 [0284.434] SetLastError (dwErrCode=0x0) [0284.434] GetLastError () returned 0x0 [0284.434] SetLastError (dwErrCode=0x0) [0284.434] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="GetStartupInfoW" | out: DestinationString="GetStartupInfoW") [0284.434] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetStartupInfoW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e4c00) returned 0x0 [0284.438] GetLastError () returned 0x0 [0284.438] SetLastError (dwErrCode=0x0) [0284.438] GetLastError () returned 0x0 [0284.438] SetLastError (dwErrCode=0x0) [0284.438] GetLastError () returned 0x0 [0284.438] SetLastError (dwErrCode=0x0) [0284.438] GetLastError () returned 0x0 [0284.438] SetLastError (dwErrCode=0x0) [0284.438] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="QueryPerformanceCounter" | out: DestinationString="QueryPerformanceCounter") [0284.438] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="QueryPerformanceCounter", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1db720) returned 0x0 [0284.438] GetLastError () returned 0x0 [0284.438] SetLastError (dwErrCode=0x0) [0284.439] GetLastError () returned 0x0 [0284.439] SetLastError (dwErrCode=0x0) [0284.439] GetLastError () returned 0x0 [0284.439] SetLastError (dwErrCode=0x0) [0284.439] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="GetCurrentThreadId" | out: DestinationString="GetCurrentThreadId") [0284.439] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetCurrentThreadId", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1db460) returned 0x0 [0284.439] GetLastError () returned 0x0 [0284.439] SetLastError (dwErrCode=0x0) [0284.439] GetLastError () returned 0x0 [0284.439] SetLastError (dwErrCode=0x0) [0284.439] GetLastError () returned 0x0 [0284.439] SetLastError (dwErrCode=0x0) [0284.439] GetLastError () returned 0x0 [0284.439] SetLastError (dwErrCode=0x0) [0284.439] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="GetSystemTimeAsFileTime" | out: DestinationString="GetSystemTimeAsFileTime") [0284.439] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetSystemTimeAsFileTime", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ddf70) returned 0x0 [0284.439] GetLastError () returned 0x0 [0284.439] SetLastError (dwErrCode=0x0) [0284.439] GetLastError () returned 0x0 [0284.439] SetLastError (dwErrCode=0x0) [0284.440] GetLastError () returned 0x0 [0284.440] SetLastError (dwErrCode=0x0) [0284.440] GetLastError () returned 0x0 [0284.440] SetLastError (dwErrCode=0x0) [0284.440] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="InitializeSListHead" | out: DestinationString="InitializeSListHead") [0284.440] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="InitializeSListHead", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd505421c0) returned 0x0 [0284.440] GetLastError () returned 0x0 [0284.440] SetLastError (dwErrCode=0x0) [0284.440] GetLastError () returned 0x0 [0284.440] SetLastError (dwErrCode=0x0) [0284.440] GetLastError () returned 0x0 [0284.440] SetLastError (dwErrCode=0x0) [0284.440] GetLastError () returned 0x0 [0284.440] SetLastError (dwErrCode=0x0) [0284.440] RtlInitAnsiString (in: DestinationString=0x5ffb88, SourceString="HeapSize" | out: DestinationString="HeapSize") [0284.440] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="HeapSize", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd504eb780) returned 0x0 [0284.440] GetLastError () returned 0x0 [0284.440] SetLastError (dwErrCode=0x0) [0284.441] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RtlPcToFileHeader", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e5170) returned 0x0 [0284.441] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RaiseException", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e4d70) returned 0x0 [0284.442] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="RtlUnwindEx", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e6ba0) returned 0x0 [0284.442] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetLastError", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1db710) returned 0x0 [0284.442] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="InitializeCriticalSectionAndSpinCount", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ed750) returned 0x0 [0284.442] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="TlsAlloc", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e3ad0) returned 0x0 [0284.442] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="TlsGetValue", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1db450) returned 0x0 [0284.443] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="TlsSetValue", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1db7d0) returned 0x0 [0284.443] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="TlsFree", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e3e40) returned 0x0 [0284.443] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="ExitProcess", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e4d80) returned 0x0 [0284.443] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetModuleHandleExW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e6b90) returned 0x0 [0284.444] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetModuleFileNameW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e4840) returned 0x0 [0284.444] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetStdHandle", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e3e80) returned 0x0 [0284.444] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="WriteFile", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1edcc0) returned 0x0 [0284.444] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="HeapFree", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1db480) returned 0x0 [0284.445] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="HeapAlloc", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd504f52d0) returned 0x0 [0284.445] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FlsAlloc", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e6cd0) returned 0x0 [0284.445] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FlsGetValue", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1dd6e0) returned 0x0 [0284.446] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FlsSetValue", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e3ae0) returned 0x0 [0284.446] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FlsFree", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e7660) returned 0x0 [0284.460] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="CompareStringW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e2ce0) returned 0x0 [0284.460] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="LCMapStringW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ddd00) returned 0x0 [0284.461] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetLocaleInfoW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e72a0) returned 0x0 [0284.461] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="IsValidLocale", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e3a80) returned 0x0 [0284.461] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetUserDefaultLCID", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e3a70) returned 0x0 [0284.461] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="EnumSystemLocalesW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e205d30) returned 0x0 [0284.462] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetFileType", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1edac0) returned 0x0 [0284.462] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FlushFileBuffers", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ed9d0) returned 0x0 [0284.462] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetConsoleOutputCP", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1edfb0) returned 0x0 [0284.462] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetConsoleMode", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1edfa0) returned 0x0 [0284.462] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetFileSizeEx", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1edaa0) returned 0x0 [0284.463] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetFilePointerEx", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1edc70) returned 0x0 [0284.463] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="ReadConsoleW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ee010) returned 0x0 [0284.463] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="HeapReAlloc", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd504f39f0) returned 0x0 [0284.463] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FindClose", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ed900) returned 0x0 [0284.463] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FindFirstFileExW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ed960) returned 0x0 [0284.464] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FindNextFileW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ed9c0) returned 0x0 [0284.464] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="IsValidCodePage", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e31d0) returned 0x0 [0284.464] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetACP", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1dd720) returned 0x0 [0284.464] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetOEMCP", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ec840) returned 0x0 [0284.465] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetEnvironmentStringsW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e6790) returned 0x0 [0284.465] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="FreeEnvironmentStringsW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e67a0) returned 0x0 [0284.465] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetEnvironmentVariableW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e7500) returned 0x0 [0284.465] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="GetProcessHeap", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1dd4f0) returned 0x0 [0284.465] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="SetStdHandle", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1e7190) returned 0x0 [0284.466] LdrGetProcedureAddress (in: BaseAddress=0x7ffd4e1c0000, Name="WriteConsoleW", Ordinal=0x0, ProcedureAddress=0x5ffb98 | out: ProcedureAddress=0x5ffb98*=0x7ffd4e1ee050) returned 0x0 [0284.466] VirtualProtect (in: lpAddress=0x7ff771f50000, dwSize=0x400, flNewProtect=0x4, lpflOldProtect=0x5ffd30 | out: lpflOldProtect=0x5ffd30*=0x2) returned 1 [0284.467] VirtualProtect (in: lpAddress=0x7ff771f50000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x5ffd28 | out: lpflOldProtect=0x5ffd28*=0x4) returned 1 [0284.467] GetLastError () returned 0x0 [0284.468] SetLastError (dwErrCode=0x0) [0284.468] GetLastError () returned 0x0 [0284.468] GetLastError () returned 0x0 [0284.468] SetLastError (dwErrCode=0x0) [0284.468] SetLastError (dwErrCode=0x0) [0284.468] GetLastError () returned 0x0 [0284.468] SetLastError (dwErrCode=0x0) [0284.468] VirtualProtect (in: lpAddress=0x7ff771f51000, dwSize=0x33b0c, flNewProtect=0x20, lpflOldProtect=0x5ffd40 | out: lpflOldProtect=0x5ffd40*=0x40) returned 1 [0284.469] VirtualProtect (in: lpAddress=0x7ff771f85000, dwSize=0x125ec, flNewProtect=0x2, lpflOldProtect=0x5ffd40 | out: lpflOldProtect=0x5ffd40*=0x40) returned 1 [0284.470] VirtualProtect (in: lpAddress=0x7ff771f98000, dwSize=0x825e9c, flNewProtect=0x4, lpflOldProtect=0x5ffd40 | out: lpflOldProtect=0x5ffd40*=0x40) returned 1 [0284.498] VirtualProtect (in: lpAddress=0x7ff7727be000, dwSize=0x2fdc, flNewProtect=0x2, lpflOldProtect=0x5ffd40 | out: lpflOldProtect=0x5ffd40*=0x80) returned 1 [0284.498] VirtualProtect (in: lpAddress=0x7ff7727c1000, dwSize=0xf4, flNewProtect=0x2, lpflOldProtect=0x5ffd40 | out: lpflOldProtect=0x5ffd40*=0x40) returned 1 [0284.499] VirtualProtect (in: lpAddress=0x7ff7727c2000, dwSize=0x96c, flNewProtect=0x2, lpflOldProtect=0x5ffd40 | out: lpflOldProtect=0x5ffd40*=0x40) returned 1 [0284.499] GetLastError () returned 0x0 [0284.499] SetLastError (dwErrCode=0x0) [0284.499] GetLastError () returned 0x0 [0284.499] SetLastError (dwErrCode=0x0) [0284.499] GetLastError () returned 0x0 [0284.499] SetLastError (dwErrCode=0x0) [0284.499] GetLastError () returned 0x0 [0284.499] SetLastError (dwErrCode=0x0) [0284.499] GetLastError () returned 0x0 [0284.499] GetLastError () returned 0x0 [0284.499] SetLastError (dwErrCode=0x0) [0284.499] SetLastError (dwErrCode=0x0) [0284.499] GetLastError () returned 0x0 [0284.499] SetLastError (dwErrCode=0x0) [0284.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x400000, lpStartAddress=0x7ff7727d7e30, lpParameter=0x8f3740, dwCreationFlags=0x10004, lpThreadId=0x5ffbb8 | out: lpThreadId=0x5ffbb8*=0x4f8) returned 0x1f0 [0284.500] GetLocalTime (in: lpSystemTime=0x5ffcb0 | out: lpSystemTime=0x5ffcb0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2b, wSecond=0xd, wMilliseconds=0x160)) [0284.500] ResumeThread (hThread=0x1f0) returned 0x1 [0284.501] SetTimer (hWnd=0x0, nIDEvent=0x1, uElapse=0xfb0, lpTimerFunc=0x7ff77281f060) returned 0x7f4a [0284.501] GetLastError () returned 0x0 [0284.501] SetLastError (dwErrCode=0x0) [0284.501] GetLastError () returned 0x0 [0284.501] SetLastError (dwErrCode=0x0) [0284.501] GetLastError () returned 0x0 [0284.501] SetLastError (dwErrCode=0x0) [0284.501] GetLastError () returned 0x0 [0284.501] SetLastError (dwErrCode=0x0) [0284.501] GetLastError () returned 0x0 [0284.501] SetLastError (dwErrCode=0x0) [0284.501] GetLastError () returned 0x0 [0284.502] GetLastError () returned 0x0 [0284.502] SetLastError (dwErrCode=0x0) [0284.502] SetLastError (dwErrCode=0x0) [0284.502] GetLastError () returned 0x0 [0284.502] SetLastError (dwErrCode=0x0) [0284.502] GetLastError () returned 0x0 [0284.502] SetLastError (dwErrCode=0x0) [0284.502] GetLastError () returned 0x0 [0284.502] SetLastError (dwErrCode=0x0) [0284.502] GetLastError () returned 0x0 [0284.502] SetLastError (dwErrCode=0x0) [0284.502] GetLastError () returned 0x0 [0284.502] SetLastError (dwErrCode=0x0) [0284.502] GetLastError () returned 0x0 [0284.502] SetLastError (dwErrCode=0x0) [0284.502] GetLastError () returned 0x0 [0284.503] SetLastError (dwErrCode=0x0) [0284.503] GetLastError () returned 0x0 [0284.503] SetLastError (dwErrCode=0x0) [0284.503] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ffdb8 | out: lpSystemTimeAsFileTime=0x5ffdb8*(dwLowDateTime=0x1da4e440, dwHighDateTime=0x1d7fc90)) [0284.503] GetCurrentThreadId () returned 0x63c [0284.503] QueryPerformanceCounter (in: lpPerformanceCount=0x5ffdc0 | out: lpPerformanceCount=0x5ffdc0*=1220471268141) returned 1 [0284.503] GetLastError () returned 0x0 [0284.503] SetLastError (dwErrCode=0x0) [0284.503] GetLastError () returned 0x0 [0284.503] SetLastError (dwErrCode=0x0) [0284.503] GetLastError () returned 0x0 [0284.503] SetLastError (dwErrCode=0x0) [0284.503] GetLastError () returned 0x0 [0284.504] SetLastError (dwErrCode=0x0) [0284.504] SysReAllocStringLen (in: pbstr=0x5ffb98*=0x0, psz="api-ms-win-core-synch-l1-2-0", len=0x1c | out: pbstr=0x5ffb98*="api-ms-win-core-synch-l1-2-0") returned 1 [0284.504] CharLowerBuffW (in: lpsz="api-ms-win-core-synch-l1-2-0", cchLength=0x1c | out: lpsz="api-ms-win-core-synch-l1-2-0") returned 0x1c [0284.504] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0284.504] GetLastError () returned 0x0 [0284.504] SetLastError (dwErrCode=0x0) [0284.504] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4d6c7c50 [0284.505] GetLastError () returned 0x0 [0284.505] SetLastError (dwErrCode=0x0) [0284.505] GetLastError () returned 0x0 [0284.505] SetLastError (dwErrCode=0x0) [0284.505] GetLastError () returned 0x0 [0284.505] SetLastError (dwErrCode=0x0) [0284.505] GetLastError () returned 0x0 [0284.505] SetLastError (dwErrCode=0x0) [0284.505] SysReAllocStringLen (in: pbstr=0x5ffb98*=0x0, psz="api-ms-win-core-fibers-l1-1-1", len=0x1d | out: pbstr=0x5ffb98*="api-ms-win-core-fibers-l1-1-1") returned 1 [0284.505] CharLowerBuffW (in: lpsz="api-ms-win-core-fibers-l1-1-1", cchLength=0x1d | out: lpsz="api-ms-win-core-fibers-l1-1-1") returned 0x1d [0284.505] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0284.505] GetLastError () returned 0x0 [0284.505] SetLastError (dwErrCode=0x0) [0284.505] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsAlloc") returned 0x7ffd4d6d7e50 [0284.506] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsSetValue") returned 0x7ffd4d6c3cb0 [0284.506] GetLastError () returned 0x0 [0284.506] SetLastError (dwErrCode=0x0) [0284.506] GetLastError () returned 0x0 [0284.506] SetLastError (dwErrCode=0x0) [0284.507] GetLastError () returned 0x0 [0284.507] SetLastError (dwErrCode=0x0) [0284.507] GetLastError () returned 0x0 [0284.507] SetLastError (dwErrCode=0x0) [0284.507] SysReAllocStringLen (in: pbstr=0x5ffb98*=0x0, psz="api-ms-win-core-synch-l1-2-0", len=0x1c | out: pbstr=0x5ffb98*="api-ms-win-core-synch-l1-2-0") returned 1 [0284.507] CharLowerBuffW (in: lpsz="api-ms-win-core-synch-l1-2-0", cchLength=0x1c | out: lpsz="api-ms-win-core-synch-l1-2-0") returned 0x1c [0284.507] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0284.507] GetLastError () returned 0x0 [0284.507] SetLastError (dwErrCode=0x0) [0284.507] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4d6c7c50 [0284.508] GetProcessHeap () returned 0x710000 [0284.508] GetLastError () returned 0x0 [0284.508] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x3c8) returned 0x263dfc0 [0284.508] SetLastError (dwErrCode=0x0) [0284.508] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1200) returned 0x6f9cb0 [0284.510] GetStartupInfoW (in: lpStartupInfo=0x5ffc90 | out: lpStartupInfo=0x5ffc90*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) [0284.510] GetStdHandle (nStdHandle=0xfffffff6) returned 0x20 [0284.510] GetFileType (hFile=0x20) returned 0x2 [0284.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x24 [0284.510] GetFileType (hFile=0x24) returned 0x2 [0284.510] GetStdHandle (nStdHandle=0xfffffff4) returned 0x28 [0284.510] GetFileType (hFile=0x28) returned 0x2 [0284.512] GetACP () returned 0x4e4 [0284.512] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x228) returned 0x263e390 [0284.513] IsValidCodePage (CodePage=0x4e4) returned 1 [0284.513] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x5ffa30 | out: lpCPInfo=0x5ffa30) returned 1 [0284.513] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x5ff2d0 | out: lpCPInfo=0x5ff2d0) returned 1 [0284.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x5ff2f0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0284.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x5ff2f0, cbMultiByte=256, lpWideCharStr=0x5ff020, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0284.513] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpCharType=0x5ff5f0 | out: lpCharType=0x5ff5f0) returned 1 [0284.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x5ff2f0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0284.513] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x5ff2f0, cbMultiByte=256, lpWideCharStr=0x5fefc0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0284.513] GetLastError () returned 0x0 [0284.513] SetLastError (dwErrCode=0x0) [0284.513] GetLastError () returned 0x0 [0284.513] SetLastError (dwErrCode=0x0) [0284.513] GetLastError () returned 0x0 [0284.513] SetLastError (dwErrCode=0x0) [0284.513] GetLastError () returned 0x0 [0284.513] SetLastError (dwErrCode=0x0) [0284.513] SysReAllocStringLen (in: pbstr=0x5fedb8*=0x0, psz="api-ms-win-core-localization-l1-2-1", len=0x23 | out: pbstr=0x5fedb8*="api-ms-win-core-localization-l1-2-1") returned 1 [0284.513] CharLowerBuffW (in: lpsz="api-ms-win-core-localization-l1-2-1", cchLength=0x23 | out: lpsz="api-ms-win-core-localization-l1-2-1") returned 0x23 [0284.513] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0284.514] GetLastError () returned 0x0 [0284.514] SetLastError (dwErrCode=0x0) [0284.514] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="LCMapStringEx") returned 0x7ffd4d685350 [0284.514] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0284.514] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x5fedb0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0284.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x5ff3f0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x97\x02", lpUsedDefaultChar=0x0) returned 256 [0284.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x5ff2f0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0284.514] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x5ff2f0, cbMultiByte=256, lpWideCharStr=0x5fefc0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0284.514] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0284.514] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x5fedb0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0284.514] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x5ff4f0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0284.514] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100) returned 0x7262d0 [0284.514] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5ffab0, nSize=0x105 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe")) returned 0x3b [0284.515] GetLastError () returned 0x0 [0284.515] SetLastError (dwErrCode=0x0) [0284.515] GetLastError () returned 0x0 [0284.515] SetLastError (dwErrCode=0x0) [0284.515] GetLastError () returned 0x0 [0284.515] SetLastError (dwErrCode=0x0) [0284.515] GetLastError () returned 0x0 [0284.515] SetLastError (dwErrCode=0x0) [0284.515] SysReAllocStringLen (in: pbstr=0x5ff8b8*=0x0, psz="kernel32", len=0x8 | out: pbstr=0x5ff8b8*="kernel32") returned 1 [0284.515] CharLowerBuffW (in: lpsz="kernel32", cchLength=0x8 | out: lpsz="kernel32") returned 0x8 [0284.515] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x7ffd4e1c0000 [0284.515] GetLastError () returned 0x0 [0284.515] SetLastError (dwErrCode=0x0) [0284.515] GetLastError () returned 0x0 [0284.515] SetLastError (dwErrCode=0x0) [0284.515] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="AreFileApisANSI") returned 0x7ffd4e1e4820 [0284.516] GetLastError () returned 0x0 [0284.516] SetLastError (dwErrCode=0x0) [0284.516] AreFileApisANSI () returned 1 [0284.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0284.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", cchWideChar=-1, lpMultiByteStr=0x7ff7727bd5c0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", lpUsedDefaultChar=0x0) returned 60 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x4c) returned 0x6c1c80 [0284.516] RtlInitializeSListHead (in: ListHead=0x7ff7727bd1b0 | out: ListHead=0x7ff7727bd1b0) [0284.516] GetLastError () returned 0x0 [0284.516] SetLastError (dwErrCode=0x0) [0284.516] GetEnvironmentStringsW () returned 0x263e5c0* [0284.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1254, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1254 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4e6) returned 0x6faec0 [0284.516] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1254, lpMultiByteStr=0x6faec0, cbMultiByte=1254, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1254 [0284.516] FreeEnvironmentStringsW (penv=0x263e5c0) returned 1 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x118) returned 0x73a860 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1f) returned 0x6c2870 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x2e) returned 0x2632960 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x31) returned 0x2632de0 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x3c) returned 0x903090 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x31) returned 0x2632ea0 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x14) returned 0x263ec70 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x24) returned 0x6fb910 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0xd) returned 0x263e7d0 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1d) returned 0x6fb7c0 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x31) returned 0x2632320 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x15) returned 0x263ea50 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x17) returned 0x263e650 [0284.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0xe) returned 0x263e990 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x69) returned 0x9064f0 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x3e) returned 0x9031d0 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1d) returned 0x6fb520 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x48) returned 0x9033b0 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x12) returned 0x263ed90 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x18) returned 0x263e9f0 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1b) returned 0x6fb670 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1e) returned 0x6fb6a0 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x29) returned 0x2632860 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1e) returned 0x6fb790 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x6b) returned 0x906070 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x17) returned 0x263eab0 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0xf) returned 0x263e9d0 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x16) returned 0x263eb10 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x2a) returned 0x2632f20 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x29) returned 0x2632ce0 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x12) returned 0x263e6f0 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x21) returned 0x6fb9a0 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x16) returned 0x263e810 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x22) returned 0x6fba90 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x12) returned 0x263ec90 [0284.517] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6faec0 | out: hHeap=0x710000) returned 1 [0284.517] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1000) returned 0x6fbbc0 [0284.517] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff771f661ac) returned 0x0 [0284.518] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20) returned 0x6fb460 [0284.518] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x30) returned 0x26329a0 [0284.518] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20) returned 0x6fb850 [0284.518] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x30) returned 0x2632da0 [0284.519] FreeConsole () returned 1 [0284.522] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x5ff570 | out: TokenHandle=0x5ff570*=0x28) returned 1 [0284.522] GetTokenInformation (in: TokenHandle=0x28, TokenInformationClass=0x14, TokenInformation=0x5ff568, TokenInformationLength=0x4, ReturnLength=0x5ff564 | out: TokenInformation=0x5ff568, ReturnLength=0x5ff564) returned 1 [0284.522] CloseHandle (hObject=0x28) returned 1 [0284.522] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender", ulOptions=0x0, samDesired=0x20006, phkResult=0x5ff578 | out: phkResult=0x5ff578*=0x28) returned 0x0 [0284.522] RegSetValueExA (in: hKey=0x28, lpValueName="DisableAntiSpyware", Reserved=0x0, dwType=0x4, lpData=0x5ff5a8*=0x1, cbData=0x4 | out: lpData=0x5ff5a8*=0x1) returned 0x0 [0284.522] RegCloseKey (hKey=0x28) returned 0x0 [0284.522] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x5ff558, dwRevision=0x1 | out: pSecurityDescriptor=0x5ff558) returned 1 [0284.522] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x5ff558, bDaclPresent=1, pDacl=0x0, bDaclDefaulted=0 | out: pSecurityDescriptor=0x5ff558) returned 1 [0284.523] RegCreateKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x20006, lpSecurityAttributes=0x5ff540, phkResult=0x5ff538, lpdwDisposition=0x5ff534 | out: phkResult=0x5ff538*=0x28, lpdwDisposition=0x5ff534*=0x2) returned 0x0 [0284.523] RegCloseKey (hKey=0x28) returned 0x0 [0284.523] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", ulOptions=0x0, samDesired=0x20006, phkResult=0x5ff578 | out: phkResult=0x5ff578*=0x28) returned 0x0 [0284.523] RegSetValueExA (in: hKey=0x28, lpValueName="DisableBehaviorMonitoring", Reserved=0x0, dwType=0x4, lpData=0x5ff5a8*=0x1, cbData=0x4 | out: lpData=0x5ff5a8*=0x1) returned 0x0 [0284.523] RegCloseKey (hKey=0x28) returned 0x0 [0284.523] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", ulOptions=0x0, samDesired=0x20006, phkResult=0x5ff578 | out: phkResult=0x5ff578*=0x28) returned 0x0 [0284.523] RegSetValueExA (in: hKey=0x28, lpValueName="DisableOnAccessProtection", Reserved=0x0, dwType=0x4, lpData=0x5ff5a8*=0x1, cbData=0x4 | out: lpData=0x5ff5a8*=0x1) returned 0x0 [0284.523] RegCloseKey (hKey=0x28) returned 0x0 [0284.523] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection", ulOptions=0x0, samDesired=0x20006, phkResult=0x5ff578 | out: phkResult=0x5ff578*=0x28) returned 0x0 [0284.523] RegSetValueExA (in: hKey=0x28, lpValueName="DisableScanOnRealtimeEnable", Reserved=0x0, dwType=0x4, lpData=0x5ff5a8*=0x1, cbData=0x4 | out: lpData=0x5ff5a8*=0x1) returned 0x0 [0284.523] RegCloseKey (hKey=0x28) returned 0x0 [0284.523] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x30) returned 0x2632c60 [0284.523] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x47) returned 0x903220 [0284.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x2632c60 | out: hHeap=0x710000) returned 1 [0284.524] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x263e690 [0284.524] GetLastError () returned 0x0 [0284.524] SetLastError (dwErrCode=0x0) [0284.524] GetLastError () returned 0x0 [0284.524] SetLastError (dwErrCode=0x0) [0284.524] GetLastError () returned 0x0 [0284.524] SetLastError (dwErrCode=0x0) [0284.524] GetLastError () returned 0x0 [0284.524] SetLastError (dwErrCode=0x0) [0284.524] SysReAllocStringLen (in: pbstr=0x5ff108*=0x0, psz="api-ms-win-core-string-l1-1-0", len=0x1d | out: pbstr=0x5ff108*="api-ms-win-core-string-l1-1-0") returned 1 [0284.524] CharLowerBuffW (in: lpsz="api-ms-win-core-string-l1-1-0", cchLength=0x1d | out: lpsz="api-ms-win-core-string-l1-1-0") returned 0x1d [0284.524] LoadLibraryExW (lpLibFileName="api-ms-win-core-string-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0284.524] GetLastError () returned 0x0 [0284.524] SetLastError (dwErrCode=0x0) [0284.525] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="CompareStringEx") returned 0x7ffd4d684040 [0284.525] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="EnumSystemLocalesEx") returned 0x7ffd4d6e2bd0 [0284.525] GetLastError () returned 0x0 [0284.525] SetLastError (dwErrCode=0x0) [0284.525] GetLastError () returned 0x0 [0284.525] SetLastError (dwErrCode=0x0) [0284.525] GetLastError () returned 0x0 [0284.525] SetLastError (dwErrCode=0x0) [0284.525] GetLastError () returned 0x0 [0284.525] SetLastError (dwErrCode=0x0) [0284.525] SysReAllocStringLen (in: pbstr=0x5ff108*=0x0, psz="api-ms-win-core-datetime-l1-1-1", len=0x1f | out: pbstr=0x5ff108*="api-ms-win-core-datetime-l1-1-1") returned 1 [0284.525] CharLowerBuffW (in: lpsz="api-ms-win-core-datetime-l1-1-1", cchLength=0x1f | out: lpsz="api-ms-win-core-datetime-l1-1-1") returned 0x1f [0284.525] LoadLibraryExW (lpLibFileName="api-ms-win-core-datetime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0284.526] GetLastError () returned 0x0 [0284.526] SetLastError (dwErrCode=0x0) [0284.526] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="GetDateFormatEx") returned 0x7ffd4d6d1230 [0284.526] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="GetLocaleInfoEx") returned 0x7ffd4d680710 [0284.526] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="GetTimeFormatEx") returned 0x7ffd4d6d87b0 [0284.534] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="GetUserDefaultLocaleName") returned 0x7ffd4d6a37a0 [0284.534] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="IsValidLocaleName") returned 0x7ffd4d69a6f0 [0284.535] GetLastError () returned 0x0 [0284.535] SetLastError (dwErrCode=0x0) [0284.535] GetLastError () returned 0x0 [0284.535] SetLastError (dwErrCode=0x0) [0284.535] GetLastError () returned 0x0 [0284.535] SetLastError (dwErrCode=0x0) [0284.535] GetLastError () returned 0x0 [0284.535] SetLastError (dwErrCode=0x0) [0284.535] SysReAllocStringLen (in: pbstr=0x5ff108*=0x0, psz="api-ms-win-core-localization-obsolete-l1-2-0", len=0x2c | out: pbstr=0x5ff108*="api-ms-win-core-localization-obsolete-l1-2-0") returned 1 [0284.535] CharLowerBuffW (in: lpsz="api-ms-win-core-localization-obsolete-l1-2-0", cchLength=0x2c | out: lpsz="api-ms-win-core-localization-obsolete-l1-2-0") returned 0x2c [0284.535] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-obsolete-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0284.535] GetLastError () returned 0x0 [0284.535] SetLastError (dwErrCode=0x0) [0284.535] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="LCIDToLocaleName") returned 0x7ffd4d6ce2c0 [0284.536] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="LocaleNameToLCID") returned 0x7ffd4d67e330 [0284.536] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x38) returned 0x2632b60 [0284.536] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x2) returned 0x716ac0 [0284.536] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x716ac0 | out: hHeap=0x710000) returned 1 [0284.536] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x2) returned 0x716ac0 [0284.536] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x30) returned 0x2632ee0 [0284.536] GetLastError () returned 0x0 [0284.536] SetLastError (dwErrCode=0x0) [0284.536] GetLastError () returned 0x0 [0284.536] SetLastError (dwErrCode=0x0) [0284.536] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x158) returned 0x2634610 [0284.536] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6a6) returned 0x6fe2d0 [0284.536] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe2d0 | out: hHeap=0x710000) returned 1 [0284.536] GetLastError () returned 0x0 [0284.537] SetLastError (dwErrCode=0x0) [0284.537] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x6fe440 [0284.537] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x2) returned 0x6fe450 [0284.537] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x4) returned 0x6fe370 [0284.537] GetLastError () returned 0x0 [0284.537] SetLastError (dwErrCode=0x0) [0284.537] GetLastError () returned 0x0 [0284.537] SetLastError (dwErrCode=0x0) [0284.537] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x158) returned 0x6f9580 [0284.537] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6a6) returned 0x6fe4e0 [0284.537] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe4e0 | out: hHeap=0x710000) returned 1 [0284.537] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe440 | out: hHeap=0x710000) returned 1 [0284.537] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x2634610 | out: hHeap=0x710000) returned 1 [0284.537] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe370 | out: hHeap=0x710000) returned 1 [0284.537] GetLastError () returned 0x0 [0284.537] SetLastError (dwErrCode=0x0) [0284.537] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x6fe3d0 [0284.537] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x2) returned 0x6fe330 [0284.537] GetLastError () returned 0x0 [0284.537] SetLastError (dwErrCode=0x0) [0284.537] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x200) returned 0x6fe4e0 [0284.537] GetLastError () returned 0x0 [0284.538] SetLastError (dwErrCode=0x0) [0284.538] GetLastError () returned 0x0 [0284.538] SetLastError (dwErrCode=0x0) [0284.538] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x4) returned 0x6fe3b0 [0284.538] GetLastError () returned 0x0 [0284.538] SetLastError (dwErrCode=0x0) [0284.538] GetLastError () returned 0x0 [0284.538] SetLastError (dwErrCode=0x0) [0284.538] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x158) returned 0x2634610 [0284.538] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6a6) returned 0x6fe6f0 [0284.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe6f0 | out: hHeap=0x710000) returned 1 [0284.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe3d0 | out: hHeap=0x710000) returned 1 [0284.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6f9580 | out: hHeap=0x710000) returned 1 [0284.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe3b0 | out: hHeap=0x710000) returned 1 [0284.538] GetLastError () returned 0x0 [0284.538] SetLastError (dwErrCode=0x0) [0284.538] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x6fe3f0 [0284.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe330 | out: hHeap=0x710000) returned 1 [0284.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe450 | out: hHeap=0x710000) returned 1 [0284.538] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x263e8f0 [0284.539] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x263e750 [0284.539] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x58) returned 0x6c1ec0 [0284.539] AreFileApisANSI () returned 1 [0284.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x903220, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0284.539] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x78) returned 0x905ff0 [0284.539] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x903220, cbMultiByte=-1, lpWideCharStr=0x905ff0, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 60 [0284.539] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x5ff100, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0284.539] GetFileType (hFile=0x28) returned 0x1 [0284.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x905ff0 | out: hHeap=0x710000) returned 1 [0284.540] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x263e9b0 [0284.540] GetLastError () returned 0x0 [0284.540] SetLastError (dwErrCode=0x0) [0284.540] GetLastError () returned 0x0 [0284.540] SetLastError (dwErrCode=0x0) [0284.540] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x158) returned 0x6f9580 [0284.540] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6a6) returned 0x6fe6f0 [0284.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe6f0 | out: hHeap=0x710000) returned 1 [0284.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe3f0 | out: hHeap=0x710000) returned 1 [0284.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x2634610 | out: hHeap=0x710000) returned 1 [0284.541] GetLastError () returned 0x0 [0284.541] SetLastError (dwErrCode=0x0) [0284.541] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x6fe460 [0284.541] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x2) returned 0x6fe340 [0284.541] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x4) returned 0x6fe3e0 [0284.541] GetLastError () returned 0x0 [0284.541] SetLastError (dwErrCode=0x0) [0284.541] GetLastError () returned 0x0 [0284.541] SetLastError (dwErrCode=0x0) [0284.541] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x158) returned 0x2634610 [0284.541] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6a6) returned 0x6fe6f0 [0284.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe6f0 | out: hHeap=0x710000) returned 1 [0284.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe460 | out: hHeap=0x710000) returned 1 [0284.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6f9580 | out: hHeap=0x710000) returned 1 [0284.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe3e0 | out: hHeap=0x710000) returned 1 [0284.541] GetLastError () returned 0x0 [0284.541] SetLastError (dwErrCode=0x0) [0284.541] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x6fe360 [0284.542] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x2) returned 0x6fe3b0 [0284.542] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x4) returned 0x6fe3e0 [0284.542] GetLastError () returned 0x0 [0284.542] SetLastError (dwErrCode=0x0) [0284.542] GetLastError () returned 0x0 [0284.542] SetLastError (dwErrCode=0x0) [0284.542] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x158) returned 0x6f9580 [0284.542] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6a6) returned 0x6fe6f0 [0284.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe6f0 | out: hHeap=0x710000) returned 1 [0284.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe360 | out: hHeap=0x710000) returned 1 [0284.544] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x2634610 | out: hHeap=0x710000) returned 1 [0284.544] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe3e0 | out: hHeap=0x710000) returned 1 [0284.544] GetLastError () returned 0x0 [0284.545] SetLastError (dwErrCode=0x0) [0284.545] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x6fe350 [0284.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe3b0 | out: hHeap=0x710000) returned 1 [0284.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe340 | out: hHeap=0x710000) returned 1 [0284.545] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x263e970 [0284.545] CloseHandle (hObject=0x28) returned 1 [0284.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x263e750 | out: hHeap=0x710000) returned 1 [0284.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x263e690 | out: hHeap=0x710000) returned 1 [0284.545] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x30) returned 0x2632820 [0284.545] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x47) returned 0x903400 [0284.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x2632820 | out: hHeap=0x710000) returned 1 [0284.545] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x5ff570 | out: TokenHandle=0x5ff570*=0x28) returned 1 [0284.545] GetTokenInformation (in: TokenHandle=0x28, TokenInformationClass=0x14, TokenInformation=0x5ff568, TokenInformationLength=0x4, ReturnLength=0x5ff564 | out: TokenInformation=0x5ff568, ReturnLength=0x5ff564) returned 1 [0284.545] CloseHandle (hObject=0x28) returned 1 [0284.545] lstrlenA (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 59 [0284.545] RegOpenKeyExA (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20006, phkResult=0x5ff578 | out: phkResult=0x5ff578*=0x28) returned 0x0 [0284.546] RegSetValueExA (in: hKey=0x28, lpValueName="RegHost", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe", cbData=0x3b | out: lpData="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 0x0 [0284.546] RegCloseKey (hKey=0x28) returned 0x0 [0284.546] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40) returned 0x903680 [0284.546] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x263e690 [0284.546] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x263e890 [0284.546] AreFileApisANSI () returned 1 [0284.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x903680, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0284.546] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x78) returned 0x905f70 [0284.546] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x903680, cbMultiByte=-1, lpWideCharStr=0x905f70, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 60 [0284.546] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x5ff260, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0284.546] GetFileType (hFile=0x28) returned 0x1 [0284.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x905f70 | out: hHeap=0x710000) returned 1 [0284.547] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x263ea10 [0284.547] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x263e850 [0284.547] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x58) returned 0x6c1860 [0284.547] AreFileApisANSI () returned 1 [0284.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x903220, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0284.547] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x78) returned 0x906570 [0284.547] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x903220, cbMultiByte=-1, lpWideCharStr=0x906570, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 60 [0284.547] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x5ff260, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff [0284.548] GetLastError () returned 0x20 [0284.548] GetLastError () returned 0x20 [0284.549] SetLastError (dwErrCode=0x20) [0284.549] GetLastError () returned 0x20 [0284.549] SetLastError (dwErrCode=0x20) [0284.549] GetLastError () returned 0x20 [0284.549] SetLastError (dwErrCode=0x20) [0284.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x906570 | out: hHeap=0x710000) returned 1 [0284.549] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x263e730 [0284.549] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x263ed70 [0284.549] AreFileApisANSI () returned 1 [0284.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x903680, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 60 [0284.549] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x78) returned 0x906870 [0284.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x903680, cbMultiByte=-1, lpWideCharStr=0x906870, cchWideChar=60 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe") returned 60 [0284.549] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\RegHost.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\reghost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x5ff110, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x24 [0284.549] GetFileType (hFile=0x24) returned 0x1 [0284.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x906870 | out: hHeap=0x710000) returned 1 [0284.549] SetFilePointerEx (in: hFile=0x24, liDistanceToMove=0x0, lpNewFilePointer=0x5ff270, dwMoveMethod=0x2 | out: lpNewFilePointer=0x5ff270*=8483840) returned 1 [0284.550] SetFilePointerEx (in: hFile=0x24, liDistanceToMove=0x0, lpNewFilePointer=0x5ff1d0, dwMoveMethod=0x1 | out: lpNewFilePointer=0x5ff1d0*=8483840) returned 1 [0284.550] CloseHandle (hObject=0x24) returned 1 [0284.550] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x263ed70 | out: hHeap=0x710000) returned 1 [0284.550] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x263e730 | out: hHeap=0x710000) returned 1 [0284.550] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x817400) returned 0x31ea040 [0284.603] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x8, Size=0x1000) returned 0x906fd0 [0284.603] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.605] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.605] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.605] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.605] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.606] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.606] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.606] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.606] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.607] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.607] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.607] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.624] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.625] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.625] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.625] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.625] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.625] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.626] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.626] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.626] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.626] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.627] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.627] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.627] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.628] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.628] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.628] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.628] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.628] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.629] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.629] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.629] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.630] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.630] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.630] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.633] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.633] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.634] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.634] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.634] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.634] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.635] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.635] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.635] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.635] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.636] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.636] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.636] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.636] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.637] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.637] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.637] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.645] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.645] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.646] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.646] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.646] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.649] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.649] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.650] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.650] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.650] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.650] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.651] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.652] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.652] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.652] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.653] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.654] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.654] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.654] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.655] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.655] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.655] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.655] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.656] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.656] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.656] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.656] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.657] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.657] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.657] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.657] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.658] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.658] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.658] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.658] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.658] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.659] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.659] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.659] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.659] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.660] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.660] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.660] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.660] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.661] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.661] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.661] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.661] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.662] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.662] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.665] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.666] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.666] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.666] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.666] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.667] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.667] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.667] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.667] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.667] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.668] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.668] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.668] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.668] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.669] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.669] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.669] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.669] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.670] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.670] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.670] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.670] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.671] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.671] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.671] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.671] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.673] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.673] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.673] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.674] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.674] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.674] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.674] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.675] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.675] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.675] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.676] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.676] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.676] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.676] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.677] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.677] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.677] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.678] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.678] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.678] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.681] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.681] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.682] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.682] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.682] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.682] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.683] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.683] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.683] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.683] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.684] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.684] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.684] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.685] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.685] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.685] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.685] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.686] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.686] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.686] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.686] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.687] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.687] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.687] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.687] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.689] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.689] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.689] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.689] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.690] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.690] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.690] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.690] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.691] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.691] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.691] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.691] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.692] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.692] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.692] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.692] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.693] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.693] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.693] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.697] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.698] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.698] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.698] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.698] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.699] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.699] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.699] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.699] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.700] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.700] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.700] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.700] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.701] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.701] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.701] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.701] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.702] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.702] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.702] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.703] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.703] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.703] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.703] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.704] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.705] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.705] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.705] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.706] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.706] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.706] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.706] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.707] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.707] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.707] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.707] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.708] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.708] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.708] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.708] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.709] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.709] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.709] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.709] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.710] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.710] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.713] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.713] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.714] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.714] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.714] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.714] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.715] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.715] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.715] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0284.715] ReadFile (in: hFile=0x28, lpBuffer=0x906fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5ff348, lpOverlapped=0x0 | out: lpBuffer=0x906fd0*, lpNumberOfBytesRead=0x5ff348*=0x1000, lpOverlapped=0x0) returned 1 [0285.081] SetLastError (dwErrCode=0x0) [0285.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x263e850 | out: hHeap=0x710000) returned 1 [0285.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x263ea10 | out: hHeap=0x710000) returned 1 [0285.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x263e890 | out: hHeap=0x710000) returned 1 [0285.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x263e690 | out: hHeap=0x710000) returned 1 [0285.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x903680 | out: hHeap=0x710000) returned 1 [0285.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x903400 | out: hHeap=0x710000) returned 1 [0285.081] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20) returned 0x6fbac0 [0285.081] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x30) returned 0x26329e0 [0285.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fbac0 | out: hHeap=0x710000) returned 1 [0285.081] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x30) returned 0x2632920 [0285.081] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x50) returned 0x6c1f20 [0285.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x26329e0 | out: hHeap=0x710000) returned 1 [0285.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x2632920 | out: hHeap=0x710000) returned 1 [0285.082] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40) returned 0x903400 [0285.082] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x80) returned 0x6f98e0 [0285.082] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6c1f20 | out: hHeap=0x710000) returned 1 [0285.082] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x903400 | out: hHeap=0x710000) returned 1 [0285.082] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xbf) returned 0x2633710 [0285.082] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6f98e0 | out: hHeap=0x710000) returned 1 [0285.082] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20) returned 0x6fbac0 [0285.082] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fbac0 | out: hHeap=0x710000) returned 1 [0285.082] CreateProcessA (in: lpApplicationName="C:\\Windows\\explorer.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x5ff510*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x5ff4e0 | out: lpCommandLine=0x0, lpProcessInformation=0x5ff4e0*(hProcess=0x24, hThread=0x28, dwProcessId=0x4f4, dwThreadId=0xefc)) returned 1 [0285.142] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x1000, flProtect=0x4) returned 0x1f0000 [0285.142] GetThreadContext (in: hThread=0x28, lpContext=0x1f0000 | out: lpContext=0x1f0000*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x10000b, MxCsr=0x1f80, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x7ff7aac6e090, Rdx=0x3fa000, Rbx=0x0, Rsp=0xcffd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7ffd5052c230, FltSave.ControlWord=0x27f, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x1f80, FltSave.MxCsr_Mask=0xffff, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x27f, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0285.143] VirtualAllocEx (hProcess=0x24, lpAddress=0x140000000, dwSize=0x22000, flAllocationType=0x3000, flProtect=0x40) returned 0x140000000 [0285.143] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x140000000, lpBuffer=0x7ff771f98000*, nSize=0x400, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771f98000*, lpNumberOfBytesWritten=0x0) returned 1 [0285.144] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x140001000, lpBuffer=0x7ff771f98400*, nSize=0xf400, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771f98400*, lpNumberOfBytesWritten=0x0) returned 1 [0285.147] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x3fa010, lpBuffer=0x7ff771f98138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771f98138*, lpNumberOfBytesWritten=0x0) returned 1 [0285.147] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x140011000, lpBuffer=0x7ff771fa7800*, nSize=0x9c00, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fa7800*, lpNumberOfBytesWritten=0x0) returned 1 [0285.149] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x3fa010, lpBuffer=0x7ff771f98138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771f98138*, lpNumberOfBytesWritten=0x0) returned 1 [0285.149] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x14001b000, lpBuffer=0x7ff771fb1400*, nSize=0xc00, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb1400*, lpNumberOfBytesWritten=0x0) returned 1 [0285.150] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x3fa010, lpBuffer=0x7ff771f98138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771f98138*, lpNumberOfBytesWritten=0x0) returned 1 [0285.151] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x14001d000, lpBuffer=0x7ff771fb2000*, nSize=0x1200, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb2000*, lpNumberOfBytesWritten=0x0) returned 1 [0285.152] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x3fa010, lpBuffer=0x7ff771f98138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771f98138*, lpNumberOfBytesWritten=0x0) returned 1 [0285.152] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x14001f000, lpBuffer=0x7ff771fb3200*, nSize=0x200, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb3200*, lpNumberOfBytesWritten=0x0) returned 1 [0285.153] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x3fa010, lpBuffer=0x7ff771f98138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771f98138*, lpNumberOfBytesWritten=0x0) returned 1 [0285.154] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x140020000, lpBuffer=0x7ff771fb3400*, nSize=0x200, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb3400*, lpNumberOfBytesWritten=0x0) returned 1 [0285.158] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x3fa010, lpBuffer=0x7ff771f98138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771f98138*, lpNumberOfBytesWritten=0x0) returned 1 [0285.159] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x140021000, lpBuffer=0x7ff771fb3600*, nSize=0x800, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb3600*, lpNumberOfBytesWritten=0x0) returned 1 [0285.159] WriteProcessMemory (in: hProcess=0x24, lpBaseAddress=0x3fa010, lpBuffer=0x7ff771f98138*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771f98138*, lpNumberOfBytesWritten=0x0) returned 1 [0285.160] SetThreadContext (hThread=0x28, lpContext=0x1f0000*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x10000b, MxCsr=0x1f80, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x140001c18, Rdx=0x3fa000, Rbx=0x0, Rsp=0xcffd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7ffd5052c230, FltSave.ControlWord=0x27f, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x1f80, FltSave.MxCsr_Mask=0xffff, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x27f, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0285.161] ResumeThread (hThread=0x28) returned 0x1 [0285.161] WaitForSingleObject (hHandle=0x24, dwMilliseconds=0x0) returned 0x102 [0285.161] SetPriorityClass (hProcess=0x24, dwPriorityClass=0x40) returned 1 [0285.161] CreateProcessA (in: lpApplicationName="C:\\Windows\\bfsvc.exe", lpCommandLine="C:\\Windows\\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0xa6ceE57d9638dA506ff99899c6C018292Ef4826C -coin etc -worker EasyMiner_Bot -mi 14", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x5ff510*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x5ff4e0 | out: lpCommandLine="C:\\Windows\\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0xa6ceE57d9638dA506ff99899c6C018292Ef4826C -coin etc -worker EasyMiner_Bot -mi 14", lpProcessInformation=0x5ff4e0*(hProcess=0x20, hThread=0x18, dwProcessId=0x4e4, dwThreadId=0x980)) returned 1 [0285.170] VirtualAlloc (lpAddress=0x0, dwSize=0x8, flAllocationType=0x1000, flProtect=0x4) returned 0x22f0000 [0285.174] GetThreadContext (in: hThread=0x18, lpContext=0x22f0000 | out: lpContext=0x22f0000*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x10000b, MxCsr=0x1f80, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x7ff7a55b8c30, Rdx=0x226000, Rbx=0x0, Rsp=0xcffd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7ffd5052c230, FltSave.ControlWord=0x27f, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x1f80, FltSave.MxCsr_Mask=0xffff, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x27f, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0285.214] VirtualAllocEx (hProcess=0x20, lpAddress=0x140000000, dwSize=0x815000, flAllocationType=0x3000, flProtect=0x40) returned 0x140000000 [0285.218] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x140000000, lpBuffer=0x7ff771fb3e00*, nSize=0x400, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb3e00*, lpNumberOfBytesWritten=0x0) returned 1 [0285.219] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x140001000, lpBuffer=0x7ff771fb4200*, nSize=0x422a00, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb4200*, lpNumberOfBytesWritten=0x0) returned 1 [0285.944] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x226010, lpBuffer=0x7ff771fb3f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb3f70*, lpNumberOfBytesWritten=0x0) returned 1 [0285.946] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x140424000, lpBuffer=0x7ff7723d6c00*, nSize=0x35c400, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff7723d6c00*, lpNumberOfBytesWritten=0x0) returned 1 [0286.073] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x226010, lpBuffer=0x7ff771fb3f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb3f70*, lpNumberOfBytesWritten=0x0) returned 1 [0286.075] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x140781000, lpBuffer=0x7ff772733000*, nSize=0x56a00, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff772733000*, lpNumberOfBytesWritten=0x0) returned 1 [0286.090] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x226010, lpBuffer=0x7ff771fb3f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb3f70*, lpNumberOfBytesWritten=0x0) returned 1 [0286.092] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x1407e1000, lpBuffer=0x7ff772789a00*, nSize=0x28600, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff772789a00*, lpNumberOfBytesWritten=0x0) returned 1 [0286.098] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x226010, lpBuffer=0x7ff771fb3f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb3f70*, lpNumberOfBytesWritten=0x0) returned 1 [0286.103] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x14080a000, lpBuffer=0x7ff7727b2000*, nSize=0x200, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff7727b2000*, lpNumberOfBytesWritten=0x0) returned 1 [0286.105] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x226010, lpBuffer=0x7ff771fb3f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb3f70*, lpNumberOfBytesWritten=0x0) returned 1 [0286.106] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x14080b000, lpBuffer=0x7ff7727b2200*, nSize=0x1000, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff7727b2200*, lpNumberOfBytesWritten=0x0) returned 1 [0286.108] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x226010, lpBuffer=0x7ff771fb3f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb3f70*, lpNumberOfBytesWritten=0x0) returned 1 [0286.109] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x14080c000, lpBuffer=0x7ff7727b3200*, nSize=0x200, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff7727b3200*, lpNumberOfBytesWritten=0x0) returned 1 [0286.112] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x226010, lpBuffer=0x7ff771fb3f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb3f70*, lpNumberOfBytesWritten=0x0) returned 1 [0286.114] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x14080d000, lpBuffer=0x7ff7727b3400*, nSize=0x8000, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff7727b3400*, lpNumberOfBytesWritten=0x0) returned 1 [0286.118] WriteProcessMemory (in: hProcess=0x20, lpBaseAddress=0x226010, lpBuffer=0x7ff771fb3f70*, nSize=0x8, lpNumberOfBytesWritten=0x0 | out: lpBuffer=0x7ff771fb3f70*, lpNumberOfBytesWritten=0x0) returned 1 [0286.119] SetThreadContext (hThread=0x18, lpContext=0x22f0000*(P1Home=0x0, P2Home=0x0, P3Home=0x0, P4Home=0x0, P5Home=0x0, P6Home=0x0, ContextFlags=0x10000b, MxCsr=0x1f80, SegCs=0x33, SegDs=0x0, SegEs=0x0, SegFs=0x0, SegGs=0x0, SegSs=0x2b, EFlags=0x200, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, Rax=0x0, Rcx=0x1403a756c, Rdx=0x226000, Rbx=0x0, Rsp=0xcffd8, Rbp=0x0, Rsi=0x0, Rdi=0x0, R8=0x0, R9=0x0, R10=0x0, R11=0x0, R12=0x0, R13=0x0, R14=0x0, R15=0x0, Rip=0x7ffd5052c230, FltSave.ControlWord=0x27f, FltSave.StatusWord=0x0, FltSave.TagWord=0x0, FltSave.Reserved1=0x0, FltSave.ErrorOpcode=0x0, FltSave.ErrorOffset=0x0, FltSave.ErrorSelector=0x0, FltSave.Reserved2=0x0, FltSave.DataOffset=0x0, FltSave.DataSelector=0x0, FltSave.Reserved3=0x0, FltSave.MxCsr=0x1f80, FltSave.MxCsr_Mask=0xffff, FltSave.FloatRegisters.Low=0x0, FltSave.FloatRegisters.High=0x0, FltSave.XmmRegisters.Low=0x0, FltSave.XmmRegisters.High=0x0, FltSave.Reserved4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0), FltSave.StackControl=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0), FltSave.Cr0NpxState=0x0, Header.Low=0x27f, Header.High=0x0, Legacy.Low=0x0, Legacy.High=0x0, Xmm0.Low=0x0, Xmm0.High=0x0, Xmm1.Low=0x0, Xmm1.High=0x0, Xmm2.Low=0x0, Xmm2.High=0x0, Xmm3.Low=0x0, Xmm3.High=0x0, Xmm4.Low=0x0, Xmm4.High=0x0, Xmm5.Low=0x0, Xmm5.High=0x0, Xmm6.Low=0x0, Xmm6.High=0x0, Xmm7.Low=0x0, Xmm7.High=0x0, Xmm8.Low=0x0, Xmm8.High=0x0, Xmm9.Low=0x0, Xmm9.High=0x0, Xmm10.Low=0x0, Xmm10.High=0x0, Xmm11.Low=0x0, Xmm11.High=0x0, Xmm12.Low=0x0, Xmm12.High=0x0, Xmm13.Low=0x0, Xmm13.High=0x0, Xmm14.Low=0x0, Xmm14.High=0x0, Xmm15.Low=0x0, Xmm15.High=0x0, VectorRegister.Low=0x0, VectorRegister.High=0x0, VectorControl=0x0, DebugControl=0x0, LastBranchToRip=0x0, LastBranchFromRip=0x0, LastExceptionToRip=0x0, LastExceptionFromRip=0x0)) returned 1 [0286.120] ResumeThread (hThread=0x18) returned 0x1 [0286.152] WaitForSingleObject (hHandle=0x20, dwMilliseconds=0x0) returned 0x102 [0286.152] SetPriorityClass (hProcess=0x20, dwPriorityClass=0x40) returned 1 [0286.152] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x2633710 | out: hHeap=0x710000) returned 1 [0286.152] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x903220 | out: hHeap=0x710000) returned 1 [0286.152] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x2632da0 | out: hHeap=0x710000) returned 1 [0286.152] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fb850 | out: hHeap=0x710000) returned 1 [0286.152] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x26329a0 | out: hHeap=0x710000) returned 1 [0286.152] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fb460 | out: hHeap=0x710000) returned 1 [0286.152] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x263e9b0 | out: hHeap=0x710000) returned 1 [0286.152] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x263e970 | out: hHeap=0x710000) returned 1 [0286.153] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe4e0 | out: hHeap=0x710000) returned 1 [0286.153] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x2632ee0 | out: hHeap=0x710000) returned 1 [0286.153] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x263e8f0 | out: hHeap=0x710000) returned 1 [0286.153] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x716ac0 | out: hHeap=0x710000) returned 1 [0286.153] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x2632b60 | out: hHeap=0x710000) returned 1 [0286.153] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7262d0 | out: hHeap=0x710000) returned 1 [0286.153] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6c1ec0 | out: hHeap=0x710000) returned 1 [0286.153] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6c1860 | out: hHeap=0x710000) returned 1 [0286.153] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fbbc0 | out: hHeap=0x710000) returned 1 [0286.153] GetLastError () returned 0x0 [0286.154] SetLastError (dwErrCode=0x0) [0286.154] GetLastError () returned 0x0 [0286.154] SetLastError (dwErrCode=0x0) [0286.154] GetLastError () returned 0x0 [0286.154] SetLastError (dwErrCode=0x0) [0286.154] GetLastError () returned 0x0 [0286.154] SetLastError (dwErrCode=0x0) [0286.154] SysReAllocStringLen (in: pbstr=0x5ffb38*=0x0, psz="api-ms-win-appmodel-runtime-l1-1-2", len=0x22 | out: pbstr=0x5ffb38*="api-ms-win-appmodel-runtime-l1-1-2") returned 1 [0286.154] CharLowerBuffW (in: lpsz="api-ms-win-appmodel-runtime-l1-1-2", cchLength=0x22 | out: lpsz="api-ms-win-appmodel-runtime-l1-1-2") returned 0x22 [0286.154] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-2", hFile=0x0, dwFlags=0x800) returned 0x7ffd4cb70000 [0286.155] GetLastError () returned 0x0 [0286.155] SetLastError (dwErrCode=0x0) [0286.155] GetProcAddress (hModule=0x7ffd4cb70000, lpProcName="AppPolicyGetProcessTerminationMethod") returned 0x0 [0286.156] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x5ffd18 | out: phModule=0x5ffd18) returned 0 [0286.156] ExitProcess (uExitCode=0x0) [0286.156] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6fe350 | out: hHeap=0x710000) returned 1 [0286.156] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x6f9580 | out: hHeap=0x710000) returned 1 [0286.156] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x263dfc0 | out: hHeap=0x710000) returned 1 Thread: id = 147 os_tid = 0x13fc Thread: id = 148 os_tid = 0x1150 [0283.520] GetTickCount () returned 0xb8a132 [0283.520] Sleep (dwMilliseconds=0x3e8) [0284.556] Sleep (dwMilliseconds=0x3e8) [0285.589] Sleep (dwMilliseconds=0x3e8) Thread: id = 149 os_tid = 0x4f8 [0284.519] GetLastError () returned 0x57 [0284.519] GetLastError () returned 0x0 [0284.519] LocalAlloc (uFlags=0x40, uBytes=0x12c9) returned 0x6fcff0 [0284.520] SetLastError (dwErrCode=0x0) [0284.520] GetLastError () returned 0x0 [0284.520] SetLastError (dwErrCode=0x0) [0284.520] GetLastError () returned 0x0 [0284.520] SetLastError (dwErrCode=0x0) [0284.520] GetLastError () returned 0x0 [0284.520] SetLastError (dwErrCode=0x0) [0284.520] GetLastError () returned 0x0 [0284.520] SetLastError (dwErrCode=0x0) [0284.520] GetLastError () returned 0x0 [0284.520] SetLastError (dwErrCode=0x0) [0284.520] GetLastError () returned 0x0 [0284.520] SetLastError (dwErrCode=0x0) [0284.520] GetLastError () returned 0x0 [0284.520] SetLastError (dwErrCode=0x0) [0284.520] GetLastError () returned 0x0 [0284.520] SetLastError (dwErrCode=0x0) [0284.520] GetLastError () returned 0x0 [0284.520] SetLastError (dwErrCode=0x0) [0284.520] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff771f50000 [0284.521] GetModuleHandleA (lpModuleName=0x0) returned 0x7ff771f50000 [0284.521] GetLastError () returned 0x0 [0284.521] SetLastError (dwErrCode=0x0) [0284.521] GetLastError () returned 0x0 [0284.521] SetLastError (dwErrCode=0x0) [0284.521] GetLastError () returned 0x0 [0284.521] SetLastError (dwErrCode=0x0) [0284.521] GetCurrentThreadId () returned 0x4f8 [0284.521] GetLastError () returned 0x0 [0284.521] SetLastError (dwErrCode=0x0) [0284.521] SetLastError (dwErrCode=0x57) [0284.521] GetLastError () returned 0x57 [0284.521] SetLastError (dwErrCode=0x57) [0284.521] GetLastError () returned 0x57 [0284.521] SetLastError (dwErrCode=0x57) [0284.521] GetLocalTime (in: lpSystemTime=0x31dfdd0 | out: lpSystemTime=0x31dfdd0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2b, wSecond=0xd, wMilliseconds=0x175)) [0284.521] GetTickCount () returned 0xb8a51a [0284.521] Sleep (dwMilliseconds=0x3e8) [0285.528] GetLocalTime (in: lpSystemTime=0x31dfdd0 | out: lpSystemTime=0x31dfdd0*(wYear=0x7e5, wMonth=0xc, wDayOfWeek=0x3, wDay=0x1d, wHour=0x9, wMinute=0x2b, wSecond=0xe, wMilliseconds=0x17c)) [0285.528] GetTickCount () returned 0xb8a902 [0285.528] Sleep (dwMilliseconds=0x3e8) Process: id = "12" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x43fd2000" os_pid = "0xf28" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x694" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4460 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4461 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4462 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4463 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4464 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4465 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 4466 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 4467 start_va = 0x7ff7625c0000 end_va = 0x7ff7625d0fff monitored = 0 entry_point = 0x7ff7625c16b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 4468 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4469 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4470 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 4471 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4472 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 4473 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4474 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4475 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4476 start_va = 0x190000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 4477 start_va = 0x4c0000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4478 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4479 start_va = 0x7ffd44e60000 end_va = 0x7ffd44eb8fff monitored = 0 entry_point = 0x7ffd44e6fbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 4480 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 4481 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4482 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4483 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4484 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4485 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4486 start_va = 0x1e0000 end_va = 0x1e6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4487 start_va = 0x7ffd50380000 end_va = 0x7ffd504c2fff monitored = 0 entry_point = 0x7ffd503a8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 4488 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4489 start_va = 0x7ffd4e2e0000 end_va = 0x7ffd4e31afff monitored = 0 entry_point = 0x7ffd4e2e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4490 start_va = 0x7ffd4db80000 end_va = 0x7ffd4dc40fff monitored = 0 entry_point = 0x7ffd4dba0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 4491 start_va = 0x7ffd4b010000 end_va = 0x7ffd4b195fff monitored = 0 entry_point = 0x7ffd4b05d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 4492 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4493 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 4494 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 4495 start_va = 0x630000 end_va = 0x7b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 4496 start_va = 0x7c0000 end_va = 0x940fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 4497 start_va = 0x950000 end_va = 0x1d4ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000950000" filename = "" Region: id = 4498 start_va = 0x4d0000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4499 start_va = 0x4d0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 4500 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 4501 start_va = 0x7ffd4eb30000 end_va = 0x7ffd5008efff monitored = 0 entry_point = 0x7ffd4ec911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 4502 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4503 start_va = 0x7ffd4cce0000 end_va = 0x7ffd4d323fff monitored = 0 entry_point = 0x7ffd4cea64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 4504 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4505 start_va = 0x7ffd500f0000 end_va = 0x7ffd50141fff monitored = 0 entry_point = 0x7ffd500ff530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4506 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4507 start_va = 0x7ffd4d5b0000 end_va = 0x7ffd4d664fff monitored = 0 entry_point = 0x7ffd4d5f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 4508 start_va = 0x7ffd4cb10000 end_va = 0x7ffd4cb5afff monitored = 0 entry_point = 0x7ffd4cb135f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4509 start_va = 0x7ffd4caf0000 end_va = 0x7ffd4cb03fff monitored = 0 entry_point = 0x7ffd4caf52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4510 start_va = 0x7ffd4b470000 end_va = 0x7ffd4b505fff monitored = 0 entry_point = 0x7ffd4b495570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 4511 start_va = 0x1d50000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 4512 start_va = 0x1f30000 end_va = 0x2149fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f30000" filename = "" Region: id = 4513 start_va = 0x2150000 end_va = 0x2361fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 4514 start_va = 0x1d50000 end_va = 0x1e60fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d50000" filename = "" Region: id = 4515 start_va = 0x1f20000 end_va = 0x1f2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 4516 start_va = 0x2370000 end_va = 0x2586fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002370000" filename = "" Region: id = 4517 start_va = 0x2590000 end_va = 0x269bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 4518 start_va = 0x510000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 4519 start_va = 0x7ffd4e320000 end_va = 0x7ffd4e479fff monitored = 0 entry_point = 0x7ffd4e3638e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 4520 start_va = 0x50000 end_va = 0x50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4521 start_va = 0x26a0000 end_va = 0x275bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000026a0000" filename = "" Region: id = 4522 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 4523 start_va = 0x7ffd4a370000 end_va = 0x7ffd4a391fff monitored = 0 entry_point = 0x7ffd4a371a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 4524 start_va = 0x7ffd4b200000 end_va = 0x7ffd4b212fff monitored = 0 entry_point = 0x7ffd4b202760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 4525 start_va = 0x7ffd4c900000 end_va = 0x7ffd4c955fff monitored = 0 entry_point = 0x7ffd4c910bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 4526 start_va = 0x60000 end_va = 0x66fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 4527 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 4528 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 4529 start_va = 0x550000 end_va = 0x551fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 4530 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 4531 start_va = 0x580000 end_va = 0x584fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 4532 start_va = 0x590000 end_va = 0x590fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 4533 start_va = 0x5a0000 end_va = 0x5a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 4534 start_va = 0x7ffd43ba0000 end_va = 0x7ffd43e13fff monitored = 0 entry_point = 0x7ffd43c10400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 4535 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 4536 start_va = 0x5c0000 end_va = 0x5c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Thread: id = 143 os_tid = 0x34c Thread: id = 144 os_tid = 0xe14 Thread: id = 145 os_tid = 0x764 Thread: id = 146 os_tid = 0x1088 Process: id = "13" image_name = "explorer.exe" filename = "c:\\windows\\explorer.exe" page_root = "0x19755000" os_pid = "0x4f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x694" cmd_line = "\"C:\\Windows\\explorer.exe\"" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4675 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4676 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4677 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4678 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4679 start_va = 0xe0000 end_va = 0xe1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4680 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 4681 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4682 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4683 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 4684 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 4685 start_va = 0x7ff7aabd0000 end_va = 0x7ff7ab017fff monitored = 0 entry_point = 0x7ff7aac6e090 region_type = mapped_file name = "explorer.exe" filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe") Region: id = 4686 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4688 start_va = 0x140000000 end_va = 0x140021fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000140000000" filename = "" Region: id = 4702 start_va = 0x560000 end_va = 0x65ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 4703 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 4704 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 4705 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 4706 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 4707 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 4708 start_va = 0x7ffd4a880000 end_va = 0x7ffd4a8f8fff monitored = 0 entry_point = 0x7ffd4a89fb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 4710 start_va = 0x7df5ffe40000 end_va = 0x7df5ffebdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb") Region: id = 4711 start_va = 0x7ffd4eb30000 end_va = 0x7ffd5008efff monitored = 0 entry_point = 0x7ffd4ec911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 4712 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 4713 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 4714 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 4715 start_va = 0x7ffd4cce0000 end_va = 0x7ffd4d323fff monitored = 0 entry_point = 0x7ffd4cea64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 4716 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 4717 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 4718 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 4719 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 4720 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 4721 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 4722 start_va = 0x7ffd500f0000 end_va = 0x7ffd50141fff monitored = 0 entry_point = 0x7ffd500ff530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 4723 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 4724 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 4725 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 4726 start_va = 0x7ffd4d5b0000 end_va = 0x7ffd4d664fff monitored = 0 entry_point = 0x7ffd4d5f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 4727 start_va = 0x7ffd4cb10000 end_va = 0x7ffd4cb5afff monitored = 0 entry_point = 0x7ffd4cb135f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 4728 start_va = 0x7ffd4caf0000 end_va = 0x7ffd4cb03fff monitored = 0 entry_point = 0x7ffd4caf52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 4729 start_va = 0x660000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 4730 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 4731 start_va = 0x500000 end_va = 0x538fff monitored = 0 entry_point = 0x5012f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4732 start_va = 0x660000 end_va = 0x7e7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000660000" filename = "" Region: id = 4733 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 4734 start_va = 0x7ffd4e2e0000 end_va = 0x7ffd4e31afff monitored = 0 entry_point = 0x7ffd4e2e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 4735 start_va = 0x840000 end_va = 0x9c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000840000" filename = "" Region: id = 4736 start_va = 0x9d0000 end_va = 0x1dcffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009d0000" filename = "" Region: id = 4737 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 4738 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 4739 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4740 start_va = 0x500000 end_va = 0x517fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 4741 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4742 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4743 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4744 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4745 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4746 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4747 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4748 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4749 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4750 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4751 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4752 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4753 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4754 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4755 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4756 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4757 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4758 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4759 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4760 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4761 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4762 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4763 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4764 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4765 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4766 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4767 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4768 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4769 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4770 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4771 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4772 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4773 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4774 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4775 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4776 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4777 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4778 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4779 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4780 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4781 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4782 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4783 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4784 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4785 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4786 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4787 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4788 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4789 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4790 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4791 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4792 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4793 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4794 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4795 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4796 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4797 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4798 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4799 start_va = 0x500000 end_va = 0x517fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 4800 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4801 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4802 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4803 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4804 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4805 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4806 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4807 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4808 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4809 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4810 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4811 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4812 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4813 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4814 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4815 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4816 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4817 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4818 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4819 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4820 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4821 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4822 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4823 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4824 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4825 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4826 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4827 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4828 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4829 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4830 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4831 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4832 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4833 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4834 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4835 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4836 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4837 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4838 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4839 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4840 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4841 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4842 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4843 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4844 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4845 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4846 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4847 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4848 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4849 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4850 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4851 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4852 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4853 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4854 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4855 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4856 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4857 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4858 start_va = 0x500000 end_va = 0x517fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 4859 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4860 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4861 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4862 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4863 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4864 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4865 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4866 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4867 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4868 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4869 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4870 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4871 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4872 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4873 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4874 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4875 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4876 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4877 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4878 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4879 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4880 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4881 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4882 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4883 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4884 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4885 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4886 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4887 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4888 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4889 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4890 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4891 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4892 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4893 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4894 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4895 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4896 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4897 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4898 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4899 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4900 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4901 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4902 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4903 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4904 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4905 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4906 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4907 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4908 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4909 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4910 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4911 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4912 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4913 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4914 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4915 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4916 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4917 start_va = 0x500000 end_va = 0x517fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 4918 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4919 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4920 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4921 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4922 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4923 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4924 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4925 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4926 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4927 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4928 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4929 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4930 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4931 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4932 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4933 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4934 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4935 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4936 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4937 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4938 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4939 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4940 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4941 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4942 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4943 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4944 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4945 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4946 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4947 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4948 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4949 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4950 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4951 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4952 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4953 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4954 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4955 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4956 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4957 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4958 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4959 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4960 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4961 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4962 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4963 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4964 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4965 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4966 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4967 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4968 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4969 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4970 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4971 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4972 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4973 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4974 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4975 start_va = 0x1f0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 4976 start_va = 0x500000 end_va = 0x517fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 4977 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4978 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4979 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4980 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4981 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4982 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4983 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4984 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4985 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4986 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4987 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4988 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4989 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4990 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4991 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4992 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4993 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4994 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4995 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4996 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4997 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4998 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 4999 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 5000 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 5001 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 5002 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 5003 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 5004 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 5005 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 5006 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 5007 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Thread: id = 150 os_tid = 0xefc [0285.465] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0285.465] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4d6c7c50 [0285.466] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0285.466] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsAlloc") returned 0x7ffd4d6d7e50 [0285.466] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsSetValue") returned 0x7ffd4d6c3cb0 [0285.466] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0285.466] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4d6c7c50 [0285.467] GetProcessHeap () returned 0x560000 [0285.467] GetLastError () returned 0x36b7 [0285.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3c8) returned 0x576a00 [0285.467] SetLastError (dwErrCode=0x36b7) [0285.467] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1200) returned 0x576dd0 [0285.469] GetStartupInfoW (in: lpStartupInfo=0xcfe10 | out: lpStartupInfo=0xcfe10*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\explorer.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) [0285.469] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0285.469] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0285.470] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0285.470] GetCommandLineA () returned="\"C:\\Windows\\explorer.exe\"" [0285.470] GetCommandLineW () returned="\"C:\\Windows\\explorer.exe\"" [0285.470] GetACP () returned 0x4e4 [0285.470] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x228) returned 0x56dc40 [0285.470] IsValidCodePage (CodePage=0x4e4) returned 1 [0285.470] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xcfbb0 | out: lpCPInfo=0xcfbb0) returned 1 [0285.470] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xcf450 | out: lpCPInfo=0xcf450) returned 1 [0285.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf470, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0285.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf470, cbMultiByte=256, lpWideCharStr=0xcf1a0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x01䲯") returned 256 [0285.470] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x01䲯", cchSrc=256, lpCharType=0xcf770 | out: lpCharType=0xcf770) returned 1 [0285.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf470, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0285.470] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf470, cbMultiByte=256, lpWideCharStr=0xcf140, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0285.470] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0285.470] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="LCMapStringEx") returned 0x7ffd4d685350 [0285.470] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0285.470] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xcef30, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256 [0285.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0xcf570, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", lpUsedDefaultChar=0x0) returned 256 [0285.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf470, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0285.471] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xcf470, cbMultiByte=256, lpWideCharStr=0xcf140, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256 [0285.471] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0285.471] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0xcef30, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256 [0285.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0xcf670, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256 [0285.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100) returned 0x5747c0 [0285.471] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xcfc30, nSize=0x105 | out: lpFilename="C:\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe")) returned 0x17 [0285.471] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x7ffd4e1c0000 [0285.471] GetProcAddress (hModule=0x7ffd4e1c0000, lpProcName="AreFileApisANSI") returned 0x7ffd4e1e4820 [0285.471] AreFileApisANSI () returned 1 [0285.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\explorer.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0285.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\explorer.exe", cchWideChar=-1, lpMultiByteStr=0x14001c2a0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\explorer.exe", lpUsedDefaultChar=0x0) returned 24 [0285.471] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x28) returned 0x5704a0 [0285.471] RtlInitializeSListHead (in: ListHead=0x14001c0e0 | out: ListHead=0x14001c0e0) [0285.471] GetLastError () returned 0x0 [0285.472] SetLastError (dwErrCode=0x0) [0285.472] GetEnvironmentStringsW () returned 0x577fe0* [0285.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1254, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1254 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4e6) returned 0x5789c0 [0285.472] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1254, lpMultiByteStr=0x5789c0, cbMultiByte=1254, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1254 [0285.472] FreeEnvironmentStringsW (penv=0x577fe0) returned 1 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x118) returned 0x56e1d0 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1f) returned 0x570290 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2e) returned 0x569e20 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x31) returned 0x5697d0 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3c) returned 0x575aa0 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x31) returned 0x569810 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x14) returned 0x5669c0 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x24) returned 0x570470 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xd) returned 0x569e60 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1d) returned 0x570140 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x31) returned 0x569850 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x15) returned 0x566f20 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x17) returned 0x566f40 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xe) returned 0x566f60 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x69) returned 0x5671b0 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x3e) returned 0x576900 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1d) returned 0x5701a0 [0285.472] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x48) returned 0x575e60 [0285.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x12) returned 0x567230 [0285.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x18) returned 0x567250 [0285.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1b) returned 0x5700b0 [0285.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1e) returned 0x5701d0 [0285.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x29) returned 0x566f80 [0285.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1e) returned 0x5700e0 [0285.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x6b) returned 0x566a10 [0285.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x17) returned 0x566fc0 [0285.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0xf) returned 0x566a90 [0285.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x16) returned 0x566ab0 [0285.476] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x2a) returned 0x5780f0 [0285.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x29) returned 0x578470 [0285.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x12) returned 0x569b70 [0285.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x21) returned 0x5706e0 [0285.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x16) returned 0x578fe0 [0285.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x22) returned 0x5703b0 [0285.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x12) returned 0x579120 [0285.477] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5789c0 | out: hHeap=0x560000) returned 1 [0285.477] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x8, Size=0x1000) returned 0x5792c0 [0285.477] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x14000245c) returned 0x0 [0285.477] GetStartupInfoW (in: lpStartupInfo=0xcfea0 | out: lpStartupInfo=0xcfea0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\explorer.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0285.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x30) returned 0x5783f0 [0285.478] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x47) returned 0x576860 [0285.478] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5783f0 | out: hHeap=0x560000) returned 1 [0285.478] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x8 [0285.492] Process32First (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.493] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x80, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.494] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.495] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.496] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.498] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.499] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.500] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.501] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.502] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.502] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.504] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0285.504] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.508] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.509] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.509] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.510] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.511] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.511] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.512] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.513] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0285.513] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x604, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.514] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.515] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0285.515] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0285.516] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0285.517] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0285.517] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0285.518] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0285.518] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.519] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0285.520] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.520] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.521] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.524] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.529] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0285.529] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0285.530] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0285.531] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0285.551] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0285.552] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0285.552] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0285.553] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0285.556] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0285.557] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0285.557] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0285.558] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0285.558] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0285.560] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0285.560] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1034, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x394, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0285.561] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x107c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.562] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf0, pcPriClassBase=4, dwFlags=0x0, szExeFile="RegHost.exe")) returned 1 [0285.562] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0285.563] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x694, pcPriClassBase=4, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.564] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x694, pcPriClassBase=4, dwFlags=0x0, szExeFile="bfsvc.exe")) returned 1 [0285.564] Process32Next (in: hSnapshot=0x8, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x694, pcPriClassBase=4, dwFlags=0x0, szExeFile="bfsvc.exe")) returned 0 [0285.565] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x14c [0285.574] Process32First (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.574] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x80, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.575] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.575] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.576] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.577] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.578] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.578] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.579] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.580] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.580] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.581] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0285.582] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.582] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.583] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.583] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.584] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.585] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.590] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.591] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.592] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0285.592] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x604, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.593] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.594] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0285.594] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0285.595] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0285.596] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0285.597] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0285.597] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0285.598] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.599] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0285.599] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.600] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.601] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.604] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.604] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0285.605] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0285.606] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0285.606] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0285.607] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0285.608] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0285.608] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0285.609] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0285.610] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0285.610] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0285.611] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0285.612] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0285.612] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0285.613] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0285.614] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1034, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x394, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0285.614] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x107c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.615] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf0, pcPriClassBase=4, dwFlags=0x0, szExeFile="RegHost.exe")) returned 1 [0285.616] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0285.616] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x694, pcPriClassBase=4, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.619] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x694, pcPriClassBase=4, dwFlags=0x0, szExeFile="bfsvc.exe")) returned 1 [0285.620] Process32Next (in: hSnapshot=0x14c, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x694, pcPriClassBase=4, dwFlags=0x0, szExeFile="bfsvc.exe")) returned 0 [0285.621] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x150 [0285.627] Process32First (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.628] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x80, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.628] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.631] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.632] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.633] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.636] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.637] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.638] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.639] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.639] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.640] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0285.642] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.643] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.644] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.645] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.646] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.646] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.647] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.648] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.649] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0285.650] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x604, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.653] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.654] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0285.655] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0285.655] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0285.656] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0285.657] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0285.657] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0285.658] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.658] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0285.659] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.660] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.661] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.662] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.663] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0285.664] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0285.664] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0285.665] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0285.666] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0285.668] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0285.669] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0285.670] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0285.670] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0285.672] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0285.672] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0285.673] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0285.677] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0285.678] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0285.678] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1034, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x394, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0285.679] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x107c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.681] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf0, pcPriClassBase=4, dwFlags=0x0, szExeFile="RegHost.exe")) returned 1 [0285.682] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0285.686] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x694, pcPriClassBase=4, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.687] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x694, pcPriClassBase=4, dwFlags=0x0, szExeFile="bfsvc.exe")) returned 1 [0285.688] Process32Next (in: hSnapshot=0x150, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x694, pcPriClassBase=4, dwFlags=0x0, szExeFile="bfsvc.exe")) returned 0 [0285.689] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x154 [0285.703] Process32First (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.704] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x80, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.706] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.707] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.708] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.708] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.709] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.710] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.711] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.712] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.712] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.713] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0285.718] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.719] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.720] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.721] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.722] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.722] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.723] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.724] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.725] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0285.728] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x604, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.729] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.729] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0285.733] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0285.734] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0285.735] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0285.735] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0285.736] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0285.737] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.738] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0285.739] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.740] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0285.741] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.742] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.742] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0285.744] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x8b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0285.745] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0285.746] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0285.750] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0285.751] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0285.752] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0285.753] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0285.753] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0285.754] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0285.755] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1328, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0285.756] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0285.757] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0285.758] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1348, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0285.759] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1034, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x394, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0285.760] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x107c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0285.761] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xf0, pcPriClassBase=4, dwFlags=0x0, szExeFile="RegHost.exe")) returned 1 [0285.765] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0285.766] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x694, pcPriClassBase=4, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.767] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x694, pcPriClassBase=4, dwFlags=0x0, szExeFile="bfsvc.exe")) returned 1 [0285.768] Process32Next (in: hSnapshot=0x154, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x694, pcPriClassBase=4, dwFlags=0x0, szExeFile="bfsvc.exe")) returned 0 [0285.768] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x158 [0285.778] Process32First (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0285.782] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x80, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0285.783] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0285.783] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.784] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x16c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0285.785] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0285.786] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x1fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0285.787] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x214, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0285.788] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x21c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1bc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0285.788] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x270, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.789] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.790] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1fc, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0285.791] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.792] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.793] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.797] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.798] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.799] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.800] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.801] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0285.801] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0285.802] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x604, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0285.803] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0285.804] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0285.805] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x214, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0285.806] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0285.806] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x8f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0285.808] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0285.808] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0285.809] Process32Next (in: hSnapshot=0x158, lppe=0xcfc10 | out: lppe=0xcfc10*(dwSize=0x130, cntUsage=0x0, th32ProcessID=0xd3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x270, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 Thread: id = 152 os_tid = 0xd20 Process: id = "14" image_name = "bfsvc.exe" filename = "c:\\windows\\bfsvc.exe" page_root = "0x1975d000" os_pid = "0x4e4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x694" cmd_line = "C:\\Windows\\bfsvc.exe -log 0 -ftime 60 -pool eu1-etc.ethermine.org:4444 -wal 0xa6ceE57d9638dA506ff99899c6C018292Ef4826C -coin etc -worker EasyMiner_Bot -mi 14" cur_dir = "C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 4689 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 4690 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 4691 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 4692 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 4693 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 4694 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 4695 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 4696 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 4697 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 4698 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 4699 start_va = 0x7ff7a55b0000 end_va = 0x7ff7a55c3fff monitored = 0 entry_point = 0x7ff7a55b8c30 region_type = mapped_file name = "bfsvc.exe" filename = "\\Windows\\bfsvc.exe" (normalized: "c:\\windows\\bfsvc.exe") Region: id = 4700 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 4709 start_va = 0x140000000 end_va = 0x140814fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000140000000" filename = "" Region: id = 5008 start_va = 0x5d0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005d0000" filename = "" Region: id = 5009 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5010 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5011 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5012 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 5013 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5073 start_va = 0x7ffd4e960000 end_va = 0x7ffd4e967fff monitored = 0 entry_point = 0x7ffd4e9610b0 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\System32\\psapi.dll" (normalized: "c:\\windows\\system32\\psapi.dll") Region: id = 5074 start_va = 0x6d0000 end_va = 0x16cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 5075 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5076 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5077 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5078 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5079 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5080 start_va = 0x7ffd4e270000 end_va = 0x7ffd4e2dafff monitored = 0 entry_point = 0x7ffd4e2890c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 5081 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5082 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5083 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5084 start_va = 0x7ffd50380000 end_va = 0x7ffd504c2fff monitored = 0 entry_point = 0x7ffd503a8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5085 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 5086 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 5087 start_va = 0x7ffd4cc80000 end_va = 0x7ffd4ccd4fff monitored = 0 entry_point = 0x7ffd4cc97970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 5088 start_va = 0x7ffd4cb60000 end_va = 0x7ffd4cb6ffff monitored = 0 entry_point = 0x7ffd4cb656e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 5089 start_va = 0x7ffd4d350000 end_va = 0x7ffd4d516fff monitored = 0 entry_point = 0x7ffd4d3adb80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 5090 start_va = 0x7ffd4c3c0000 end_va = 0x7ffd4c41bfff monitored = 0 entry_point = 0x7ffd4c3d6f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 5091 start_va = 0x400000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 5092 start_va = 0x1c0000 end_va = 0x1c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5093 start_va = 0x400000 end_va = 0x438fff monitored = 0 entry_point = 0x4012f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5094 start_va = 0x580000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 5095 start_va = 0x16d0000 end_va = 0x1857fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000016d0000" filename = "" Region: id = 5096 start_va = 0x7ffd4e2e0000 end_va = 0x7ffd4e31afff monitored = 0 entry_point = 0x7ffd4e2e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5097 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 5098 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 5099 start_va = 0x1860000 end_va = 0x19e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001860000" filename = "" Region: id = 5100 start_va = 0x19f0000 end_va = 0x2deffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000019f0000" filename = "" Region: id = 5101 start_va = 0x400000 end_va = 0x4bffff monitored = 0 entry_point = 0x420da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Thread: id = 151 os_tid = 0x980 [0286.725] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0286.725] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4d6c7c50 [0286.725] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0286.725] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsAlloc") returned 0x7ffd4d6d7e50 [0286.725] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsSetValue") returned 0x7ffd4d6c3cb0 [0286.725] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0286.725] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="InitializeCriticalSectionEx") returned 0x7ffd4d6c7c50 [0286.726] GetProcessHeap () returned 0x5d0000 [0286.726] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x7ffd4d670000 [0286.726] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsAlloc") returned 0x7ffd4d6d7e50 [0286.726] GetLastError () returned 0x0 [0286.726] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsGetValue") returned 0x7ffd4d6b3780 [0286.726] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x3c8) returned 0x5db140 [0286.726] GetProcAddress (hModule=0x7ffd4d670000, lpProcName="FlsSetValue") returned 0x7ffd4d6c3cb0 [0286.726] SetLastError (dwErrCode=0x0) [0286.727] RtlAllocateHeap (HeapHandle=0x5d0000, Flags=0x8, Size=0x1000) returned 0x5dfd50 Thread: id = 156 os_tid = 0xdb4 Process: id = "15" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x18f29000" os_pid = "0xdd8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0x4e4" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f4cd" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 5014 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 5015 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 5016 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 5017 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 5018 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 5019 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 5020 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 5021 start_va = 0x7ff7625c0000 end_va = 0x7ff7625d0fff monitored = 0 entry_point = 0x7ff7625c16b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 5022 start_va = 0x7ffd504d0000 end_va = 0x7ffd50690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 5023 start_va = 0x5a0000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 5024 start_va = 0x7ffd4d670000 end_va = 0x7ffd4d857fff monitored = 0 entry_point = 0x7ffd4d69ba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 5025 start_va = 0x7ffd4e1c0000 end_va = 0x7ffd4e26cfff monitored = 0 entry_point = 0x7ffd4e1d81a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 5026 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 5027 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 5028 start_va = 0x90000 end_va = 0x14dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 5029 start_va = 0x7ffd4df00000 end_va = 0x7ffd4df9cfff monitored = 0 entry_point = 0x7ffd4df078a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 5030 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 5031 start_va = 0x400000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 5032 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 5033 start_va = 0x7ffd45f20000 end_va = 0x7ffd45f78fff monitored = 0 entry_point = 0x7ffd45f2fbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 5034 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 5035 start_va = 0x7ffd4dc70000 end_va = 0x7ffd4deecfff monitored = 0 entry_point = 0x7ffd4dd44970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 5036 start_va = 0x7ffd4da60000 end_va = 0x7ffd4db7bfff monitored = 0 entry_point = 0x7ffd4daa02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 5037 start_va = 0x7ffd4d860000 end_va = 0x7ffd4d8c9fff monitored = 0 entry_point = 0x7ffd4d896d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 5038 start_va = 0x7ffd4e9d0000 end_va = 0x7ffd4eb25fff monitored = 0 entry_point = 0x7ffd4e9da8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 5039 start_va = 0x7ffd4d8d0000 end_va = 0x7ffd4da55fff monitored = 0 entry_point = 0x7ffd4d91ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 5040 start_va = 0x1a0000 end_va = 0x1a6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 5041 start_va = 0x7ffd50380000 end_va = 0x7ffd504c2fff monitored = 0 entry_point = 0x7ffd503a8210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 5042 start_va = 0x7ffd4e160000 end_va = 0x7ffd4e1bafff monitored = 0 entry_point = 0x7ffd4e1738b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 5043 start_va = 0x7ffd4e2e0000 end_va = 0x7ffd4e31afff monitored = 0 entry_point = 0x7ffd4e2e12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 5044 start_va = 0x7ffd4db80000 end_va = 0x7ffd4dc40fff monitored = 0 entry_point = 0x7ffd4dba0da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 5045 start_va = 0x7ffd4b010000 end_va = 0x7ffd4b195fff monitored = 0 entry_point = 0x7ffd4b05d700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 5046 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 5047 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 5048 start_va = 0x6a0000 end_va = 0x827fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 5049 start_va = 0x830000 end_va = 0x9b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000830000" filename = "" Region: id = 5050 start_va = 0x9c0000 end_va = 0x1dbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009c0000" filename = "" Region: id = 5051 start_va = 0x1dc0000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 5052 start_va = 0x400000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 5053 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 5054 start_va = 0x7ffd4eb30000 end_va = 0x7ffd5008efff monitored = 0 entry_point = 0x7ffd4ec911f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 5055 start_va = 0x7ffd4cb80000 end_va = 0x7ffd4cbc2fff monitored = 0 entry_point = 0x7ffd4cb94b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 5056 start_va = 0x7ffd4cce0000 end_va = 0x7ffd4d323fff monitored = 0 entry_point = 0x7ffd4cea64b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 5057 start_va = 0x7ffd4e480000 end_va = 0x7ffd4e526fff monitored = 0 entry_point = 0x7ffd4e4958d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 5058 start_va = 0x7ffd500f0000 end_va = 0x7ffd50141fff monitored = 0 entry_point = 0x7ffd500ff530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 5059 start_va = 0x7ffd4cb70000 end_va = 0x7ffd4cb7efff monitored = 0 entry_point = 0x7ffd4cb73210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 5060 start_va = 0x7ffd4d5b0000 end_va = 0x7ffd4d664fff monitored = 0 entry_point = 0x7ffd4d5f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 5061 start_va = 0x7ffd4cb10000 end_va = 0x7ffd4cb5afff monitored = 0 entry_point = 0x7ffd4cb135f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 5062 start_va = 0x7ffd4caf0000 end_va = 0x7ffd4cb03fff monitored = 0 entry_point = 0x7ffd4caf52e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 5063 start_va = 0x7ffd4b470000 end_va = 0x7ffd4b505fff monitored = 0 entry_point = 0x7ffd4b495570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 5064 start_va = 0x4c0000 end_va = 0x55ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 5066 start_va = 0x1fa0000 end_va = 0x22d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 5067 start_va = 0x22e0000 end_va = 0x24f8fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000022e0000" filename = "" Region: id = 5068 start_va = 0x2500000 end_va = 0x2719fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 5069 start_va = 0x1dc0000 end_va = 0x1ecdfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001dc0000" filename = "" Region: id = 5070 start_va = 0x1f90000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f90000" filename = "" Region: id = 5071 start_va = 0x2720000 end_va = 0x2933fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002720000" filename = "" Region: id = 5072 start_va = 0x2940000 end_va = 0x2a4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Thread: id = 153 os_tid = 0x4e0 Thread: id = 154 os_tid = 0x3a0 Thread: id = 155 os_tid = 0xe00